path: root/Source/WebCore/ChangeLog

2012-08-22  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        [TouchAdjustment] Adjust to word or selection
        https://bugs.webkit.org/show_bug.cgi?id=94449

        Reviewed by Antonio Gomes.

        Makes each separate word a separate subtarget when context menu triggers
        selections, and only the selected part of a partial selected node a 
        target when selections are not overridden.

        Fix of reverted commit r126026, fix misplaced ASSERT.

        Test: touchadjustment/context-menu-text-subtargets.html

        * page/TouchAdjustment.cpp:
        (TouchAdjustment):
        (WebCore::TouchAdjustment::providesContextMenuItems):
        (WebCore::TouchAdjustment::appendQuadsToSubtargetList):
        (WebCore::TouchAdjustment::appendBasicSubtargetsForNode):
        (WebCore::TouchAdjustment::appendContextSubtargetsForNode):
        (WebCore::TouchAdjustment::compileSubtargetList):
        (WebCore::findBestClickableCandidate):
        (WebCore::findBestContextMenuCandidate):

2012-08-22  Andrey Adaikin  <aandrey@chromium.org>

        Web Inspector: [WebGL] Generic framework draft for tracking WebGL resources
        https://bugs.webkit.org/show_bug.cgi?id=90597

        Reviewed by Pavel Feldman.

        Wrap WebGL rendering context methods and collect a trace log if we are in capturing mode.
        Stubbed code for collecting calls contributing to a WebGL resource state so that we could replay them later.

        Typical scenario:
        - we wrap a GL context with InjectedScript.wrapWebGLContext() and return a proxy to the inspected page
        - the proxy saves all calls necessary to do a replay later - only those that modify a resource's state
        - when we turn on capturing mode (InjectedScript.captureFrame), we save all WebGL calls to a trace log

        * inspector/InjectedScriptSource.js:
        (.):
        * inspector/InjectedScriptWebGLModuleSource.js:
        (.):

2012-08-22  Andrey Adaikin  <aandrey@chromium.org>

        Web Inspector: [WebGL] Add minimum transport protocol from backend to frontend
        https://bugs.webkit.org/show_bug.cgi?id=88973

        Reviewed by Pavel Feldman.

        Added the following protocol methods to communicate with the WebGL injected
        module: captureFrame, getTraceLog, dropTraceLog, replayTraceLog.

        * inspector/CodeGeneratorInspector.py:
        * inspector/InjectedScriptWebGLModule.cpp:
        (WebCore::InjectedScriptWebGLModule::captureFrame):
        (WebCore):
        (WebCore::InjectedScriptWebGLModule::dropTraceLog):
        (WebCore::InjectedScriptWebGLModule::getTraceLog):
        (WebCore::InjectedScriptWebGLModule::replayTraceLog):
        * inspector/InjectedScriptWebGLModule.h:
        (InjectedScriptWebGLModule):
        * inspector/Inspector.json:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        * inspector/InspectorWebGLAgent.cpp:
        (WebCore::InspectorWebGLAgent::InspectorWebGLAgent):
        (WebCore::InspectorWebGLAgent::dropTraceLog):
        (WebCore):
        (WebCore::InspectorWebGLAgent::captureFrame):
        (WebCore::InspectorWebGLAgent::getTraceLog):
        (WebCore::InspectorWebGLAgent::replayTraceLog):
        * inspector/InspectorWebGLAgent.h:
        (WebCore):
        (WebCore::InspectorWebGLAgent::create):
        (InspectorWebGLAgent):

2012-08-22  Hans Wennborg  <hans@chromium.org>

        Remove unused field DeleteEntryRequest::m_type
        https://bugs.webkit.org/show_bug.cgi?id=94680

        Unreviewed build fix.

        Remove this unused field. Clang warns about it and it breaks the
        Chromium build.

        No change in functionality, no new tests.

        * inspector/InspectorFileSystemAgent.cpp:
        (WebCore):

2012-08-21  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: console.time() should use performance.now()
        https://bugs.webkit.org/show_bug.cgi?id=94263

        Reviewed by Pavel Feldman.

        - use monotonicallyIncreasingTime() instead of currentTime() for measuring time intervals
            with console.time()/console.timeEnd()
        - adjust precision to 3 digits after decimal point (i.e. microseconds) when formatting intervals;

        * inspector/InspectorConsoleAgent.cpp:
        (WebCore::InspectorConsoleAgent::stopTiming):

2012-08-22  Takashi Sakamoto  <tasak@google.com>

        Dynamically styling ShadowDom content on a node distributed to another shadow insertion point fails.
        https://bugs.webkit.org/show_bug.cgi?id=92899

        Reviewed by Hajime Morita.

        Since childNeedsStyleRecalc is not cleared when parent nodes are
        attached, setNeedsStyleRecalc flag is not reached Document. So,
        document() doesn't run re-layout.

        Test: fast/dom/shadow/shadowdom-dynamic-styling.html

        * dom/ContainerNode.h:
        (ContainerNode):
        (WebCore::ContainerNode::detachAsNode):
        Removed detachAsNode, because the below change made the method
        not-used.
        * dom/Element.cpp:
        (WebCore::Element::detach):
        Modify to invoke ContainerNode::detach when any shadow subtree is
        attached. ContainerNode::detach takes care of childNeedsStyleRecalc
        flag.
        * dom/ElementShadow.cpp:
        (WebCore::ElementShadow::invalidateDistribution):
        Use SetAttached for lazyAttach instead of DoNotSetAttached, because
        it is reuired to invoke ContainerNode::detach. If not, attached() is
        false and reattach() invokes only attach(). This causes to leave
        shadow host's childNeedsStyleRecalc flag true after
        Element::recalcStyle.

2012-08-22  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Add deleteEntry command and deletionCompleted event to FileSystemAgent
        https://bugs.webkit.org/show_bug.cgi?id=91831

        Reviewed by Vsevolod Vlasov.

        InspectorAgent-side implementation of deleteEntry command.

        Test will be added after JS-side implementation landed.

        * inspector/Inspector.json:
        * inspector/InspectorFileSystemAgent.cpp:
        (WebCore):
        (WebCore::InspectorFileSystemAgent::requestFileSystemRoot):
        (WebCore::InspectorFileSystemAgent::requestDirectoryContent):
        (WebCore::InspectorFileSystemAgent::requestMetadata):
        (WebCore::InspectorFileSystemAgent::requestFileContent):
        (WebCore::InspectorFileSystemAgent::deleteEntry):
        (WebCore::InspectorFileSystemAgent::assertFrontend):
        * inspector/InspectorFileSystemAgent.h:
        (InspectorFileSystemAgent):
        * inspector/front-end/FileSystemModel.js:
        (WebInspector.FileSystemDispatcher.prototype.fileContentReceived):
        (WebInspector.FileSystemDispatcher.prototype.deletionCompleted):

2012-08-21  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: TabbedPane: measure tab widths in batches.
        https://bugs.webkit.org/show_bug.cgi?id=94484

        Reviewed by Vsevolod Vlasov.

        - Introduces global batch update schema
        - Migrates Toolbar and TabbedPane to the new schema

        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel):
        * inspector/front-end/TabbedPane.js:
        (WebInspector.TabbedPane.prototype.appendTab):
        (WebInspector.TabbedPane.prototype._updateTabElements):
        (WebInspector.TabbedPane.prototype._innerUpdateTabElements):
        (WebInspector.TabbedPane.prototype._updateWidths):
        (WebInspector.TabbedPane.prototype._measureWidths):
        (WebInspector.TabbedPaneTab):
        (WebInspector.TabbedPaneTab.prototype.width):
        (WebInspector.TabbedPaneTab.prototype.setWidth):
        * inspector/front-end/Toolbar.js:
        (WebInspector.Toolbar):
        (WebInspector.Toolbar.prototype._updateDropdownButtonAndHideDropdown):
        (WebInspector.Toolbar.prototype._innerUpdateDropdownButtonAndHideDropdown):
        * inspector/front-end/UIUtils.js:
        (WebInspector.startBatchUpdate):
        (WebInspector.invokeOnceAfterBatchUpdate.get if):
        (WebInspector.invokeOnceAfterBatchUpdate):
        * inspector/front-end/inspector.js:
        * inspector/front-end/utilities.js:

2012-08-21  Kentaro Hara  <haraken@chromium.org>

        [V8] Move String related code in V8Binding to a separate file
        https://bugs.webkit.org/show_bug.cgi?id=94571

        Reviewed by Adam Barth.

        This patch moves V8Parameter, V8ParameterBase and String related code
        in V8Binding to a separate file.

        No tests. No change in behavior.

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/v8/V8Binding.cpp:
        * bindings/v8/V8Binding.h:
        * bindings/v8/V8StringResource.cpp: Added.
        * bindings/v8/V8StringResource.h: Added.
        (WebCore):

2012-08-21  Sukolsak Sakshuwong  <sukolsak@google.com>

        Implement UndoManager's automatic DOM transactions
        https://bugs.webkit.org/show_bug.cgi?id=91812

        Reviewed by Ryosuke Niwa.

        This patch implements automatic DOM transactions in UndoManager
        by recording changes in tree structure, attributes, and character data
        of nodes under undo scope host.

        Tests: editing/undomanager/automatic-transaction-attribute.html
               editing/undomanager/automatic-transaction-data.html
               editing/undomanager/automatic-transaction-node.html

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/DOMTransaction.h:
        (WebCore::DOMTransaction::addTransactionStep):
        (DOMTransaction):
        * bindings/v8/DOMTransaction.cpp:
        (DOMTransactionScope):
        (WebCore::DOMTransactionScope::DOMTransactionScope):
        (WebCore::DOMTransactionScope::~DOMTransactionScope):
        (WebCore):
        (WebCore::DOMTransaction::apply):
        (WebCore::DOMTransaction::unapply):
        (WebCore::DOMTransaction::reapply):
        * bindings/v8/DOMTransaction.h:
        (WebCore::DOMTransaction::addTransactionStep):
        (DOMTransaction):
        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
        * dom/CharacterData.cpp:
        (WebCore::CharacterData::setDataAndUpdate):
        * dom/ContainerNode.cpp:
        (WebCore::willRemoveChild):
        (WebCore::willRemoveChildren):
        (WebCore::updateTreeAfterInsertion):
        * dom/Element.cpp:
        (WebCore::Element::willModifyAttribute):
        * editing/DOMTransactionStep.cpp: Added.
        (WebCore):
        (WebCore::NodeInsertingDOMTransactionStep::NodeInsertingDOMTransactionStep):
        (WebCore::NodeInsertingDOMTransactionStep::create):
        (WebCore::NodeInsertingDOMTransactionStep::unapply):
        (WebCore::NodeInsertingDOMTransactionStep::reapply):
        (WebCore::NodeRemovingDOMTransactionStep::NodeRemovingDOMTransactionStep):
        (WebCore::NodeRemovingDOMTransactionStep::create):
        (WebCore::NodeRemovingDOMTransactionStep::unapply):
        (WebCore::NodeRemovingDOMTransactionStep::reapply):
        (WebCore::DataReplacingDOMTransactionStep::DataReplacingDOMTransactionStep):
        (WebCore::DataReplacingDOMTransactionStep::create):
        (WebCore::DataReplacingDOMTransactionStep::unapply):
        (WebCore::DataReplacingDOMTransactionStep::reapply):
        (WebCore::AttrChangingDOMTransactionStep::AttrChangingDOMTransactionStep):
        (WebCore::AttrChangingDOMTransactionStep::create):
        (WebCore::AttrChangingDOMTransactionStep::unapply):
        (WebCore::AttrChangingDOMTransactionStep::reapply):
        * editing/DOMTransactionStep.h: Added.
        (WebCore):
        (DOMTransactionStep):
        (WebCore::DOMTransactionStep::~DOMTransactionStep):
        (NodeInsertingDOMTransactionStep):
        (NodeRemovingDOMTransactionStep):
        (DataReplacingDOMTransactionStep):
        (AttrChangingDOMTransactionStep):
        * editing/UndoManager.cpp:
        (WebCore):
        (WebCore::UndoManager::isRecordingAutomaticTransaction):
        (WebCore::UndoManager::addTransactionStep):
        * editing/UndoManager.h:
        (WebCore):
        (WebCore::UndoManager::setRecordingDOMTransaction):
        (UndoManager):

2012-08-21  Shezan Baig  <sbaig1@bloomberg.net>

        Fix cross-direction stretch for replaced elements in row flexbox
        https://bugs.webkit.org/show_bug.cgi?id=94237

        Reviewed by Ojan Vafai.

        When stretching, don't take into account the instrinsic size of child
        replaced elements. Only the fixed size, min size, and max size of the
        child should be taken into account. The logic that computed this was
        moved from RenderBox::computeLogicalHeight to a new helper method
        called logicalHeightConstrainedByMinMax.  This helper method is now
        used from RenderFlexibleBox::applyStretchAlignmentToChild, instead of
        using RenderBox::computeLogicalHeight.

        A similar change will need to be made for column-flowing flexboxes.
        This will be addressed in https://webkit.org/b/94604.

        No new tests.  The existing css3/flexbox/flexitem.html test was
        extended to cover this case.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::logicalHeightConstrainedByMinMax): New helper
        method that is used by RenderBox::computeLogicalHeight and also by
        RenderFlexibleBox::applyStretchAlignmentToChild.
        (WebCore):
        (WebCore::RenderBox::computeLogicalHeight): Updated to use the new
        logicalHeightConstrainedByMinMax helper method.
        * rendering/RenderBox.h:
        (RenderBox):
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::applyStretchAlignmentToChild): Use
        logicalHeightConstrainedByMinMax instead of computeLogicalHeight.

2012-08-21  Hayato Ito  <hayato@chromium.org>

        Make an event object clonable to support an event propagation across seamless iframes.
        https://bugs.webkit.org/show_bug.cgi?id=93678

        Reviewed by Dimitri Glazkov.

        We should clone an event object when a event propagates across
        seamless iframes.  Currently Event and MouseEvent are
        supported. Support for other kinds of events will be addressed
        later.

        This is one of the pre-requirements to support an event
        propagation across seamless iframes.

        No new tests, no behavior change.

        * dom/Event.cpp:
        (WebCore::Event::cloneFor):
        (WebCore):
        * dom/Event.h:
        (WebCore):
        (Event):
        * dom/MouseEvent.cpp:
        (WebCore::adjustedClinetX):
        (WebCore):
        (WebCore::adjustedClinetY):
        (WebCore::MouseEvent::cloneFor):
        * dom/MouseEvent.h:
        (MouseEvent):

2012-08-21  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: IDBRequest can be GCd during event dispatch
        https://bugs.webkit.org/show_bug.cgi?id=94235

        Reviewed by Ojan Vafai.

        Avoid a "race" where GC may attempt to reclaim IDB objects that are marked
        "done" prior to the completion of the event dispatch. The script runtime
        may decide to do a GC pass before calling the event handler, releasing the
        object and turning the dispatch into a no-op.

        This is a partial reversion (with renames, etc) of r123275, r124842,
        and r121492. Added a new test, although it does not exercise the "race"
        condition directly.

        Test: storage/indexeddb/pending-activity.html
              storage/indexeddb/pending-activity-workers.html

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::close): Let the IDBRequest know it this cursor won't
        make it fire again.
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::IDBRequest): Reintroduce "am I done?" flag.
        (WebCore::IDBRequest::finishCursor): Cursors may fire events at the same
        IDBRequest repeatedly, so we need to know when they're are really done.
        (WebCore):
        (WebCore::IDBRequest::hasPendingActivity): Test the flag.
        (WebCore::IDBRequest::dispatchEvent): Set the flag.
        * Modules/indexeddb/IDBRequest.h:
        (IDBRequest):
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::IDBTransaction): Reintroduce "am I done?" flag.
        (WebCore::IDBTransaction::hasPendingActivity): Test the flag.
        (WebCore::IDBTransaction::dispatchEvent): Set the flag.
        * Modules/indexeddb/IDBTransaction.h:

2012-08-21  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: [regression] Settings panel fails to open.
        https://bugs.webkit.org/show_bug.cgi?id=94647

        Unreviewed: one line JS front-end fix.

        * inspector/front-end/ScriptsSearchScope.js:
        * inspector/front-end/Settings.js:

2012-08-21  Julien Chaffraix  <jchaffraix@webkit.org>

        Crash in RenderTableSection::setCellLogicalWidths
        https://bugs.webkit.org/show_bug.cgi?id=94291

        Reviewed by Abhishek Arya.

        This issue was that splitAnonymousBoxesAroundChild would move a table section
        into a newly created table *without* marking it as needing cell recalc. The table
        would thus never build its structure to match its sections. The fix is to hop on
        the new willBeRemovedFromTree signal so that the section invalidates itself properly.

        Test: fast/table/crash-split-table-section-no-cell-recalc.html

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::willBeRemovedFromTree):
        * rendering/RenderTableSection.h:
        Replaced willBeDestroyed by willBeRemovedFromTree in RenderTableSection. This ensures that it is called
        when moving sections in the tree to mark them as needing cell recalc.

2012-08-21  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] multiple fields time input UI should not have two focus ring.
        https://bugs.webkit.org/show_bug.cgi?id=94579

        Reviewed by Hajime Morita.

        This patch adds CSS selectors to override focus style for multiple
        fields time input UI.

        No new tests. fast/forms/time-multiple-fields/time-multiple-fields-appearance-basic.html
        is updated for including focus state appearance.

        * css/html.css:
        (input::-webkit-datetime-edit-ampm-field:focus): Override default focus appearance.
        (input::-webkit-datetime-edit-hour-field:focus): ditto
        (input::-webkit-datetime-edit-millisecond-field:focus): ditto
        (input::-webkit-datetime-edit-minute-field:focus): ditto
        (input::-webkit-datetime-edit-second-field:focus): ditto

2012-08-21  Adam Barth  <abarth@webkit.org>

        V8 shouldn't have its own way of printing cross-origin error messages
        https://bugs.webkit.org/show_bug.cgi?id=94641

        Reviewed by Eric Seidel.

        V8 used to re-implement (poorly) the code for printing out an error
        message when a same-origin check failed. This patch deletes that code
        in favor of just calling the WebCore version of the code. There more to
        clean up here, but I had to stop before spidering over the whole
        codebase.

        * bindings/generic/BindingSecurity.cpp:
        (WebCore::canAccessDocument):
        * bindings/js/BindingState.cpp:
        * bindings/js/BindingState.h:
        * bindings/v8/BindingState.cpp:
        (WebCore::printErrorMessageForFrame):
        * bindings/v8/BindingState.h:
        (WebCore):
        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::reportUnsafeJavaScriptAccess):
        * bindings/v8/V8Proxy.cpp:
        * bindings/v8/V8Proxy.h:
        (V8Proxy):

2012-08-21  Shinya Kawanaka  <shinyak@chromium.org>

        A shadow element in ShadowDOM of a button element does not work.
        https://bugs.webkit.org/show_bug.cgi?id=91486

        Reviewed by Dimitri Glazkov.

        Since a button element is extended from an HTMLFormControlElement, it creates a UserAgentShadowDOM
        just before adding an AuthorShadowDOM. However, actually a button element does not need any UserAgentShadowDOM.
        So we have to prevent it from creating UserAgentShadowDOM.

        Test: fast/dom/shadow/shadowdom-for-button.html

        * html/HTMLButtonElement.cpp:
        (WebCore::HTMLButtonElement::willAddAuthorShadowRoot):
        (WebCore):
        * html/HTMLButtonElement.h:

2012-08-21  Sukolsak Sakshuwong  <sukolsak@google.com>

        Remove UndoManager's undoscope content attribute
        https://bugs.webkit.org/show_bug.cgi?id=94637

        Reviewed by Ryosuke Niwa.

        No new tests. Covered by existing tests.

        * bindings/v8/DOMTransaction.cpp:
        (WebCore::DOMTransaction::callFunction):
        * dom/Document.cpp:
        (WebCore::Document::undoManager):
        * dom/Element.cpp:
        (WebCore::Element::~Element):
        (WebCore):
        * dom/Element.h:
        (Element):
        * dom/Element.idl:
        * dom/ElementRareData.h:
        (ElementRareData):
        * editing/UndoManager.cpp:
        (WebCore::UndoManager::create):
        (WebCore::UndoManager::UndoManager):
        (WebCore::UndoManager::disconnect):
        (WebCore::UndoManager::transact):
        (WebCore::UndoManager::undo):
        (WebCore::UndoManager::redo):
        (WebCore::UndoManager::clearUndo):
        (WebCore::UndoManager::clearRedo):
        (WebCore):
        * editing/UndoManager.h:
        (WebCore):
        (UndoManager):
        (WebCore::UndoManager::document):
        (WebCore::UndoManager::ownerNode):
        * html/HTMLAttributeNames.in:
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::parseAttribute):
        (WebCore::HTMLElement::setContentEditable):

2012-08-21  Joanmarie Diggs  <jdiggs@igalia.com>

        [Gtk] No accessible caret-moved events found in certain content
        https://bugs.webkit.org/show_bug.cgi?id=72811

        Reviewed by Chris Fleizach.

        Part of the bug is due to objects which should claim to implement AtkText
        failed to do so as a result of containing a mixture of inline and block
        spans.

        An updated unit test was provided.

        * accessibility/gtk/WebKitAccessibleWrapperAtk.cpp:
        (roleIsTextType): New method to check if a role is one expected to have
        implemented the AtkText interface. Currently that is defined as:
         - ParagraphRole
         - HeadingRole
         - DivRole
         - CellRole
        (getInterfaceMaskFromObject): If a role is one of the text type roles,
        automatically add WAI_TEXT to the accessible object's interface mask.

2012-08-21  Tony Chang  <tony@chromium.org>

        Force XML comments to maintain whitespace
        https://bugs.webkit.org/show_bug.cgi?id=94620

        Reviewed by Pavel Feldman.

        Fix a typo in XMLViewer.css for white-space formatting. This seems
        like the desired behavior so you can see, e.g., code formatted in an
        XML comment.

        Covered by existing xmlviewer tests in http/tests/xmlviewer/dumpAsText

        * xml/XMLViewer.css:
        (.comment): Fix typo.
        * xml/XMLViewer.js:
        (createComment): Add style to comment nodes.

2012-08-21  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r126202.
        http://trac.webkit.org/changeset/126202
        https://bugs.webkit.org/show_bug.cgi?id=94657

        Causes assertion failures on Chromium Linux dbg compositing
        layout tests (Requested by dominicc on #webkit).

        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::applyFilters):
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
        (WebCore::LayerRendererChromium::drawTileQuad):
        (WebCore::LayerRendererChromium::drawYUVVideoQuad):
        (WebCore::LayerRendererChromium::drawTextureQuad):
        (WebCore::LayerRendererChromium::getFramebufferTexture):
        (WebCore::LayerRendererChromium::bindFramebufferToTexture):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
        (WebCore::CCResourceProvider::createResource):
        (WebCore::CCResourceProvider::createResourceFromExternalTexture):
        (WebCore::CCResourceProvider::deleteResource):
        (WebCore::CCResourceProvider::upload):
        (WebCore::CCResourceProvider::lockForWrite):
        (WebCore::CCResourceProvider::unlockForWrite):
        (WebCore::CCResourceProvider::flush):
        (WebCore::CCResourceProvider::shallowFlushIfSupported):
        (WebCore::CCResourceProvider::lockForRead):
        (WebCore::CCResourceProvider::unlockForRead):
        (WebCore::CCResourceProvider::CCResourceProvider):
        * platform/graphics/chromium/cc/CCResourceProvider.h:
        (WebCore):
        (CCResourceProvider):
        (WebCore::CCResourceProvider::Resource::Resource):
        (Resource):
        (CCScopedLockResourceForRead):
        (WebCore::CCScopedLockResourceForRead::CCScopedLockResourceForRead):
        (WebCore::CCScopedLockResourceForRead::~CCScopedLockResourceForRead):
        (WebCore::CCScopedLockResourceForRead::textureId):
        (CCScopedLockResourceForWrite):
        (WebCore::CCScopedLockResourceForWrite::CCScopedLockResourceForWrite):
        (WebCore::CCScopedLockResourceForWrite::~CCScopedLockResourceForWrite):
        (WebCore::CCScopedLockResourceForWrite::textureId):

2012-08-21  David Grogan  <dgrogan@chromium.org>

        IndexedDB: Fire error at request when abort is called in upgradeneeded
        https://bugs.webkit.org/show_bug.cgi?id=94402

        Reviewed by Tony Chang.

        Tests - updated intversion-abort-in-initial-upgradeneeded-expected.txt

        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::transactionFinishedAndAbortFired):
        (WebCore::IDBDatabaseBackendImpl::transactionFinishedAndCompleteFired):
        (WebCore):
        (WebCore::IDBDatabaseBackendImpl::runIntVersionChangeTransaction):
        Now that second-half open calls don't get abandoned on the queue, we
        can ASSERT that there's at most one of them at any time.

        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
        (IDBDatabaseBackendImpl):
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::dispatchEvent):
        Move setting m_didFireUpgradeNeededEvent before dispatching the event.
        If abort is called in the event handler an error event will be
        enqueued and ASSERT_WITH_MESSAGE(m_readyState == PENDING ||
        m_didFireUpgradeNeededEvent, ...) needs to pass.

        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
        (WebCore::IDBTransactionBackendImpl::abort):
        (WebCore::IDBTransactionBackendImpl::commit):

2012-08-21  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r126233.
        http://trac.webkit.org/changeset/126233
        https://bugs.webkit.org/show_bug.cgi?id=94656

        Broke Chromium Mac build (Requested by dominicc on #webkit).

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * css/mediaControls.css:
        (video::-webkit-media-text-track-display):
        * html/shadow/MediaControlElements.cpp:
        (RenderTextTrackContainerElement):
        (WebCore::MediaControlTextTrackContainerElement::updateDisplay):
        * html/track/TextTrack.cpp:
        * html/track/TextTrack.h:
        (TextTrack):
        * html/track/TextTrackCue.cpp:
        (WebCore::TextTrackCue::TextTrackCue):
        (WebCore::TextTrackCue::calculateComputedLinePosition):
        (WebCore::TextTrackCue::calculateDisplayParameters):
        (WebCore::TextTrackCue::getDisplayTree):
        (WebCore::TextTrackCue::getPositionCoordinates):
        * html/track/TextTrackCue.h:
        (WebCore):
        (TextTrackCue):
        * rendering/RenderTextTrackCue.cpp: Removed.
        * rendering/RenderTextTrackCue.h: Removed.

2012-08-20  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove getToStringName() and getToStringTemplate() from V8Binding
        https://bugs.webkit.org/show_bug.cgi?id=94573

        Reviewed by Adam Barth.

        - Remove V8Binding::getToStringName() and V8Binding::getToStringTemplate().

        - Replace getToStringName() with String::NewSymbol("toString").

        - Fix V8PerIsolateData::getToStringTemplate() so that it caches a persistent
        handle of a created FunctionTemplate. Before this patch, a FunctionTemplate
        had been created for each toString().

        No tests. No change in behavior.

        * bindings/v8/V8Binding.cpp:
        (WebCore::constructorToString):
        * bindings/v8/V8Binding.h:
        (WebCore):
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateImplementation):
        * bindings/scripts/test/V8/V8Float64Array.cpp:
        (WebCore::ConfigureV8Float64ArrayTemplate):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        (WebCore::ConfigureV8TestActiveDOMObjectTemplate):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
        (WebCore::ConfigureV8TestCustomNamedGetterTemplate):
        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
        (WebCore::ConfigureV8TestEventConstructorTemplate):
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        (WebCore::ConfigureV8TestEventTargetTemplate):
        * bindings/scripts/test/V8/V8TestException.cpp:
        (WebCore::ConfigureV8TestExceptionTemplate):
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore::ConfigureV8TestInterfaceTemplate):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
        (WebCore::ConfigureV8TestMediaQueryListListenerTemplate):
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        (WebCore::ConfigureV8TestNamedConstructorTemplate):
        * bindings/scripts/test/V8/V8TestNode.cpp:
        (WebCore::ConfigureV8TestNodeTemplate):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::ConfigureV8TestObjTemplate):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore::ConfigureV8TestSerializedScriptValueInterfaceTemplate):
        * bindings/v8/V8PerIsolateData.h:
        (V8PerIsolateData):

2012-08-21  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] WebGL Aquarium fails to render
        https://bugs.webkit.org/show_bug.cgi?id=94634

        The aquarium leaves with a glColorMask(false, false, false, true) which
        caused us to fail to blit the color components of the aquarium to the
        EGLImage.

        Fixed by setting an appropriate color mask for a blit operation.

        Reviewed by Yong Li.

        No new tests, tested manually.

        * platform/graphics/blackberry/EGLImageLayerWebKitThread.cpp:
        (WebCore::EGLImageLayerWebKitThread::blitToFrontBuffer):

2012-08-21  Victor Carbune  <victor@rosedu.org>

        Display a TextTrackCue when snap-to-lines flag is set
        https://bugs.webkit.org/show_bug.cgi?id=79751

        Reviewed by Tony Chang.

        This patch implements rendering functionality for a given text track,
        following closer the exact WebVTT specification. There are two new classes
        which have been added in order to succesfully cover rendering when of a text
        track cue.

        RenderTextTrackCue handles the specific rendering algorithm required,
        by checking for overlaps with other boxes that are in the same
        container (these can be any other boxes, not necessarily other cues,
        the video controls, for example).

        TextTrackCueBox extends HTMLDivElement and is an intermediate layer
        between the renderer class and the actual cue object. Its purpose is
        to instantiate the particular renderer and cover all the default CSS
        styling that needs to be applied to the cue.

        The layout is done in two steps:
          - Step 1: Layout the TextTrackCue with default CSS properties set (this is
        the TextTrackCueBox decorated with the respective CSS elements)
          - Step 2: RenderTextTrackCue adjusts the box position depending on the
        parameters of the TextTrackCue object and the overlaps that may occur with
        previously positioned cues.

        Tests: media/track/track-cue-rendering-horizontal.html
               media/track/track-cue-rendering-vertical.html

        * CMakeLists.txt: Updated to include RenderTextTrackCue.
        * GNUmakefile.list.am: Updated to include RenderTextTrackCue.
        * Target.pri: Updated to include RenderTextTrackCue.
        * WebCore.gypi: Updated to include RenderTextTrackCue.
        * WebCore.vcproj/WebCore.vcproj: Updated to include RenderTextTrackCue.
        * WebCore.xcodeproj/project.pbxproj: Updated to include RenderTextTrackCue.
        * css/mediaControls.css: Removed unreliable CSS.
        (video::-webkit-media-text-track-display): Removed properties.
        * html/shadow/MediaControlElements.cpp: Updated to not use the new class.
        (RenderTextTrackContainerElement):
        (WebCore::MediaControlTextTrackContainerElement::updateDisplay): Simplified
        the function by moving the check if track is rendered in TextTrack and used
        the TextTrackCueBox for cues.
        * html/track/TextTrack.cpp: Added a new method.
        (WebCore::TextTrack::isRendered): Method that returns whether the track should
        be rendered or not.
        (WebCore):
        * html/track/TextTrack.h: Added the isRendered method.
        (TextTrack):
        * html/track/TextTrackCue.cpp: Added several helper methods and
        the TextTrackCueBox.
        (WebCore):
        (WebCore::TextTrackCueBox::TextTrackCueBox): The TextTrackCueBox extends
        the HTMLDivElement and represents a bridge class between RenderTextTrackCue
        and TextTrackCue. This is required as the layout is done in two steps, as
        explained on top of the ChangeLog entry.
        (WebCore::TextTrackCueBox::getCue): Returns the associated TextTrackCue object.
        (WebCore::TextTrackCueBox::applyCSSProperties): Applies a part of the default CSS
        properties, as defined by section 3.5.1 of the WebVTT specification.
        (WebCore::TextTrackCueBox::shadowPseudoId): Moved the shadow pseudo id.
        (WebCore::TextTrackCueBox::createRenderer): Creates the particular renderer.
        (WebCore::TextTrackCue::TextTrackCue): Corrected the internal writing mode map.
        (WebCore::TextTrackCue::calculateComputedLinePosition): Updated the compute line
        position algorithm. This requires, however, a method to consider only rendered
        tracks (and therefore will be addressed completely in subsequent changeset).
        (WebCore::TextTrackCue::calculateDisplayParameters): Updated and corrected the
        computed display parameters to match the current specification.
        (WebCore::TextTrackCue::getDisplayTree): Update to use the TextTrackCueBox class
        and moved CSS application to the respective class.
        (WebCore::TextTrackCue::getPositionCoordinates): Added comment to specify in which
        situation this method is used and change visibility to private.
        (WebCore::TextTrackCue::getCSSWritingMode): Returns the CSS writing mode corresponding
        to the cue writing mode.
        (WebCore::TextTrackCue::getCSSSize): Returns the cue width / height (depending on the
        writing direction.
        (WebCore::TextTrackCue::getCSSPosition): Returns the default display position, that is
        used in the first layout step.
        * html/track/TextTrackCue.h:
        (WebCore):
        (TextTrackCueBox):
        (WebCore::TextTrackCueBox::create): Initialization method.
        (TextTrackCue):
        (WebCore::TextTrackCue::getWritingDirection): Helper method to return the internal
        values used to represent the writing direction.
        * rendering/RenderTextTrackCue.cpp: Added.
        (WebCore):
        (WebCore::RenderTextTrackCue::RenderTextTrackCue):
        (WebCore::RenderTextTrackCue::layout): The rendering steps, as mentioned in
        the WebVTT rendering rules. Currently, this treats only the snap-to-lines set
        case. It is implemented following closely the spec, and might be subject to
        change as discussions on various bugs evolve.
        (WebCore::RenderTextTrackCue::initializeLayoutParameters): Steps 1 - 7.
        (WebCore::RenderTextTrackCue::placeBoxInDefaultPosition): Steps 8 - 10.
        (WebCore::RenderTextTrackCue::isOutside): Inline method to check if the cue is outside.
        (WebCore::RenderTextTrackCue::isOverlapping): Inline method to check if the cue overlaps other boxes.
        (WebCore::RenderTextTrackCue::shouldSwitchDirection): Step 12.
        (WebCore::RenderTextTrackCue::moveBoxesByStep): Step 13.
        (WebCore::RenderTextTrackCue::switchDirection): Steps 15 - 18.
        (WebCore::RenderTextTrackCue::repositionCueSnapToLinesSet): Cue repositioning
        for text track cue when the snap to lines flag is set.
        (WebCore::RenderTextTrackCue::repositionCueSnapToLinesNotSet): Cue repositioning
        for text track cue when the snap to lines flag is not set. Not implemented yet.
        * rendering/RenderTextTrackCue.h: Added.
        (WebCore):
        (RenderTextTrackCue): Rendering class, handling the display of cues.

2012-08-21  Lianghui Chen  <liachen@rim.com>

        [BlackBerry] Add RSS content handling support
        https://bugs.webkit.org/show_bug.cgi?id=93496

        Reviewed by Rob Buis.

        Add code to filter RSS content, and properly convert them to HTML
        content so they can display nicely, instead of as plain text.

        Following modules are included:

        RSSFilterStream: the code for detecting RSS content, and controlling
        the handling of these content.

        RSSParserBase: the base class for the following 3 RSS parser.
        RSS10Parser: the code for decoding RSS 1.0 content.
        RSS20Parser: the code for decoding RSS 2.0 content.
        RSSAtomParser: the code for decoding Atom format RSS content.
        RSSGenerator: the code for generating HTML content based on RSS feed.

        No new tests as it's not changing how HTML content is handled.

        * PlatformBlackBerry.cmake:
        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::initialize):
        * platform/network/blackberry/rss/RSS10Parser.cpp: Added.
        (WebCore):
        (WebCore::RSS10Parser::RSS10Parser):
        (WebCore::RSS10Parser::parseBuffer):
        (WebCore::RSS10Parser::parseXmlDoc):
        (WebCore::RSS10Parser::parseItemBaseAttribute):
        (WebCore::RSS10Parser::parseItem):
        (WebCore::RSS10Parser::parseFeed):
        * platform/network/blackberry/rss/RSS10Parser.h: Added.
        (WebCore):
        (RSS10Parser):
        * platform/network/blackberry/rss/RSS20Parser.cpp: Added.
        (WebCore):
        (WebCore::RSS20Parser::RSS20Parser):
        (WebCore::RSS20Parser::parseBuffer):
        (WebCore::RSS20Parser::parseXmlDoc):
        (WebCore::RSS20Parser::parseItemBaseAttribute):
        (WebCore::RSS20Parser::parseItem):
        (WebCore::RSS20Parser::parseFeed):
        (WebCore::RSS20Parser::parseEnclosure):
        * platform/network/blackberry/rss/RSS20Parser.h: Added.
        (WebCore):
        (RSS20Parser):
        * platform/network/blackberry/rss/RSSAtomParser.cpp: Added.
        (WebCore):
        (WebCore::isRelativePath):
        (WebCore::RSSAtomLink::relType):
        (WebCore::RSSAtomParser::RSSAtomParser):
        (WebCore::RSSAtomParser::parseBuffer):
        (WebCore::RSSAtomParser::parseXmlDoc):
        (WebCore::RSSAtomParser::parseItemBaseAttribute):
        (WebCore::RSSAtomParser::parseItem):
        (WebCore::RSSAtomParser::parseFeed):
        (WebCore::RSSAtomParser::parseLink):
        (WebCore::RSSAtomParser::enclosureFromLink):
        (WebCore::RSSAtomParser::parseContent):
        (WebCore::RSSAtomParser::parseAuthor):
        (WebCore::RSSAtomParser::parseCategory):
        * platform/network/blackberry/rss/RSSAtomParser.h: Added.
        (WebCore):
        (RSSAtomLink):
        (WebCore::RSSAtomLink::RSSAtomLink):
        (RSSAtomParser):
        * platform/network/blackberry/rss/RSSFilterStream.cpp: Added.
        (WebCore):
        (WebCore::isASCIISpaceLowerByte):
        (WebCore::stripWhiteSpace):
        (WebCore::equalIgnoringCase):
        (WebCore::isAtomMIMEType):
        (WebCore::isRSSMIMEType):
        (WebCore::isPotentialRSSMIMEType):
        (WebCore::isRSSContent):
        (WebCore::RSSTypeFromContentType):
        (WebCore::RSSTypeFromContent):
        (WebCore::createParser):
        (WebCore::findXMLEncodingPosition):
        (WebCore::findXMLLanguagePosition):
        (WebCore::defaultEncodingForLanguage):
        (WebCore::isTranscodingNeeded):
        (WebCore::transcode):
        (WebCore::transcodeContent):
        (WebCore::RSSFilterStream::RSSFilterStream):
        (WebCore::RSSFilterStream::notifyStatusReceived):
        (WebCore::RSSFilterStream::notifyHeadersReceived):
        (WebCore::RSSFilterStream::notifyDataReceived):
        (WebCore::RSSFilterStream::notifyClose):
        (WebCore::RSSFilterStream::convertContentToHtml):
        (WebCore::RSSFilterStream::handleRSSContent):
        (WebCore::RSSFilterStream::charset):
        (WebCore::RSSFilterStream::encoding):
        (WebCore::RSSFilterStream::saveHeaders):
        (WebCore::RSSFilterStream::removeHeader):
        (WebCore::RSSFilterStream::updateHeader):
        (WebCore::RSSFilterStream::updateRSSHeaders):
        (WebCore::RSSFilterStream::sendSavedHeaders):
        (WebCore::RSSFilterStream::appendData):
        * platform/network/blackberry/rss/RSSFilterStream.h: Added.
        (WebCore):
        (RSSFilterStream):
        * platform/network/blackberry/rss/RSSGenerator.cpp: Added.
        (WebCore):
        (WebCore::RSSGenerator::RSSGenerator):
        (WebCore::RSSGenerator::~RSSGenerator):
        (WebCore::RSSGenerator::generateHtml):
        * platform/network/blackberry/rss/RSSGenerator.h: Added.
        (WebCore):
        (RSSGenerator):
        * platform/network/blackberry/rss/RSSParserBase.cpp: Added.
        (WebCore):
        (WebCore::RSSEnclosure::RSSEnclosure):
        (WebCore::RSSEnclosure::typeInEnum):
        (WebCore::RSSEnclosure::suggestedName):
        (WebCore::RSSFeed::RSSFeed):
        (WebCore::RSSFeed::~RSSFeed):
        (WebCore::RSSFeed::clear):
        (WebCore::RSSItem::RSSItem):
        (WebCore::RSSItem::~RSSItem):
        (WebCore::RSSItem::clear):
        (WebCore::RSSParserBase::RSSParserBase):
        (WebCore::RSSParserBase::~RSSParserBase):
        (WebCore::textFromXMLAttr):
        (WebCore::textFromXMLNode):
        * platform/network/blackberry/rss/RSSParserBase.h: Added.
        (WebCore):
        (RSSEnclosure):
        (RSSItemBase):
        (RSSParserBase):

2012-08-21  Andrew Lo  <anlo@rim.com>

        [BlackBerry] requestAnimationFrame: Unscheduled display link frames need to be sent to main thread
        https://bugs.webkit.org/show_bug.cgi?id=94600

        Reviewed by Rob Buis.

        http://trac.webkit.org/changeset/116792 implements destroying
        DisplayRefreshMonitor after the number of unscheduled frames exceeds 10.

        Part of that change involves dispatching to the main thread whether
        the frame was scheduled or not.

        Make the corresponding change for the BlackBerry port that was made for
        DisplayRefreshMonitorMac.cpp.

        Tests covered by http://trac.webkit.org/changeset/116792

        * platform/graphics/blackberry/DisplayRefreshMonitorBlackBerry.cpp:
        (WebCore::DisplayRefreshMonitor::displayLinkFired):

2012-08-21  Brian Salomon  <bsalomon@google.com>

        [Chromium/Skia] Filters should flush the SkCanvas
        https://bugs.webkit.org/show_bug.cgi?id=94602

        Reviewed by Stephen White.

        Adds a SkCanvas::flush call to FilterBufferState::swap() to ensure the textures are updated before they are consumed by the compositor.

        Covered by existing css3/filters layout tests.

        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:

2012-08-21  Lianghui Chen  <liachen@rim.com>

        [BlackBerry] Use new method to create socket handle
        https://bugs.webkit.org/show_bug.cgi?id=89991

        Reviewed by Rob Buis.

        Update the way to create SocketStream as the platform API has changed.

        No new tests as no change of behaviour, just API change adaptation.

        * platform/network/blackberry/SocketStreamHandleBlackBerry.cpp:
        (WebCore::SocketStreamHandle::SocketStreamHandle):

2012-08-21  Kentaro Hara  <haraken@chromium.org>

        [V8] Move compileScript() from V8Proxy to ScriptSourceCode
        https://bugs.webkit.org/show_bug.cgi?id=94561

        Reviewed by Adam Barth.

        To kill V8Proxy, this patch moves compileScript() from V8Proxy
        to ScriptSourceCode. This patch also removes fromWebCoreString().

        No tests. No change in behavior.

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/v8/ScriptController.h:
        (ScriptController):
        * bindings/v8/ScriptSourceCode.cpp: Added.
        (WebCore):
        (WebCore::ScriptSourceCode::compileScript):
        * bindings/v8/ScriptSourceCode.h:
        (ScriptSourceCode):
        * bindings/v8/V8Binding.h:
        * bindings/v8/V8LazyEventListener.cpp:
        (WebCore::V8LazyEventListener::prepareListenerObject):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::evaluate):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):
        * bindings/v8/WorkerContextExecutionProxy.cpp:
        (WebCore::WorkerContextExecutionProxy::evaluate):
        (WebCore::WorkerContextExecutionProxy::runScript):
        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
        (WebCore::V8InjectedScriptHost::getEventListenersCallback):
        * bindings/v8/custom/V8MessageEventCustom.cpp:
        (WebCore::V8MessageEvent::dataAccessorGetter):
        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
        (WebCore::toV8Object):
        (WebCore::V8WebGLRenderingContext::getSupportedExtensionsCallback):

2012-08-21  Kentaro Hara  <haraken@chromium.org>

        [V8] Move toV8Context() from V8Proxy to V8Binding
        https://bugs.webkit.org/show_bug.cgi?id=94597

        Reviewed by Adam Barth.

        To kill V8Proxy, we can move toV8Context() from V8Proxy to V8Binding.

        No tests. No change in behavior.

        * bindings/v8/V8Binding.cpp:
        (WebCore::toV8Context):
        (WebCore):
        * bindings/v8/V8Binding.h:
        (WebCore):
        * bindings/v8/V8Proxy.cpp:
        * bindings/v8/V8Proxy.h:

2012-08-21  Gabriel Peal  <gpeal@google.com>

        Web Inspector: Embeddable Web Inspector
        https://bugs.webkit.org/show_bug.cgi?id=91528

        Reviewed by Pavel Feldman.

        Adds functionality to the inspector such that it is better suited to run embedded in another webpage. It adds the ability to prepopulate the timeline panel with an existing recording among other controls.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/InspectorFrontendAPI.js:
        (InspectorFrontendAPI.dispatchQueryParameters):
        (InspectorFrontendAPI.loadTimelineFromURL):
        * inspector/front-end/InspectorFrontendHostStub.js:
        (.WebInspector.InspectorFrontendHostStub.prototype.hiddenPanels):
        (.WebInspector.InspectorFrontendHostStub.prototype.loadResourceSynchronously):
        * inspector/front-end/InspectorView.js:
        * inspector/front-end/TimelineModel.js:
        (WebInspector.TimelineModel.prototype.loadFromURL.onDataReceived):
        (WebInspector.TimelineModel.prototype.loadFromURL.parseAndImportData):
        (WebInspector.TimelineModel.prototype.loadFromURL.onLoad):
        (WebInspector.TimelineModel.prototype.loadFromURL):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype.loadFromURL):
        * inspector/front-end/inspector.js:
        (WebInspector._createPanels):
        (WebInspector.loaded):
        * inspector/front-end/utilities.js:

2012-08-21  Robin Cao  <robin.cao@torchmobile.com.cn>

        [BlackBerry] Add support for getUserMedia
        https://bugs.webkit.org/show_bug.cgi?id=94591

        Reviewed by George Staikos.

        Implement getUserMedia feature using the platform API.

        Tests in fast/mediastream cover this.

        PR #153571

        Reviewed internally by George Staikos.

        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
        (WebCore::toWebMediaStreamSource):
        (WebCore):
        (WebCore::toWebMediaStreamDescriptor):
        (WebCore::MediaPlayerPrivate::lookupMediaStream):
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
        (MediaPlayerPrivate):

2012-08-21  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: remove DOMNodeRemoved listener from the DefaultTextEditor
        https://bugs.webkit.org/show_bug.cgi?id=94592

        Reviewed by Yury Semikhatsky.

        It seems to be not necessary.

        * inspector/front-end/DefaultTextEditor.js:
        (WebInspector.TextEditorMainPanel):
        (WebInspector.TextEditorMainPanel.prototype._handleDOMUpdates):
        (WebInspector.TextEditorMainChunk):
        (WebInspector.TextEditorMainChunk.prototype.set expanded):

2012-08-21  Thiago Marcos P. Santos  <thiago.santos@intel.com>

        CodeGeneratorInspector.py: Generate guards for type validators
        https://bugs.webkit.org/show_bug.cgi?id=94511

        Reviewed by Yury Semikhatsky.

        Fix regression when building debug and one of the generated types is
        disabled by a compile flag. We should generate guards for these type
        validators the same way as we are doing on the include headers.

        * inspector/CodeGeneratorInspector.py:
        (TypeBindings.create_type_declaration_.EnumBinding.get_code_generator.CodeGenerator.generate_type_builder):

2012-08-21  Florin Malita  <fmalita@chromium.org>

        ASSERT triggered in SVGTRefTargetEventListener::handleEvent()
        https://bugs.webkit.org/show_bug.cgi?id=94487

        Reviewed by Nikolas Zimmermann.

        The current way of tracking tref target elements by id can leave stale event listeners
        under certain circumstances. This patch switches to storing a target RefPtr instead
        to avoid an id lookup which may not return the original/attached element.

        Test: svg/custom/tref-stale-listener-crash.html

        * svg/SVGTRefElement.cpp:
        (SVGTRefTargetEventListener):
        (WebCore::SVGTRefTargetEventListener::isAttached): use m_target instead of an explicit bool.
        (WebCore::SVGTRefTargetEventListener::SVGTRefTargetEventListener):
        (WebCore::SVGTRefTargetEventListener::attach): save a target RefPtr instead of an id.
        (WebCore::SVGTRefTargetEventListener::detach): detach the target element directly without
        going through a lookup.
        (WebCore::SVGTRefTargetEventListener::handleEvent):
        (WebCore::SVGTRefElement::updateReferencedText): use an explicit target pointer instead of
        the id-based lookup.
        (WebCore::SVGTRefElement::buildPendingResource):
        * svg/SVGTRefElement.h:
        (SVGTRefElement):

2012-08-21  Alexandre Elias  <aelias@google.com>

        [chromium] Add software bitmap resources to CCResourceProvider
        https://bugs.webkit.org/show_bug.cgi?id=93677

        Reviewed by Adrienne Walker.

        This adds the ability to CCResourceProvider to use software bitmaps.
        They are allocated as plain-old-memory, and exposed as Skia objects.

        We want the ResourceProvider to be able to handle different resource
        types at the same time.  In practice, a default resource type is
        desired for most uses within a single compositor instance, which is
        specified by the default resource type.  Default resource types are
        expected to be mostly 1-to-1 with CCRenderer types.

        New tests added by parametrizing existing CCResourceProvider tests.

        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::applyFilters):
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
        (WebCore::LayerRendererChromium::drawTileQuad):
        (WebCore::LayerRendererChromium::drawYUVVideoQuad):
        (WebCore::LayerRendererChromium::drawTextureQuad):
        (WebCore::LayerRendererChromium::getFramebufferTexture):
        (WebCore::LayerRendererChromium::bindFramebufferToTexture):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (DrawingFrame):
        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
        (WebCore::CCResourceProvider::createResource):
        (WebCore):
        (WebCore::CCResourceProvider::createGLTexture):
        (WebCore::CCResourceProvider::createBitmap):
        (WebCore::CCResourceProvider::createResourceFromExternalTexture):
        (WebCore::CCResourceProvider::deleteResource):
        (WebCore::CCResourceProvider::upload):
        (WebCore::CCResourceProvider::flush):
        (WebCore::CCResourceProvider::shallowFlushIfSupported):
        (WebCore::CCResourceProvider::lockForRead):
        (WebCore::CCResourceProvider::unlockForRead):
        (WebCore::CCResourceProvider::lockForWrite):
        (WebCore::CCResourceProvider::unlockForWrite):
        (WebCore::CCResourceProvider::ScopedReadLockGL::ScopedReadLockGL):
        (WebCore::CCResourceProvider::ScopedReadLockGL::~ScopedReadLockGL):
        (WebCore::CCResourceProvider::ScopedWriteLockGL::ScopedWriteLockGL):
        (WebCore::CCResourceProvider::ScopedWriteLockGL::~ScopedWriteLockGL):
        (WebCore::CCResourceProvider::populateSkBitmapWithResource):
        (WebCore::CCResourceProvider::ScopedReadLockSoftware::ScopedReadLockSoftware):
        (WebCore::CCResourceProvider::ScopedReadLockSoftware::~ScopedReadLockSoftware):
        (WebCore::CCResourceProvider::ScopedWriteLockSoftware::ScopedWriteLockSoftware):
        (WebCore::CCResourceProvider::ScopedWriteLockSoftware::~ScopedWriteLockSoftware):
        (WebCore::CCResourceProvider::CCResourceProvider):
        * platform/graphics/chromium/cc/CCResourceProvider.h:
        (WebCore):
        (WebCore::CCResourceProvider::setCreationPolicy):
        (WebCore::CCResourceProvider::creationPolicy):
        (CCResourceProvider):
        (ScopedReadLockGL):
        (WebCore::CCResourceProvider::ScopedReadLockGL::textureId):
        (ScopedWriteLockGL):
        (WebCore::CCResourceProvider::ScopedWriteLockGL::textureId):
        (ScopedReadLockSoftware):
        (WebCore::CCResourceProvider::ScopedReadLockSoftware::skBitmap):
        (ScopedWriteLockSoftware):
        (WebCore::CCResourceProvider::ScopedWriteLockSoftware::skCanvas):
        (Resource):

2012-08-21  Tab Atkins  <tabatkins@google.com>

        Track -webkit property usage.
        https://bugs.webkit.org/show_bug.cgi?id=93420

        Reviewed by Ojan Vafai.

        First draft of an attempt to track all usage of -webkit prefixed properties across the web.
        This attempt is dumb, but should provide useful data as a first-pass.
        I plan to optimize this for better data collection in the future.

        No tests added, as this is untestable currently.
        It should have zero effect besides histogramming.

        * css/CSSParser.cpp:
        (WebCore::cssPropertyID):

2012-08-21  Alec Flett  <alecflett@chromium.org>

        IndexedDB: remove old update/openCursor glue
        https://bugs.webkit.org/show_bug.cgi?id=94378

        Reviewed by Tony Chang.

        Remove old openCursor and update methods after landing
        https://bugs.webkit.org/show_bug.cgi?id=91125 and removing
        Chromium-side glue.

        No new tests: this code is dead.

        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
        (IDBObjectStoreBackendImpl):
        * Modules/indexeddb/IDBObjectStoreBackendInterface.h:
        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore):

2012-08-21  James Robinson  <jamesr@chromium.org>

        [chromium] Should be able to destroy a CCLayerTreeHost without manually setting the root layer
        https://bugs.webkit.org/show_bug.cgi?id=94631

        Reviewed by Adrienne Walker.

        In the depths of time when dinosaurs roamed the earth, LayerChromium and CCLayerTreeHost were both reference
        counted and there was a cycle between the root LayerChromium and CCLayerTreeHost. This required all users of
        CCLayerTreeHost to manually break the cycle by calling setRootLayer(0) before dropping their reference to the
        host. Nowadays, CCLayerTreeHost has a single owner and LayerChromiums only have a weak pointer to their host
        so we should just do this cleanup ourselves instead of imposing it on callers.

        Unit test added to LayerChromiumTest.cpp

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::~CCLayerTreeHost):

2012-08-21  Ulan Degenbaev  <ulan@chromium.org>

        Call AdjustAmountOfExternalAllocatedMemory when V8ArrayBuffer constructed and destructed
        https://bugs.webkit.org/show_bug.cgi?id=92993

        Reviewed by Kenneth Russell.

        Call AdjustAmountOfExternalAllocatedMemory when V8ArrayBuffer
        is constructed and destructed so that V8's garbage collection
        heuristics can account for the memory held by these objects.

        * WebCore.gypi:
        * bindings/v8/SerializedScriptValue.cpp:
        * bindings/v8/custom/V8ArrayBufferCustom.cpp:
        (WebCore::V8ArrayBufferDeallocationObserver::instance):
        (WebCore):
        (WebCore::V8ArrayBuffer::constructorCallback):
        * bindings/v8/custom/V8ArrayBufferCustom.h: Added.
        (WebCore):
        * bindings/v8/custom/V8ArrayBufferViewCustom.cpp:
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore::constructWebGLArray):
        * dom/MessageEvent.cpp:
        (WebCore::MessageEvent::MessageEvent):
        (WebCore::MessageEvent::initMessageEvent):

2012-08-21  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Completion events of InspectorFileSystemAgent should be fired asynchronously.
        https://bugs.webkit.org/show_bug.cgi?id=93933

        Reviewed by Yury Semikhatsky.

        InspectorFileSystemAgent fires completion event too early in error case. It should wait
        until JS code is ready.

        Test: http/tests/inspector/filesystem/request-directory-content.html
              http/tests/inspector/filesystem/request-file-content.html
              http/tests/inspector/filesystem/request-metadata.html

        * inspector/InspectorFileSystemAgent.cpp:
        (WebCore): Add ReportErrorTask class

2012-08-21  Mike West  <mkwst@chromium.org>

        Blocking a resource via Content Security Policy should trigger an Error event.
        https://bugs.webkit.org/show_bug.cgi?id=89440

        Reviewed by Jochen Eisinger.

        If a CSP directive is violated, CachedResourceLoader will trigger a
        console error, and return a null image. In that case, we now dispatch
        an error on the relevant element.

        Adjusted http/tests/security/contentSecurityPolicy/image-blocked.html
        and http/tests/security/contentSecurityPolicy/register-bypassing-scheme.html
        to test the new behavior.

        This has the side-effect of also generating errors for images blocked by
        Chromium's content settings. Adjusted
        platform/chromium/permissionclient/image-permissions.html to agree with
        the new behavior.

        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::updateFromElement):

2012-08-21  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Split out crumb list part of styles from elementsPanel.css
        https://bugs.webkit.org/show_bug.cgi?id=94301

        Reviewed by Pavel Feldman.

        As a preparation to use BreadcrumbList on FileSystem, introduce breadcrumbList.css and
        move crumb-related style entries into it from elementsPanel.css.

        No new tests. This change does not make functional change.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/front-end/ElementsPanel.js:
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/breadcrumbList.css: Added.
        (.crumbs):
        (.crumbs .crumb):
        (.crumbs .crumb.collapsed > *):
        (.crumbs .crumb.collapsed::before):
        (.crumbs .crumb.compact .extra):
        (.crumbs .crumb.dimmed):
        (.crumbs .crumb.start):
        (.crumbs .crumb.end):
        (.crumbs .crumb.selected):
        (.crumbs .crumb.selected:hover):
        (.crumbs .crumb.selected.end, .crumbs .crumb.selected.end:hover):
        (.crumbs .crumb:hover):
        (.crumbs .crumb.dimmed:hover):
        (.crumbs .crumb.end:hover):
        * inspector/front-end/elementsPanel.css:

2012-08-21  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>

        canvas/philip/tests/2d.fillStyle.parse.invalid.rgba-6.html fails
        https://bugs.webkit.org/show_bug.cgi?id=50797

        Reviewed by Andreas Kling.

        Add a check in fast-path parseAlphaValue() to return early
        if the CSS <alphavalue> ended with an invalid digit.

        Test: canvas/philip/tests/2d.fillStyle.parse.invalid.rgba-6.html

        * css/CSSParser.cpp:
        (WebCore::parseAlphaValue):

2012-08-21  Benjamin Poulain  <bpoulain@apple.com>

        Store CString data in the CStringBuffer to avoid the double indirection
        https://bugs.webkit.org/show_bug.cgi?id=94562

        Reviewed by Darin Adler.

        * bindings/cpp/WebDOMCString.cpp:
        (WebDOMCString::length): With the patch, CStringBuffer hold the real string length instead of the
        size of the buffer including the terminating zero. WebDOMCString is updated accordingly.

2012-08-21  Benjamin Poulain  <bpoulain@apple.com>

        Create CSS color output string on 8 bits
        https://bugs.webkit.org/show_bug.cgi?id=94625

        Reviewed by Andreas Kling.

        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::customCssText):
        Previously, the output string for a CSS color was computed on 16 bits.
        This was mainly forced by the use of String::number().

        Since the double to string conversion is done on 8bits anyway, I changed
        the code to use dtoa's numberToFixedPrecisionString directly instead of
        String::number().
        All the other parts were already on 8bits.

2012-08-21  Martin Robinson  <mrobinson@igalia.com>

        [GTK] Using a native window for the WebView breaks GtkOverlay
        https://bugs.webkit.org/show_bug.cgi?id=90085

        Reviewed by Alejandro G. Castro.

        No new tests. This will be covered by pixel test for accelerated
        compositing when they are activated.

        * GNUmakefile.am: Add XComposite libraries to the linker list.
        * GNUmakefile.list.am: Add RedirectedXCompositeWindow files to the source list.
        Make a new section for GLX specific files.
        * platform/graphics/glx/GLContextGLX.cpp:
        (WebCore::GLContextGLX::sharedDisplay): Expose sharedDisplay as a static method
        so that it can be called by other X11 specific code.
        * platform/graphics/glx/GLContextGLX.h: Ditto.
        * platform/gtk/RedirectedXCompositeWindow.cpp: Added. An implementation of a GL surface
        that renders to an X-window which redirects to a pixmap.
        * platform/gtk/RedirectedXCompositeWindow.h: Added.

2012-08-21  David Hyatt  <hyatt@apple.com>

        [New Multicolumn] Make column rules paint properly.
        https://bugs.webkit.org/show_bug.cgi?id=94616

        Reviewed by Simon Fraser.

        Make the new multi-column code paint column rules and also prepare it for painting
        the actual column contents.

        * rendering/RenderMultiColumnBlock.cpp:
        (WebCore::RenderMultiColumnBlock::ensureColumnSets):
        Remove the addRegionToThread call, since this is now done automatically in RenderRegion::insertedIntoTree.
        
        * rendering/RenderMultiColumnBlock.h:
        (WebCore::RenderMultiColumnBlock::flowThread):
        Make public so that RenderMultiColumnSet can access it.
        
        (RenderMultiColumnBlock):
        * rendering/RenderMultiColumnSet.cpp:
        (WebCore::RenderMultiColumnSet::columnGap):
        Add a column gap fetch method. It's identical to the one on RenderBlock (which will eventually go away
        when we kill the old multi-column code).
        
        (WebCore::RenderMultiColumnSet::columnRectAt):
        Also identical to the RenderBlock version of this method. Gets the rect for the nth column.
        
        (WebCore::RenderMultiColumnSet::paintReplaced):
        Subclass paintReplaced in order to do column rules and contents painting.
        
        (WebCore::RenderMultiColumnSet::paintColumnRules):
        (WebCore::RenderMultiColumnSet::paintColumnContents):
        Similar to the methods on RenderBlock. The former paints the rules and the latter paints the contents of
        the flow thread into the columns.
        
        * rendering/RenderMultiColumnSet.h:
        (RenderMultiColumnSet):
        Add the declarations of all the new methods.
        
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::installFlowThread):
        Added a new virtual function for installing flow threads when they didn't exist at construction time.
        This only applies to actual CSS Regions, so the subclass of the method in RenderRegionSet just does
        nothing.
        
        (WebCore::RenderRegion::attachRegion):
        Get the named flow thread code out of attachRegion, since it broke multi-column. Moved it into a
        virtual function, installFlowThread, that is only used by actual CSS regions. Eventually we may
        want a RenderRegion subclass that represents a region for a named flow thread only, but for now
        let the code sit in installFlowThread in the base class.
        
        * rendering/RenderRegion.h:
        (RenderRegion):
        Add installFlowThread declaration.
        
        * rendering/RenderRegionSet.cpp:
        (WebCore::RenderRegionSet::installFlowThread):
        installFlowThread for region sets just does nothing, since we don't use named flow threads.
        
        * rendering/RenderRegionSet.h:
        (RenderRegionSet):
        Add the override of installFlowThread.

2012-08-21  Patrick Gansterer  <paroga@webkit.org>

        [WIN] Build fix for !ENABLE(DRAG_SUPPORT).

        * page/win/EventHandlerWin.cpp:
        (WebCore):
        (WebCore::EventHandler::passMouseMoveEventToSubframe):

2012-08-21  James Robinson  <jamesr@chromium.org>

        Unreviewed, rolling out r126170.
        http://trac.webkit.org/changeset/126170
        https://bugs.webkit.org/show_bug.cgi?id=94614

        I spoke too soon

        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        (WebCore::ScrollingCoordinatorPrivate::ScrollingCoordinatorPrivate):
        (WebCore::ScrollingCoordinatorPrivate::setScrollLayer):
        (WebCore::ScrollingCoordinatorPrivate::setHorizontalScrollbarLayer):
        (WebCore::ScrollingCoordinatorPrivate::setVerticalScrollbarLayer):
        (WebCore::ScrollingCoordinatorPrivate::hasScrollLayer):
        (WebCore::ScrollingCoordinatorPrivate::scrollLayer):
        (ScrollingCoordinatorPrivate):
        (WebCore::createScrollbarLayer):
        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
        (WebCore::ScrollingCoordinator::setScrollLayer):
        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
        (WebCore::ScrollingCoordinator::setWheelEventHandlerCount):
        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
        (WebCore::ScrollingCoordinator::setLayerIsContainerForFixedPositionLayers):
        (WebCore::ScrollingCoordinator::setLayerIsFixedToContainerLayer):
        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
        (WebCore::Canvas2DLayerBridge::Canvas2DLayerBridge):
        (WebCore::Canvas2DLayerBridge::~Canvas2DLayerBridge):
        (WebCore::Canvas2DLayerBridge::prepareForDraw):
        (WebCore::Canvas2DLayerBridge::layer):
        (WebCore::Canvas2DLayerBridge::contextAcquired):
        * platform/graphics/chromium/Canvas2DLayerBridge.h:
        (Canvas2DLayerBridge):
        * platform/graphics/chromium/DrawingBufferChromium.cpp:
        (WebCore::DrawingBufferPrivate::DrawingBufferPrivate):
        (WebCore::DrawingBufferPrivate::~DrawingBufferPrivate):
        (WebCore::DrawingBufferPrivate::layer):
        (DrawingBufferPrivate):
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
        (WebCore::GraphicsLayerChromium::~GraphicsLayerChromium):
        (WebCore::GraphicsLayerChromium::willBeDestroyed):
        (WebCore):
        (WebCore::GraphicsLayerChromium::updateNames):
        (WebCore::GraphicsLayerChromium::removeFromParent):
        (WebCore::GraphicsLayerChromium::setSize):
        (WebCore::GraphicsLayerChromium::clearBackgroundColor):
        (WebCore::GraphicsLayerChromium::setContentsOpaque):
        (WebCore::GraphicsLayerChromium::setFilters):
        (WebCore::GraphicsLayerChromium::setBackgroundFilters):
        (WebCore::GraphicsLayerChromium::setMaskLayer):
        (WebCore::GraphicsLayerChromium::setBackfaceVisibility):
        (WebCore::GraphicsLayerChromium::setOpacity):
        (WebCore::GraphicsLayerChromium::setReplicatedByLayer):
        (WebCore::GraphicsLayerChromium::setContentsNeedsDisplay):
        (WebCore::GraphicsLayerChromium::setNeedsDisplay):
        (WebCore::GraphicsLayerChromium::setNeedsDisplayInRect):
        (WebCore::GraphicsLayerChromium::setContentsToImage):
        (WebCore::GraphicsLayerChromium::setContentsToCanvas):
        (WebCore::GraphicsLayerChromium::addAnimation):
        (WebCore::GraphicsLayerChromium::pauseAnimation):
        (WebCore::GraphicsLayerChromium::removeAnimation):
        (WebCore::GraphicsLayerChromium::suspendAnimations):
        (WebCore::GraphicsLayerChromium::resumeAnimations):
        (WebCore::GraphicsLayerChromium::addLinkHighlight):
        (WebCore::GraphicsLayerChromium::didFinishLinkHighlight):
        (WebCore::GraphicsLayerChromium::setContentsToMedia):
        (WebCore::GraphicsLayerChromium::primaryLayer):
        (WebCore::GraphicsLayerChromium::platformLayer):
        (WebCore::GraphicsLayerChromium::setDebugBackgroundColor):
        (WebCore::GraphicsLayerChromium::setDebugBorder):
        (WebCore::GraphicsLayerChromium::updateChildList):
        (WebCore::GraphicsLayerChromium::updateLayerPosition):
        (WebCore::GraphicsLayerChromium::updateLayerSize):
        (WebCore::GraphicsLayerChromium::updateAnchorPoint):
        (WebCore::GraphicsLayerChromium::updateTransform):
        (WebCore::GraphicsLayerChromium::updateChildrenTransform):
        (WebCore::GraphicsLayerChromium::updateMasksToBounds):
        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D):
        (WebCore::GraphicsLayerChromium::updateLayerIsDrawable):
        (WebCore::GraphicsLayerChromium::updateLayerBackgroundColor):
        (WebCore::GraphicsLayerChromium::updateContentsRect):
        (WebCore::GraphicsLayerChromium::updateContentsScale):
        (WebCore::GraphicsLayerChromium::setupContentsLayer):
        * platform/graphics/chromium/GraphicsLayerChromium.h:
        (WebCore::GraphicsLayerChromium::hasContentsLayer):
        (GraphicsLayerChromium):
        (WebCore::GraphicsLayerChromium::contentsLayer):
        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::rootLayer):
        * platform/graphics/chromium/LayerChromium.h:

2012-08-21  Adam Barth  <abarth@webkit.org>

        Update run-bindings-tests results after http://trac.webkit.org/changeset/126165

        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::jsTestActiveDOMObjectExcitingAttr):
        (WebCore::jsTestActiveDOMObjectConstructor):
        (WebCore::jsTestActiveDOMObjectPrototypeFunctionExcitingFunction):

2012-08-21  Vincent Scheib  <scheib@chromium.org>

        Add parsing logic for allow-pointer-lock to iframe sandbox attribute.
        https://bugs.webkit.org/show_bug.cgi?id=94513

        Reviewed by Adam Barth.

        Pointer lock was previously blocked from all sandboxed iframes.
        Parsing the sandbox="allow-pointer-lock" attribute allows pages
        to control the feature and enable it in sandboxed iframes.

        Tests: http/tests/pointer-lock/iframe-sandboxed-allow-pointer-lock.html
               http/tests/pointer-lock/iframe-sandboxed-nested-allow-pointer-lock.html
               http/tests/pointer-lock/iframe-sandboxed-nested-disallow-then-allow-pointer-lock.html

        * dom/SecurityContext.cpp:
        (WebCore::SecurityContext::parseSandboxPolicy):

2012-08-21  James Robinson  <jamesr@chromium.org>

        Unreviewed, rolling out r126169.
        http://trac.webkit.org/changeset/126169
        https://bugs.webkit.org/show_bug.cgi?id=94614

        Crashes already fixed downstream

        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        (WebCore::ScrollingCoordinatorPrivate::ScrollingCoordinatorPrivate):
        (ScrollingCoordinatorPrivate):
        (WebCore::ScrollingCoordinatorPrivate::setScrollLayer):
        (WebCore::ScrollingCoordinatorPrivate::setHorizontalScrollbarLayer):
        (WebCore::ScrollingCoordinatorPrivate::setVerticalScrollbarLayer):
        (WebCore::ScrollingCoordinatorPrivate::scrollLayer):
        (WebCore::scrollableLayerForGraphicsLayer):
        (WebCore):
        (WebCore::createScrollbarLayer):
        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
        (WebCore::ScrollingCoordinator::setScrollLayer):
        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
        (WebCore::ScrollingCoordinator::setWheelEventHandlerCount):
        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
        (WebCore::ScrollingCoordinator::setLayerIsContainerForFixedPositionLayers):
        (WebCore::ScrollingCoordinator::setLayerIsFixedToContainerLayer):
        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
        (WebCore::Canvas2DLayerBridge::Canvas2DLayerBridge):
        (WebCore::Canvas2DLayerBridge::~Canvas2DLayerBridge):
        (WebCore::Canvas2DLayerBridge::prepareForDraw):
        (WebCore::Canvas2DLayerBridge::layer):
        (WebCore::Canvas2DLayerBridge::contextAcquired):
        * platform/graphics/chromium/Canvas2DLayerBridge.h:
        (Canvas2DLayerBridge):
        * platform/graphics/chromium/DrawingBufferChromium.cpp:
        (WebCore::DrawingBufferPrivate::DrawingBufferPrivate):
        (WebCore::DrawingBufferPrivate::~DrawingBufferPrivate):
        (WebCore::DrawingBufferPrivate::layer):
        (DrawingBufferPrivate):
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
        (WebCore::GraphicsLayerChromium::~GraphicsLayerChromium):
        (WebCore::GraphicsLayerChromium::updateNames):
        (WebCore::GraphicsLayerChromium::removeFromParent):
        (WebCore::GraphicsLayerChromium::setSize):
        (WebCore::GraphicsLayerChromium::clearBackgroundColor):
        (WebCore::GraphicsLayerChromium::setContentsOpaque):
        (WebCore::GraphicsLayerChromium::setFilters):
        (WebCore::GraphicsLayerChromium::setBackgroundFilters):
        (WebCore::GraphicsLayerChromium::setMaskLayer):
        (WebCore::GraphicsLayerChromium::setBackfaceVisibility):
        (WebCore::GraphicsLayerChromium::setOpacity):
        (WebCore::GraphicsLayerChromium::setReplicatedByLayer):
        (WebCore::GraphicsLayerChromium::setContentsNeedsDisplay):
        (WebCore::GraphicsLayerChromium::setNeedsDisplay):
        (WebCore::GraphicsLayerChromium::setNeedsDisplayInRect):
        (WebCore::GraphicsLayerChromium::setContentsToImage):
        (WebCore::GraphicsLayerChromium::setContentsToCanvas):
        (WebCore):
        (WebCore::GraphicsLayerChromium::setContentsToMedia):
        (WebCore::GraphicsLayerChromium::setContentsTo):
        (WebCore::GraphicsLayerChromium::addAnimation):
        (WebCore::GraphicsLayerChromium::pauseAnimation):
        (WebCore::GraphicsLayerChromium::removeAnimation):
        (WebCore::GraphicsLayerChromium::suspendAnimations):
        (WebCore::GraphicsLayerChromium::resumeAnimations):
        (WebCore::GraphicsLayerChromium::addLinkHighlight):
        (WebCore::GraphicsLayerChromium::didFinishLinkHighlight):
        (WebCore::GraphicsLayerChromium::platformLayer):
        (WebCore::GraphicsLayerChromium::setDebugBackgroundColor):
        (WebCore::GraphicsLayerChromium::setDebugBorder):
        (WebCore::GraphicsLayerChromium::updateChildList):
        (WebCore::GraphicsLayerChromium::updateLayerPosition):
        (WebCore::GraphicsLayerChromium::updateLayerSize):
        (WebCore::GraphicsLayerChromium::updateAnchorPoint):
        (WebCore::GraphicsLayerChromium::updateTransform):
        (WebCore::GraphicsLayerChromium::updateChildrenTransform):
        (WebCore::GraphicsLayerChromium::updateMasksToBounds):
        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D):
        (WebCore::GraphicsLayerChromium::updateLayerIsDrawable):
        (WebCore::GraphicsLayerChromium::updateLayerBackgroundColor):
        (WebCore::GraphicsLayerChromium::updateContentsRect):
        (WebCore::GraphicsLayerChromium::updateContentsScale):
        (WebCore::GraphicsLayerChromium::setupContentsLayer):
        * platform/graphics/chromium/GraphicsLayerChromium.h:
        (WebCore::GraphicsLayerChromium::hasContentsLayer):
        (WebCore::GraphicsLayerChromium::contentLayer):
        (GraphicsLayerChromium):
        (WebCore::GraphicsLayerChromium::contentsLayer):
        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::rootLayer):
        * platform/graphics/chromium/LayerChromium.h:

2012-08-21  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r126076, r126099, and r126106.
        http://trac.webkit.org/changeset/126076
        http://trac.webkit.org/changeset/126099
        http://trac.webkit.org/changeset/126106
        https://bugs.webkit.org/show_bug.cgi?id=94614

        Caused crashes during compositor shutdown in Aura builds of
        Chromium (Requested by kbr_google on #webkit).

        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        (WebCore::ScrollingCoordinatorPrivate::ScrollingCoordinatorPrivate):
        (WebCore::ScrollingCoordinatorPrivate::setScrollLayer):
        (WebCore::ScrollingCoordinatorPrivate::setHorizontalScrollbarLayer):
        (WebCore::ScrollingCoordinatorPrivate::setVerticalScrollbarLayer):
        (WebCore::ScrollingCoordinatorPrivate::hasScrollLayer):
        (WebCore::ScrollingCoordinatorPrivate::scrollLayer):
        (ScrollingCoordinatorPrivate):
        (WebCore::createScrollbarLayer):
        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
        (WebCore::ScrollingCoordinator::setScrollLayer):
        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
        (WebCore::ScrollingCoordinator::setWheelEventHandlerCount):
        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
        (WebCore::ScrollingCoordinator::setLayerIsContainerForFixedPositionLayers):
        (WebCore::ScrollingCoordinator::setLayerIsFixedToContainerLayer):
        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
        (WebCore::Canvas2DLayerBridge::Canvas2DLayerBridge):
        (WebCore::Canvas2DLayerBridge::~Canvas2DLayerBridge):
        (WebCore::Canvas2DLayerBridge::prepareForDraw):
        (WebCore::Canvas2DLayerBridge::layer):
        (WebCore::Canvas2DLayerBridge::contextAcquired):
        * platform/graphics/chromium/Canvas2DLayerBridge.h:
        (Canvas2DLayerBridge):
        * platform/graphics/chromium/DrawingBufferChromium.cpp:
        (WebCore::DrawingBufferPrivate::DrawingBufferPrivate):
        (WebCore::DrawingBufferPrivate::~DrawingBufferPrivate):
        (WebCore::DrawingBufferPrivate::layer):
        (DrawingBufferPrivate):
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
        (WebCore::GraphicsLayerChromium::~GraphicsLayerChromium):
        (WebCore::GraphicsLayerChromium::willBeDestroyed):
        (WebCore):
        (WebCore::GraphicsLayerChromium::updateNames):
        (WebCore::GraphicsLayerChromium::removeFromParent):
        (WebCore::GraphicsLayerChromium::setSize):
        (WebCore::GraphicsLayerChromium::clearBackgroundColor):
        (WebCore::GraphicsLayerChromium::setContentsOpaque):
        (WebCore::GraphicsLayerChromium::setFilters):
        (WebCore::GraphicsLayerChromium::setBackgroundFilters):
        (WebCore::GraphicsLayerChromium::setMaskLayer):
        (WebCore::GraphicsLayerChromium::setBackfaceVisibility):
        (WebCore::GraphicsLayerChromium::setOpacity):
        (WebCore::GraphicsLayerChromium::setReplicatedByLayer):
        (WebCore::GraphicsLayerChromium::setContentsNeedsDisplay):
        (WebCore::GraphicsLayerChromium::setNeedsDisplay):
        (WebCore::GraphicsLayerChromium::setNeedsDisplayInRect):
        (WebCore::GraphicsLayerChromium::setContentsToImage):
        (WebCore::GraphicsLayerChromium::setContentsToCanvas):
        (WebCore::GraphicsLayerChromium::addAnimation):
        (WebCore::GraphicsLayerChromium::pauseAnimation):
        (WebCore::GraphicsLayerChromium::removeAnimation):
        (WebCore::GraphicsLayerChromium::suspendAnimations):
        (WebCore::GraphicsLayerChromium::resumeAnimations):
        (WebCore::GraphicsLayerChromium::addLinkHighlight):
        (WebCore::GraphicsLayerChromium::didFinishLinkHighlight):
        (WebCore::GraphicsLayerChromium::setContentsToMedia):
        (WebCore::GraphicsLayerChromium::primaryLayer):
        (WebCore::GraphicsLayerChromium::platformLayer):
        (WebCore::GraphicsLayerChromium::setDebugBackgroundColor):
        (WebCore::GraphicsLayerChromium::setDebugBorder):
        (WebCore::GraphicsLayerChromium::updateChildList):
        (WebCore::GraphicsLayerChromium::updateLayerPosition):
        (WebCore::GraphicsLayerChromium::updateLayerSize):
        (WebCore::GraphicsLayerChromium::updateAnchorPoint):
        (WebCore::GraphicsLayerChromium::updateTransform):
        (WebCore::GraphicsLayerChromium::updateChildrenTransform):
        (WebCore::GraphicsLayerChromium::updateMasksToBounds):
        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D):
        (WebCore::GraphicsLayerChromium::updateLayerIsDrawable):
        (WebCore::GraphicsLayerChromium::updateLayerBackgroundColor):
        (WebCore::GraphicsLayerChromium::updateContentsRect):
        (WebCore::GraphicsLayerChromium::updateContentsScale):
        (WebCore::GraphicsLayerChromium::setupContentsLayer):
        * platform/graphics/chromium/GraphicsLayerChromium.h:
        (WebCore::GraphicsLayerChromium::hasContentsLayer):
        (GraphicsLayerChromium):
        (WebCore::GraphicsLayerChromium::contentsLayer):
        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::rootLayer):
        * platform/graphics/chromium/LayerChromium.h:

2012-08-21  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: do not use window's eval in InjectedScript
        https://bugs.webkit.org/show_bug.cgi?id=94610

        Reviewed by Yury Semikhatsky.

        Otherwise, inspector does not work when eval is overriden.

        Test: inspector/console/console-eval-fake.html

        * bindings/js/JSInjectedScriptHostCustom.cpp:
        (WebCore::JSInjectedScriptHost::evaluate):
        (WebCore):
        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
        (WebCore::V8InjectedScriptHost::evaluateCallback):
        (WebCore):
        * inspector/InjectedScriptHost.idl:
        * inspector/InjectedScriptSource.js:
        (.):

2012-08-21  Adam Barth  <abarth@webkit.org>

        Implement JSDOMWindow*::allowsAccessFrom* in terms of BindingSecurity
        https://bugs.webkit.org/show_bug.cgi?id=93407

        Reviewed by Eric Seidel.

        This patch removes allowsAccessFrom and implements the security checks
        in terms of shouldAllowAccessToDOMWindow directly.

        * bindings/generic/BindingSecurity.cpp:
        (WebCore::BindingSecurity::shouldAllowAccessToDOMWindow):
        (WebCore):
        * bindings/generic/BindingSecurity.h:
        (BindingSecurity):
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::shouldAllowAccessToFrame):
        (WebCore):
        (WebCore::shouldAllowAccessToDOMWindow):
        * bindings/js/JSDOMBinding.h:
        (WebCore):
        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::shouldAllowAccessFrom):
        (WebCore):
        * bindings/js/JSDOMWindowBase.h:
        (JSDOMWindowBase):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::namedItemGetter):
        (WebCore::JSDOMWindow::getOwnPropertySlot):
        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
        (WebCore::JSDOMWindow::put):
        (WebCore::JSDOMWindow::deleteProperty):
        (WebCore::JSDOMWindow::getPropertyNames):
        (WebCore::JSDOMWindow::getOwnPropertyNames):
        (WebCore::JSDOMWindow::defineOwnProperty):
        (WebCore::JSDOMWindow::setLocation):
        * bindings/js/JSDOMWindowCustom.h:
        * bindings/js/JSInjectedScriptManager.cpp:
        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
        * bindings/objc/WebScriptObject.mm:
        (-[WebScriptObject _isSafeScript]):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateGetOwnPropertyDescriptorBody):
        (GenerateImplementation):

2012-08-21  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/12104508> TextIterator takes O(n^2) to iterate over n empty blocks
        https://bugs.webkit.org/show_bug.cgi?id=94429

        Reviewed by Sam Weinig.

        No new tests, because behavior is unchanged.

        * editing/TextIterator.cpp:
        (WebCore::TextIterator::shouldRepresentNodeOffsetZero): Enhanced the check for nodes that
        cannot contain VisiblePosition to also check for zero-height blocks.

2012-08-21  'Pavel Feldman'  <pfeldman@chromium.org>

        Web Inspector: break on exceptions decoration was lost, restoring.

        Not reviewed - a follow up to 126012.

        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._pauseOnExceptionStateChanged.get switch):
        (WebInspector.ScriptsPanel.prototype._pauseOnExceptionStateChanged):

2012-08-21  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r126146.
        http://trac.webkit.org/changeset/126146
        https://bugs.webkit.org/show_bug.cgi?id=94606

        It made all tests assert (Requested by Ossy on #webkit).

        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::prototypeForSignalsAndSlots):
        (JSC::Bindings::QtRuntimeMethod::call):
        (JSC::Bindings::QtRuntimeMethod::jsObjectRef):
        (JSC::Bindings::QtRuntimeMethod::connectOrDisconnect):
        * bridge/qt/qt_runtime.h:
        (QtRuntimeMethod):

2012-08-21  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r126150.
        http://trac.webkit.org/changeset/126150
        https://bugs.webkit.org/show_bug.cgi?id=94605

        Breaks 73 layout tests on chromium.webkit builder (Requested
        by pfeldman on #webkit).

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/v8/V8Binding.cpp:
        (StringTraits):
        (WebCore):
        (WebCore::v8StringToWebCoreString):
        (WebCore::int32ToWebCoreStringFast):
        (WebCore::int32ToWebCoreString):
        * bindings/v8/V8Binding.h:
        (WebCore):
        (V8ParameterBase):
        (WebCore::V8ParameterBase::operator String):
        (WebCore::V8ParameterBase::operator AtomicString):
        (WebCore::V8ParameterBase::V8ParameterBase):
        (WebCore::V8ParameterBase::prepareBase):
        (WebCore::V8ParameterBase::object):
        (WebCore::V8ParameterBase::setString):
        (WebCore::V8ParameterBase::toString):
        (WebCore::::prepare):
        * bindings/v8/V8StringResource.cpp: Removed.
        * bindings/v8/V8StringResource.h: Removed.

2012-08-21  Philippe Normand  <pnormand@igalia.com>

        Early returns in MediaPlayer setters
        https://bugs.webkit.org/show_bug.cgi?id=87304

        Calls to the MediaPlayerPrivate implementation can be avoided if
        the value to set and the current value are equal.

        Reviewed by Eric Carlson.

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::loadWithNextMediaEngine): Once a new
        MediaPlayerPrivate has been created propagate the playback rate
        value to it, as it is done for some other attributes like preload
        or preservePitch.
        (WebCore::MediaPlayer::setVolume): Perform action only if current
        and new values differ.
        (WebCore::MediaPlayer::setMuted): Ditto.
        (WebCore::MediaPlayer::setPreservesPitch): Ditto.
        (WebCore::MediaPlayer::setSize): Ditto.
        (WebCore::MediaPlayer::setVisible): Ditto.
        (WebCore::MediaPlayer::setPreload): Ditto.

2012-08-21  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: NMI: OwnPtr<T> was counted as RefPtr<T>
        https://bugs.webkit.org/show_bug.cgi?id=94599

        Reviewed by Yury Semikhatsky.

        * dom/MemoryInstrumentation.h:
        (WebCore::MemoryObjectInfo::MemoryObjectInfo):
        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl):
        (WebCore::MemoryInstrumentation::addObjectImpl):

2012-08-21  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: NMI: rename addMember for strings and KURL to addInstrumentedMember.
        https://bugs.webkit.org/show_bug.cgi?id=94580

        Reviewed by Yury Semikhatsky.

        Drive by fix: immutable ElementAttrybuteData uses the same trick with placement new as in StylePropertySet.

        * css/CSSCanvasValue.cpp:
        (WebCore::CSSCanvasValue::reportDescendantMemoryUsage):
        * css/CSSCharsetRule.cpp:
        (WebCore::CSSCharsetRule::reportDescendantMemoryUsage):
        * css/CSSFontFaceSrcValue.cpp:
        (WebCore::CSSFontFaceSrcValue::reportDescendantMemoryUsage):
        * css/CSSFunctionValue.cpp:
        (WebCore::CSSFunctionValue::reportDescendantMemoryUsage):
        * css/CSSImageSetValue.cpp:
        (WebCore::CSSImageSetValue::ImageWithScale::reportMemoryUsage):
        * css/CSSImageValue.cpp:
        (WebCore::CSSImageValue::reportDescendantMemoryUsage):
        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::reportDescendantMemoryUsage):
        * css/CSSStyleSheet.cpp:
        (WebCore::CSSStyleSheet::reportMemoryUsage):
        * css/CSSValue.cpp:
        (WebCore::TextCloneCSSValue::reportDescendantMemoryUsage):
        * css/CSSVariableValue.h:
        (WebCore::CSSVariableValue::reportDescendantMemoryUsage):
        * css/FontFeatureValue.cpp:
        (WebCore::FontFeatureValue::reportDescendantMemoryUsage):
        * css/MediaQuery.cpp:
        (WebCore::MediaQuery::reportMemoryUsage):
        * css/MediaQueryExp.cpp:
        (WebCore::MediaQueryExp::reportMemoryUsage):
        * css/StyleRuleImport.cpp:
        (WebCore::StyleRuleImport::reportDescendantMemoryUsage):
        * css/StyleSheetContents.cpp:
        (WebCore::StyleSheetContents::reportMemoryUsage):
        * css/WebKitCSSKeyframeRule.cpp:
        (WebCore::StyleKeyframe::reportMemoryUsage):
        * css/WebKitCSSKeyframesRule.cpp:
        (WebCore::StyleRuleKeyframes::reportDescendantMemoryUsage):
        * css/WebKitCSSSVGDocumentValue.cpp:
        (WebCore::WebKitCSSSVGDocumentValue::reportDescendantMemoryUsage):
        * css/WebKitCSSShaderValue.cpp:
        (WebCore::WebKitCSSShaderValue::reportDescendantMemoryUsage):
        * dom/Attribute.h:
        (WebCore::Attribute::reportMemoryUsage):
        * dom/CharacterData.cpp:
        (WebCore::CharacterData::reportMemoryUsage):
        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        * dom/ElementAttributeData.cpp:
        (WebCore::immutableElementAttributeDataSize):
        (WebCore):
        (WebCore::ElementAttributeData::createImmutable):
        (WebCore::ElementAttributeData::reportMemoryUsage):
        * dom/Event.cpp:
        (WebCore::Event::reportMemoryUsage):
        * dom/MemoryInstrumentation.cpp:
        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl):
        * dom/MemoryInstrumentation.h:
        (MemoryInstrumentation):
        * dom/QualifiedName.h:
        (WebCore::QualifiedName::QualifiedNameImpl::reportMemoryUsage):
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::reportMemoryUsage):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::reportMemoryUsage):
        * loader/SubstituteData.cpp:
        (WebCore::SubstituteData::reportMemoryUsage):
        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::reportMemoryUsage):
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::reportMemoryUsage):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::reportMemoryUsage):
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::reportMemoryUsage):
        * loader/cache/CachedShader.cpp:
        (WebCore::CachedShader::reportMemoryUsage):
        * loader/cache/CachedXSLStyleSheet.cpp:
        (WebCore::CachedXSLStyleSheet::reportMemoryUsage):
        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::reportMemoryUsage):
        * platform/network/ResourceRequestBase.cpp:
        (WebCore::ResourceRequestBase::reportMemoryUsage):
        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::reportMemoryUsage):
        * rendering/style/StyleRareInheritedData.cpp:
        (WebCore::StyleRareInheritedData::reportMemoryUsage):
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::reportMemoryUsage):
        * svg/SVGPaint.cpp:
        (WebCore::SVGPaint::reportDescendantMemoryUsage):

2012-08-20  Kentaro Hara  <haraken@chromium.org>

        [V8] Move String related code in V8Binding to a separate file
        https://bugs.webkit.org/show_bug.cgi?id=94571

        Reviewed by Adam Barth.

        This patch moves V8Parameter, V8ParameterBase and String related code
        in V8Binding to a separate file.

        No tests. No change in behavior.

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/v8/V8Binding.cpp:
        * bindings/v8/V8Binding.h:
        * bindings/v8/V8StringResource.cpp: Added.
        * bindings/v8/V8StringResource.h: Added.
        (WebCore):

2012-08-17  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] REGRESSION(r125428): fast/profiler/nested-start-and-stop-profiler.html fails
        https://bugs.webkit.org/show_bug.cgi?id=93897

        Reviewed by Kenneth Rohde Christiansen.

        Before r125428 run-time methods (wrapped signals, slots or invokable functions) were subclasses of
        JSInternalFunction and therefore real function objects in the JavaScript sense. r125428 changed them
        to be just callable objects, but they did not have Function.prototype as prototype anymore for example
        nor was their name correct (resulting in a layout test failure).

        This patch changes run-time methods back to being real function objects that have a correct name and
        have Function.prototype in their prototype change

        The objects returned by JSObjectMakeFunctionWithCallbackInjected are light-weight internal function objects
        that do not support JSObject{Set/Get}Private. Therefore we inject our own prototype right before the
        Function.prototype prototype, which uses private data to store a pointer to our C++ QtRuntimeMethod object.
        This complicates the retrieval of the pointer to that instance slightly, which is why this patch introduces
        the toRuntimeMethod convenience function that looks up our prototype first and does a check for type-safety.

        At the same time the patch removes the length properties from the run-time method itself as well as connect/disconnect.
        The length property on a function signifies the number of arguments, but in all three cases that number is
        actually variable, because of overloading. That is why we choose not to expose it in the first place.

        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::prototypeForSignalsAndSlots):
        (JSC::Bindings::QtRuntimeMethod::call):
        (JSC::Bindings::QtRuntimeMethod::jsObjectRef):
        (JSC::Bindings::QtRuntimeMethod::toRuntimeMethod):
        (Bindings):
        (JSC::Bindings::QtRuntimeMethod::connectOrDisconnect):
        * bridge/qt/qt_runtime.h:
        (QtRuntimeMethod): Remove unused member variables.

2012-08-21  Simon Hausmann  <simon.hausmann@nokia.com>

        Unreviewed build fix for newer Qt 5 versions: QVariant::WidgetStar has been removed,
        but fortunately QMetaType has a much more powerful function available for us to use.

        Thanks to Jedrzej Nowacki for the hint :)

        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::convertQVariantToValue):

2012-08-21  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove String::New() from V8 binding (Part 1)
        https://bugs.webkit.org/show_bug.cgi?id=94574

        Reviewed by Adam Barth.

        Currently, V8 binding mixes String::New(), String::NewSymbol() and v8String().
        String::New() should be replaced with String::NewSymbol() or v8String(),
        depending on use cases:

        - If it is a symbol (e.g. attribute name, constant string, etc),
        String::NewSymbol() should be used. Cache of created symbols is managed by V8.

        - If it is not a symbol, v8String() should be used. Cache of created strings
        is managed by V8 binding (i.e. StringCache class).

        This patch replaces String::New() for symbols with String::NewSymbol().

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNamedConstructorCallback):
        (GenerateNonStandardFunction):
        (GenerateImplementation):
        * bindings/scripts/test/V8/V8Float64Array.cpp:
        (WebCore::ConfigureV8Float64ArrayTemplate):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        (WebCore::ConfigureV8TestActiveDOMObjectTemplate):
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        (WebCore::ConfigureV8TestEventTargetTemplate):
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore::ConfigureV8TestInterfaceTemplate):
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        (WebCore::V8TestNamedConstructorConstructor::GetTemplate):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::ConfigureV8TestObjTemplate):
        (WebCore::V8TestObj::installPerContextProperties):
        * bindings/v8/V8DOMConfiguration.cpp:
        (WebCore::V8DOMConfiguration::batchConfigureConstants):
        (WebCore::V8DOMConfiguration::batchConfigureCallbacks):
        (WebCore::V8DOMConfiguration::configureTemplate):
        * bindings/v8/V8DOMConfiguration.h:
        (WebCore::V8DOMConfiguration::configureAttribute):

2012-08-21  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r126028.
        http://trac.webkit.org/changeset/126028
        https://bugs.webkit.org/show_bug.cgi?id=94576

        it broke compilation on apple webkit win. (Requested by loislo
        on #webkit).

        * inspector/CodeGeneratorInspector.py:
        * inspector/InjectedScriptWebGLModule.cpp:
        (WebCore::InjectedScriptWebGLModule::captureFrame):
        * inspector/InjectedScriptWebGLModule.h:
        (InjectedScriptWebGLModule):
        * inspector/Inspector.json:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        * inspector/InspectorWebGLAgent.cpp:
        (WebCore::InspectorWebGLAgent::InspectorWebGLAgent):
        * inspector/InspectorWebGLAgent.h:
        (WebCore):
        (WebCore::InspectorWebGLAgent::create):
        (InspectorWebGLAgent):

2012-08-20  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: NMI: wrong size was reported for immutable StylePropertySet
        https://bugs.webkit.org/show_bug.cgi?id=94489

        Reviewed by Yury Semikhatsky.

        Immutable StylePropertySet is created via placement new.
        The rest of the allocated buffer is used as an array of CSSProperty.
        This means that we don't need to report m_properties member but have to report actual size of the buffer
        used for both, the object and CSSProperty array.

        * css/StylePropertySet.cpp:
        (WebCore::immutableStylePropertySetSize):
        (WebCore):
        (WebCore::StylePropertySet::createImmutable):
        (WebCore::StylePropertySet::reportMemoryUsage):
        * dom/MemoryInstrumentation.h:
        (WebCore::MemoryObjectInfo::reportObjectInfo):
        (WebCore::MemoryClassInfo::MemoryClassInfo):

2012-08-20  Kentaro Hara  <haraken@chromium.org>

        [V8] Move handleOutOfMemory() from V8Proxy to V8Binding
        https://bugs.webkit.org/show_bug.cgi?id=94563

        Reviewed by Adam Barth.

        To kill V8Proxy, this patch moves handleOutOfMemory() from V8Proxy to V8Binding.

        No tests. No change in behavior.

        * bindings/v8/V8AbstractEventListener.cpp:
        (WebCore::V8AbstractEventListener::invokeEventHandler):
        * bindings/v8/V8Binding.cpp:
        (WebCore::handleOutOfMemory):
        (WebCore):
        * bindings/v8/V8Binding.h:
        (WebCore):
        * bindings/v8/V8Proxy.cpp:
        * bindings/v8/V8Proxy.h:
        (V8Proxy):
        * bindings/v8/WorkerContextExecutionProxy.cpp:
        (WebCore::WorkerContextExecutionProxy::runScript):

2012-08-20  MORITA Hajime  <morrita@google.com>

        InsertionShouldCallDidNotifyDescendantInsertions should be merged to InsertionShouldCallDidNotifySubtreeInsertions
        https://bugs.webkit.org/show_bug.cgi?id=94570

        Reviewed by Ryosuke Niwa.

        Node::didNotifySubtreeInsertions() and Node::didNotifyDescendantInsertions() are used for similar purpose and
        we could unify them to the safer one, which is didNotifySubtreeInsertions().

        This change replaces the last didNotifyDescendantInsertions() implementation in HTMLBodyElement with didNotifySubtreeInsertions()
        then eliminates related code which is no longer used.

        No new tests. Covered by existing tests.

        * dom/ContainerNodeAlgorithms.h:
        (WebCore::ChildNodeInsertionNotifier::notifyNodeInsertedIntoDocument):
        (WebCore::ChildNodeInsertionNotifier::notifyNodeInsertedIntoTree):
        * dom/Node.h: Removed didNotifyDescendantInsertions() stub and InsertionShouldCallDidNotifyDescendantInsertions enum value.
        * html/HTMLBodyElement.cpp:
        (WebCore::HTMLBodyElement::insertedInto):
        (WebCore::HTMLBodyElement::didNotifySubtreeInsertions): morphed from didNotifyDescendantInsertions()
        * html/HTMLBodyElement.h:
        (HTMLBodyElement):
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::insertedInto): Remove useless InsertionShouldCallDidNotifyDescendantInsertions return statement.

2012-08-20  Rob Buis  <rbuis@rim.com>

        Reduce GradientAttributes object size
        https://bugs.webkit.org/show_bug.cgi?id=86151

        Reviewed by Eric Seidel.

        This reduces GradientAttributes in memory size by 8 bytes on my 64-bit system. It also
        reduces the size of RenderSVGResourceLinearGradient and RenderSVGResourceRadialGradient.

        * svg/GradientAttributes.h:
        (WebCore::GradientAttributes::spreadMethod):
        (WebCore::GradientAttributes::gradientUnits):
        (GradientAttributes):
        (WebCore):
        (SameSizeAsGradientAttributes):

2012-08-20  Keishi Hattori  <keishi@webkit.org>

        Clicking input type=range with padding or border sets wrong value
        https://bugs.webkit.org/show_bug.cgi?id=94473

        Reviewed by Kent Tamura.

        We should take the padding and border width into account when calculating the value from the mouse location.

        Test: fast/forms/range/range-hit-test-with-padding.html

        * html/shadow/SliderThumbElement.cpp:
        (WebCore::sliderTrackElementOf):
        (WebCore):
        (WebCore::SliderThumbElement::setPositionFromPoint):
        * html/shadow/SliderThumbElement.h:
        (WebCore):

2012-08-20  MORITA Hajime  <morrita@google.com>

        load event shouldn't fired during node insertion traversals.
        https://bugs.webkit.org/show_bug.cgi?id=94447

        Reviewed by Ryosuke Niwa.

        HTMLFrameElementBase::didNotifyDescendantInsertions() with empty @src
        can trigger a load event during ChildNodeInsertionNotifier
        traversal, whose handler can make DOM tree state inconsistent.

        This change introduces a post traversal hook,
        didNotifySubtreeInsertions(), for the insertion traversal and
        replaces the problematic didNotifyDescendantInsertions() with it.

        Since didNotifySubtreeInsertions() is invoked after the traversal,
        it is safe for event handlers to mutate the tree.

        Test: fast/frames/iframe-onload-and-domnodeinserted.html

        * dom/ContainerNodeAlgorithms.h:
        (ChildNodeInsertionNotifier): Added a post subtree notification.
        (WebCore::ChildNodeInsertionNotifier::notifyNodeInsertedIntoDocument):
        (WebCore::ChildNodeInsertionNotifier::notify):
        * dom/Node.h:
        (WebCore::Node::didNotifySubtreeInsertions): Newly added.
        * html/HTMLFrameElementBase.cpp:
        (WebCore::HTMLFrameElementBase::insertedInto): Now returns InsertionShouldCallDidNotifySubtreeInsertions
        (WebCore::HTMLFrameElementBase::didNotifySubtreeInsertions): Replaced didNotifyDescendantInsertions()
        * html/HTMLFrameElementBase.h:
        (HTMLFrameElementBase):

2012-08-20  Shinya Kawanaka  <shinyak@chromium.org> 

        Regression(r126127): Build break on multiple platforms
        https://bugs.webkit.org/show_bug.cgi?id=94568

        Reviewed by Hajime Morita.

        Notation::cloneNode should also have ExceptionCode. We add it in this patch.

        No new tests, no change in behavior.

        * dom/Notation.cpp:
        (WebCore::Notation::cloneNode):
        * dom/Notation.h:
        (Notation):

2012-08-20  Shinya Kawanaka  <shinyak@chromium.org>

        ShadowRoot.cloneNode() must always throw a DATA_CLONE_ERR exception.
        https://bugs.webkit.org/show_bug.cgi?id=91704

        Reviewed by Dimitri Glazkov.

        According to the spec, ShadowRoot.cloneNode() should throw a DATA_CLONE_ERR exception. The existing implementation
        returned null object instead.

        We change the cloneNode() interface so that we can throw an exception from cloneNode().

        Test: fast/dom/shadow/shadowroot-clonenode.html

        * dom/Attr.cpp:
        (WebCore::Attr::cloneNode):
        * dom/Attr.h:
        * dom/CDATASection.cpp:
        (WebCore::CDATASection::cloneNode):
        * dom/CDATASection.h:
        (CDATASection):
        * dom/Comment.cpp:
        (WebCore::Comment::cloneNode):
        * dom/Comment.h:
        (Comment):
        * dom/Document.cpp:
        (WebCore::Document::cloneNode):
        * dom/Document.h:
        (Document):
        * dom/DocumentFragment.cpp:
        (WebCore::DocumentFragment::cloneNode):
        * dom/DocumentFragment.h:
        (DocumentFragment):
        * dom/DocumentType.cpp:
        (WebCore::DocumentType::cloneNode):
        * dom/DocumentType.h:
        (DocumentType):
        * dom/Element.cpp:
        (WebCore::Element::cloneNode):
        * dom/Element.h:
        (Element):
        * dom/EntityReference.cpp:
        (WebCore::EntityReference::cloneNode):
        * dom/EntityReference.h:
        (EntityReference):
        * dom/Node.h:
        (Node):
        (WebCore::Node::cloneNode):
        * dom/Node.idl:
        * dom/ProcessingInstruction.cpp:
        (WebCore::ProcessingInstruction::cloneNode):
        * dom/ProcessingInstruction.h:
        (ProcessingInstruction):
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::cloneNode):
        * dom/ShadowRoot.h:
        (ShadowRoot):
        * dom/Text.cpp:
        (WebCore::Text::cloneNode):
        * dom/Text.h:
        (Text):

2012-08-20  Kent Tamura  <tkent@chromium.org>

        [Chromium-win] Use native digits in parsing/formatting dates in the textfield part of input[type=date]
        https://bugs.webkit.org/show_bug.cgi?id=94281

        Reviewed by Hajime Morita.

        Tests: Add some cases to Source/WebKit/chromium/tests/LocaleWinTest.cpp

        * platform/text/LocaleWin.cpp:
        (WebCore::LocaleWin::isLocalizedDigit): A helper for parseNumber(). This
        return true if the specified character is one of native digits.
        (WebCore::LocaleWin::parseNumber):
        Try to parse ASCII digits, then try to parse native digtis. This
        becomes a member of LocaleWin because it uses
        convertFromLocalizedNumber().
        (WebCore::LocaleWin::appendNumber): Apply convertToLocalizedNumber().
        (WebCore::LocaleWin::appendTwoDigitsNumber): ditto.
        (WebCore::LocaleWin::appendFourDigitsNumber): ditto.
        * platform/text/LocaleWin.h:
        (LocaleWin):
        - Make some static functions member functions of LocaleWin.
        - Add isLocalizedDigit().

2012-08-20  Kentaro Hara  <haraken@chromium.org>

        Rename collectGarbageIfNecessary() to hintForCollectGarbage()
        https://bugs.webkit.org/show_bug.cgi?id=94455

        Reviewed by Adam Barth.

        This is a follow-up patch for r126098.

        collectGarbage() always collects garbage. collectGarbageIfNecessary() just sends
        an idle notification to V8, which is just a hint for V8 to trigger GC.
        To clarify the difference, this patch renames collectGarbageIfNecessary()
        to hintForCollectGarbage().

        No tests. No change in behavior.

        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::clearForClose):
        (WebCore::ScriptController::clearForNavigation):
        * bindings/v8/V8GCController.cpp:
        (WebCore::V8GCController::hintForCollectGarbage):
        * bindings/v8/V8GCController.h:
        (V8GCController):

2012-08-20  Alexandre Elias  <aelias@google.com>

        [chromium] Texture layer should not generate zero textureId quads
        https://bugs.webkit.org/show_bug.cgi?id=94550

        Reviewed by Adrienne Walker.

        After a context loss, CCTextureLayerImpl would clear its textureId
        but continued to produce external resources and quads with the zero
        textureid.  Add early returns so that CCTextureLayerImpl becomes
        inert after a context loss.

        Added assertion in read lock so that dontUseOldResourcesAfterLostContext
        test catches the problem.

        * platform/graphics/chromium/cc/CCResourceProvider.h:
        (WebCore::CCScopedLockResourceForRead::CCScopedLockResourceForRead):
        * platform/graphics/chromium/cc/CCTextureLayerImpl.cpp:
        (WebCore::CCTextureLayerImpl::willDraw):
        (WebCore::CCTextureLayerImpl::appendQuads):
        (WebCore::CCTextureLayerImpl::didDraw):
        (WebCore::CCTextureLayerImpl::didLoseContext):

2012-08-20  Kent Tamura  <tkent@chromium.org>

        [Chromium] Make the popup positioning code testable
        https://bugs.webkit.org/show_bug.cgi?id=94086

        Reviewed by Hajime Morita.

        Introduce PopupContent interface in order to make a mock.

        * platform/chromium/PopupContainer.cpp:
        (WebCore::PopupContainer::layoutAndCalculateWidgetRectInternal):
         - Make it a member of PopupContainer to avoid namespace pollution.
         - Use PopupContent interface.
         - Make the code clearer.
        * platform/chromium/PopupContainer.h:
        (PopupContainer): Expose layoutAndCalculateWidgetRectInternal.

        * platform/chromium/PopupListBox.cpp:
        (WebCore::PopupListBox::popupContentHeight): Added.
        * platform/chromium/PopupListBox.h:
        (PopupContent): Added.
        (PopupListBox): Inherit PopupContent.
        (WebCore::PopupListBox::~PopupListBox):
        Make this virtual because this class has some virtual functions.

2012-08-20  Tom Sepez  <tsepez@chromium.org>

        XSSAuditor too tolerant of injected data: URLs from other "hostless" schemes.
        https://bugs.webkit.org/show_bug.cgi?id=94547

        Reviewed by Adam Barth.

        Check that there is a host before making same-host tests.

        Test: fast/frames/xss-auditor-handles-file-urls.html

        * html/parser/XSSAuditor.cpp:
        (WebCore::XSSAuditor::eraseAttributeIfInjected):
        (WebCore::XSSAuditor::isLikelySafeResource):
        * html/parser/XSSAuditor.h:

2012-08-20  Elliott Sprehn  <esprehn@chromium.org>

        Removed dead code from a very old iteration of CSS counters.
        https://bugs.webkit.org/show_bug.cgi?id=94539

        Reviewed by Eric Seidel.

        Remove two unused shorts that were on StyleRareNonInheritedData that are no longer used.

        No tests, this just removes dead code.

        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::diff):
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:
        (StyleRareNonInheritedData):

2012-08-20  Luke Macpherson   <macpherson@chromium.org>

        Fix inspector with variables enabled and enable inspector variables tests by default.
        https://bugs.webkit.org/show_bug.cgi?id=94296

        Reviewed by Hajime Morita.

        Change from using getPropertyName static function to CSSProperty::cssName(), which can resolve variables if needed.

        Covered by inspector/styles/variables.

        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::item):

2012-08-20  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>

        Cancel the outstanding vibration pattern if the pattern is 0 or an empty list
        https://bugs.webkit.org/show_bug.cgi?id=94085

        Reviewed by Kentaro Hara.

        vibrate() method to stop the device from vibrating is getting called before the
        vibration is in effect. Hence, it is failing to cancel the pre-existing instance
        of processing vibration patterns. 

        This patch cancel the pre-existing instance of the processing vibration patterns
        always when the vibrate() method called with pattern 0 or an empty list.

        No new tests since there is no return value in the Vibration API to test this
        particular case. Existing test fast/dom/navigator-vibration.html covers testing of
        the Vibration API.

        * Modules/vibration/Vibration.cpp:
        (WebCore::Vibration::vibrate):

2012-08-20  Adam Klein  <adamk@chromium.org>

        Allow MutationEvents to be enabled/disabled per context
        https://bugs.webkit.org/show_bug.cgi?id=94016

        Reviewed by Ojan Vafai.

        Chromium wants to be able to turn MutationEvents off for some
        Documents (e.g., for Apps V2). This patch makes the firing (and the
        constructor on DOMWindow) of MutationEvents a per-context feature, with
        the default being enabled.

        No functional change (since the feature defaults to enabled).
        It's not clear to me that there's a way to test this in DRT without
        adding a special hook for this one feature. It will be tested in
        Chromium once it's implemented in Chromium.

        * dom/ContextFeatures.cpp:
        (WebCore::ContextFeatures::mutationEventsEnabled): Add new method,
        with the default being enabled.
        * dom/ContextFeatures.h:
        * dom/Document.cpp:
        (WebCore::Document::addMutationEventListenerTypeIfEnabled): Add new
        method that checks the ContextFeature flag before adding the passed-in
        listener type.
        (WebCore::Document::addListenerTypeIfNeeded): Call the new method
        instead of addListenerType for MutationEvent types.
        * dom/Document.h:
        (WebCore::Document::addListenerType): Make private to avoid anyone
        outside Document from enabling MutationEvent listeners. All callers
        must go through addListenerTypeIfNeeded.

2012-08-20  Levi Weintraub  <leviw@chromium.org>

        [Sub-pixel Layout] Block selection gap repainting can leave one pixel gaps
        https://bugs.webkit.org/show_bug.cgi?id=94526

        Reviewed by Eric Seidel.

        Reverting RenderLayer's m_blockSelectionGapsBounds to be an IntRect and applying enclosingIntRect to the
        gapRects added to the bounds. Previously, we'd end multiple block gaps and pixel snap the result, which
        can yield results one pixel off in width and height.

        Covered by existing tests. This undoes some of the rebaselining from when sub-pixel was enabled for Chromium.

        * rendering/RenderLayer.cpp:
        * rendering/RenderLayer.h:

2012-08-20  Kentaro Hara  <haraken@chromium.org>

        [V8] Move instrumentedCallFunction() from V8Proxy to ScriptController
        https://bugs.webkit.org/show_bug.cgi?id=94456

        Reviewed by Adam Barth.

        To kill V8Proxy, this patch moves instrumentedCallFunction() from V8Proxy
        to ScriptController. Also this patch renames instrumentedCallFunction()
        to callFunctionWithInstrumentation(), for consistency with callFunction().

        No tests. No change in behavior.

        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::callFunction):
        (WebCore):
        (WebCore::handleMaxRecursionDepthExceeded):
        (WebCore::resourceInfo):
        (WebCore::resourceString):
        (WebCore::ScriptController::callFunctionWithInstrumentation):
        * bindings/v8/ScriptController.h:
        (ScriptController):
        * bindings/v8/ScriptFunctionCall.cpp:
        (WebCore::ScriptCallback::call):
        * bindings/v8/V8Callback.cpp:
        (WebCore::invokeCallback):
        * bindings/v8/V8NodeFilterCondition.cpp:
        (WebCore::V8NodeFilterCondition::acceptNode):
        * bindings/v8/V8Proxy.cpp:
        (WebCore):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):
        * bindings/v8/V8WindowErrorHandler.cpp:
        (WebCore::V8WindowErrorHandler::callListenerFunction):
        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):

2012-08-20  Elliott Sprehn  <esprehn@chromium.org>

        Never notify of insertedIntoTree during document destruction.
        https://bugs.webkit.org/show_bug.cgi?id=94535

        Reviewed by Eric Seidel.

        Never notify of insertedIntoTree during document destruction. Previously since we
        avoid notifying of willBeRemovedFromTree it's possible we could have gotten several
        insertedIntoTree notifications without ever being told we were removed.

        No tests needed since this just closes holes related to future code.

        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::appendChildNode): Never call insertedIntoTree during document destruction.
        (WebCore::RenderObjectChildList::insertChildNode): Same.
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::attachRegion): Removed unneeded document destruction check.

2012-08-20  James Robinson  <jamesr@chromium.org>

        [chromium] Initialize GraphicsLayerChromium::m_contentsLayerId when setting contents layer
        https://bugs.webkit.org/show_bug.cgi?id=94552

        Reviewed by Kenneth Russell.

        Set it or it don't work good.

        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::setupContentsLayer):

2012-08-20  Rik Cabanier  <cabanier@adobe.com>

        parse CSS attribute -webkit-blend-mode
        https://bugs.webkit.org/show_bug.cgi?id=94024
 
        Reviewed by Dirk Schulze.

        Added parsing and general CSS handling of -webkit-blend-mode per http://www.w3.org/TR/2012/WD-compositing-20120816/

        Tests: css3/compositing/blend-mode-property-parsing-invalid.html
               css3/compositing/blend-mode-property-parsing.html
               css3/compositing/blend-mode-property.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore):
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/CSSValueKeywords.in:
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * rendering/RenderLayer.h:
        (RenderLayer):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::createPrimaryGraphicsLayer):
        (WebCore):
        (WebCore::RenderLayerBacking::updateLayerBlendMode):
        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
        (WebCore::RenderLayerBacking::setBlendMode):
        * rendering/RenderLayerBacking.h:
        (RenderLayerBacking):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::diff):
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:
        (StyleRareNonInheritedData):

2012-08-20  Kentaro Hara  <haraken@chromium.org>

        [V8] Move retrieve{Window,Frame,PerContextData}() from V8Proxy to V8Binding
        https://bugs.webkit.org/show_bug.cgi?id=94460

        Reviewed by Adam Barth.

        To kill V8Proxy, we move retrieve{Window,Frame,PerContextData}()
        from V8Proxy to V8Binding. Also, this patch renames these methods as follows:

        - retrieveWindow() -> toDOMWindow()
        - retrieveFrame() -> toFrameIfNotDetached()
        - retrievePerContextData() -> perContextDataForCurrentWorld()

        No tests. No change in behavior.

        * bindings/v8/BindingState.cpp:
        (WebCore::activeDOMWindow):
        (WebCore::firstDOMWindow):
        (WebCore::activeFrame):
        (WebCore::firstFrame):
        (WebCore::currentFrame):
        (WebCore::currentDocument):
        * bindings/v8/PageScriptDebugServer.cpp:
        (WebCore::retrieveFrameWithGlobalObjectCheck):
        (WebCore::PageScriptDebugServer::getDebugListenerForContext):
        (WebCore::PageScriptDebugServer::runMessageLoopOnPause):
        * bindings/v8/V8Binding.cpp:
        (WebCore::retrieveWindow):
        (WebCore):
        (WebCore::retrieveFrame):
        (WebCore::retrievePerContextData):
        * bindings/v8/V8Binding.h:
        (WebCore):
        * bindings/v8/V8DOMWrapper.cpp:
        (WebCore::V8DOMWrapper::constructorForType):
        * bindings/v8/V8NPUtils.cpp:
        (WebCore::convertV8ObjectToNPVariant):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::handleOutOfMemory):
        (WebCore::V8Proxy::context):
        (WebCore::V8Proxy::matchesCurrentContext):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):

2012-08-20  Abhishek Arya  <inferno@chromium.org>

        Yank an unneccessary if added in r125810.
        https://bugs.webkit.org/show_bug.cgi?id=85804

        Reviewed by Levi Weintraub.

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::layoutInlineChildren):

2012-08-20  James Robinson  <jamesr@chromium.org>

        [chromium] REGRESSION(126076) Should not touch old GraphicsLayerChromium::m_contentsLayer when setting up a new contents layer
        https://bugs.webkit.org/show_bug.cgi?id=94544

        Reviewed by Adrienne Walker.

        GraphicsLayerChromium only keeps a weak pointer to its m_contentsLayer. When replacing it with a new contents
        layer, it may be unsafe to touch the old value. It's also completely unnecessary.

        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
        (WebCore::GraphicsLayerChromium::setContentsToImage):
        (WebCore::GraphicsLayerChromium::setContentsTo):
        (WebCore::GraphicsLayerChromium::setupContentsLayer):
        * platform/graphics/chromium/GraphicsLayerChromium.h:

2012-08-20  Kentaro Hara  <haraken@chromium.org>

        [V8] Move collectGarbage() from ScriptController to V8GCController
        https://bugs.webkit.org/show_bug.cgi?id=94455

        Reviewed by Adam Barth.

        - This patch moves collectGarbage() from ScriptController to V8GCController.
        - This patch makes collectGarbage() a static method.
        - This patch removes ScriptController::lowMemoryNotification()
        since it is not used at all.

        No tests. No change in behavior.

        * bindings/v8/ScriptController.cpp:
        * bindings/v8/ScriptController.h:
        * bindings/v8/V8GCController.cpp:
        (WebCore::V8GCController::collectGarbage):
        (WebCore):
        * bindings/v8/V8GCController.h:
        (V8GCController):

2012-08-20  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove V8Proxy from V8IsolatedContext
        https://bugs.webkit.org/show_bug.cgi?id=94450

        Reviewed by Adam Barth.

        This patch removes dependency on V8Proxy from V8IsolatedContext.

        No tests. No change in behavior.

        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::evaluateInIsolatedWorld):
        * bindings/v8/V8IsolatedContext.cpp:
        (WebCore::V8IsolatedContext::V8IsolatedContext):
        * bindings/v8/V8IsolatedContext.h:
        (WebCore):
        (V8IsolatedContext):

2012-08-20  Philip Rogers  <pdr@google.com>

        Canvas drawImage() should draw SVG at the correct scale.
        https://bugs.webkit.org/show_bug.cgi?id=94377

        Previously, drawing SVG in canvas would render at the incorrect scale
        because imageSizeForRenderer did not take into account the page scale.
        After this patch, we now incorporate the page scale in
        CachedImage::imageSizeForRenderer().

        Reviewed by Tim Horton.

        Test: svg/as-image/svg-as-image-canvas.html

        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::imageSizeForRenderer):

2012-08-20  Simon Fraser  <simon.fraser@apple.com>

        Assertion going back to results.html page from an image diff result
        https://bugs.webkit.org/show_bug.cgi?id=94143

        Reviewed by Adam Barth.

        Avoid redundantly setting the DOMWindow on a JSDOMWindow shell in
        ScriptCachedFrameData::restore(), as we may have already done this
        in ScriptController::clearWindowShell(). This avoids an assertion
        on some platforms when going Back to the test results page from
        a diff image.

        * bindings/js/ScriptCachedFrameData.cpp:
        (WebCore::ScriptCachedFrameData::restore):

2012-08-20  Dean Jackson  <dino@apple.com>

        [WebGL] OES_vertex_array_object is not correctly un/binding or deleting
        https://bugs.webkit.org/show_bug.cgi?id=94029

        Reviewed by Ken Russell.

        When the currently bound vertex array is deleted, the specification says that
        the default object should be bound in its place. Also, binding a null object
        as a vertex array was not actually clearing the bound object at the GL layer.
        And lastly, it should not be possible to bind a deleted vertex array.

        The test case for this is the public Khronos WebGL conformance suite, in particular:
        conformance/extensions/oes-vertex-array-object.html

        * html/canvas/OESVertexArrayObject.cpp:
        (WebCore::OESVertexArrayObject::deleteVertexArrayOES): Check if the deleted array is
        currently bound, and if so, unbind it.
        (WebCore::OESVertexArrayObject::bindVertexArrayOES): Make sure never to bind an
        array that has been marked as deleted.
        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
        (WebCore::Extensions3DOpenGL::bindVertexArrayOES): Remove the null check on bind. We
        do need to call glBindVertexArrayAPPLE with a null value in order to clear it.

2012-08-20  Kentaro Hara  <haraken@chromium.org>

        [V8] Move clearForClose() and clearForNavigation() from V8Proxy to ScriptController
        https://bugs.webkit.org/show_bug.cgi?id=94459

        Reviewed by Adam Barth.

        To kill V8Proxy, we can move clearForClose() and
        clearForNavigation() from V8Proxy to ScriptController.

        No tests. No change in behavior.

        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::~ScriptController):
        (WebCore::ScriptController::resetIsolatedWorlds):
        (WebCore):
        (WebCore::ScriptController::clearForClose):
        (WebCore::ScriptController::clearForNavigation):
        (WebCore::ScriptController::clearWindowShell):
        * bindings/v8/ScriptController.h:
        (ScriptController):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::~V8Proxy):
        (WebCore::V8Proxy::handleOutOfMemory):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):

2012-08-20  Dirk Schulze  <krit@webkit.org>

        CSS Masking and CSS Filters applied in wrong order
        https://bugs.webkit.org/show_bug.cgi?id=94354

        Reviewed by Dean Jackson.

        According to the Filter Effects spec, the order should be first filters, then masking and clipping.
        Changed the order on applying the different effects in RenderLayer.

        Test: css3/filters/filter-mask-clip-order.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::paintLayerContents): First filter, then mask and clip the content.

2012-08-20  Kentaro Hara  <haraken@chromium.org>

        [V8] Move mainWorldContext() from V8Proxy to ScriptController
        https://bugs.webkit.org/show_bug.cgi?id=94453

        Reviewed by Adam Barth.

        This patch moves mainWorldContext() from V8Proxy to ScriptController.
        In addition, this patch removes dependency on V8Proxy from WorldContextHandle.

        No tests. No change in behavior.

        * bindings/v8/DOMTransaction.cpp:
        (WebCore::DOMTransaction::callFunction):
        * bindings/v8/NPV8Object.cpp:
        (WebCore::toV8Context):
        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::evaluate):
        (WebCore::ScriptController::mainWorldContext):
        (WebCore):
        (WebCore::ScriptController::bindToWindowObject):
        (WebCore::createScriptObject):
        (WebCore::ScriptController::createScriptObjectForPluginElement):
        * bindings/v8/ScriptController.h:
        (ScriptController):
        * bindings/v8/ScriptState.cpp:
        (WebCore::mainWorldScriptState):
        * bindings/v8/V8LazyEventListener.cpp:
        (WebCore::V8LazyEventListener::prepareListenerObject):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::context):
        (WebCore::toV8Context):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):
        * bindings/v8/WorldContextHandle.cpp:
        (WebCore::WorldContextHandle::adjustedContext):
        * bindings/v8/WorldContextHandle.h:
        (WebCore):
        (WorldContextHandle):

2012-08-20  Adam Klein  <adamk@chromium.org>

        Remove redundant TOUCH_LISTENER event type
        https://bugs.webkit.org/show_bug.cgi?id=94524

        Reviewed by Ryosuke Niwa.

        Code that needs to determine whether there are touch listeners
        can instead call Document::touchEventHandlerCount(), added in r107832.
        TOUCH_LISTENER didn't fit very well into the hasListenerType() model
        anyway, as there's not a 1:1 correspondance between the enum value and
        an event.

        * dom/Document.cpp:
        (WebCore::Document::addListenerTypeIfNeeded): Remove two bits of code:
        the bookkeeping for TOUCH_LISTENER, and the notification into
        ChromeClient (which is handled by calls to didAddTouchEventHandler in
        all the places that call addListenerTypeIfNeeded).
        (WebCore::Document::didRemoveTouchEventHandler): Remove bookkeeping for TOUCH_LISTENER.
        * dom/Document.h:
        * history/CachedFrame.cpp:
        (WebCore::CachedFrameBase::restore): Call touchEventHandlerCount instead of hasListenerType.
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::updateType): ditto
        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleTouchEvent): ditto
        * page/Frame.cpp:
        (WebCore::Frame::setDocument): ditto
        * testing/Internals.cpp: Remove hasTouchEventListener method since its
        data source no longer exists.
        * testing/Internals.h: ditto
        (Internals):
        * testing/Internals.idl: ditto

2012-08-16  James Robinson  <jamesr@chromium.org>

        [chromium] Change WebLayer from a concrete type to a pure virtual interface
        https://bugs.webkit.org/show_bug.cgi?id=94174

        Reviewed by Adrienne Walker.

        This updates WebCore code for the WebLayer interface changes. Classes that have ownership of specific layer
        types (such as DrawingBufferChromium, Canvas2DLayerBridge and ScrollingCoordinatorChromium) hold ownership
        of a specific type and a pointer to the WebLayer to GraphicsLayerChromium to be included in the final layer
        tree. GraphicsLayerChromium holds a WebContentLayer and (optionally) a WebImageLayer and WebLayer (for
        m_transformLayer) and assembles the final layer tree.

        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        (WebCore::ScrollingCoordinatorPrivate::ScrollingCoordinatorPrivate):
        (ScrollingCoordinatorPrivate):
        (WebCore::ScrollingCoordinatorPrivate::setScrollLayer):
        (WebCore::ScrollingCoordinatorPrivate::setHorizontalScrollbarLayer):
        (WebCore::ScrollingCoordinatorPrivate::setVerticalScrollbarLayer):
        (WebCore::ScrollingCoordinatorPrivate::scrollLayer):
        (WebCore::scrollableLayerForGraphicsLayer):
        (WebCore):
        (WebCore::createScrollbarLayer):
        (WebCore::ScrollingCoordinator::setScrollLayer):
        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
        (WebCore::ScrollingCoordinator::setWheelEventHandlerCount):
        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
        (WebCore::ScrollingCoordinator::setLayerIsContainerForFixedPositionLayers):
        (WebCore::ScrollingCoordinator::setLayerIsFixedToContainerLayer):
        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
        (WebCore::AcceleratedDeviceContext::AcceleratedDeviceContext):
        (WebCore::AcceleratedDeviceContext::clearLayer):
        (AcceleratedDeviceContext):
        (WebCore::AcceleratedDeviceContext::prepareForDraw):
        (WebCore::Canvas2DLayerBridge::Canvas2DLayerBridge):
        (WebCore::Canvas2DLayerBridge::~Canvas2DLayerBridge):
        (WebCore::Canvas2DLayerBridge::skCanvas):
        (WebCore::Canvas2DLayerBridge::layer):
        (WebCore::Canvas2DLayerBridge::contextAcquired):
        * platform/graphics/chromium/Canvas2DLayerBridge.h:
        (WebCore):
        (Canvas2DLayerBridge):
        * platform/graphics/chromium/DrawingBufferChromium.cpp:
        (WebCore::DrawingBufferPrivate::DrawingBufferPrivate):
        (WebCore::DrawingBufferPrivate::~DrawingBufferPrivate):
        (WebCore::DrawingBufferPrivate::layer):
        (DrawingBufferPrivate):
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
        (WebCore::GraphicsLayerChromium::~GraphicsLayerChromium):
        (WebCore::GraphicsLayerChromium::updateNames):
        (WebCore::GraphicsLayerChromium::removeFromParent):
        (WebCore::GraphicsLayerChromium::setSize):
        (WebCore::GraphicsLayerChromium::clearBackgroundColor):
        (WebCore::GraphicsLayerChromium::setContentsOpaque):
        (WebCore::GraphicsLayerChromium::setFilters):
        (WebCore::GraphicsLayerChromium::setBackgroundFilters):
        (WebCore::GraphicsLayerChromium::setMaskLayer):
        (WebCore::GraphicsLayerChromium::setBackfaceVisibility):
        (WebCore::GraphicsLayerChromium::setOpacity):
        (WebCore::GraphicsLayerChromium::setReplicatedByLayer):
        (WebCore::GraphicsLayerChromium::setContentsNeedsDisplay):
        (WebCore::GraphicsLayerChromium::setNeedsDisplay):
        (WebCore::GraphicsLayerChromium::setNeedsDisplayInRect):
        (WebCore::GraphicsLayerChromium::setContentsToImage):
        (WebCore::GraphicsLayerChromium::setContentsToCanvas):
        (WebCore):
        (WebCore::GraphicsLayerChromium::setContentsToMedia):
        (WebCore::GraphicsLayerChromium::setContentsTo):
        (WebCore::GraphicsLayerChromium::addAnimation):
        (WebCore::GraphicsLayerChromium::pauseAnimation):
        (WebCore::GraphicsLayerChromium::removeAnimation):
        (WebCore::GraphicsLayerChromium::suspendAnimations):
        (WebCore::GraphicsLayerChromium::resumeAnimations):
        (WebCore::GraphicsLayerChromium::addLinkHighlight):
        (WebCore::GraphicsLayerChromium::didFinishLinkHighlight):
        (WebCore::GraphicsLayerChromium::platformLayer):
        (WebCore::GraphicsLayerChromium::setDebugBackgroundColor):
        (WebCore::GraphicsLayerChromium::setDebugBorder):
        (WebCore::GraphicsLayerChromium::updateChildList):
        (WebCore::GraphicsLayerChromium::updateLayerPosition):
        (WebCore::GraphicsLayerChromium::updateLayerSize):
        (WebCore::GraphicsLayerChromium::updateAnchorPoint):
        (WebCore::GraphicsLayerChromium::updateTransform):
        (WebCore::GraphicsLayerChromium::updateChildrenTransform):
        (WebCore::GraphicsLayerChromium::updateMasksToBounds):
        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D):
        (WebCore::GraphicsLayerChromium::updateLayerIsDrawable):
        (WebCore::GraphicsLayerChromium::updateLayerBackgroundColor):
        (WebCore::GraphicsLayerChromium::updateContentsRect):
        (WebCore::GraphicsLayerChromium::updateContentsScale):
        (WebCore::GraphicsLayerChromium::setupContentsLayer):
        * platform/graphics/chromium/GraphicsLayerChromium.h:
        (WebCore::GraphicsLayerChromium::hasContentsLayer):
        (WebCore::GraphicsLayerChromium::contentLayer):
        (GraphicsLayerChromium):
        (WebCore::GraphicsLayerChromium::contentsLayer):
        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::rootLayer):
        * platform/graphics/chromium/LayerChromium.h:

2012-08-20  Leandro Gracia Gil  <leandrogracia@chromium.org>

        Move transformFriendlyBoundingBox out of Range
        https://bugs.webkit.org/show_bug.cgi?id=94366

        Reviewed by Simon Fraser and Ryosuke Niwa.

        Bug 93111 introduced a new method in Range called transformFriendlyBoundingBox.
        However, this method should not have been added there in order to reduce the
        dependencies between Range and the rendering code. This patch moves it to a
        static method in RenderObject.

        Tests: existing tests, no new feature added by this patch.

        * dom/Range.cpp:
        * dom/Range.h:
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::absoluteBoundingBoxRectForRange):
        (WebCore):
        * rendering/RenderObject.h:
        (RenderObject):

2012-08-20  Ryosuke Niwa  <rniwa@webkit.org>

        Replace isolate || bidi-override by isolate-override
        https://bugs.webkit.org/show_bug.cgi?id=89746

        Reviewed by Levi Weintraub.

        The combination of bidi-isolate and isolate was replaced by a single isolate-override in
        http://lists.w3.org/Archives/Public/www-style/2012May/0541.html. The spec. has been updated accordingly:
        http://dev.w3.org/csswg/css3-writing-modes/#unicode-bidi

        To follow the specification change, added -webkit-isolate-override and removed the support for
        isolate || bidi-override, simplifying the CSS parser and serializer.

        Test: fast/text/bidi-override-isolate.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Removed. We can just new a CSSPrimitiveValue
        constructor now.
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added now that unicode-bidi always creates a signle
        primitive value instead of a primitive value of css value list.
        (WebCore::CSSPrimitiveValue::operator EUnicodeBidi):
        * css/CSSValueKeywords.in: Added -webkit-isolate-override
        * css/StyleBuilder.cpp:
        (WebCore): Removed ApplyPropertyUnicodeBidi since we can use ApplyPropertyDefault now.
        (WebCore::StyleBuilder::StyleBuilder): Use ApplyPropertyDefault.
        * platform/text/UnicodeBidi.h: Renamed OverrideIsolate to IsolateOverride to match the spec.
        (WebCore::isIsolated):
        (WebCore::isOverride):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::constructBidiRuns):

2012-08-20  Tony Chang  <tony@chromium.org>

        RenderGrid children should always be RenderBoxes
        https://bugs.webkit.org/show_bug.cgi?id=94305

        Reviewed by Abhishek Arya.

        During RenderGrid::layout, we assume all the children are RenderBoxes.
        When removing children, if the last child is an anonymous block, we don't
        want to remove the anonymous block for grids. Ensure this doesn't happen
        by adding canCollapseAnonymousBlockChild to RenderBlock (flexboxen and
        grid can override this method).

        Test: fast/css-grid-layout/should-not-collapse-anonymous-blocks.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removeChild): Check canCollapseAnonymousBlockChild().
        * rendering/RenderBlock.h:
        (WebCore::RenderBlock::canCollapseAnonymousBlockChild):
        (RenderBlock):
        * rendering/RenderDeprecatedFlexibleBox.h: canCollapseAnonymousBlockChild returns false.
        * rendering/RenderFlexibleBox.h: canCollapseAnonymousBlockChild returns false.
        * rendering/RenderGrid.h: canCollapseAnonymousBlockChild returns false.

2012-08-20  Kenneth Russell  <kbr@google.com>

        Unreviewed, rolling out r126026.
        http://trac.webkit.org/changeset/126026
        https://bugs.webkit.org/show_bug.cgi?id=94449

        Caused assertion failure in layout test touchadjustment/context-menu.html

        * page/TouchAdjustment.cpp:
        (TouchAdjustment):
        (WebCore::TouchAdjustment::providesContextMenuItems):
        (WebCore::TouchAdjustment::appendSubtargetsForNodeToList):
        (WebCore::TouchAdjustment::compileSubtargetList):
        (WebCore::findBestClickableCandidate):
        (WebCore::findBestContextMenuCandidate):

2012-08-20  Andrew Lo  <anlo@rim.com>

        [BlackBerry] Enabling DEBUG_LAYER_ANIMATION results in build break & warnings
        https://bugs.webkit.org/show_bug.cgi?id=94514

        Reviewed by Rob Buis.

        Add wtf::CString definition to fix build break when enabling DEBUG_LAYER_ANIMATION
        debug prints. Fix build warnings from prints.

        No new tests, non-functional change.

        * platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp:
        (WebCore::GraphicsLayerBlackBerry::addAnimation):
        (WebCore::GraphicsLayerBlackBerry::pauseAnimation):

2012-08-20  Christophe Dumez  <christophe.dumez@intel.com>

        [JSC] SerializedScriptValue::create() should throw a DataCloneError if input is an unsupported object
        https://bugs.webkit.org/show_bug.cgi?id=94493

        Reviewed by Oliver Hunt.

        Update JSC implementation for SerializedScriptValue::create() so that
        a DataCloneError is thrown when the input value is an unsupported
        object. The previous implementation was not throwing any error.

        This change is according to the structured clone specification at:
        http://www.w3.org/TR/html5/common-dom-interfaces.html#structured-clone

        This also matches the corresponding V8 implementation.

        Test: fast/events/message-port-multi.html.

        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::CloneSerializer::dumpIfTerminal):
        (WebCore::CloneSerializer::serialize):
        (WebCore::SerializedScriptValue::maybeThrowExceptionIfSerializationFailed):
        * bindings/js/SerializedScriptValue.h:

2012-08-20  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r125884.
        http://trac.webkit.org/changeset/125884
        https://bugs.webkit.org/show_bug.cgi?id=94523

        Appears to be causing a top crash in the Canary channel
        (Requested by abarth on #webkit).

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/v8/DOMWrapperWorld.cpp:
        (WebCore::DOMWrapperWorld::DOMWrapperWorld):
        (WebCore::mainThreadNormalWorld):
        * bindings/v8/DOMWrapperWorld.h:
        (WebCore):
        (WebCore::DOMWrapperWorld::create):
        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
        (DOMWrapperWorld):
        * bindings/v8/IsolatedWorld.cpp: Copied from Source/WebCore/bindings/v8/DOMWrapperWorld.cpp.
        (WebCore):
        (WebCore::IsolatedWorld::IsolatedWorld):
        (WebCore::IsolatedWorld::~IsolatedWorld):
        * bindings/v8/IsolatedWorld.h: Copied from Source/WebCore/bindings/v8/DOMWrapperWorld.h.
        (WebCore):
        (IsolatedWorld):
        (WebCore::IsolatedWorld::create):
        (WebCore::IsolatedWorld::count):
        (WebCore::IsolatedWorld::id):
        (WebCore::IsolatedWorld::domDataStore):
        * bindings/v8/V8DOMWrapper.h:
        (WebCore::V8DOMWrapper::getCachedWrapper):
        * bindings/v8/V8IsolatedContext.cpp:
        (WebCore::V8IsolatedContext::V8IsolatedContext):
        (WebCore::V8IsolatedContext::destroy):
        * bindings/v8/V8IsolatedContext.h:
        (WebCore::V8IsolatedContext::getEntered):
        (WebCore::V8IsolatedContext::world):
        (V8IsolatedContext):
        * bindings/v8/V8PerIsolateData.h:
        (WebCore::V8PerIsolateData::registerDOMDataStore):
        (WebCore::V8PerIsolateData::unregisterDOMDataStore):

2012-08-20  Chris Rogers  <crogers@google.com>

        Remove improper ASSERT in AudioParamTimeline::valuesForTimeRangeImpl()
        https://bugs.webkit.org/show_bug.cgi?id=94504

        Reviewed by Kenneth Russell.

        AudioParamTimeline::valuesForTimeRangeImpl() is able to handle the case where there are no timeline events.
        So don't ASSERT for that case.

        * Modules/webaudio/AudioParamTimeline.cpp:
        (WebCore::AudioParamTimeline::valuesForTimeRangeImpl):

2012-08-20  Ken Buchanan  <kenrb@chromium.org>
        Line boxes not being dirtied correctly during inline removal
        https://bugs.webkit.org/show_bug.cgi?id=93156

        Reviewed by David Hyatt.

        When two inline objects were being removed from different lineboxes
        in an ancestral RenderBlock, the way the RenderBlock was being marked
        prevented the second linebox from being marked dirty. This causes
        it to not get layout in the subsequent layout pass.

        This patch causes only the descendants corresponding to actual changed
        lineboxes to have their ancestorLineBoxDirty bit set, rather than
        the RenderBlock that contains the lineboxes themselves.

        * rendering/RenderLineBoxList.cpp:
        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):

2012-08-20  John Mellor  <johnme@chromium.org>

        Text Autosizing: Only take into account block width <= document layout width.
        https://bugs.webkit.org/show_bug.cgi?id=93862

        Reviewed by Kenneth Rohde Christiansen.

        Instead of calculating the textAutosizingMultiplier purely based on the
        width of each block, we now work out the maximum width of the block
        that could be displayed onscreen at any one time, and use that value.
        This avoids excessive text size multiplication (there's no point making
        text bigger than this, since you wouldn't be able to zoom out far
        enough to read it!).

        To determine the maximum onscreen block width, we take the minimum of
        the block width and the layoutWidth of the narrowest non-flattened
        ancestor frame. Flattened frames are ignored since they don't impose a
        hard limit on the maximum width that can be displayed, instead they can
        stretch to fit their contents. Note that on mobile the layoutWidth of
        the main frame is the fixed layout width aka viewport width.

        In practice this caps the maximum multiplier to a value that depends
        on the metrics of the device. For example on a Nexus S (480 x 800px
        and 1.5x devicePixelRatio) with a 980px default fixed layout width,
        this limits the multiplier to: 980 / (480/1.5) = 3.0625

        Most pages won't have blocks that actually hit this cap, or they will
        only slightly exceed it (so their multiplier will only be slightly
        reduced). For example it's not uncommon for desktop pages to be
        slightly wider than 980px, but they would have to additionally have
        text that spans the full width of the page for this to affect them, and
        even then it would merely slightly decrease their multiplier).

        This will have more dramatic effects on the rare desktop pages which
        give a width=device-width (or similar) mobile viewport tag (on ports
        which support viewports). A follow-up patch will hopefully address this
        by wrapping the text in such excessively wide blocks to the layoutWidth.

        Tests: fast/text-autosizing/narrow-iframe-flattened.html
               fast/text-autosizing/narrow-iframe.html
               fast/text-autosizing/wide-block.html
               fast/text-autosizing/wide-iframe.html

        * page/FrameView.cpp:
        (WebCore::FrameView::isInChildFrameWithFrameFlattening):

            Made public and const, so can be used from TextAutosizer.

        * rendering/TextAutosizer.cpp:
        (WebCore::TextAutosizer::processSubtree):

            Computes the minimum layout width of the parent frames, as described
            above.

        (WebCore::TextAutosizer::processBlock):

            Limits used block width to this min layout width.

2012-08-20  Hans Wennborg  <hans@chromium.org>

        Respect runtime flags for Device Orientation and Device Motion
        https://bugs.webkit.org/show_bug.cgi?id=94479

        Reviewed by Adam Barth.

        There are flags that allows disabling of device orientation and device
        motion at runtime. These flags determine the availability of the
        corresponding event constructors in DOMWindow.

        However, the flags should also control the ability to add event
        listeners for these events, otherwise the feature can be used even if
        it is disabled.

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::addEventListener):

2012-08-20  Philip Rogers  <pdr@google.com>

        Remove incorrect getBBox() code
        https://bugs.webkit.org/show_bug.cgi?id=94419

        Reviewed by Dirk Schulze.

        SVGPathElement defines a getBBox() function that is wrong and
        should use objectBoundingBox(). This patch cleans this up.

        No new tests as this is just a cleanup of old code.

        * svg/SVGPathElement.cpp:
        (WebCore):
        * svg/SVGPathElement.h:
        (SVGPathElement):

2012-08-20  David Reveman  <reveman@chromium.org>

        [Chromium] Schedule texture uploads based on hard-coded timer and vsync.
        https://bugs.webkit.org/show_bug.cgi?id=84281

        Reviewed by James Robinson.

        Improve interaction between vsync and texture uploads by performing
        uploads in smaller batches and use a hard-coded timer to emulate
        upload completion. This greatly reduces the chance of the compositor
        missing a vsync due to being busy with texture uploads.

        The CCScheduler client is now given a time limit when told to update
        more resources. This time limit is passed to an instance of the
        CCTextureUpdateController class, which is responsible for performing
        texture updates until the limit is reached.

        Unit tests: CCSchedulerTest.RequestCommit
                    CCTextureUpdateControllerTest.UpdateMoreTextures
                    CCTextureUpdateControllerTest.HasMoreUpdates

        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
        (WebCore::CCFrameRateController::nextTickTime):
        (WebCore):
        * platform/graphics/chromium/cc/CCFrameRateController.h:
        (CCFrameRateController):
        * platform/graphics/chromium/cc/CCScheduler.cpp:
        (WebCore::CCScheduler::processScheduledActions):
        * platform/graphics/chromium/cc/CCScheduler.h:
        (CCSchedulerClient):
        * platform/graphics/chromium/cc/CCTextureUpdateController.cpp:
        (WebCore::CCTextureUpdateController::maxPartialTextureUpdates):
        (WebCore::CCTextureUpdateController::CCTextureUpdateController):
        (WebCore::CCTextureUpdateController::updateMoreTextures):
        (WebCore):
        (WebCore::CCTextureUpdateController::onTimerFired):
        (WebCore::CCTextureUpdateController::monotonicTimeNow):
        (WebCore::CCTextureUpdateController::updateMoreTexturesTime):
        (WebCore::CCTextureUpdateController::updateMoreTexturesSize):
        (WebCore::CCTextureUpdateController::updateMoreTexturesIfEnoughTimeRemaining):
        (WebCore::CCTextureUpdateController::updateMoreTexturesNow):
        * platform/graphics/chromium/cc/CCTextureUpdateController.h:
        (WebCore::CCTextureUpdateController::create):
        (CCTextureUpdateController):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::beginFrameCompleteOnImplThread):
        (WebCore::CCThreadProxy::scheduledActionUpdateMoreResources):
        * platform/graphics/chromium/cc/CCThreadProxy.h:

2012-08-20  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>

        [css3-text] Add parsing support for -webkit-text-decoration-style
        https://bugs.webkit.org/show_bug.cgi?id=94093

        Reviewed by Julien Chaffraix.

        This patch implements the "text-decoration-style" property parsing as specified
        in CSS3 working draft, with "-webkit-" prefix. The specification can be found
        here: http://dev.w3.org/csswg/css3-text/#text-decoration-style

        Additionally, Mozilla implementation details can be found here:
        https://developer.mozilla.org/en-US/docs/CSS/text-decoration-style

        This is an individual task for bug 90958. Rendering support will be handled on a
        different bug.

        Test: fast/css3-text-decoration/getComputedStyle/getComputedStyle-text-decoration-style.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::renderTextDecorationStyleFlagsToCSSValue):
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::operator TextDecorationStyle):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/CSSValueKeywords.in:
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::diff):
        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyleConstants.h: Added non-bitwise TextDecorationStyle enum.
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData): Added m_textDecorationStyle to default and copy constructors.
        (WebCore::StyleRareNonInheritedData::operator==): Include m_textDecorationStyle in comparison.
        * rendering/style/StyleRareNonInheritedData.h:
        (StyleRareNonInheritedData):
        Added m_textDecorationStyle here as it won't be used regularly.

2012-08-20  Jakob Petsovits  <jpetsovits@rim.com>

        [BlackBerry] Persist cookies not from atexit() but the new onThreadFinished()
        https://bugs.webkit.org/show_bug.cgi?id=94482
        RIM PR 184923

        Reviewed by Yong Li.

        BlackBerry::Platform recently made changes that ensure
        that MessageClient threads are being shut down correctly.
        A new onThreadFinished() virtual was introduced for
        custom clean-up functionality and can replace the
        atexit() handler that we previously used to flush cookies
        to the cookie database backingstore.

        No new functionality, no new tests.

        * platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.cpp:
        (WebCore):
        (WebCore::CookieDatabaseBackingStore::onThreadFinished):
        (WebCore::CookieDatabaseBackingStore::sendChangesToDatabaseSynchronously):
        * platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h:
        (CookieDatabaseBackingStore):
        * platform/blackberry/CookieManager.cpp:
        (WebCore):
        (WebCore::cookieManager):
        * platform/blackberry/CookieManager.h:

2012-08-20  Alexandre Elias  <aelias@google.com>

        [chromium] Move non-GL-specific code out of LayerRendererChromium
        https://bugs.webkit.org/show_bug.cgi?id=93927

        Reviewed by Adrienne Walker.

        This patch moves most of the generic logic dealing with matrices and
        render passes into a new class "CCDirectRenderer" that sits between
        CCRenderer and LayerRendererChromium, and also publicly exposes a
        few other things like the UnthrottledTextureUploader.

        The plan is for the future software compositing implementation to also
        derive from CCDirectRenderer, whereas the ubercompositor delegating
        renderer will still derive from CCRenderer.

        No new tests (no-op refactoring).

        * WebCore.gypi:
        * platform/graphics/chromium/GeometryBinding.cpp:
        (WebCore::GeometryBinding::GeometryBinding):
        * platform/graphics/chromium/GeometryBinding.h:
        (GeometryBinding):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::LayerRendererChromium):
        (WebCore::LayerRendererChromium::beginDrawingFrame):
        (WebCore::LayerRendererChromium::drawQuad):
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
        (WebCore::LayerRendererChromium::drawTileQuad):
        (WebCore::LayerRendererChromium::finishDrawingFrame):
        (WebCore::LayerRendererChromium::drawQuadGeometry):
        (WebCore::LayerRendererChromium::bindFramebufferToOutputSurface):
        (WebCore):
        (WebCore::LayerRendererChromium::bindFramebufferToTexture):
        (WebCore::LayerRendererChromium::enableScissorTestRect):
        (WebCore::LayerRendererChromium::disableScissorTest):
        (WebCore::LayerRendererChromium::setDrawViewportSize):
        (WebCore::LayerRendererChromium::makeContextCurrent):
        (WebCore::LayerRendererChromium::initializeSharedObjects):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        * platform/graphics/chromium/TextureCopier.h:
        (TextureCopier):
        * platform/graphics/chromium/TextureUploader.h:
        (UnthrottledTextureUploader):
        (WebCore::UnthrottledTextureUploader::create):
        (WebCore::UnthrottledTextureUploader::~UnthrottledTextureUploader):
        (WebCore::UnthrottledTextureUploader::UnthrottledTextureUploader):
        (WebCore):
        * platform/graphics/chromium/cc/CCDirectRenderer.cpp: Added.
        (projectionMatrix):
        (canvasMatrix):
        (WebCore):
        (WebCore::CCDirectRenderer::DrawingFrame::initializeMatrices):
        (WebCore::CCDirectRenderer::DrawingFrame::initializeScissors):
        (WebCore::CCDirectRenderer::decideRenderPassAllocationsForFrame):
        (WebCore::CCDirectRenderer::drawFrame):
        (WebCore::CCDirectRenderer::drawRenderPass):
        (WebCore::CCDirectRenderer::useRenderPass):
        (WebCore::CCDirectRenderer::haveCachedResourcesForRenderPassId):
        (WebCore::CCDirectRenderer::renderPassTextureSize):
        (WebCore::CCDirectRenderer::renderPassTextureFormat):
        * platform/graphics/chromium/cc/CCDirectRenderer.h: Added.
        (WebCore):
        (CCDirectRenderer):
        (WebCore::CCDirectRenderer::~CCDirectRenderer):
        (WebCore::CCDirectRenderer::resourceProvider):
        (WebCore::CCDirectRenderer::CCDirectRenderer):
        (DrawingFrame):
        (WebCore::CCDirectRenderer::DrawingFrame::DrawingFrame):
        (CachedTexture):
        (WebCore::CCDirectRenderer::CachedTexture::create):
        (WebCore::CCDirectRenderer::CachedTexture::~CachedTexture):
        (WebCore::CCDirectRenderer::CachedTexture::isComplete):
        (WebCore::CCDirectRenderer::CachedTexture::setIsComplete):
        (WebCore::CCDirectRenderer::CachedTexture::CachedTexture):
        (WebCore::CCDirectRenderer::quadVertexRect):
        (WebCore::CCDirectRenderer::quadRectTransform):

2012-08-20  Julien Chaffraix  <jchaffraix@webkit.org>

        Introduce a will-be-removed-from-tree notification in RenderObject
        https://bugs.webkit.org/show_bug.cgi?id=94271

        Reviewed by Abhishek Arya.

        Following bug 93874, we have an insertion notification. This change adds the
        matching removal notification (willBeRemovedFromTree).

        Refactoring covered by existing tests.

        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::removeChildNode):
        Removed the code from here and moved it below.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::willBeRemovedFromTree):
        * rendering/RenderObject.h:
        This is the base function that should be called by every instance.

        * rendering/RenderListItem.cpp:
        (WebCore::RenderListItem::willBeRemovedFromTree):
        * rendering/RenderListItem.h:
        * rendering/RenderQuote.cpp:
        (WebCore::RenderQuote::willBeRemovedFromTree):
        * rendering/RenderQuote.h:
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::willBeRemovedFromTree):
        * rendering/RenderRegion.h:
        Overriden functions.

2012-08-20  Mike West  <mkwst@chromium.org>

        CSP 1.1: The 'plugin-types' warning should include details about explicit type declaration when relevant.
        https://bugs.webkit.org/show_bug.cgi?id=94432

        Reviewed by Adam Barth.

        Given a 'plugin-types' Content Security Policy directive, an 'object' or
        'embed' tag is blocked if it doesn't include an explicit declaration of
        the plugin's expected media type. This restriction should be made clear
        in the console warning that's generated.

        Existing tests have been adjusted to agree with the new error string.

        * page/ContentSecurityPolicy.cpp:
        (WebCore::CSPDirectiveList::checkMediaTypeAndReportViolation):
            If a media type fail to match the policy's restrictions, and the
            declared type attribute is empty, then add another line to the
            console warning, espousing the virtues of explicit declaration.

2012-08-20  Dana Jansens  <danakj@chromium.org>

        [chromium] Update HUD resources as a final step to drawing a frame
        https://bugs.webkit.org/show_bug.cgi?id=93743

        Reviewed by Adrienne Walker.

        The HUD should be painted as a last step, after the whole frame has been
        generated. This introduces a new "updateHudTexture" method on the HUD layer
        and has the HUD layer save itself on CCLayerTreeHostImpl so that it can
        call back to this method.

        This allows the CCLayerTreeHostImpl to cause the HUD layer to update its
        texture as a final step before drawing the frame, allowing the HUD texture
        to contain all possible information about the current frame.

        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
        (WebCore::CCHeadsUpDisplayLayerImpl::willDraw):
        (WebCore):
        (WebCore::CCHeadsUpDisplayLayerImpl::appendQuads):
        (WebCore::CCHeadsUpDisplayLayerImpl::updateHudTexture):
        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.h:
        (CCHeadsUpDisplayLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::drawLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (WebCore):
        (WebCore::CCLayerTreeHostImpl::setHudLayer):
        (WebCore::CCLayerTreeHostImpl::hudLayer):
        (CCLayerTreeHostImpl):

2012-08-20  Ian Vollick  <vollick@chromium.org>

        [chromium] Add tracing for active composited animations
        https://bugs.webkit.org/show_bug.cgi?id=84210

        Reviewed by James Robinson.

        This patch issues the trace events from the animations. Animations will
        report when they start and finish on the main and impl threads (via
        TRACE_EVENT_ASYNC*), and also issues instant trace events whenever they
        change state.

        No new tests, only changes tracing behavior.

        * platform/graphics/chromium/cc/CCActiveAnimation.cpp:
        (WebCore::CCActiveAnimation::CCActiveAnimation):
        (WebCore::CCActiveAnimation::~CCActiveAnimation):
        (WebCore::CCActiveAnimation::setRunState):
        (WebCore::CCActiveAnimation::clone):
        (WebCore):
        (WebCore::CCActiveAnimation::cloneAndInitialize):
        * platform/graphics/chromium/cc/CCActiveAnimation.h:
        (WebCore::CCActiveAnimation::isControllingInstance):
        (CCActiveAnimation):
        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
        (WebCore::CCLayerAnimationController::pushNewAnimationsToImplThread):
        (WebCore::CCLayerAnimationController::replaceImplThreadAnimations):
        (WebCore::CCLayerAnimationController::tickAnimations):

2012-08-20  Bill Budge  <bbudge@chromium.org>

        webkitfullscreenchange not fired properly in iframe.
        https://bugs.webkit.org/show_bug.cgi?id=93525

        Reviewed by Adam Barth.

        webkitCancelFullScreen exits fullscreen by invoking webkitExitFullScreen on topDocument.
        However, if webkitDidExitFullScreenForElement is invoked on a descendant document, no events
        get dispatched. This change starts the event dispatch delay timer on the document where
        webkitCancelFullScreen was called, so that the events get dispatched. In addition, when events
        are dispatched, the check whether a node has been removed is changed to also check that the
        node isn't in another document, as can happen with frames. Finally, webkitExitFullscreen
        is fixed to remove unnecessary code and conform to the spec.

        No new tests (the existing fullscreen/exit-full-screen-iframe.html test now passes).

        * dom/Document.cpp:
        (WebCore::Document::webkitExitFullscreen):
        (WebCore::Document::webkitDidExitFullScreenForElement):
        (WebCore::Document::fullScreenChangeDelayTimerFired):

2012-08-20  Yuzhu Shen  <yzshen@chromium.com>

        [chromium] pepper plugins sometimes are shifted by 1 pixel
        https://bugs.webkit.org/show_bug.cgi?id=94257

        Reviewed by Levi Weintraub.

        Change RenderWidget::updateWidgetGeometry() to use LayoutRect instead of IntRect to avoid unwanted truncation
        (when converting from FloatRect to IntRect).

        This makes sure that the optimized rendering code path of Pepper plugin
        (PluginInstance::GetBitmapForOptimizedPluginPaint) has consistent coordinates with the normal WebKit rendering
        code path.

        No new tests because we don't have Pepper plugin tests in WebKit.

        * rendering/RenderWidget.cpp:
        (WebCore::RenderWidget::updateWidgetGeometry):

2012-08-20  Christophe Dumez  <christophe.dumez@intel.com>

        postMessage() in MessagePort.idl does not match spec
        https://bugs.webkit.org/show_bug.cgi?id=94477

        Reviewed by Kentaro Hara.

        Update definition of postMessage() in MessagePort.idl
        to match the specification at:
        http://www.w3.org/TR/html5/comms.html#messageport

        The first argument should be of type 'any', not
        'DOMString'.

        No new tests, no behavior change.

        * dom/MessagePort.idl:

2012-08-20  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r125989.
        http://trac.webkit.org/changeset/125989
        https://bugs.webkit.org/show_bug.cgi?id=94485

        "Two of the new tests always failed on Mac bots" (Requested by
        bradee-oh on #webkit).

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore):
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/CSSValueKeywords.in:
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * rendering/RenderLayer.h:
        (RenderLayer):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::createPrimaryGraphicsLayer):
        (WebCore):
        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
        * rendering/RenderLayerBacking.h:
        (RenderLayerBacking):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::diff):
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:
        (StyleRareNonInheritedData):

2012-08-20  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        [Qt] Custom tap-highlight-color renders fully opaque
        https://bugs.webkit.org/show_bug.cgi?id=94468

        Reviewed by Kenneth Rohde Christiansen.

        Adjust the default tap-highlight-color to figure in that is will be
        drawn semi-transparent.

        * rendering/RenderTheme.h:
        (RenderTheme):

2012-08-20  Andrey Adaikin  <aandrey@chromium.org>

        Web Inspector: [WebGL] Add minimum transport protocol from backend to frontend
        https://bugs.webkit.org/show_bug.cgi?id=88973

        Reviewed by Pavel Feldman.

        Added the following protocol methods to communicate with the WebGL injected
        module: captureFrame, getTraceLog, dropTraceLog, replayTraceLog.

        * inspector/CodeGeneratorInspector.py:
        * inspector/InjectedScriptWebGLModule.cpp:
        (WebCore::InjectedScriptWebGLModule::captureFrame):
        (WebCore):
        (WebCore::InjectedScriptWebGLModule::dropTraceLog):
        (WebCore::InjectedScriptWebGLModule::getTraceLog):
        (WebCore::InjectedScriptWebGLModule::replayTraceLog):
        * inspector/InjectedScriptWebGLModule.h:
        (InjectedScriptWebGLModule):
        * inspector/Inspector.json:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        * inspector/InspectorWebGLAgent.cpp:
        (WebCore::InspectorWebGLAgent::InspectorWebGLAgent):
        (WebCore::InspectorWebGLAgent::dropTraceLog):
        (WebCore):
        (WebCore::InspectorWebGLAgent::captureFrame):
        (WebCore::InspectorWebGLAgent::getTraceLog):
        (WebCore::InspectorWebGLAgent::replayTraceLog):
        * inspector/InspectorWebGLAgent.h:
        (WebCore):
        (WebCore::InspectorWebGLAgent::create):
        (InspectorWebGLAgent):

2012-08-20  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        [TouchAdjustment] Adjust to word or selection
        https://bugs.webkit.org/show_bug.cgi?id=94449

        Reviewed by Antonio Gomes.

        Makes each separate word a separate subtarget when context menu triggers
        selections, and only the selected part of a partial selected node a 
        target when selections are not overridden.

        Test: touchadjustment/context-menu-text-subtargets.html

        * page/TouchAdjustment.cpp:
        (TouchAdjustment):
        (WebCore::TouchAdjustment::providesContextMenuItems):
        (WebCore::TouchAdjustment::appendQuadsToSubtargetList):
        (WebCore::TouchAdjustment::appendBasicSubtargetsForNode):
        (WebCore::TouchAdjustment::appendContextSubtargetsForNode):
        (WebCore::TouchAdjustment::compileSubtargetList):
        (WebCore::findBestClickableCandidate):
        (WebCore::findBestContextMenuCandidate):

2012-08-20  Xan Lopez  <xlopez@igalia.com>

        [GTK] Provide backwards compatible method for WebKitDOMWebKitNamedFlow::overflow
        https://bugs.webkit.org/show_bug.cgi?id=94464

        Reviewed by Carlos Garcia Campos.

        Provide a compatibility method to access the new 'overset'
        property through the old 'overflow' name in
        WebKitDOMWebKitNamedFlow. Note that trying to access it through
        g_object_get directly will give a runtime warning, since the
        property does not actually exist anymore; this is done purely to
        maintain API compatibility.

        * bindings/gobject/WebKitDOMCustom.cpp:
        (webkit_dom_webkit_named_flow_get_overflow): add method.
        * bindings/gobject/WebKitDOMCustom.h:

2012-08-20  Sami Kyostila  <skyostil@chromium.org>

        [chromium] Convert screen space scroll gestures to layer space
        https://bugs.webkit.org/show_bug.cgi?id=92499

        Reviewed by James Robinson.

        Scroll gestures should be converted from screen space to local layer space to
        correctly apply the scroll delta to page scaled and/or transformed layers.
        Visually this means that the scrolled content will always follow the user's
        finger for any "well-formed" layer transform.

        Wheel scroll deltas will still be directly interpreted as local layer scroll
        coordinates.

        We also adjust the logic for propagating ("bubbling") scroll events to parent
        layers. Previously a parent layer was allowed to scroll in the screen-space
        axis orthogonal to the direction the starting layer scrolled toward. For
        example if a vertically scrolling layer is scrolled diagonally down and right,
        the layer moves down and its parent to the right.

        This patch generalizes this behavior to non-axis aligned transformed layers so
        that the scrolling direction of any parent is constrained to be perpendicular
        direction of movement of the starting layer. This makes the scrolling behavior
        of transformed layers physically plausible. For instance, assume a 45 degree
        rotated, vertically scrollable layer. Dragging your finger vertically
        (relative to the layer) scrolls the layer up and down, while horizontal
        movement results in the parent of the layer moving in a corresponding way.

        Since generally users want to scroll a single layer in one direction, this
        patch also introduces a rule that if the resulting movement of a layer is
        within 45 degrees of the original scroll input, the bubbling process is
        stopped. This makes it possible to reliably scroll a single layer without
        affecting any of its parents.

        Added new unit tests:
            CCLayerTreeHostImplTest.scrollAxisAlignedRotatedLayer
            CCLayerTreeHostImplTest.scrollNonAxisAlignedRotatedLayer
            CCLayerTreeHostImplTest.scrollScaledLayer
            CCMathUtilTest.smallestAngleBetweenVectors
            CCMathUtilTest.vectorProjection

        * platform/graphics/chromium/cc/CCInputHandler.h:
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::scrollBegin):
        (WebCore::scrollLayerWithScreenSpaceDelta):
        (WebCore):
        (WebCore::scrollLayerWithLocalDelta):
        (WebCore::CCLayerTreeHostImpl::scrollBy):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCMathUtil.cpp:
        (WebCore::CCMathUtil::smallestAngleBetweenVectors):
        (WebCore):
        (WebCore::CCMathUtil::projectVector):
        * platform/graphics/chromium/cc/CCMathUtil.h:
        (CCMathUtil):

2012-08-20  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Add API to set preferred languages to WebKit2 GTK+
        https://bugs.webkit.org/show_bug.cgi?id=90878

        Unreviewed. Fix mac build.

        * WebCore.exp.in: Export WebCore::languageDidChange().

2012-08-20  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: improve standalone test harness to allow attaching to inspector before test.
        https://bugs.webkit.org/show_bug.cgi?id=94426

        Reviewed by Vsevolod Vlasov.

        - User can not "Debug", attach inspector to the front-end and "Continue" test execution.
        - You can also assign filter from the query parameter.

        * inspector/front-end/test-runner.html:

2012-08-20  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: load scripts panel lazily
        https://bugs.webkit.org/show_bug.cgi?id=94416

        Reviewed by Vsevolod Vlasov.

        - removes access to WebInspector.panels.scripts and loads it lazily.
        - extracts classes to their own files when classes residing in one file belong to different modules
        - removes StylesPanel.js in favor of the actual classes it contains 

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/AdvancedSearchController.js:
        (WebInspector.AdvancedSearchController.prototype.handleShortcut):
        * inspector/front-end/BreakpointsSidebarPane.js:
        * inspector/front-end/FilteredItemSelectionDialog.js:
        * inspector/front-end/InspectorFrontendAPI.js:
        (InspectorFrontendAPI._pendingCommands.isDebuggingEnabled):
        (InspectorFrontendAPI.setDebuggingEnabled):
        * inspector/front-end/NativeBreakpointsSidebarPane.js: Added.
        (WebInspector.NativeBreakpointsSidebarPane):
        (WebInspector.NativeBreakpointsSidebarPane.prototype._addListElement):
        (WebInspector.NativeBreakpointsSidebarPane.prototype._removeListElement):
        (WebInspector.NativeBreakpointsSidebarPane.prototype._reset):
        * inspector/front-end/ObjectPropertiesSection.js:
        (WebInspector.ObjectPropertyTreeElement.prototype._functionContextMenuEventFired):
        * inspector/front-end/ScriptSnippetModel.js:
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.showGoToSourceDialog):
        * inspector/front-end/SnippetJavaScriptSourceFrame.js: Added.
        (WebInspector.SnippetJavaScriptSourceFrame):
        (WebInspector.SnippetJavaScriptSourceFrame.prototype.statusBarItems):
        (WebInspector.SnippetJavaScriptSourceFrame.prototype._runButtonClicked):
        * inspector/front-end/StyleSheetOutlineDialog.js: Added.
        (WebInspector.StyleSheetOutlineDialog):
        (WebInspector.StyleSheetOutlineDialog.show):
        (WebInspector.StyleSheetOutlineDialog.prototype.itemTitleAt):
        (WebInspector.StyleSheetOutlineDialog.prototype.itemSubtitleAt):
        (WebInspector.StyleSheetOutlineDialog.prototype.itemKeyAt):
        (WebInspector.StyleSheetOutlineDialog.prototype.itemsCount):
        (WebInspector.StyleSheetOutlineDialog.prototype.requestItems):
        (WebInspector.StyleSheetOutlineDialog.prototype.requestItems.didGetStyleSheet):
        (WebInspector.StyleSheetOutlineDialog.prototype.selectItem):
        (WebInspector.StyleSheetOutlineDialog.prototype.rewriteQuery):
        * inspector/front-end/StyleSource.js: Renamed from Source/WebCore/inspector/front-end/StylesPanel.js.
        (WebInspector.StylesUISourceCodeProvider):
        (WebInspector.StylesUISourceCodeProvider.prototype.uiSourceCodes):
        (WebInspector.StylesUISourceCodeProvider.prototype.rawLocationToUILocation):
        (WebInspector.StylesUISourceCodeProvider.prototype.uiLocationToRawLocation):
        (WebInspector.StylesUISourceCodeProvider.prototype._populate):
        (WebInspector.StylesUISourceCodeProvider.prototype._resourceAdded):
        (WebInspector.StylesUISourceCodeProvider.prototype.reset):
        (WebInspector.StyleSource):
        (WebInspector.StyleSource.prototype.isEditable):
        (WebInspector.StyleSource.prototype.workingCopyCommitted):
        (WebInspector.StyleSource.prototype.workingCopyChanged):
        (WebInspector.StyleSource.prototype._callOrSetTimeout):
        (WebInspector.StyleSource.prototype._commitIncrementalEdit):
        (WebInspector.StyleSource.prototype._clearIncrementalUpdateTimer):
        (WebInspector.InspectorStyleSource):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:
        (WebInspector._panelDescriptors):
        (WebInspector._registerShortcuts):
        (WebInspector.documentKeyDown):
        (WebInspector._showAnchorLocation):

2012-08-20  Dominik Röttsches  <dominik.rottsches@intel.com>

        [EFL] Get rid of pango backend support once harfbuzz-ng is working
        https://bugs.webkit.org/show_bug.cgi?id=92102

        Reviewed by Kenneth Rohde Christiansen.

        Removing support for Pango complex font rendering now that we HarfBuzz.

        No new tests, no change in behavior.

        * PlatformEfl.cmake: Removing Pango specific includes and libraries.

2012-08-20  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: prepare scripts panel to be lazily loaded
        https://bugs.webkit.org/show_bug.cgi?id=94423

        Reviewed by Vsevolod Vlasov.

        - makes scripts panel read workspace data upon creation
        - moves pause on script state management into the debugger model
        - updates frontend API to use debugger model, not scripts panel

        * inspector/front-end/DebuggerModel.js:
        (WebInspector.DebuggerModel.prototype.debuggerEnabled):
        (WebInspector.DebuggerModel.prototype.disableDebugger):
        (WebInspector.DebuggerModel.prototype._debuggerWasEnabled):
        (WebInspector.DebuggerModel.prototype._pauseOnExceptionStateChanged):
        (WebInspector.DebuggerModel.prototype.get _debuggerWasDisabled):
        * inspector/front-end/InspectorFrontendAPI.js:
        (InspectorFrontendAPI._pendingCommands.isDebuggingEnabled):
        (InspectorFrontendAPI.setDebuggingEnabled):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel):
        (WebInspector.ScriptsPanel.prototype._debuggerWasEnabled):
        (WebInspector.ScriptsPanel.prototype._debuggerWasDisabled):
        (WebInspector.ScriptsPanel.prototype._reset):
        (WebInspector.ScriptsPanel.prototype.canShowAnchorLocation):
        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
        (WebInspector.ScriptsPanel.prototype._enableDebugging):
        (WebInspector.ScriptsPanel.prototype._togglePauseOnExceptions):
        (WebInspector.ScriptsPanel.prototype.showGoToSourceDialog):
        * inspector/front-end/inspector.js:
        (WebInspector.documentKeyDown):

2012-08-20  Robin Cao  <robin.cao@torchmobile.com.cn>

        [BlackBerry] Adapt to changes in the platform media player API
        https://bugs.webkit.org/show_bug.cgi?id=94329
        PR #194237

        Reviewed by Antonio Gomes.

        The interface to platform's media player has changed from MMRPlayer
        to PlatformPlayer. This patch adapts to this change.

        And we also decided to postpone the creation of PlatformPlayer until
        the loading started. This is needed because we may create different
        types of player for different media sources.

        This is a refactor, no new tests.

        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
        (WebCore::MediaPlayerPrivate::getSupportedTypes):
        (WebCore::MediaPlayerPrivate::supportsType):
        (WebCore::MediaPlayerPrivate::notifyAppActivatedEvent):
        (WebCore::MediaPlayerPrivate::setCertificatePath):
        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
        (WebCore::MediaPlayerPrivate::load):
        (WebCore::MediaPlayerPrivate::cancelLoad):
        (WebCore::MediaPlayerPrivate::prepareToPlay):
        (WebCore::MediaPlayerPrivate::play):
        (WebCore::MediaPlayerPrivate::pause):
        (WebCore::MediaPlayerPrivate::naturalSize):
        (WebCore::MediaPlayerPrivate::hasVideo):
        (WebCore::MediaPlayerPrivate::hasAudio):
        (WebCore::MediaPlayerPrivate::duration):
        (WebCore::MediaPlayerPrivate::currentTime):
        (WebCore::MediaPlayerPrivate::seek):
        (WebCore::MediaPlayerPrivate::setRate):
        (WebCore::MediaPlayerPrivate::paused):
        (WebCore::MediaPlayerPrivate::setVolume):
        (WebCore::MediaPlayerPrivate::maxTimeSeekable):
        (WebCore::MediaPlayerPrivate::buffered):
        (WebCore::MediaPlayerPrivate::paint):
        (WebCore::MediaPlayerPrivate::hasAvailableVideoFrame):
        (WebCore::MediaPlayerPrivate::movieLoadType):
        (WebCore::MediaPlayerPrivate::setAllowPPSVolumeUpdates):
        (WebCore::MediaPlayerPrivate::updateStates):
        (WebCore):
        (WebCore::MediaPlayerPrivate::onStateChanged):
        (WebCore::MediaPlayerPrivate::onMediaStatusChanged):
        (WebCore::MediaPlayerPrivate::onError):
        (WebCore::MediaPlayerPrivate::waitMetadataTimerFired):
        (WebCore::MediaPlayerPrivate::showErrorDialog):
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
        (MediaPlayerPrivate):

2012-08-19  Kentaro Hara  <haraken@chromium.org>

        [V8] Move contextDebugId() and setContextDebugId() from V8Proxy to ScriptController
        https://bugs.webkit.org/show_bug.cgi?id=94446

        Reviewed by Adam Barth.

        To kill V8Proxy, we can move contextDebugId() and setContextDebugId()
        from V8Proxy to ScriptController.

        No tests. No change in behavior.

        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::setContextDebugId):
        (WebCore):
        (WebCore::ScriptController::contextDebugId):
        * bindings/v8/ScriptController.h:
        (ScriptController):
        * bindings/v8/V8IsolatedContext.cpp:
        (WebCore::V8IsolatedContext::V8IsolatedContext):
        * bindings/v8/V8Proxy.cpp:
        * bindings/v8/V8Proxy.h:
        (V8Proxy):

2012-08-20  Kentaro Hara  <haraken@chromium.org>

        [V8] Move V8Proxy::newInstance() to V8ObjectConstructor
        https://bugs.webkit.org/show_bug.cgi?id=94443

        Reviewed by Adam Barth.

        To kill V8Proxy, this patch moves V8Proxy::newInstance() to
        V8ObjectConstructor::newInstanceInFrame().
        In addition, this patch does the following things:

        - For consistency with V8ObjectConstructor::newInstanceInFrame(),
        this patch inserts an if(v8::V8::IsDead()) check to just after
        Function::NewInstance(). The check is done by V8Binding::assertIfV8IsDead().

        - To avoid #include circular dependency, this patch de-inline
        V8ObjectConstructor::newInstance()s. I didn't observe any perf regression.
        I don't think these methods are worth being inlined, because
        these methods call Function::NewInstance(), which is not inlined
        and calls a bunch of heavy mehtods in V8.

        No tests. No change in behavior.

        * bindings/v8/NPV8Object.cpp:
        (_NPN_Construct):
        * bindings/v8/V8Binding.cpp:
        (WebCore::assertIfV8IsDead):
        (WebCore):
        * bindings/v8/V8Binding.h:
        (WebCore):
        * bindings/v8/V8ObjectConstructor.cpp:
        (WebCore::V8ObjectConstructor::newInstance):
        (WebCore):
        (WebCore::V8ObjectConstructor::newInstanceInFrame):
        * bindings/v8/V8ObjectConstructor.h:
        (WebCore):
        (V8ObjectConstructor):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::runScript):
        (WebCore::V8Proxy::instrumentedCallFunction):

2012-08-20  Kentaro Hara  <haraken@chromium.org>

        [V8] Move V8Proxy::m_extensions to ScriptController
        https://bugs.webkit.org/show_bug.cgi?id=94444

        Reviewed by Adam Barth.

        To kill V8Proxy, this patch moves V8Proxy::m_extensions to ScriptController.
        This patch also renames extensions() to registeredExtensions() for clarification.

        No tests. No change in behavior.

        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::registeredExtensions):
        (WebCore):
        (WebCore::ScriptController::registerExtensionIfNeeded):
        * bindings/v8/ScriptController.h:
        (WebCore):
        (ScriptController):
        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::V8DOMWindowShell::createNewContext):
        * bindings/v8/V8Proxy.cpp:
        * bindings/v8/V8Proxy.h:
        (WebCore):
        (V8Proxy):

2012-08-20  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: toolbar causes 8 reflows upon opening
        https://bugs.webkit.org/show_bug.cgi?id=94422

        Reviewed by Yury Semikhatsky.

        Toolbar's overflow code causes inspector to do 8 reflows upon opening.
        Fixing it via introducing batch toolbar update.

        * inspector/front-end/Toolbar.js:
        (WebInspector.Toolbar):
        (WebInspector.Toolbar.prototype.setCoalescingUpdate):
        (WebInspector.Toolbar.prototype._updateDropdownButtonAndHideDropdown):
        * inspector/front-end/inspector.css:
        (body.compact .toolbar-icon):
        (body.compact .toolbar-icon.custom-toolbar-icon):
        (body.compact .toolbar-item:active .toolbar-icon):
        (body.compact .toolbar-label):
        (body.compact .toolbar-item.resources .toolbar-icon):
        (body.compact .toolbar-item.network .toolbar-icon):
        (body.compact .toolbar-item.scripts .toolbar-icon):
        (body.compact .toolbar-item.timeline .toolbar-icon):
        (body.compact .toolbar-item.profiles .toolbar-icon):
        (body.compact .toolbar-item.audits .toolbar-icon):
        (body.compact .toolbar-item.console .toolbar-icon):
        * inspector/front-end/inspector.js:
        (WebInspector.get _setCompactMode):
        (WebInspector.windowResize):

2012-08-19  Kentaro Hara  <haraken@chromium.org>

        [V8] Replace proxy()->windowShell() in ScriptController with windowShell()
        https://bugs.webkit.org/show_bug.cgi?id=94445

        Reviewed by Adam Barth.

        Now ScriptController owns windowShell. So ScriptController doesn't
        need to get windowShell through V8Proxy.

        No tests. No change in behavior.

        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::updateSecurityOrigin):
        (WebCore::ScriptController::haveInterpreter):
        (WebCore::ScriptController::enableEval):
        (WebCore::ScriptController::disableEval):
        (WebCore::ScriptController::updateDocument):
        (WebCore::ScriptController::namedItemAdded):
        (WebCore::ScriptController::namedItemRemoved):

2012-08-19  Kentaro Hara  <haraken@chromium.org>

        [V8] Move V8Proxy::callFunction() to ScriptController
        https://bugs.webkit.org/show_bug.cgi?id=94437

        Reviewed by Adam Barth.

        To kill V8Proxy, this patch moves callFunction() from V8Proxy to ScriptController.

        No tests. No change in behavior.

        * bindings/v8/DOMTransaction.cpp:
        (WebCore::DOMTransaction::callFunction):
        * bindings/v8/NPV8Object.cpp:
        (_NPN_Invoke):
        (_NPN_InvokeDefault):
        * bindings/v8/ScheduledAction.cpp:
        (WebCore::ScheduledAction::execute):
        * bindings/v8/ScheduledAction.h:
        (WebCore):
        (ScheduledAction):
        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::callFunction):
        (WebCore):
        (WebCore::ScriptController::callFunctionEvenIfScriptDisabled):
        * bindings/v8/ScriptController.h:
        (ScriptController):
        * bindings/v8/V8EventListener.cpp:
        (WebCore::V8EventListener::callListenerFunction):
        * bindings/v8/V8LazyEventListener.cpp:
        (WebCore::V8LazyEventListener::callListenerFunction):
        * bindings/v8/V8Proxy.cpp:
        * bindings/v8/V8Proxy.h:
        (V8Proxy):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::V8HTMLDocument::openCallback):

2012-08-19  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Set SpinButtonElement free from HTMLInputElement
        https://bugs.webkit.org/show_bug.cgi?id=93941

        Reviewed by Kent Tamura.

        This patch removes dependency to HTMLInputElement from SpinButtonElement.

        Functionalities used to be calling HTMLInputElement functions are
        replaced to calling functions SpinButtonOwner class.

        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::focusAndSelectSpinButtonOwner): Moved functionality from SpinButtonElement::defaultEventHandler.
        (WebCore::TextFieldInputType::shouldSpinButtonRespondToMouseEvents): Moved code from SpinButtonElement::willRespondToMouseClickEvents
        (WebCore::TextFieldInputType::shouldSpinButtonRespondToWheelEvents): Moved code from SpinButtonElement::forwardEvent
        * html/TextFieldInputType.h:
        (TextFieldInputType):
        * html/TimeInputType.cpp:
        (WebCore::TimeInputType::DateTimeEditControlOwnerImpl::focusAndSelectEditControlOwner): Moved functionality from SpinButtonElement::defaultEventHandler.
        (WebCore::TimeInputType::DateTimeEditControlOwnerImpl::isEditControlOwnerFocused): Added for DateTimeEditElement::shouldSpinButtonRespondToWheelEvents.
        * html/TimeInputType.h:
        * html/shadow/DateTimeEditElement.cpp:
        (WebCore::DateTimeEditElement::focusAndSelectSpinButtonOwner): Added for SpinButtonElementOwner class change.
        (WebCore::DateTimeEditElement::shouldSpinButtonRespondToMouseEvents): ditto
        (WebCore::DateTimeEditElement::shouldSpinButtonRespondToWheelEvents): ditto
        * html/shadow/DateTimeEditElement.h:
        (EditControlOwner): Added new virtual function declarations for SpinButtonElementOwner class change.
        (DateTimeEditElement): Added new function declarations for SpinButtonElementOwner.
        * html/shadow/SpinButtonElement.cpp:
        (WebCore::SpinButtonElement::defaultEventHandler): Changed to use SpinButtonElementOwner instead of HTMLInputElement.
        (WebCore::SpinButtonElement::forwardEvent): ditto
        (WebCore::SpinButtonElement::willRespondToMouseMoveEvents): ditto
        (WebCore::SpinButtonElement::willRespondToMouseClickEvents): ditto
        (WebCore::SpinButtonElement::step): ditto
        (WebCore::SpinButtonElement::shouldRespondToMouseEvents): Added helper function for calling SpinButtonOwner instance.
        * html/shadow/SpinButtonElement.h:
        (SpinButtonOwner): Added new virtual function declarations.
        (SpinButtonElement):

2012-08-19  Yoshifumi Inoue  <yosin@chromium.org>

        [Tests] time-multiple-fields-appearance-basic.html and time-multiple-fields-appearance-pseudo-elements.html are failed on Chromium Mac
        https://bugs.webkit.org/show_bug.cgi?id=94439

        Reviewed by Kent Tamura.

        This patch disabled CSS selector for Firefox compatibility applied to
        multiple fields time input UI, because it is supposed to apply text
        field rather than multiple fields.

        This patch allows us to have same appearance among Chromium-Linux,
        Mac and Win.

        No new tests. Following existing tests cover this change:
          fast/forms/time-multiple-fields/time-multiple-fields-appearance-basic.html
          fast/forms/time-multiple-fields/time-multiple-fields-appearance-disabled-readonly.html
          fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-classes.html
          fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements.html
          fast/forms/time-multiple-fields/time-multiple-fields-appearance-style.html

        * css/themeWin.css: Exclude input[type="time"] selector if ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS
        enabled.

2012-08-19  Kentaro Hara  <haraken@chromium.org>

        [V8] Rename SafeAllocation to V8ObjectConstructor
        https://bugs.webkit.org/show_bug.cgi?id=94436

        Reviewed by Adam Barth.

        For clarification.

        No tests. No change in behavior.

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/v8/ScriptFunctionCall.cpp:
        (WebCore::ScriptFunctionCall::construct):
        * bindings/v8/V8Binding.cpp:
        (WebCore::createRawTemplate):
        * bindings/v8/V8Binding.h:
        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::V8DOMWindowShell::installDOMWindow):
        * bindings/v8/V8DOMWrapper.cpp:
        (WebCore::V8DOMWrapper::instantiateV8Object):
        * bindings/v8/V8NPObject.cpp:
        (WebCore::createV8ObjectForNPObject):
        * bindings/v8/V8ObjectConstructor.cpp: Renamed from Source/WebCore/bindings/v8/SafeAllocation.cpp.
        (WebCore):
        (WebCore::V8ObjectConstructor::isValidConstructorMode):
        * bindings/v8/V8ObjectConstructor.h: Renamed from Source/WebCore/bindings/v8/SafeAllocation.h.
        (WebCore):
        (ConstructorMode):
        (WebCore::ConstructorMode::ConstructorMode):
        (WebCore::ConstructorMode::~ConstructorMode):
        (WebCore::ConstructorMode::current):
        (V8ObjectConstructor):
        (WebCore::V8ObjectConstructor::newInstance):
        * bindings/v8/V8PerContextData.cpp:
        (WebCore::V8PerContextData::createWrapperFromCacheSlowCase):
        * bindings/v8/WorkerContextExecutionProxy.cpp:
        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
        * bindings/v8/custom/V8InjectedScriptManager.cpp:
        (WebCore::createInjectedScriptHostV8Wrapper):
        * bindings/v8/custom/V8ScriptProfileCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ScriptProfileNodeCustom.cpp:
        (WebCore::toV8):

2012-08-19  Kentaro Hara  <haraken@chromium.org>

        [V8] Move m_windowShell from V8Proxy to ScriptController
        https://bugs.webkit.org/show_bug.cgi?id=94438

        Reviewed by Adam Barth.

        m_windowShell should be owned by ScriptController.
        After this change, I can move a bunch of V8Proxy methods
        that access windowShell() from V8Proxy to ScriptController.

        No tests. No change in behavior.

        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::ScriptController):
        * bindings/v8/ScriptController.h:
        (WebCore):
        (WebCore::ScriptController::windowShell):
        (ScriptController):
        * bindings/v8/V8Binding.h:
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::V8Proxy):
        (WebCore::V8Proxy::windowShell):
        (WebCore):
        * bindings/v8/V8Proxy.h:
        (WebCore):
        (WebCore::V8Proxy::frame):
        (V8Proxy):

2012-08-19  Benjamin Poulain  <benjamin@webkit.org>

        Do not allocate SQLiteDatabase's m_openErrorMessage until its needed
        https://bugs.webkit.org/show_bug.cgi?id=94434

        Reviewed by Andreas Kling.

        Previously, m_openErrorMessage was initialized from a static literal string whenever
        the database is not open.

        This patch changes the way we use m_openErrorMessage to only allocate a string in the
        few cases where we need it. If there is no error message, we fallback to the previous
        default string.

        The goal is to prevent allocating the string unless needed. That saves initialization time
        and memory.

        * platform/sql/SQLiteDatabase.cpp:
        (WebCore::SQLiteDatabase::SQLiteDatabase):
        (WebCore::SQLiteDatabase::close):
        (WebCore::SQLiteDatabase::lastErrorMsg):

2012-08-19  Benjamin Poulain  <benjamin@webkit.org>

        Use initialization from literal for HTML Input type names
        https://bugs.webkit.org/show_bug.cgi?id=94421

        Reviewed by Kent Tamura.

        AtomicString's initialization from literal is faster and use less memory.

        * html/InputType.cpp:
        (WebCore::InputTypeNames::button):
        (WebCore::InputTypeNames::checkbox):
        (WebCore::InputTypeNames::color):
        (WebCore::InputTypeNames::date):
        (WebCore::InputTypeNames::datetime):
        (WebCore::InputTypeNames::datetimelocal):
        (WebCore::InputTypeNames::email):
        (WebCore::InputTypeNames::file):
        (WebCore::InputTypeNames::hidden):
        (WebCore::InputTypeNames::image):
        (WebCore::InputTypeNames::month):
        (WebCore::InputTypeNames::number):
        (WebCore::InputTypeNames::password):
        (WebCore::InputTypeNames::radio):
        (WebCore::InputTypeNames::range):
        (WebCore::InputTypeNames::reset):
        (WebCore::InputTypeNames::search):
        (WebCore::InputTypeNames::submit):
        (WebCore::InputTypeNames::telephone):
        (WebCore::InputTypeNames::text):
        (WebCore::InputTypeNames::time):
        (WebCore::InputTypeNames::url):
        (WebCore::InputTypeNames::week):

2012-08-19  Benjamin Poulain  <benjamin@webkit.org>

        Remove the static Strings used for outputting values of CSS_ATTR, CSS_COUNTER, CSS_RECT
        https://bugs.webkit.org/show_bug.cgi?id=94420

        Reviewed by Kentaro Hara.

        Use the new StringBuilder::appendLiteral() instead of keeping some WTF::String in
        memory.

        The patch reduces memory usage.
        It also reduces the binary size (-1672 bytes on x86_64).
        I did not measure any difference in performance.

        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::customCssText):

2012-08-19  Rik Cabanier  <cabanier@adobe.com>

        parse CSS attribute -webkit-blend-mode
        https://bugs.webkit.org/show_bug.cgi?id=94024
 
        Reviewed by Dirk Schulze.

        Added parsing and general CSS handling of -webkit-blend-mode per http://www.w3.org/TR/2012/WD-compositing-20120816/

        Tests: css3/compositing/blend-mode-property-parsing-invalid.html
               css3/compositing/blend-mode-property-parsing.html
               css3/compositing/blend-mode-property.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore):
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/CSSValueKeywords.in:
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * rendering/RenderLayer.h:
        (RenderLayer):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::createPrimaryGraphicsLayer):
        (WebCore):
        (WebCore::RenderLayerBacking::updateLayerBlendMode):
        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
        (WebCore::RenderLayerBacking::setBlendMode):
        * rendering/RenderLayerBacking.h:
        (RenderLayerBacking):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::diff):
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:
        (StyleRareNonInheritedData):

2012-08-19  MORITA Hajime  <morrita@google.com>

        DOM mutation against including <link> shouldn't trigger pending HTML parser.
        https://bugs.webkit.org/show_bug.cgi?id=93641

        Reviewed by Ryosuke Niwa.

        HTMLLinkElement::removedFrom() invoked Document::removePendingSheet(), which can trigger
        HTMLParser that can mutate DOM tree. DOM mutation reentrancy on like this is problematic and
        should be prohibited.

        This change add an variation of Document::removePendingSheet() which postpones the notification
        which triggers DOM mutation, and flush such pending notifications at the end of ongoing mutation.

        Test: http/tests/loading/remove-child-triggers-parser.html

        * dom/ContainerNodeAlgorithms.h:
        (WebCore::ChildNodeRemovalNotifier::notify): Flushed pending notifications at the end.
        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore::Document::removePendingSheet): Added RemovePendingSheetNotificationType parameter.
        (WebCore):
        (WebCore::Document::didRemoveAllPendingStylesheet): Extracted from removePendingSheet()
        * dom/Document.h:
        (Document):
        (WebCore::Document::setNeedsNotifyRemoveAllPendingStylesheet): A flag setter.
        (WebCore::Document::notifyRemovePendingSheetIfNeeded):
        (WebCore):
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::removedFrom): Switched to use "notification later" version of removePendingSheet()
        (WebCore::HTMLLinkElement::removePendingSheet): Added RemovePendingSheetNotificationType parameter.
        * html/HTMLLinkElement.h:

2012-08-19  Kentaro Hara  <haraken@chromium.org>

        Remove RefPtr from HTMLProgressElement::m_value
        https://bugs.webkit.org/show_bug.cgi?id=94336

        Reviewed by Kent Tamura.

        To avoid reference cycles of RefPtr<Node>s, we want to remove
        unnecessary RefPtr<Node>s. The rationale is described in bug 94324.

        HTMLProgressElement::m_value does not need to be a RefPtr<Node>, because
        it is guaranteed to point to a shadow DOM tree of the HTMLProgressElement
        node, which is guaranteed to exist in the subtree of the HTMLProgressElement node.

        No tests. No change in behavior.

        * html/HTMLProgressElement.cpp:
        (WebCore::HTMLProgressElement::HTMLProgressElement):
        (WebCore::HTMLProgressElement::createShadowSubtree):
        * html/HTMLProgressElement.h:

2012-08-19  Kentaro Hara  <haraken@chromium.org>

        Remove RefPtr from SearchInputType::m_resultsButton and SearchInputType::m_cancelButton
        https://bugs.webkit.org/show_bug.cgi?id=94339

        Reviewed by Kent Tamura.

        To avoid reference cycles of RefPtr<Node>s, we want to remove unnecessary
        RefPtr<Node>s. The rationale is described in bug 94324.

        SearchInputType::m_resultsButton and SearchInputType::m_cancelButton do not
        need to be RefPtr<Node>s, because they are guaranteed to point to the shadow
        DOM tree of the SearchInputType node, which is guaranteed to exist in the
        subtree of the SearchInputType node.

        No tests. No change in behavior.

        * html/SearchInputType.cpp:
        (WebCore::SearchInputType::SearchInputType):
        (WebCore::SearchInputType::createShadowSubtree):
        (WebCore::SearchInputType::resultsButtonElement):
        (WebCore::SearchInputType::cancelButtonElement):
        (WebCore::SearchInputType::destroyShadowSubtree):
        (WebCore::SearchInputType::subtreeHasChanged):
        * html/SearchInputType.h:
        (SearchInputType):

2012-08-19  Mike West  <mkwst@chromium.org>

        CSP 1.1: Add 'plugin-types' and 'form-action' DOM API.
        https://bugs.webkit.org/show_bug.cgi?id=94415

        Reviewed by Adam Barth.

        Experimental implementations of the new 'plugin-types' and 'form-action'
        directives recently landed, but we neglected to add DOM API endpoints to
        query their state. Those APIs have been added to the specification[1],
        and this patch brings our implementation up to date.

        Tests: http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowformaction.html
               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowplugintype.html

        * page/DOMSecurityPolicy.cpp:
        (isAllowed):
            As a drive-by, change a parameter from a KURL to a String to match
            the actual template. There's no reason to stringify an empty URL
            when we can just use an empty string instead.
        (isAllowedWithType):
            Call out to the ContentSecurityPolicy object to check the protected
            resource's ability to load a given media type.
        (WebCore::DOMSecurityPolicy::allowsFormAction):
            Call out to the ContentSecurityPolicy object to check the protected
            resource's ability to submit a form to the given URL.
        (WebCore):
        (WebCore::DOMSecurityPolicy::allowsPluginType):
            Pipes the plugin type through 'isAllowedWithType' for resolution.
        * page/DOMSecurityPolicy.h:
            Add the 'allowsPluginType' and 'allowsFormAction' methods.
        (DOMSecurityPolicy):
        * page/DOMSecurityPolicy.idl:
            Add the 'allowsPluginType' and 'allowsFormAction' methods.

2012-08-19  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: load network panel lazily
        https://bugs.webkit.org/show_bug.cgi?id=94414

        Reviewed by Vsevolod Vlasov.

        This change removes access to WebInspector.panels.network and loads it lazily.

        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:
        * inspector/front-end/ConsoleMessage.js:
        (WebInspector.ConsoleMessageImpl):
        (WebInspector.ConsoleMessageImpl.prototype.clone):
        * inspector/front-end/ConsoleModel.js:
        (WebInspector.ConsoleMessage.create):
        (WebInspector.ConsoleDispatcher.prototype.messageAdded):
        * inspector/front-end/ConsoleView.js:
        (WebInspector.ConsoleMessage.create):
        * inspector/front-end/NetworkLog.js:
        (WebInspector.NetworkLog):
        (WebInspector.NetworkLog.prototype._onRequestStarted):
        (WebInspector.NetworkLog.prototype._onLoad):
        (WebInspector.NetworkLog.prototype.requestForId):
        * inspector/front-end/NetworkManager.js:
        (WebInspector.NetworkDispatcher.prototype._updateNetworkRequestWithResponse):
        * inspector/front-end/NetworkPanel.js:
        (WebInspector.NetworkLogView):
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.ScriptSnippetModel.prototype.evaluateScriptSnippet.compileCallback):
        (WebInspector.ScriptSnippetModel.prototype.evaluateScriptSnippet):
        * inspector/front-end/externs.js:
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:
        (WebInspector._panelDescriptors):
        (WebInspector._showAnchorLocation):

2012-08-19  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r125976.
        http://trac.webkit.org/changeset/125976
        https://bugs.webkit.org/show_bug.cgi?id=94430

        it does not fix build. (Requested by pfeldman on #webkit).

        * GNUmakefile.am:
        * GNUmakefile.list.am:

2012-08-19  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix make distcheck.

        * GNUmakefile.am: Add idl files in Modules/quota to EXTRA_DIST.
        * GNUmakefile.list.am: Add missing files to compilation.

2012-08-19  Andreas Kling  <kling@webkit.org>

        Remove unused ElementAttributeData::removeAttribute() overload.
        <http://webkit.org/b/94425>

        Reviewed by Antti Koivisto.

        * dom/ElementAttributeData.h:
        (ElementAttributeData):

2012-08-18  Philip Rogers  <pdr@google.com>

        Refactor SVGMaskElement to inherit from StyledElement
        https://bugs.webkit.org/show_bug.cgi?id=94418

        Reviewed by Dirk Schulze.

        Previously, SVGMaskElement inherited from SVGStyledLocatableElement which includes
        several unnecessary functions (e.g., getBBox()). This patch refactors SVGMaskElement
        to inherit from SVGStyledElement which matches the spec:
        http://www.w3.org/TR/SVG/single-page.html#masking-InterfaceSVGMaskElement

        No new tests as this is just a refactoring.

        * svg/SVGMaskElement.cpp:
        (WebCore):
        (WebCore::SVGMaskElement::SVGMaskElement):
        * svg/SVGMaskElement.h:

2012-08-18  Andreas Kling  <kling@webkit.org>

        CSSValueList: Reserve the exact amount of space needed when constructing from CSS parser.
        (No bug URL as Bugzilla is down today.)

        Reviewed by Antti Koivisto.

        Use Vector::reserveInitialCapacity() when constructing a CSSValueList from a CSSParserValueList
        since we have the final length available. Also inlined the trivial append() and prepend().

        * css/CSSValueList.cpp:
        (WebCore::CSSValueList::CSSValueList):
        * css/CSSValueList.h:
        (WebCore::CSSValueList::append):
        (WebCore::CSSValueList::prepend):

2012-08-18  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: make profiles panel a lazily loaded module.
        https://bugs.webkit.org/show_bug.cgi?id=94351

        Reviewed by Yury Semikhatsky.

        - removed usages of WebInspector.panels.profiles.
        - made panel lazily loaded

        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:
        * inspector/front-end/CPUProfileView.js:
        (WebInspector.CPUProfileHeader.prototype.createView):
        * inspector/front-end/CSSSelectorProfileView.js:
        (WebInspector.CSSSelectorProfileType.prototype.buttonClicked):
        (WebInspector.CSSSelectorProfileType.prototype._startRecordingProfile):
        (WebInspector.CSSSelectorProfileType.prototype._stopRecordingProfile):
        (WebInspector.CSSProfileHeader.prototype.createView):
        * inspector/front-end/HeapSnapshotDataGrids.js:
        (WebInspector.HeapSnapshotSortableDataGrid.prototype.populateContextMenu.revealInDominatorsView):
        (WebInspector.HeapSnapshotSortableDataGrid.prototype.populateContextMenu.else.revealInSummaryView):
        (WebInspector.HeapSnapshotSortableDataGrid.prototype.populateContextMenu):
        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapSnapshotView.prototype._profiles):
        (WebInspector.HeapSnapshotView.prototype.populateContextMenu):
        (WebInspector.HeapSnapshotProfileType.prototype.buttonClicked):
        (WebInspector.HeapProfileHeader.prototype.createView):
        * inspector/front-end/InspectorFrontendAPI.js:
        (InspectorFrontendAPI.isProfilingJavaScript):
        (InspectorFrontendAPI.startProfilingJavaScript):
        (InspectorFrontendAPI.stopProfilingJavaScript):
        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.NativeMemoryProfileHeader.prototype.createView):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfileType.prototype.buttonClicked):
        (WebInspector.ProfileHeader.prototype.view):
        (WebInspector.ProfileHeader.prototype.createView):
        (WebInspector.ProfilesPanel.prototype.toggleRecordButton):
        (WebInspector.ProfilesPanel.prototype.showProfileForURL):
        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu.didReceiveHeapObjectId):
        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu):
        (WebInspector.ProfileSidebarTreeElement.prototype.handleContextMenuEvent):
        (WebInspector.ProfileGroupSidebarTreeElement.prototype.onselect):
        * inspector/front-end/Settings.js:
        * inspector/front-end/externs.js:
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:
        (WebInspector._panelDescriptors):
        (WebInspector._toggleSearchingForNode):
        (WebInspector._profilesLinkifier):
        (WebInspector._requestZoom.set InspectorFrontendHost):
        (WebInspector._requestZoom):
        (WebInspector.documentClick.followLink):
        (WebInspector.documentClick):

2012-08-18  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: load panels code on demand
        https://bugs.webkit.org/show_bug.cgi?id=94326

        Reviewed by Vsevolod Vlasov.

        - Introduces importScript that evals in debug mode and inlines for release
        - Loads Element, Resources, Timeline, Audits panels lazily.

        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/AuditsPanel.js:
        * inspector/front-end/CodeMirrorTextEditor.js:
        (WebInspector.CodeMirrorTextEditor):
        (WebInspector.CodeMirrorTextEditor.prototype._toRange):
        * inspector/front-end/Color.js:
        * inspector/front-end/ElementsPanel.js:
        * inspector/front-end/ExtensionServer.js:
        (WebInspector.ExtensionServer.prototype._onCreatePanel):
        * inspector/front-end/Panel.js:
        (WebInspector.Panel):
        (WebInspector.PanelDescriptor):
        (WebInspector.PanelDescriptor.prototype.panel):
        * inspector/front-end/ResourcesPanel.js:
        * inspector/front-end/SettingsScreen.js:
        (WebInspector.GenericSettingsTab):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame):
        * inspector/front-end/Spectrum.js:
        (WebInspector.Spectrum.prototype.get outputColorFormat):
        * inspector/front-end/StylesSidebarPane.js:
        * inspector/front-end/TimelinePanel.js:
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:
        (WebInspector._panelDescriptors):
        (WebInspector.doLoadedDone):
        * inspector/front-end/utilities.js:
        * inspector/inline-javascript-imports.py:
        (main):

2012-08-17  Keishi Hattori  <keishi@webkit.org>

        Calendar picker shows wrong date when input element has year earlier than 100
        https://bugs.webkit.org/show_bug.cgi?id=94100

        Reviewed by Kent Tamura.

        Date.UTC can't set an year earlier than 100. So when the input has a value earlier than 100, calendar picker shows the wrong date.

        Test: fast/forms/date/calendar-picker-appearance-pre-100.html

        * Resources/pagepopups/calendarPicker.js:
        (createUTCDate): Uses setUTCFullYear when the year is pre 100.
        (parseDateString):
        (DaysTable.prototype._renderMonth):
        (DaysTable.prototype._maybeSetPreviousMonth):
        (DaysTable.prototype._maybeSetNextMonth):

2012-08-17  Vangelis Kokkevis  <vangelis@chromium.org>

        [chromium] Fix random noise around text in FPS HUD.
        https://bugs.webkit.org/show_bug.cgi?id=94400

        Reviewed by James Robinson.

        This was the result of an incorrect clear operation on the canvas
        that stores the font atlas used by the HUD.


        * platform/graphics/chromium/CompositorHUDFontAtlas.cpp:
        (WebCore::CompositorHUDFontAtlas::generateFontAtlas):

2012-08-17  Dirk Pranke  <dpranke@chromium.org>

        Unreviewed, rolling out r125897.
        http://trac.webkit.org/changeset/125897
        https://bugs.webkit.org/show_bug.cgi?id=94326

        This patch seems to have broken the inspector on the apple mac bots.

        * WebCore.gypi:
        * inspector/compile-front-end.py:
        * inspector/front-end/AuditsPanel.js:
        * inspector/front-end/CodeMirrorTextEditor.js:
        (WebInspector.CodeMirrorTextEditor):
        (WebInspector.CodeMirrorTextEditor.prototype._toRange):
        (WebInspector.CodeMirrorTextEditor.prototype._loadLibraries.loadLibrary):
        (WebInspector.CodeMirrorTextEditor.prototype._loadLibraries):
        * inspector/front-end/Color.js:
        * inspector/front-end/ElementsPanel.js:
        * inspector/front-end/ExtensionServer.js:
        (WebInspector.ExtensionServer.prototype._onCreatePanel):
        * inspector/front-end/Panel.js:
        (WebInspector.Panel):
        (WebInspector.PanelDescriptor):
        (WebInspector.PanelDescriptor.prototype.panel):
        * inspector/front-end/ResourcesPanel.js:
        * inspector/front-end/SettingsScreen.js:
        (WebInspector.GenericSettingsTab):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame):
        * inspector/front-end/Spectrum.js:
        (WebInspector.Spectrum.prototype.get outputColorFormat):
        * inspector/front-end/StylesSidebarPane.js:
        * inspector/front-end/TimelinePanel.js:
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:
        (WebInspector._panelDescriptors):
        (WebInspector.doLoadedDone):
        * inspector/front-end/utilities.js:

2012-08-17  Chris Rogers  <crogers@google.com>

        AudioParam must support k-rate processing with audio-rate connections
        https://bugs.webkit.org/show_bug.cgi?id=94385

        Reviewed by Kenneth Russell.

        Fully implement AudioParam *final* value calculation according to spec:
        https://dvcs.w3.org/hg/audio/raw-file/tip/webaudio/specification.html#AudioParam

        In particular, this covers the case where the parameter is k-rate, and we also
        have audio-rate connections to the AudioParam.

        * Modules/webaudio/AudioParam.cpp:
        (WebCore::AudioParam::finalValue):
        (WebCore):
        (WebCore::AudioParam::calculateSampleAccurateValues):
        (WebCore::AudioParam::calculateFinalValues):
        * Modules/webaudio/AudioParam.h:
        (AudioParam):
        * Modules/webaudio/DelayDSPKernel.cpp:
        (WebCore::DelayDSPKernel::process):

2012-08-17  Alice Cheng  <alice_cheng@apple.com>

        Preserve styling elements in DeleteSelectionCommand
        <rdar://problem/12040676>
        https://bugs.webkit.org/show_bug.cgi?id=93643

        Reviewed by Ryosuke Niwa.

        Styling elements (<link> and <style>) can appear inside editable content. To 
        prevent accidental deletion, we move styling elements to rootEditableElement in
        DeleteSelectionCommand undoably.

        Test: editing/execCommand/delete-selection-has-style.html

        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss): Added to preserve styling elements during the command
        (WebCore::DeleteSelectionCommand::handleGeneralDelete):  Modified to preserve styling elements during the command
        * editing/DeleteSelectionCommand.h:
        (DeleteSelectionCommand):

2012-08-17  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r125940.
        http://trac.webkit.org/changeset/125940
        https://bugs.webkit.org/show_bug.cgi?id=94398

        "Causes crashes on the bots
        http://build.webkit.org/results/Apple%20Lion%20Debug%20WK2%20(Tests)/r125944%20(2626)/fast/css
        /first-letter-removed-added-crash-log.txt" (Requested by
        bradee-oh on #webkit).

        * rendering/RenderListItem.cpp:
        * rendering/RenderListItem.h:
        (RenderListItem):
        * rendering/RenderObject.cpp:
        * rendering/RenderObject.h:
        (RenderObject):
        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::removeChildNode):
        * rendering/RenderObjectChildList.h:
        (RenderObjectChildList):
        * rendering/RenderQuote.cpp:
        * rendering/RenderQuote.h:
        * rendering/RenderRegion.cpp:
        * rendering/RenderRegion.h:
        (RenderRegion):

2012-08-17  Sukolsak Sakshuwong  <sukolsak@google.com>

        Disconnect UndoManager when its undo scope host is destroyed
        https://bugs.webkit.org/show_bug.cgi?id=94388

        Reviewed by Ryosuke Niwa.

        Disconnect UndoManager in Element's destructor to prevent
        use-after-free vulnerabilities.

        Test: editing/undomanager/undoscopehost-use-after-free.html

        * dom/Element.cpp:
        (WebCore::Element::~Element):

2012-08-17  Dan Bernstein  <mitz@apple.com>

        Fixed incorrect references to JSVoidCallback.{cpp,h} in the project file.

        * WebCore.xcodeproj/project.pbxproj:

2012-08-17  Ryosuke Niwa  <rniwa@webkit.org>

        Fix Xcode project file.

        * WebCore.xcodeproj/project.pbxproj:

2012-08-17  Kangil Han  <kangil.han@samsung.com>

        [BlackBerry][EFL] Remove compile warning in WebCore
        https://bugs.webkit.org/show_bug.cgi?id=94328

        Reviewed by Rob Buis.

        Fixed compile time warning in WebCore.

        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::createEdje): unused variable ‘errmsg’ [-Wunused-variable]
        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp:
        (WebCore::HarfBuzzShaper::selectionRect): ‘toX’ may be used uninitialized in this function [-Wuninitialized], ‘fromX’ may be used uniniti

2012-08-17  Arnaud Renevier  <a.renevier@sisa.samsung.com>

        [V8] use checkInboundData in setWebGLArrayHelper
        https://bugs.webkit.org/show_bug.cgi?id=93051

        Reviewed by Kenneth Russell.

        Use TypedArray method checkInboundData in setWebGLArrayHelper instead
        of performing the computation manually.

        No new tests. This patch doesn't change behavior.

        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore::setWebGLArrayHelper):

2012-08-17  Alexey Proskuryakov  <ap@apple.com>

        REGRESSION (r125912): Crashes in worker tests
        https://bugs.webkit.org/show_bug.cgi?id=94390

        Reviewed by Brady Eidson and Sam Weinig.

        * bindings/js/JSDOMBinding.cpp: (WebCore::reportException): It's always fine
        to report an exception on a worker context, but it's not fine to treat those as windows.

2012-08-17  James Robinson  <jamesr@chromium.org>

        [chromium] Add missing header files to .gypi and missing include to CCTiledLayerImpl.cpp
        https://bugs.webkit.org/show_bug.cgi?id=94391

        Reviewed by Adrienne Walker.

        * WebCore.gypi:
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:

2012-08-17  David Grogan  <dgrogan@chromium.org>

        IndexedDB: Test if getting a TRANSACTION_INACTIVE_ERR is possible when setting version
        https://bugs.webkit.org/show_bug.cgi?id=94269

        Reviewed by Ojan Vafai.

        I don't see a path through which this code is exercised.
        ASSERT_NOT_REACHED doesn't cause any of our tests to fail. It might be
        timing-related, in which case this ASSERT should be sporadically hit.
        If this ASSERT is hit, see if we can write a test that exercises it or
        at least add comments explaining how it gets exercised. If this ASSERT
        is not hit after a while, change it to
        ASSERT(transaction.scheduleTask(...)).

        No new tests, we're looking for existing tests to fail.

        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::setVersion):
        (WebCore::IDBDatabaseBackendImpl::runIntVersionChangeTransaction):

2012-08-17  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r125922.
        http://trac.webkit.org/changeset/125922
        https://bugs.webkit.org/show_bug.cgi?id=94389

        "Causing failing/crashing tests on Mac bots" (Requested by
        bradee-oh on #webkit).

        * WebCore.gypi:
        * inspector/front-end/CPUProfileView.js:
        (WebInspector.CPUProfileHeader.prototype.createView):
        * inspector/front-end/CSSSelectorProfileView.js:
        (WebInspector.CSSSelectorProfileType.prototype.buttonClicked):
        (WebInspector.CSSSelectorProfileType.prototype._startRecordingProfile):
        (WebInspector.CSSSelectorProfileType.prototype._stopRecordingProfile):
        (WebInspector.CSSProfileHeader.prototype.createView):
        * inspector/front-end/HeapSnapshotDataGrids.js:
        (WebInspector.HeapSnapshotSortableDataGrid.prototype.populateContextMenu.revealInDominatorsView):
        (WebInspector.HeapSnapshotSortableDataGrid.prototype.populateContextMenu.else.revealInSummaryView):
        (WebInspector.HeapSnapshotSortableDataGrid.prototype.populateContextMenu):
        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapSnapshotView.prototype._profiles):
        (WebInspector.HeapSnapshotView.prototype.populateContextMenu):
        (WebInspector.HeapSnapshotProfileType.prototype.buttonClicked):
        (WebInspector.HeapProfileHeader.prototype.createView):
        * inspector/front-end/InspectorFrontendAPI.js:
        (InspectorFrontendAPI.isProfilingJavaScript):
        (InspectorFrontendAPI.startProfilingJavaScript):
        (InspectorFrontendAPI.stopProfilingJavaScript):
        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.NativeMemoryProfileHeader.prototype.createView):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfileType.prototype.buttonClicked):
        (WebInspector.ProfileHeader.prototype.view):
        (WebInspector.ProfileHeader.prototype.createView):
        (WebInspector.ProfilesPanel.prototype.toggleRecordButton):
        (WebInspector.ProfilesPanel.prototype.showProfileForURL):
        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu.didReceiveHeapObjectId):
        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu):
        (WebInspector.ProfileSidebarTreeElement.prototype.handleContextMenuEvent):
        (WebInspector.ProfileGroupSidebarTreeElement.prototype.onselect):
        * inspector/front-end/Settings.js:
        * inspector/front-end/externs.js:
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:
        (WebInspector._panelDescriptors):
        (WebInspector._toggleSearchingForNode):
        (WebInspector._requestZoom.set InspectorFrontendHost):
        (WebInspector._requestZoom):
        (WebInspector.documentClick.followLink):
        (WebInspector.documentClick):
        (WebInspector.frontendReused):

2012-08-17  Julien Chaffraix  <jchaffraix@webkit.org>

        Introduce a will-be-removed-from-tree notification in RenderObject
        https://bugs.webkit.org/show_bug.cgi?id=94271

        Reviewed by Abhishek Arya.

        Following bug 93874, we have an insertion notification. This change adds the
        matching removal notification (willBeRemovedFromTree).

        Refactoring covered by existing tests.

        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::removeChildNode):
        Removed the code from here and moved it below.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::willBeRemovedFromTree):
        * rendering/RenderObject.h:
        This is the base function that should be called by every instance.

        * rendering/RenderListItem.cpp:
        (WebCore::RenderListItem::willBeRemovedFromTree):
        * rendering/RenderListItem.h:
        * rendering/RenderQuote.cpp:
        (WebCore::RenderQuote::willBeRemovedFromTree):
        * rendering/RenderQuote.h:
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::willBeRemovedFromTree):
        * rendering/RenderRegion.h:
        Overriden functions.

2012-08-17  Brian Anderson  <brianderson@chromium.org>

        Fix vsyncTick drought when vsync throttling is disabled
        https://bugs.webkit.org/show_bug.cgi?id=94012

        Reviewed by James Robinson.

        CCFrameRateController made an assumption that every vsyncTick results
        in a call to didBeginFrame, which is not necessarily true and causes
        the CCFrameRateController to stop ticking when vsync is disabled. We
        move the manual ticks out of didBeginFrame and manually tick in the
        proper place.

        CCFrameRateControllerTest updated with use cases that should tick
        without a didBeginFrame and will fail without this patch.

        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
        (WebCore::CCFrameRateController::setActive):
        (WebCore::CCFrameRateController::onTimerTick):
        (WebCore::CCFrameRateController::didBeginFrame):

2012-08-16  Ojan Vafai  <ojan@chromium.org>

        Delete some dead code in RenderBox::computePercentageLogicalHeight
        https://bugs.webkit.org/show_bug.cgi?id=94262

        Reviewed by Tony Chang.

        I'm pretty sure this is dead code. None of the layout tests hit this code,
        including the ones added in the original patch http://trac.webkit.org/changeset/10983.
        I spent a good while and could not concoct a test that hits this code.

        The test-cases added in that file, as well as the test-cases I came up with that should
        go through this codepath, instead go through computePositionedLogicalHeight and never 
        hit computePercentageLogicalHeight.
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computePercentageLogicalHeight):

2012-08-17  Benjamin Poulain  <bpoulain@apple.com>

        Make it easier to append a literal to StringBuilder
        https://bugs.webkit.org/show_bug.cgi?id=94273

        Reviewed by Kentaro Hara.

        Use StringBuilder::appendLiteral() in MarkupAccumulator instead of computing every
        value individually.

        * editing/MarkupAccumulator.cpp:
        (WebCore::MarkupAccumulator::appendComment):
        (WebCore::MarkupAccumulator::appendXMLDeclaration):
        (WebCore::MarkupAccumulator::appendDocumentType):
        (WebCore::MarkupAccumulator::appendCDATASection):

2012-08-17  Benjamin Poulain  <bpoulain@apple.com>

        Share the StringImpl the CSS property names
        https://bugs.webkit.org/show_bug.cgi?id=94187

        Reviewed by Alexey Proskuryakov.

        Previously, we would instanciate a new String every time a CSS property name was needed.

        This patches moves the creation of the AtomicString to CSSPropertyNames and reuse that
        StringImpl whenever needed.

        With the patch, accessing CSS property names from JavaScript gets about 2.1 times faster.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        (WebCore::CSSComputedStyleDeclaration::item):
        * css/CSSPrimitiveValue.cpp:
        (WebCore::valueOrPropertyName):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::cssName):
        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::item):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyShorthand):
        * css/makeprop.pl:
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::getSupportedCSSProperties):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyle::styleWithProperties):
        * page/animation/ImplicitAnimation.cpp:
        (WebCore::ImplicitAnimation::sendTransitionEvent):

2012-08-16  James Robinson  <jamesr@chromium.org>

        [chromium] Add Source/WebCore/platform/graphics/chromium/cc/ to include path and remove cc/ prefix from includes
        https://bugs.webkit.org/show_bug.cgi?id=94279

        Reviewed by Adam Barth.

        This brings us more in line with the rest of the WebKit repo and avoids potential header collisions during
        transition.

        * WebCore.gyp/WebCore.gyp:
        * platform/chromium/support/CCThreadImpl.cpp:
        * platform/chromium/support/CCThreadImpl.h:
        * platform/chromium/support/WebCompositorImpl.cpp:
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/ContentLayerChromium.cpp:
        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.cpp:
        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.h:
        * platform/graphics/chromium/IOSurfaceLayerChromium.cpp:
        * platform/graphics/chromium/ImageLayerChromium.cpp:
        * platform/graphics/chromium/LayerChromium.cpp:
        * platform/graphics/chromium/LayerChromium.h:
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        * platform/graphics/chromium/LayerRendererChromium.h:
        * platform/graphics/chromium/LayerTextureUpdater.h:
        * platform/graphics/chromium/LinkHighlight.cpp:
        * platform/graphics/chromium/RateLimiter.cpp:
        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        * platform/graphics/chromium/SolidColorLayerChromium.cpp:
        * platform/graphics/chromium/TextureLayerChromium.cpp:
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        * platform/graphics/chromium/TiledLayerChromium.h:
        * platform/graphics/chromium/TreeSynchronizer.cpp:
        * platform/graphics/chromium/VideoLayerChromium.cpp:
        * platform/graphics/chromium/cc/CCActiveAnimation.cpp:
        * platform/graphics/chromium/cc/CCActiveGestureAnimation.cpp:
        * platform/graphics/chromium/cc/CCAnimationCurve.cpp:
        * platform/graphics/chromium/cc/CCAnimationEvents.h:
        * platform/graphics/chromium/cc/CCCheckerboardDrawQuad.cpp:
        * platform/graphics/chromium/cc/CCCheckerboardDrawQuad.h:
        * platform/graphics/chromium/cc/CCDamageTracker.cpp:
        * platform/graphics/chromium/cc/CCDebugBorderDrawQuad.cpp:
        * platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h:
        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp:
        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.h:
        * platform/graphics/chromium/cc/CCDrawQuad.cpp:
        * platform/graphics/chromium/cc/CCDrawQuad.h:
        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
        * platform/graphics/chromium/cc/CCFrameRateController.h:
        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.h:
        * platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.cpp:
        * platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.h:
        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.h:
        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp:
        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h:
        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        * platform/graphics/chromium/cc/CCLayerIterator.cpp:
        * platform/graphics/chromium/cc/CCLayerIterator.h:
        * platform/graphics/chromium/cc/CCLayerQuad.cpp:
        * platform/graphics/chromium/cc/CCLayerSorter.cpp:
        * platform/graphics/chromium/cc/CCLayerSorter.h:
        * platform/graphics/chromium/cc/CCLayerTilingData.cpp:
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        * platform/graphics/chromium/cc/CCMathUtil.cpp:
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
        * platform/graphics/chromium/cc/CCOverdrawMetrics.cpp:
        * platform/graphics/chromium/cc/CCPageScaleAnimation.cpp:
        * platform/graphics/chromium/cc/CCPrioritizedTexture.h:
        * platform/graphics/chromium/cc/CCProxy.cpp:
        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        * platform/graphics/chromium/cc/CCRenderPass.h:
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:
        * platform/graphics/chromium/cc/CCRenderer.h:
        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
        * platform/graphics/chromium/cc/CCResourceProvider.h:
        * platform/graphics/chromium/cc/CCScheduler.cpp:
        * platform/graphics/chromium/cc/CCScheduler.h:
        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
        * platform/graphics/chromium/cc/CCScopedTexture.cpp:
        * platform/graphics/chromium/cc/CCScopedTexture.h:
        * platform/graphics/chromium/cc/CCScopedThreadProxy.h:
        * platform/graphics/chromium/cc/CCScrollbarAnimationController.cpp:
        * platform/graphics/chromium/cc/CCScrollbarAnimationControllerLinearFade.cpp:
        * platform/graphics/chromium/cc/CCScrollbarAnimationControllerLinearFade.h:
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
        * platform/graphics/chromium/cc/CCSettings.cpp:
        * platform/graphics/chromium/cc/CCSharedQuadState.cpp:
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        * platform/graphics/chromium/cc/CCSolidColorDrawQuad.cpp:
        * platform/graphics/chromium/cc/CCSolidColorDrawQuad.h:
        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.h:
        * platform/graphics/chromium/cc/CCStreamVideoDrawQuad.cpp:
        * platform/graphics/chromium/cc/CCStreamVideoDrawQuad.h:
        * platform/graphics/chromium/cc/CCTexture.cpp:
        * platform/graphics/chromium/cc/CCTexture.h:
        * platform/graphics/chromium/cc/CCTextureDrawQuad.cpp:
        * platform/graphics/chromium/cc/CCTextureDrawQuad.h:
        * platform/graphics/chromium/cc/CCTextureLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCTextureLayerImpl.h:
        * platform/graphics/chromium/cc/CCTextureUpdateController.cpp:
        * platform/graphics/chromium/cc/CCTextureUpdateController.h:
        * platform/graphics/chromium/cc/CCTextureUpdateQueue.cpp:
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        * platform/graphics/chromium/cc/CCThreadTask.h:
        * platform/graphics/chromium/cc/CCTileDrawQuad.cpp:
        * platform/graphics/chromium/cc/CCTileDrawQuad.h:
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
        * platform/graphics/chromium/cc/CCTimer.cpp:
        * platform/graphics/chromium/cc/CCTimingFunction.cpp:
        * platform/graphics/chromium/cc/CCTimingFunction.h:
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
        * platform/graphics/chromium/cc/CCYUVVideoDrawQuad.cpp:
        * platform/graphics/chromium/cc/CCYUVVideoDrawQuad.h:
        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:

2012-08-17  Ojan Vafai  <ojan@chromium.org>

        Delete dead code in deprecated flexbox for RTL line-clamp
        https://bugs.webkit.org/show_bug.cgi?id=94282

        Reviewed by Tony Chang.

        -webkit-line-clamp and direction:rtl is not supported. Delete some
        obviously dead code that half-tries to support it.
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::applyLineClamp):

2012-08-17  John Mellor  <johnme@chromium.org>

        Text Autosizing: Increase line height in proportion to font size.
        https://bugs.webkit.org/show_bug.cgi?id=91660

        Reviewed by Julien Chaffraix.

        This patch causes line heights to be increased in proportion to font
        size (so autosized text doesn't overlap itself). It does this by adding
        a textAutosizingMultiplier() to RenderStyle, which the lineHeight()
        getter multiplies its response by.

        It also cleans up one or two things, for example treatAsInline is
        renamed isNotAnAutosizingContainer to clarify that its purpose is to
        discriminate autosizing containers (the smallest unit that we can turn
        Text Autosizing on or off for; in particular these are not allowed to
        be line participants, since multiple sizes on one line looks awful).

        Tests: fast/text-autosizing/em-margin-border-padding.html
               fast/text-autosizing/narrow-child.html
               fast/text-autosizing/nested-em-line-height.html
               fast/text-autosizing/simple-paragraph.html
               fast/text-autosizing/span-child.html
               fast/text-autosizing/wide-child.html

        * css/StyleBuilder.cpp:
        (WebCore::ApplyPropertyLineHeight::applyValue):

            Replaced Length(-100.0, Percent) with RenderStyle::initialLineHeight(),
            which is equivalent but makes the intent clearer.

        (WebCore::ApplyPropertyLineHeight::createHandler):

            Use specifiedLineHeight to match setLineHeight which takes a specified
            line height (and generally this avoids accidentally inheriting text
            autosizing).

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::applyProperty):

            Similarly use specifiedLineHeight when inheriting line height.

        * page/animation/CSSPropertyAnimation.cpp:
        (WebCore::CSSPropertyAnimation::ensurePropertyMap):

            Get and set specified lineHeight/fontSize if Text Autosizing is
            enabled to avoid setting the specified value to the computed value
            (causing values to be multiplied more than once!).

        * platform/blackberry/RenderThemeBlackBerry.cpp:
        (WebCore::RenderThemeBlackBerry::adjustMediaControlStyle):

            Adjust for renamed setBlendedFontSize, and maintain cast to int.

        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):

            Replaced Length(-100.0, Percent) with RenderStyle::initialLineHeight(),
            which is equivalent but makes the intent clearer.

        * rendering/TextAutosizer.cpp:
        (WebCore::TextAutosizer::processSubtree):

            Use nextInPreOrderMatchingFilter instead of traverseNext, and some
            other methods that got renamed.

        (WebCore::TextAutosizer::processBox):

            Renamed from processBlock, since RenderBoxes are sufficient; use
            renamed nextInPreOrderMatchingFilter; make two calls to setMultiplier
            (one for parent for line height) instead of processText.

        (WebCore::TextAutosizer::setMultiplier):

            Simplified from previous processText method; this just sets the
            style's textAutosizingMultiplier (and the style does the rest).

        (WebCore::TextAutosizer::isNotAnAutosizingContainer):

            Renamed from treatAsInline; added explanatory comment; changed
            isRenderBlock to isBox as boxes still have logicalWidth; changed
            isInlineBlockOrInlineTable to isInline as it was an omission that
            other inlines were allowed.

        (WebCore::TextAutosizer::nextInPreOrderMatchingFilter):

            Renamed from TextAutosizer::traverseNext.

        (RenderObjectFilterFunctor):

            Renamed from RenderObjectFilter to clafiry that it's a function ptr.

        * rendering/TextAutosizer.h:
        (TextAutosizer): Previously mentioned renamings.

        * rendering/mathml/RenderMathMLSubSup.cpp:
        (WebCore::RenderMathMLSubSup::fixScriptsStyle):

            Adjust for renamed setBlendedFontSize.

        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::diff):

            textAutosizingMultiplier is a StyleDifferenceLayout (we want
            setNeedsLayoutAndPrefWidthsRecalc to get called).

        (WebCore::RenderStyle::setFontSize):

            Renamed from setBlendedFontSize; if Text Autosizing is enabled and a
            multiplier is set it auto-calculates the computedSize; float
            param instead of int as discussed on webkit.org/b/91660.

        * rendering/style/RenderStyle.h:

            Added specifiedFontSize, computedFontSize and specifiedLineHeight
            getters; changed lineHeight to dynamically calculate autosized line
            height, and made computedLineHeight use this value instead of the
            specified line height; also added textAutosizingMultiplier
            getter/setter (the setter updated the font description's computed
            size, by calling setFontSize); also renamed the parameter to
            setLineHeight to explicitly note that it's setting the
            specifiedLineHeight (and can still be adjusted by autosizing).

        * rendering/style/StyleVisualData.cpp/.h:

            Added m_textAutosizingMultiplier (this seems the best place to put a
            non-inherited non-rare presentational property).

2012-08-17  Raphael Kubo da Costa  <rakuco@webkit.org>

        [CMake] Add FindDBus.cmake and use it in the EFL port.
        https://bugs.webkit.org/show_bug.cgi?id=94319

        Reviewed by Daniel Bates.

        * PlatformEfl.cmake: Link against DBUS_LIBRARIES and add
        DBUS_INCLUDE_DIRS to the include path list if BATTERY_STATUS
        support is enabled.

2012-08-17  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: make profiles panel a lazily loaded module.
        https://bugs.webkit.org/show_bug.cgi?id=94351

        Reviewed by Yury Semikhatsky.

        Moving files from .html to importScript.

        * WebCore.gypi:
        * inspector/front-end/CPUProfileView.js:
        (WebInspector.CPUProfileHeader.prototype.createView):
        * inspector/front-end/CSSSelectorProfileView.js:
        (WebInspector.CSSSelectorProfileType.prototype.buttonClicked):
        (WebInspector.CSSSelectorProfileType.prototype._startRecordingProfile):
        (WebInspector.CSSSelectorProfileType.prototype._stopRecordingProfile):
        (WebInspector.CSSProfileHeader.prototype.createView):
        * inspector/front-end/HeapSnapshotDataGrids.js:
        (WebInspector.HeapSnapshotSortableDataGrid.prototype.populateContextMenu.revealInDominatorsView):
        (WebInspector.HeapSnapshotSortableDataGrid.prototype.populateContextMenu.else.revealInSummaryView):
        (WebInspector.HeapSnapshotSortableDataGrid.prototype.populateContextMenu):
        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapSnapshotView.prototype._profiles):
        (WebInspector.HeapSnapshotView.prototype.populateContextMenu):
        (WebInspector.HeapSnapshotProfileType.prototype.buttonClicked):
        (WebInspector.HeapProfileHeader.prototype.createView):
        * inspector/front-end/InspectorFrontendAPI.js:
        (InspectorFrontendAPI.isProfilingJavaScript):
        (InspectorFrontendAPI.startProfilingJavaScript):
        (InspectorFrontendAPI.stopProfilingJavaScript):
        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.NativeMemoryProfileHeader.prototype.createView):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfileType.prototype.buttonClicked):
        (WebInspector.ProfileHeader.prototype.view):
        (WebInspector.ProfileHeader.prototype.createView):
        (WebInspector.ProfilesPanel.prototype.toggleRecordButton):
        (WebInspector.ProfilesPanel.prototype.showProfileForURL):
        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu.didReceiveHeapObjectId):
        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu):
        (WebInspector.ProfileSidebarTreeElement.prototype.handleContextMenuEvent):
        (WebInspector.ProfileGroupSidebarTreeElement.prototype.onselect):
        * inspector/front-end/externs.js:
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:
        (WebInspector._panelDescriptors):
        (WebInspector._toggleSearchingForNode):
        (WebInspector._profilesLinkifier):
        (WebInspector._requestZoom.set InspectorFrontendHost):
        (WebInspector._requestZoom):
        (WebInspector.documentClick.followLink):
        (WebInspector.documentClick):

2012-08-17  Dominic Mazzoni  <dmazzoni@google.com>

        REGRESSION(r125710) - canvas-fallback-content tests asserting in Chromium
        https://bugs.webkit.org/show_bug.cgi?id=94156

        Reviewed by Chris Fleizach.

        When determining if a Node is focusable, check the canvas subtree
        case first before encountering assertions that assume that anything
        focusable must have an associated renderer.

        Fixes existing tests so they don't assert.

        * dom/Node.cpp:
        (WebCore::Node::isFocusable):

2012-08-17  Arpita Bahuguna  <arpitabahuguna@gmail.com>

        ASSERTION FAILED: allocatedMaxLogicalWidth <= cellMaxLogicalWidth : int WebCore::AutoTableLayout::calcEffectiveLogicalWidth()
        https://bugs.webkit.org/show_bug.cgi?id=92471

        Reviewed by Julien Chaffraix.

        The assert occurs due to the float based computations causing a floating
        point rounding error between allocatedMaxLogicalWidth and cellMaxLogicalWidth.

        Test: fast/table/assert-autotablelayout-maxlogicalwidth.html

        * rendering/AutoTableLayout.cpp:
        (WebCore::AutoTableLayout::calcEffectiveLogicalWidth):
        Converting float based calculations for computing max logical width to int based;
        similar to the calculations for min logical width.

2012-08-17  John J. Barton  <johnjbarton@chromium.org>

        Web Inspector: Add //@ sourceURL to test-runner evals
        https://bugs.webkit.org/show_bug.cgi?id=94268

        Reviewed by Pavel Feldman.

        Postpend a line that tells the debugger what to call this eval buffer.
        Name ends in the sequennce number so all evals will appear together.
        evaluateInWebInspector0.js eg

        * inspector/front-end/TestController.js:
        (WebInspector.evaluateForTestInFrontend):

2012-08-17  Adam Barth  <abarth@webkit.org>

        REGRESSION (r125592): Crash in Console::addMessage, under InjectedBundle::reportException
        https://bugs.webkit.org/show_bug.cgi?id=94220

        Reviewed by Alexey Proskuryakov.

        Previously, this code was trying to detect whether a DOMWindow is
        currently displayed in a Frame by testing whether
        DOMWindow->scriptExecutionContext is zero. That used to work, but now
        that DOMWindow->scriptExecutionContext is non-zero for detached
        DOMWindow, this code doesn't work anymore. This patch replaces the code
        with the current idiom, which is to call
        DOMWindow::isCurrentDisplayedInFrame.

        Alexey and I couldn't figure out how to test this change. This bug
        causes a crash when some Safari extensions are installed, but it's not
        clear whether this bug can be triggered from the web platform. We're
        going to ask Jessie for ideas when she gets back from vacation.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::reportException):

2012-08-17  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r125892.
        http://trac.webkit.org/changeset/125892
        https://bugs.webkit.org/show_bug.cgi?id=94350

        Broke windows build (Requested by vollick on #webkit).

        * platform/graphics/chromium/cc/CCActiveAnimation.cpp:
        (WebCore::CCActiveAnimation::CCActiveAnimation):
        (WebCore::CCActiveAnimation::~CCActiveAnimation):
        (WebCore::CCActiveAnimation::setRunState):
        (WebCore::CCActiveAnimation::cloneForImplThread):
        * platform/graphics/chromium/cc/CCActiveAnimation.h:
        (CCActiveAnimation):
        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
        (WebCore::CCLayerAnimationController::pushNewAnimationsToImplThread):
        (WebCore):
        (WebCore::CCLayerAnimationController::replaceImplThreadAnimations):
        (WebCore::CCLayerAnimationController::tickAnimations):

2012-08-17  Zach Kuznia  <zork@chromium.org>

        Add support for Skia Magnifier filter to Chromium layers
        https://bugs.webkit.org/show_bug.cgi?id=93939

        Reviewed by James Robinson.

        This is used by Chrome OS for the screen magnifier

        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:
        (WebCore::CCRenderSurfaceFilters::optimize):
        (WebCore::CCRenderSurfaceFilters::apply):

2012-08-17  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Touch adjustment for context menu gestures
        https://bugs.webkit.org/show_bug.cgi?id=94101

        Reviewed by Antonio Gomes.

        Adds a new filter for detecting nodes that provides extra context-menu items, 
        and use that in a new set of functions for adjusting context-menu gestures.

        Tests: touchadjustment/context-menu-select-text.html
               touchadjustment/context-menu.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::bestContextMenuNodeForTouchPoint):
        (WebCore::EventHandler::adjustGesturePosition):
        * page/EventHandler.h:
        (EventHandler):
        * page/TouchAdjustment.cpp:
        (WebCore::TouchAdjustment::nodeProvidesContextMenuItems):
        (TouchAdjustment):
        (WebCore::findBestContextMenuCandidate):
        * page/TouchAdjustment.h:
        * testing/Internals.cpp:
        (WebCore::Internals::touchPositionAdjustedToBestContextMenuNode):
        (WebCore::Internals::touchNodeAdjustedToBestContextMenuNode):
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-08-17  Pavel Feldman  <pfeldman@chromium.org>

        https://bugs.webkit.org/show_bug.cgi?id=94326

        Reviewed by Vsevolod Vlasov.

        Loading code on demand (upon the panel access).

        * WebCore.gypi:
        * inspector/front-end/AuditsPanel.js:
        * inspector/front-end/CodeMirrorTextEditor.js:
        (WebInspector.CodeMirrorTextEditor):
        (WebInspector.CodeMirrorTextEditor.prototype._toRange):
        * inspector/front-end/ElementsPanel.js:
        * inspector/front-end/ExtensionServer.js:
        (WebInspector.ExtensionServer.prototype._onCreatePanel):
        * inspector/front-end/Panel.js:
        (WebInspector.Panel):
        (WebInspector.PanelDescriptor):
        (WebInspector.PanelDescriptor.prototype.panel):
        * inspector/front-end/ResourcesPanel.js:
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame):
        * inspector/front-end/TimelinePanel.js:
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:
        (WebInspector._panelDescriptors):
        (WebInspector.doLoadedDone):
        * inspector/front-end/utilities.js:

2012-08-17  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r125880.
        http://trac.webkit.org/changeset/125880
        https://bugs.webkit.org/show_bug.cgi?id=94347

        Breaks front-end compilation: SourceFrame passed where View is
        expected. (Requested by pfeldman on #webkit).

        * inspector/front-end/CodeMirrorTextEditor.js:
        (WebInspector.CodeMirrorTextEditor.prototype._loadLibraries):
        * inspector/front-end/DefaultTextEditor.js:
        (WebInspector.DefaultTextEditor.prototype.wasShown):
        (WebInspector.DefaultTextEditor.prototype.willHide):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame):
        (WebInspector.JavaScriptSourceFrame.prototype.wasShown):
        (WebInspector.JavaScriptSourceFrame.prototype.willHide):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame):
        (WebInspector.SourceFrame.prototype.wasShown):
        (WebInspector.SourceFrame.prototype.willHide):
        * inspector/front-end/TextEditor.js:
        * inspector/front-end/scriptsPanel.css:
        (.script-view):
        (.script-view.visible):

2012-08-17  Milian Wolff  <milian.wolff@kdab.com>

        [Qt] QNX build fails due to ctype usage in system headers
        https://bugs.webkit.org/show_bug.cgi?id=93849

        Reviewed by Simon Hausmann.

        Move the check for whether DisallowCType should be active or not
        to the DisallowCType.h header. This way, we can update the list
        of platforms or OSes which do not work with this header in a
        central place. All users can now safely include the header
        and do not need to place custom guards around it.

        * config.h:

2012-08-17  Simon Hausmann  <simon.hausmann@nokia.com>

        Unreviewed trivial build fix: Correct file name in bindings/js/DOMTransaction.h used in HEADERS

        * Target.pri:

2012-08-17  Ian Vollick  <vollick@chromium.org>

        [chromium] Add tracing for active composited animations
        https://bugs.webkit.org/show_bug.cgi?id=84210

        Reviewed by James Robinson.

        This patch issues the trace events from the animations. Animations will
        report when they start and finish on the main and impl threads (via
        TRACE_EVENT_ASYNC*), and also issues instant trace events whenever they
        change state.

        No new tests, only changes tracing behavior.

        * platform/graphics/chromium/cc/CCActiveAnimation.cpp:
        (WebCore::CCActiveAnimation::CCActiveAnimation):
        (WebCore::CCActiveAnimation::~CCActiveAnimation):
        (WebCore::CCActiveAnimation::setRunState):
        (WebCore::CCActiveAnimation::clone):
        (WebCore):
        (WebCore::CCActiveAnimation::cloneAndInitialize):
        * platform/graphics/chromium/cc/CCActiveAnimation.h:
        (WebCore::CCActiveAnimation::isControllingInstance):
        (CCActiveAnimation):
        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
        (WebCore::CCLayerAnimationController::pushNewAnimationsToImplThread):
        (WebCore::CCLayerAnimationController::replaceImplThreadAnimations):
        (WebCore::CCLayerAnimationController::tickAnimations):

2012-08-17  John J. Barton  <johnjbarton@chromium.org>

        Web Inspector: enhance external test-runner and add cleanup code
        https://bugs.webkit.org/show_bug.cgi?id=94231

        Reviewed by Pavel Feldman.

        add 'click on test result to select for next run' feature.
        remember the users size for the inspector popup.
        refactor server URLs to one location at top of file.
        use the same value for both tests and scanner servers.
        remove one extra instruction on the page.
        refactor clean up code.
        close the two popup windows if the test-runner.html is reloaded.

        * inspector/front-end/test-runner.html:

2012-08-17  Simon Hausmann  <simon.hausmann@nokia.com>

        Unreviewed trivial follow-up fix to r125873: Add missing adoptRef to avoid leaks.

        * bridge/qt/qt_instance.cpp:
        (JSC::Bindings::WeakMap::set):

2012-08-17  Kentaro Hara  <haraken@chromium.org>

        Remove RefPtr from DateInputType::m_pickerElement
        https://bugs.webkit.org/show_bug.cgi?id=94330

        Reviewed by Kent Tamura.

        To avoid reference cycles of RefPtr<Node>s, we want to remove
        unnecessary RefPtr<Node>s. The rationale is describe in bug 94324.

        DateInputType::m_pickerElement does not need to be a RefPtr<Node>,
        because it is guaranteed to point to a shadow DOM tree of the DateInputType
        node, which is guaranteed to exist in the subtree of the DateInputType node.

        No tests. No change in behavior.

        * html/DateInputType.cpp:
        (WebCore::DateInputType::DateInputType):
        (WebCore::DateInputType::createShadowSubtree):
        (WebCore::DateInputType::destroyShadowSubtree):
        * html/DateInputType.h:
        (DateInputType):

2012-08-17  Dan Carney  <dcarney@google.com>

        Refactor away IsolatedWorld
        https://bugs.webkit.org/show_bug.cgi?id=93971

        Reviewed by Kentaro Hara.

        Remove IsolatedWorld class as it was 1:1 with DOMWrapperWorld.
        This update fixes a bad assertion which caused the previous
        version to be rolled back.

        No tests.  No change in functionality.

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/v8/DOMWrapperWorld.cpp:
        (WebCore):
        (WebCore::mainThreadNormalWorld):
        * bindings/v8/DOMWrapperWorld.h:
        (WebCore):
        (DOMWrapperWorld):
        (WebCore::DOMWrapperWorld::create):
        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
        (WebCore::DOMWrapperWorld::count):
        (WebCore::DOMWrapperWorld::worldId):
        (WebCore::DOMWrapperWorld::domDataStore):
        (WebCore::DOMWrapperWorld::DOMWrapperWorld):
        * bindings/v8/IsolatedWorld.cpp: Removed.
        * bindings/v8/IsolatedWorld.h: Removed.
        * bindings/v8/V8DOMWrapper.h:
        (WebCore::V8DOMWrapper::getCachedWrapper):
        * bindings/v8/V8IsolatedContext.cpp:
        (WebCore::V8IsolatedContext::V8IsolatedContext):
        (WebCore::V8IsolatedContext::destroy):
        * bindings/v8/V8IsolatedContext.h:
        (WebCore::V8IsolatedContext::getEntered):
        (WebCore::V8IsolatedContext::world):
        (V8IsolatedContext):
        * bindings/v8/V8PerIsolateData.h:
        (WebCore::V8PerIsolateData::registerDOMDataStore):
        (WebCore::V8PerIsolateData::unregisterDOMDataStore):

2012-08-17  Kangil Han  <kangil.han@samsung.com>

        [EFL] Remove alloca usage
        https://bugs.webkit.org/show_bug.cgi?id=93931

        Reviewed by Carlos Garcia Campos.

        This patch is unifying the approaches for the creation of Edje_Message_Float_Set messages, and getting rid of alloca is part of it, since it is not portable.

        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::paintThemePart):
        * platform/efl/ScrollbarEfl.cpp:
        (ScrollbarEfl::updateThumbPositionAndProportion):

2012-08-17  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: hovering over an image link in Timeline popup kills popup
        https://bugs.webkit.org/show_bug.cgi?id=94213

        Reviewed by Pavel Feldman.

        - Fixed bug with ElementsPanel PopoverHelper acting on the TimelinePanel (due to which the original issue occurs).
        - Image preview added to resource entries popover in the timeline.
        - Extracted the core image preview building code into UIUtils.js.
        - Drive-by: fixed image centering in the preview element.

        * inspector/front-end/ElementsPanel.js:
        (WebInspector.ElementsPanel):
        (WebInspector.ElementsPanel.prototype._showPopover.showPopover):
        (WebInspector.ElementsPanel.prototype._showPopover):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype._showPopover.showCallback):
        (WebInspector.TimelinePanel.prototype._showPopover):
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.needsPreviewElement):
        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):
        First build the image preview element if necessary, then do everything else.
        (WebInspector.TimelinePresentationModel.Record.prototype._generatePopupContentWithImagePreview):
        Original generatePopupContent() code plus the preview generation when necessary.
        * inspector/front-end/UIUtils.js:
        (WebInspector.buildImagePreviewContents.errorCallback):
        (WebInspector.buildImagePreviewContents.buildContent):
        (WebInspector.buildImagePreviewContents): Extracted from ElementsPanel. Enabled building of preview elements without the dimensions text data.
        * inspector/front-end/elementsPanel.css:
        (.image-preview-container):
        (.image-preview-container img):
        * inspector/front-end/timelinePanel.css:
        (.image-preview-container): Fixed centering of the preview container contents.
        (.image-preview-container img):
        (.image-container):

2012-08-17  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: decouple extension server from the Elements panel
        https://bugs.webkit.org/show_bug.cgi?id=94322

        Reviewed by Pavel Feldman.

        - relay WebInspector.ElementsTreeOutline.Events.SelectedNodeChanged received in ElementsPanel on WebInspector.notifications;

        * inspector/front-end/ElementsPanel.js:
        (WebInspector.ElementsPanel.prototype._selectedNodeChanged):
        * inspector/front-end/ExtensionServer.js:

2012-08-17  Jan Keromnes  <janx@linux.com>

        Web Inspector: SourceFrame shouldn't be a View
        https://bugs.webkit.org/show_bug.cgi?id=93444

        Reviewed by Pavel Feldman.

        Move SourceFrame from being a View to being an Object. This will allow
        future ExtensionSourceFrames to share a single iframe ExtensionView.

        * inspector/front-end/CodeMirrorTextEditor.js:
        (WebInspector.CodeMirrorTextEditor.prototype.wasShown):
        (WebInspector.CodeMirrorTextEditor.prototype.willHide):
        * inspector/front-end/DefaultTextEditor.js:
        (WebInspector.DefaultTextEditor.prototype.wasShown):
        (WebInspector.DefaultTextEditor.prototype.willHide):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame):
        (WebInspector.SourceFrame.prototype.show):
        (WebInspector.SourceFrame.prototype.detach):
        (WebInspector.SourceFrame.prototype.focus):
        (WebInspector.SourceFrame.prototype._onTextEditorWasShown):
        (WebInspector.SourceFrame.prototype._onTextEditorWillHide):
        * inspector/front-end/TextEditor.js:
        * inspector/front-end/scriptsPanel.css:

2012-08-17  Pavel Chadnov  <chadnov@google.com>

        Web Inspector: requests filtering in network tab
        https://bugs.webkit.org/show_bug.cgi?id=93090

        Reviewed by Vsevolod Vlasov.

        Added filtering support to search panel.
        Implemented filtering for network panel.
        
        * inspector/front-end/NetworkPanel.js:
        (WebInspector.NetworkLogView.prototype._clearSearchMatchedList):
        (WebInspector.NetworkLogView.prototype._updateHighlightIfMatched):
        (WebInspector.NetworkLogView.prototype._highlightMatchedRequests):
        (WebInspector.NetworkLogView.prototype._highlightNthMatchedRequestForSearch):
        (WebInspector.NetworkLogView.prototype.performSearch):
        (WebInspector.NetworkLogView.prototype.performFilter):
        (WebInspector.NetworkLogView.prototype.jumpToPreviousSearchResult):
        (WebInspector.NetworkLogView.prototype.jumpToNextSearchResult):
        (WebInspector.NetworkPanel.prototype.performFilter):
        (WebInspector.NetworkDataGridNode.prototype._highlightMatchedSubstring):
        * inspector/front-end/SearchController.js:
        (WebInspector.SearchController):
        (WebInspector.SearchController.prototype.cancelSearch):
        (WebInspector.SearchController.prototype.showSearchField):
        (WebInspector.SearchController.prototype._switchFilterToSearch):
        (WebInspector.SearchController.prototype._switchSearchToFilter):
        (WebInspector.SearchController.prototype._updateFilterVisibility):
        (WebInspector.SearchController.prototype._replaceAll):
        (WebInspector.SearchController.prototype._filterCheckboxClick):
        (WebInspector.SearchController.prototype._performFilter):
        (WebInspector.SearchController.prototype._onFilterInput):
        (WebInspector.SearchController.prototype._onSearchInput):
        (WebInspector.SearchController.prototype.resetFilter):
        * inspector/front-end/inspector.css:
        (.filter):
        * inspector/front-end/networkLogView.css:
        (.network-log-grid.data-grid.filter-other table.data tr.revealed.network-type-other:not(.filtered-out)):

2012-08-17  Anthony Berent  <aberent@chromium.org>

        View source doesn't interpret escape characters in hrefs.
        https://bugs.webkit.org/show_bug.cgi?id=94216

        Reviewed by Adam Barth.

        The cause was that HTMLViewSourceDocument was passing the unparsed content of the href attribute to the DOM as the URL for the link.
        The fix is to pass the parsed content of the href attribute to the DOM.

        Test: fast/forms/frames/viewsource-link-on-href-value.html extended to test this case.

        * html/HTMLViewSourceDocument.cpp:
        (WebCore::HTMLViewSourceDocument::processTagToken): Pass parsed URL to AddRange.
        (WebCore::HTMLViewSourceDocument::addRange):Added argument for parsed URL, and used this instead of text, to create link.
        * html/HTMLViewSourceDocument.h:
        (HTMLViewSourceDocument): Add new link argument to addRange for parsed URL, defaulting to "".

2012-08-17  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Rename SpinButtonElement::StepActionHandler to SpinButtonOwner
        https://bugs.webkit.org/show_bug.cgi?id=94311

        Reviewed by Kent Tamura.

        This patch renames SpinButtonElement::StepActionHandler class to
        SpinButtonOwner for adding functions to it for communicating spin
        button and its owner.

        No new tests. This patch doesn't change behavior.

        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::~TextFieldInputType):
        (WebCore::TextFieldInputType::destroyShadowSubtree):
        * html/TextFieldInputType.h:
        (TextFieldInputType):
        * html/shadow/DateTimeEditElement.cpp:
        (WebCore::DateTimeEditElement::~DateTimeEditElement):
        * html/shadow/DateTimeEditElement.h:
        (DateTimeEditElement):
        * html/shadow/SpinButtonElement.cpp:
        (WebCore::SpinButtonElement::SpinButtonElement):
        (WebCore::SpinButtonElement::create):
        (WebCore::SpinButtonElement::doStepAction):
        * html/shadow/SpinButtonElement.h:
        (WebCore::SpinButtonElement::SpinButtonOwner::~SpinButtonOwner):
        (SpinButtonElement):
        (WebCore::SpinButtonElement::removeSpinButtonOwner):

2012-08-16  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] Replace use of internal Weak smart pointer with JSWeakObjectMap
        https://bugs.webkit.org/show_bug.cgi?id=93872

        Reviewed by Kenneth Rohde Christiansen.

        The intention of this patch series is to replace use of internal JSC
        API with use of the stable and public C API.

        The JSC::Weak template is internal API and the only part of the C API
        that exposes similar functionality is the JSWeakObjectMap. It is
        special in the sense that its life-time is tied to the life-time of the
        JS global object, which in turn is subject to garbage collection. In
        order to maximize re-use of the same map across different JSContextRef
        instances, we use one JSWeakObjectMap per context group and store the
        map in a separate context.

        * bridge/qt/qt_instance.cpp:
        (JSC::Bindings::unusedWeakObjectMapCallback):
        (Bindings):
        (JSC::Bindings::WeakMapImpl::WeakMapImpl):
        (JSC::Bindings::WeakMapImpl::~WeakMapImpl):
        (JSC::Bindings::WeakMap::~WeakMap):
        (JSC::Bindings::WeakMap::set):
        (JSC::Bindings::WeakMap::get):
        (JSC::Bindings::WeakMap::remove):
        * bridge/qt/qt_instance.h:
        (WeakMapImpl):
        (Bindings):
        (WeakMap):
        (QtInstance):
        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::QtRuntimeMethod::~QtRuntimeMethod):
        (JSC::Bindings::QtRuntimeMethod::jsObjectRef):
        * bridge/qt/qt_runtime.h:
        (QtRuntimeMethod):


2012-08-16  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: build Elements, Resources, Timeline, Audits and Console panels lazily.
        https://bugs.webkit.org/show_bug.cgi?id=94222

        Reviewed by Vsevolod Vlasov.

        There is no need to construct these panels on inspector startup - we can do that lazily.
        This change introduces the concept of PanelDescriptor that is sufficient for the panel
        representation before it has been selected. It also makes selected panels build lazily.

        The next step is to migrate rest of the panels and load the panel code lazily as well.
        That should speed up startup time significantly.

        * inspector/front-end/AuditsPanel.js:
        (WebInspector.AuditsPanel):
        (WebInspector.AuditsPanel.prototype._auditFinishedCallback):
        (WebInspector.AuditsSidebarTreeElement):
        (WebInspector.AuditsSidebarTreeElement.prototype.onselect):
        (WebInspector.AuditResultSidebarTreeElement):
        (WebInspector.AuditResultSidebarTreeElement.prototype.onselect):
        * inspector/front-end/ConsolePanel.js:
        * inspector/front-end/DOMStorage.js:
        (WebInspector.DOMStorageDispatcher.prototype.addDOMStorage):
        (WebInspector.DOMStorageDispatcher.prototype.domStorageUpdated):
        * inspector/front-end/Database.js:
        (WebInspector.DatabaseDispatcher.prototype.addDatabase):
        * inspector/front-end/ElementsPanel.js:
        (WebInspector.ElementsPanel):
        (WebInspector.ElementsPanel.prototype.revealAndSelectNode):
        (WebInspector.ElementsPanel.prototype.setSearchingForNode):
        (WebInspector.ElementsPanel.prototype.toggleSearchingForNode):
        * inspector/front-end/ElementsTreeOutline.js:
        (WebInspector.ElementsTreeElement.prototype._populateForcedPseudoStateItems):
        * inspector/front-end/ExtensionPanel.js:
        (WebInspector.ExtensionPanel):
        (WebInspector.ExtensionPanel.prototype.jumpToPreviousSearchResult):
        * inspector/front-end/ExtensionServer.js:
        (WebInspector.ExtensionServer.prototype._onCreatePanel):
        (WebInspector.ExtensionServer.prototype._onAddAuditCategory):
        * inspector/front-end/InspectorFrontendAPI.js:
        (InspectorFrontendAPI.isTimelineProfilingEnabled):
        (InspectorFrontendAPI.setTimelineProfilingEnabled):
        (InspectorFrontendAPI.showConsole):
        (InspectorFrontendAPI.showResources):
        (InspectorFrontendAPI.enterInspectElementMode):
        * inspector/front-end/InspectorView.js:
        (WebInspector.InspectorView):
        (WebInspector.InspectorView.prototype.addPanel):
        (WebInspector.InspectorView.prototype.panel):
        (WebInspector.InspectorView.prototype.showPanel):
        (WebInspector.InspectorView.prototype._keyDownInternal):
        * inspector/front-end/NetworkPanel.js:
        * inspector/front-end/Panel.js:
        (WebInspector.Panel.prototype.wasShown):
        (WebInspector.Panel.prototype.willHide):
        (WebInspector.PanelDescriptor):
        (WebInspector.PanelDescriptor.prototype.name):
        (WebInspector.PanelDescriptor.prototype.title):
        (WebInspector.PanelDescriptor.prototype.iconURL):
        (WebInspector.PanelDescriptor.prototype.setIconURL):
        (WebInspector.PanelDescriptor.prototype.panel):
        (WebInspector.PanelDescriptor.prototype.lazy):
        * inspector/front-end/ProfilesPanel.js:
        * inspector/front-end/ResourceTreeModel.js:
        (WebInspector.ResourceTreeModel.prototype.cachedResourcesLoaded):
        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.ResourcesPanel):
        * inspector/front-end/ScriptsPanel.js:
        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted.successCallback):
        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.linkifyURL):
        * inspector/front-end/TimelinePanel.js:
        * inspector/front-end/Toolbar.js:
        (WebInspector.Toolbar.prototype.addPanel):
        (WebInspector.Toolbar.prototype._createPanelToolbarItem.onToolbarItemClicked):
        (WebInspector.Toolbar.prototype._createPanelToolbarItem.panelSelected):
        (WebInspector.Toolbar.prototype._createPanelToolbarItem):
        (WebInspector.Toolbar.prototype._panelSelected):
        (WebInspector.Toolbar.prototype._setDropdownVisible):
        (WebInspector.ToolbarDropdown):
        (WebInspector.ToolbarDropdown.prototype.show):
        (WebInspector.ToolbarDropdown.prototype._populate):
        * inspector/front-end/inspector.css:
        (.toolbar-small .toolbar-icon.custom-toolbar-icon):
        * inspector/front-end/inspector.js:
        (WebInspector._panelDescriptors):
        (WebInspector._panelSelected):
        (WebInspector._createGlobalStatusBarItems):
        (WebInspector.documentClick.followLink):
        (WebInspector.documentClick):
        (WebInspector.openResource):
        (WebInspector.showPanel):
        (WebInspector.panel):
        (WebInspector.inspect.):
        (WebInspector.inspect):
        (WebInspector._showAnchorLocation):
        (WebInspector.showProfileForURL):
        (WebInspector.frontendReused):

2012-08-17  Pascal Massimino  <pascal.massimino@gmail.com>

        libwebp-0.2.0: handle alpha channel if present

        https://bugs.webkit.org/show_bug.cgi?id=93430

        Reviewed by Adam Barth.

        updated the Layout test webp-image-decoding.html

        * platform/image-decoders/webp/WEBPImageDecoder.cpp:
        (outputMode):
                switch to premultiplied-RGB if needed
        (WebCore::WEBPImageDecoder::WEBPImageDecoder):
        (WebCore::WEBPImageDecoder::decode):
                use WebPGetFeatures() instead of WebPGetInfo(),
                to detect presence of alpha channel
        * platform/image-decoders/webp/WEBPImageDecoder.h:
        (WEBPImageDecoder):
                add a m_hasAlpha field

2012-08-17  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Enable multiple fields time input UI for Chromium except Android
        https://bugs.webkit.org/show_bug.cgi?id=94195

        Reviewed by Kent Tamura.

        This patch enables multiple fields time input UI for Chromium except
        for Android.

        No new tests. Existing tests in fast/forms/time-multiple-fields/
        covers appearance and functionality of multiple fields time UI.

        A manual checking for browser displays multiple fields time input UI
        is needed.

        * bindings/generic/RuntimeEnabledFeatures.cpp:
        (WebCore): Changed RuntimeEnabledFeatures::isInputTypeTimeEnabled to true
        if ENABLE_INPUT_TYPE_TIME is enabled.

2012-08-17  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Introduce SpinButtonElement.{cpp,h} into build
        https://bugs.webkit.org/show_bug.cgi?id=94289

        Reviewed by Kent Tamura.

        This patch introduces html/shadow/SpinButtonElement.{cpp,h} into
        build, files were copied from TextControlInnerElements.{cpp,h} by
        bug 93943.

        No new tests. This patch doesn't changes behavior.

        * CMakeLists.txt: Added SpinButtonElement.cpp
        * GNUmakefile.list.am: Added SpinButtonElement.{cpp,h}
        * Target.pri: Added SpinButtonElement.cpp
        * WebCore.gypi: Added SpinButtonElement.{cpp,h}
        * WebCore.vcproj/WebCore.vcproj: Added SpinButtonElement.{cpp,h}
        * WebCore.xcodeproj/project.pbxproj: Added SpinButtonElement.{cpp,h}
        * accessibility/AccessibilitySpinButton.h: Replaced include file to SpinButtonElement.h from TextControlInnerElements.h
        * html/TextFieldInputType.h: Added include file SpinButtonElement.h
        * html/shadow/DateTimeEditElement.h: Replaced include file to SpinButtonElement.h from TextControlInnerElements.h
        * html/shadow/SpinButtonElement.cpp: Removed code other than SpinButtonElement.
        * html/shadow/SpinButtonElement.h: Removed code other than SpinButtonElement.
        * html/shadow/TextControlInnerElements.cpp: Removed code of SpinButtonElement.
        * html/shadow/TextControlInnerElements.h: Removed SpinButtonElement.
        * rendering/RenderTheme.cpp: Added include file SpinButtonElement.h

2012-08-17  Sukolsak Sakshuwong  <sukolsak@google.com>

        Implement UndoManager's V8 bindings
        https://bugs.webkit.org/show_bug.cgi?id=93912

        Reviewed by Ryosuke Niwa.

        This patch implements V8 bindings for UndoManager's transact() method.
        We keep alive the user objects passed to transact() by storing them in
        a hidden property of DOMTransaction's wrapper and registering implicit
        references from UndoManager to DOMTransaction.

        Tests: editing/undomanager/domtransaction-survives-gc.html
               editing/undomanager/undomanager-isolated-world.html
               editing/undomanager/undomanager-transact.html
               editing/undomanager/undomanager-undo-redo.html
               editing/undomanager/undomanager-use-after-free.html

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * Target.pri:
        * UseJSC.cmake:
        * UseV8.cmake:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/DOMTransaction.cpp: Added.
        (WebCore):
        (WebCore::DOMTransaction::DOMTransaction):
        (WebCore::DOMTransaction::create):
        (WebCore::DOMTransaction::apply):
        (WebCore::DOMTransaction::unapply):
        (WebCore::DOMTransaction::reapply):
        * bindings/js/DOMTransaction.h: Added.
        (WebCore):
        (DOMTransaction):
        (WebCore::DOMTransaction::undoManager):
        (WebCore::DOMTransaction::setUndoManager):
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSUndoManagerCustom.cpp: Added.
        (WebCore):
        (WebCore::JSUndoManager::transact):
        * bindings/v8/DOMTransaction.cpp: Added.
        (WebCore):
        (WebCore::DOMTransaction::DOMTransaction):
        (WebCore::DOMTransaction::create):
        (WebCore::DOMTransaction::apply):
        (WebCore::DOMTransaction::unapply):
        (WebCore::DOMTransaction::reapply):
        (WebCore::DOMTransaction::getFunction):
        (WebCore::DOMTransaction::callFunction):
        * bindings/v8/DOMTransaction.h: Added.
        (WebCore):
        (DOMTransaction):
        (WebCore::DOMTransaction::undoManager):
        (WebCore::DOMTransaction::setUndoManager):
        * bindings/v8/V8HiddenPropertyName.h:
        (WebCore):
        * bindings/v8/custom/V8DOMTransactionCustom.cpp: Added.
        (WebCore):
        (WebCore::V8DOMTransaction::visitDOMWrapper):
        * bindings/v8/custom/V8UndoManagerCustom.cpp: Added.
        (WebCore):
        (WebCore::V8UndoManager::transactCallback):
        * dom/Document.cpp:
        (WebCore::Document::~Document):
        (WebCore::Document::undoManager):
        * dom/Element.cpp:
        (WebCore::Element::undoManager):
        (WebCore::Element::disconnectUndoManager):
        * editing/CompositeEditCommand.h:
        * editing/DOMTransaction.idl: Added.
        * editing/Editor.cpp:
        (WebCore::Editor::appliedEditing):
        (WebCore::Editor::unappliedEditing):
        (WebCore::Editor::reappliedEditing):
        (WebCore::Editor::canUndo):
        (WebCore::Editor::undo):
        (WebCore::Editor::canRedo):
        (WebCore::Editor::redo):
        * editing/UndoManager.cpp:
        (WebCore::UndoManager::create):
        (WebCore::UndoManager::UndoManager):
        (WebCore::clearStack):
        (WebCore):
        (WebCore::UndoManager::disconnect):
        (WebCore::UndoManager::stop):
        (WebCore::UndoManager::~UndoManager):
        (WebCore::createUndoManagerEntry):
        (WebCore::UndoManager::transact):
        (WebCore::UndoManager::undo):
        (WebCore::UndoManager::redo):
        (WebCore::UndoManager::registerUndoStep):
        (WebCore::UndoManager::registerRedoStep):
        (WebCore::UndoManager::clearUndo):
        (WebCore::UndoManager::clearRedo):
        * editing/UndoManager.h:
        (WebCore):
        (UndoManager):
        (WebCore::UndoManager::position):
        (WebCore::UndoManager::canUndo):
        (WebCore::UndoManager::canRedo):
        (WebCore::UndoManager::undoScopeHost):
        (WebCore::UndoManager::ownerNode):
        * editing/UndoManager.idl:
        * editing/UndoStep.h:
        (UndoStep):

2012-08-16  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: CPU profile view select overlaps with status bar buttons
        https://bugs.webkit.org/show_bug.cgi?id=94243

        Reviewed by Pavel Feldman.

        - use StatusBarComboBox inated of plain select element in the status bar of CPU profile view;
        - add StatusBarComboBox.select()

        * inspector/front-end/CPUProfileView.js:
        (WebInspector.CPUProfileView.prototype.get statusBarItems):
        * inspector/front-end/StatusBarButton.js:
        (WebInspector.StatusBarComboBox.prototype.selectedOption):
        (WebInspector.StatusBarComboBox.prototype.select):
        * inspector/front-end/externs.js: drive-by fix: add declaration to suppress compilation error;
        (Array.prototype.select):

2012-08-16  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Snippet script mapping should not load snippets until workspace reset event is dispatched on scripts panel.
        https://bugs.webkit.org/show_bug.cgi?id=94218

        Reviewed by Pavel Feldman.

        Scripts panel does not load uiSourceCodes in workspace reset handler anymore.
        Snippet script mapping does not start reloading snippets after reset until WorkspaceReset event is dispatched.

        * inspector/front-end/JavaScriptSourceFrame.js: Simplified isComittingEditing to be reset synchronously.
        (WebInspector.JavaScriptSourceFrame.prototype.commitEditing):
        (WebInspector.JavaScriptSourceFrame.prototype._didEditContent):
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.ScriptSnippetModel.prototype._reset):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._uiSourceCodeAdded):
        (WebInspector.ScriptsPanel.prototype._addUISourceCode):
        (WebInspector.ScriptsPanel.prototype._reset):
        * inspector/front-end/UISourceCodeFrame.js: Simplified isComittingEditing to be reset synchronously.
        (WebInspector.UISourceCodeFrame.prototype.commitEditing):
        (WebInspector.UISourceCodeFrame.prototype._didEditContent):

2012-08-16  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r125829.
        http://trac.webkit.org/changeset/125829
        https://bugs.webkit.org/show_bug.cgi?id=94299

        Maybe causing Chromium AutomationTabHelperBrowserTest failures
        (Requested by enne on #webkit).

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::init):
        (WebCore::FrameLoader::prepareForLoadStart):
        (WebCore::FrameLoader::clearProvisionalLoad):
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
        (WebCore::FrameLoader::detachFromParent):
        * loader/FrameLoader.h:
        (FrameLoader):

2012-08-16  Nico Weber  <thakis@chromium.org>

        [chromium/mac] Remove RenderThemeChromiumMac::paintTextField override
        https://bugs.webkit.org/show_bug.cgi?id=94276

        Reviewed by Eric Seidel.

        The comment says this can go once 10.5 goes away. Besides, the
        superclass implementation has the same hack anyway.

        No behavior change.

        * rendering/RenderThemeChromiumMac.h:
        (RenderThemeChromiumMac):
        * rendering/RenderThemeChromiumMac.mm:

2012-08-16  David Barr  <davidbarr@chromium.org>

        @import url("#foo") causes stack overflow
        https://bugs.webkit.org/show_bug.cgi?id=93687

        Reviewed by Tony Chang.

        Test: http/tests/css/css-imports-url-fragment.html

        * css/StyleRuleImport.cpp:
        (WebCore::StyleRuleImport::requestStyleSheet): Ignore the fragment identifier in cycle detection.

2012-08-16  Antoine Labour  <piman@chromium.org>

        [chromium] Add resource transfer functions to CCResourceProvider
        https://bugs.webkit.org/show_bug.cgi?id=93524

        Reviewed by James Robinson.

        This adds methods to CCResourceProvider to be able to transport
        resources from a child to a parent.

        Added test to CCResourceProviderTest.

        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
        (WebCore::CCResourceProvider::inUseByConsumer):
        (WebCore::CCResourceProvider::createResource):
        (WebCore::CCResourceProvider::createResourceFromExternalTexture):
        (WebCore::CCResourceProvider::CCResourceProvider):
        (WebCore::CCResourceProvider::createChild):
        (WebCore):
        (WebCore::CCResourceProvider::destroyChild):
        (WebCore::CCResourceProvider::getChildToParentMap):
        (WebCore::CCResourceProvider::prepareSendToParent):
        (WebCore::CCResourceProvider::prepareSendToChild):
        (WebCore::CCResourceProvider::receiveFromChild):
        (WebCore::CCResourceProvider::receiveFromParent):
        (WebCore::CCResourceProvider::transferResource):
        * platform/graphics/chromium/cc/CCResourceProvider.h:
        (Mailbox):
        (TransferableResource):
        (TransferableResourceList):
        (CCResourceProvider):
        (Resource):
        (Child):

2012-08-16  David Grogan  <dgrogan@chromium.org>

        IndexedDB: Frontend and plumbing for integer versions
        https://bugs.webkit.org/show_bug.cgi?id=92897

        Reviewed by Tony Chang.

        This patch exposes integer versions and the upgradeneeded event to
        script.

        The events surrounding an IDBOpenDBRequest follow a new pattern
        compared to other idb requests. An open request can receive a blocked
        event, an upgradeneeded event, and then a success event. When
        dispatching the upgradeneeded and success events the request has its
        readyState set to DONE and its result property set to an IDBDatabase.
        We usually think of IDBRequests firing one event with one result,
        cursors being the big exception. There are some minor changes around
        enqueuing and dispatching events to support this.

        There's also some funkiness in
        IDBRequest::onSuccess(PassRefPtr<IDBDatabaseBackendInterface>) so that
        the IDBDatabase object delivered in upgradeneeded is reused for the
        success event.

        Tests - expectations are updated in this patch.

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::setVersion):
        (WebCore::IDBDatabase::onVersionChange):
        (WebCore):
        (WebCore::IDBDatabase::registerFrontendCallbacks):
        * Modules/indexeddb/IDBDatabase.h:
        (IDBDatabase):
        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::runIntVersionChangeTransaction):
        * Modules/indexeddb/IDBDatabaseCallbacks.h:
        (IDBDatabaseCallbacks):
        * Modules/indexeddb/IDBDatabaseCallbacksImpl.cpp:
        (WebCore::IDBDatabaseCallbacksImpl::onVersionChange):
        (WebCore):
        * Modules/indexeddb/IDBDatabaseCallbacksImpl.h:
        (IDBDatabaseCallbacksImpl):
        * Modules/indexeddb/IDBFactory.cpp:
        (WebCore::IDBFactory::open):
        (WebCore):
        * Modules/indexeddb/IDBFactory.h:
        (IDBFactory):
        * Modules/indexeddb/IDBFactory.idl:
        * Modules/indexeddb/IDBFactoryBackendImpl.cpp:
        (WebCore::IDBFactoryBackendImpl::open):
        * Modules/indexeddb/IDBFactoryBackendImpl.h:
        (IDBFactoryBackendImpl):
        * Modules/indexeddb/IDBFactoryBackendInterface.h:
        (IDBFactoryBackendInterface):
        * Modules/indexeddb/IDBOpenDBRequest.cpp: Added.
        (WebCore):
        (WebCore::IDBOpenDBRequest::create):
        (WebCore::IDBOpenDBRequest::IDBOpenDBRequest):
        (WebCore::IDBOpenDBRequest::~IDBOpenDBRequest):
        (WebCore::IDBOpenDBRequest::interfaceName):
        (WebCore::IDBOpenDBRequest::onBlocked):
        (WebCore::IDBOpenDBRequest::onUpgradeNeeded):
        (WebCore::IDBOpenDBRequest::shouldEnqueueEvent):
        * Modules/indexeddb/IDBOpenDBRequest.h: Copied from Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacksImpl.h.
        (WebCore):
        (IDBOpenDBRequest):
        * Modules/indexeddb/IDBOpenDBRequest.idl: Copied from Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacks.h.
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::IDBRequest):
        (WebCore::IDBRequest::shouldEnqueueEvent):
        (WebCore::IDBRequest::onSuccess):
        This function works with WebIDBCallbacksImpl::onSuccess to reuse its
        IDBDatabaseBackendInterface that it got during
        IDBOpenDBRequest::onUpgradeNeeded.

        (WebCore::IDBRequest::dispatchEvent):
        (WebCore::IDBRequest::transactionDidDispatchCompleteOrAbort):
        (WebCore):
        (WebCore::IDBRequest::enqueueEvent):
        * Modules/indexeddb/IDBRequest.h:
        (WebCore::IDBRequest::onBlocked):
        (IDBRequest):
        * Modules/indexeddb/IDBTransaction.cpp:
        We now take a pointer to the openDBRequest if this is a version
        change transaction as a result of an open-with-version call so that we
        can clear the transaction property on the openDBRequest as soon as the
        upgradeneeded event is dispatched per the spec ("... set request's
        transaction property to null... ", currently 4.8.12).

        (WebCore::IDBTransaction::create):
        (WebCore):
        (WebCore::IDBTransaction::IDBTransaction):
        (WebCore::IDBTransaction::setActive):
        (WebCore::IDBTransaction::onComplete):
        (WebCore::IDBTransaction::dispatchEvent):
        * Modules/indexeddb/IDBTransaction.h:
        (WebCore):
        (IDBTransaction):
        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
        (WebCore::IDBTransactionBackendImpl::commit):
        * Modules/indexeddb/IDBUpgradeNeededEvent.cpp: Copied from Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacksImpl.cpp.
        (WebCore):
        (WebCore::IDBUpgradeNeededEvent::create):
        (WebCore::IDBUpgradeNeededEvent::IDBUpgradeNeededEvent):
        (WebCore::IDBUpgradeNeededEvent::~IDBUpgradeNeededEvent):
        (WebCore::IDBUpgradeNeededEvent::oldVersion):
        (WebCore::IDBUpgradeNeededEvent::newVersion):
        (WebCore::IDBUpgradeNeededEvent::interfaceName):
        * Modules/indexeddb/IDBUpgradeNeededEvent.h: Copied from Source/WebKit/chromium/src/WebIDBDatabaseCallbacksImpl.h.
        (WebCore):
        (IDBUpgradeNeededEvent):
        * Modules/indexeddb/IDBUpgradeNeededEvent.idl: Copied from Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacks.h.
        * WebCore.gypi:
        * dom/EventNames.h:
        (WebCore):
        * dom/EventNames.in:
        * dom/EventTargetFactory.in:
        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore):

2012-08-16  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Cleanup CSS selectors for multiple fields time input UI
        https://bugs.webkit.org/show_bug.cgi?id=94287

        Reviewed by Kent Tamura.

        This patch cleans CSS selectors for multiple fields time input UI:
         - Removed "width" from fields: we use monospace font for field.
         - Use "em" instead of "px" for unit.
         - Add left margin to spin button.

        Changes of this patch affect only both ENABLE_INPUT_TYPE_TIME and
        ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS are enabled.

        Tests: fast/forms/time-multiple-fields/time-multiple-fields-appearance-basic.html
               fast/forms/time-multiple-fields/time-multiple-fields-appearance-disabled-readonly.html
               fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-classes.html
               fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements.html
               fast/forms/time-multiple-fields/time-multiple-fields-appearance-style.html

        * css/html.css:
        (input::-webkit-datetime-edit-ampm-field):
        (input::-webkit-datetime-edit-hour-field):
        (input::-webkit-datetime-edit-millisecond-field):
        (input::-webkit-datetime-edit-minute-field):
        (input::-webkit-datetime-edit-second-field):
        (input[type=time]::-webkit-inner-spin-button):

2012-08-16  John Bates  <jbates@google.com>

        Fix vsync-disabled Null pointer crash bug
        https://bugs.webkit.org/show_bug.cgi?id=94280

        Reviewed by Kentaro Hara.

        The m_timeSource member is NULL for vsync-disabled path, need to check for that.

        Tests: Covered by Chromium throughput tests. All the compositor thread throughput tests are crashing.

        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
        (WebCore::CCFrameRateController::setTimebaseAndInterval):

2012-08-16  Michael Saboff  <msaboff@apple.com>

        HTML Parser should produce 8bit substrings for inline style and script elements
        https://bugs.webkit.org/show_bug.cgi?id=93742

        Reviewed by Benjamin Poulain.

        Currently all data associated with a token is stored and processed as UChars.
        Added code to determine that the contents of token data is all 8 bit by keeping
        the logical OR value of all prior characters. Also added a flag that the parser
        can set to indicate when the token data is converted to a String that we want
        to make an 8 bit string if possible. Enabled this handling for script, style,
        iframe, noembed, noframes, noscript and xmp tags.

        No new tests. Existing tests provide coverage.

        * html/parser/HTMLTokenizer.cpp:
        (WebCore::HTMLTokenizer::nextToken):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::ExternalCharacterTokenBuffer::ExternalCharacterTokenBuffer):
        (WebCore::HTMLTreeBuilder::ExternalCharacterTokenBuffer::isAll8BitData):
        (HTMLTreeBuilder::ExternalCharacterTokenBuffer):
        (WebCore::HTMLTreeBuilder::ExternalCharacterTokenBuffer::takeRemaining):
        * xml/parser/MarkupTokenBase.h:
        (WebCore::MarkupTokenBase::clear):
        (WebCore::MarkupTokenBase::appendToCharacter):
        (MarkupTokenBase):
        (WebCore::MarkupTokenBase::eraseCharacters):
        (WebCore::MarkupTokenBase::setConvertTo8Bit):
        (WebCore::MarkupTokenBase::isAll8BitData):
        (WebCore::AtomicMarkupTokenBase::AtomicMarkupTokenBase):
        (WebCore::AtomicMarkupTokenBase::isAll8BitData):
        (AtomicMarkupTokenBase):
        (WebCore::AtomicMarkupTokenBase::clearExternalCharacters):

2012-08-16  Michelangelo De Simone  <michelangelo@webkit.org>

        [Part 3] Parse the custom() function in -webkit-filter: parse the 3d-transforms parameters
        https://bugs.webkit.org/show_bug.cgi?id=71443

        Reviewed by Dirk Schulze.

        custom() now correctly parses the 3d-tranforms parameters. In order to do that the parseTransform() method 
        has been refactored and split to reuse already present code. 

        * css/CSSParser.cpp:
        (WebCore::parseTranslateTransformValue): Renamed from parseTransformValue()
        (WebCore::CSSParser::parseValue): Reference updated from parseTransformValue() to parseTranslateTransformValue()
        (WebCore::CSSParser::parseTransform): This method has been split in two to reuse already present code
        (WebCore):
        (WebCore::CSSParser::parseTransformValue): New method to parse single transform values
        (WebCore::CSSParser::parseCustomFilter): Updated to parse the transform parameters
        (WebCore::CSSParser::parseCustomFilterTransform): New method to parse custom() transforms 
        * css/CSSParser.h:

2012-08-16  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r125838.
        http://trac.webkit.org/changeset/125838
        https://bugs.webkit.org/show_bug.cgi?id=94283

        Breaks Mac compile due to bug 74625 (Requested by enne on
        #webkit).

        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
        (WebCore::CCResourceProvider::inUseByConsumer):
        (WebCore::CCResourceProvider::createResource):
        (WebCore::CCResourceProvider::createResourceFromExternalTexture):
        (WebCore::CCResourceProvider::deleteOwnedResources):
        (WebCore::CCResourceProvider::CCResourceProvider):
        * platform/graphics/chromium/cc/CCResourceProvider.h:
        (CCResourceProvider):
        (Resource):

2012-08-16  Kenneth Russell  <kbr@google.com>

        Unreviewed, rolling out r125800.
        http://trac.webkit.org/changeset/125800
        https://bugs.webkit.org/show_bug.cgi?id=84281

        Hypothesis that this change caused gpu_throughput_tests to
        start timing out on all platforms on the Chromium GPU
        canaries.

        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
        * platform/graphics/chromium/cc/CCFrameRateController.h:
        (CCFrameRateController):
        * platform/graphics/chromium/cc/CCScheduler.cpp:
        (WebCore::CCScheduler::processScheduledActions):
        * platform/graphics/chromium/cc/CCScheduler.h:
        (CCSchedulerClient):
        * platform/graphics/chromium/cc/CCTextureUpdateController.cpp:
        (WebCore::CCTextureUpdateController::maxPartialTextureUpdates):
        (WebCore::CCTextureUpdateController::CCTextureUpdateController):
        (WebCore::CCTextureUpdateController::updateMoreTextures):
        (WebCore::CCTextureUpdateController::updateMoreTexturesSize):
        * platform/graphics/chromium/cc/CCTextureUpdateController.h:
        (WebCore::CCTextureUpdateController::create):
        (CCTextureUpdateController):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::beginFrameCompleteOnImplThread):
        (WebCore::CCThreadProxy::scheduledActionUpdateMoreResources):
        * platform/graphics/chromium/cc/CCThreadProxy.h:

2012-08-16  Kenneth Russell  <kbr@google.com>

        Unreviewed, rolling out r125833.
        http://trac.webkit.org/changeset/125833
        https://bugs.webkit.org/show_bug.cgi?id=94234

        Was not the cause of the test failures. Per
        http://crbug.com/143311 , it is probably WebKit r125800.

        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
        (WebCore::Canvas2DLayerBridge::~Canvas2DLayerBridge):
        (WebCore::Canvas2DLayerBridge::deferredCanvas):
        (WebCore):
        (WebCore::Canvas2DLayerBridge::prepareForDraw):
        (WebCore::Canvas2DLayerBridge::skCanvas):
        * platform/graphics/chromium/Canvas2DLayerBridge.h:
        (Canvas2DLayerBridge):
        * platform/graphics/skia/ImageBufferSkia.cpp:

2012-08-16  Antoine Labour  <piman@chromium.org>

        [chromium] Add resource transfer functions to CCResourceProvider
        https://bugs.webkit.org/show_bug.cgi?id=93524

        Reviewed by James Robinson.

        This adds methods to CCResourceProvider to be able to transport
        resources from a child to a parent.

        Added test to CCResourceProviderTest.

        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
        (WebCore::CCResourceProvider::inUseByConsumer):
        (WebCore::CCResourceProvider::createResource):
        (WebCore::CCResourceProvider::createResourceFromExternalTexture):
        (WebCore::CCResourceProvider::CCResourceProvider):
        (WebCore::CCResourceProvider::createChild):
        (WebCore):
        (WebCore::CCResourceProvider::destroyChild):
        (WebCore::CCResourceProvider::getChildToParentMap):
        (WebCore::CCResourceProvider::prepareSendToParent):
        (WebCore::CCResourceProvider::prepareSendToChild):
        (WebCore::CCResourceProvider::receiveFromChild):
        (WebCore::CCResourceProvider::receiveFromParent):
        (WebCore::CCResourceProvider::transferResource):
        * platform/graphics/chromium/cc/CCResourceProvider.h:
        (Mailbox):
        (TransferableResource):
        (TransferableResourceList):
        (CCResourceProvider):
        (Resource):
        (Child):

2012-08-16  Kent Tamura  <tkent@chromium.org>

        [Chromium-win] Use native digits in a case of "context" substitution setting too.
        https://bugs.webkit.org/show_bug.cgi?id=94210

        Reviewed by Hajime Morita.

        Use native digits in a case of "context" substitution setting, not only
        "native" substitution.  IE10's input[type=number] always show native
        digits even if the system setting is "context". We had better follow
        this behavior.

        No new tests. This behavior depends on the system locale setting.

        * platform/text/LocaleWin.cpp:
        (WebCore::LocaleWin::initializeNumberLocalizerData):
        Uses 0-9 only if the substitution setting is "0 to 9". It measn we apply
        native digits if the substitution setting is "context" or "native".

2012-08-16  Huang Dongsung  <luxtella@company100.net>

        [Texmap] Render gif animation well.
        https://bugs.webkit.org/show_bug.cgi?id=93458

        Reviewed by Noam Rosenthal.

        GraphicsLayerTextureMapper::setContentsToImage() checks the pointer to the
        image, not nativeImagePtr, so Texmap currently draws only the first frame of gif
        animations. This patch makes Texmap draw gif animations.

        No new tests, could not write a test due to DRT limitation, see Bug 93458.

        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
        (WebCore::GraphicsLayerTextureMapper::setContentsNeedsDisplay):
        (WebCore::GraphicsLayerTextureMapper::setContentsToImage):
        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
        (GraphicsLayerTextureMapper):

2012-08-16  Kenneth Russell  <kbr@google.com>

        Unreviewed, rolling out r125804.
        http://trac.webkit.org/changeset/125804
        https://bugs.webkit.org/show_bug.cgi?id=94234

        Made threaded tests in performance_browser_tests start timing
        out on Chromium GPU bots

        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
        (AcceleratedDeviceContext):
        (WebCore::AcceleratedDeviceContext::AcceleratedDeviceContext):
        (WebCore::AcceleratedDeviceContext::prepareForDraw):
        (WebCore):
        (WebCore::Canvas2DLayerBridge::~Canvas2DLayerBridge):
        (WebCore::Canvas2DLayerBridge::skCanvas):
        * platform/graphics/chromium/Canvas2DLayerBridge.h:
        (Canvas2DLayerBridge):
        * platform/graphics/skia/ImageBufferSkia.cpp:

2012-08-16  Adam Barth  <abarth@webkit.org>

        Rename DOMWindow::clear to something more descriptive
        https://bugs.webkit.org/show_bug.cgi?id=93993

        Reviewed by Eric Seidel.

        As requested by Eric Seidel. In WebKit, we typically use "clear" to
        mean zeroing out a pointer (e.g., OwnPtr::clear). For DOMWindow, it's
        more like we're resetting the DOMWindow to a known state (i.e., its
        initial state), modulo a wrinkle w.r.t. the PageCache. The new name
        attempts to clarify the situation.

        * dom/Document.cpp:
        (WebCore::Document::~Document):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::clear):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::~DOMWindow):
        (WebCore::DOMWindow::frameDestroyed):
        (WebCore::DOMWindow::resetUnlessSuspendedForPageCache):
        (WebCore::DOMWindow::resetDOMWindowProperties):
        * page/DOMWindow.h:
        (DOMWindow):

2012-08-16  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r125717.
        http://trac.webkit.org/changeset/125717
        https://bugs.webkit.org/show_bug.cgi?id=94272

        Likely to be causing Chromium Win Debug extensions browser
        tests to fail (Requested by enne on #webkit).

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/v8/DOMWrapperWorld.cpp:
        (WebCore::DOMWrapperWorld::DOMWrapperWorld):
        (WebCore::mainThreadNormalWorld):
        * bindings/v8/DOMWrapperWorld.h:
        (WebCore):
        (WebCore::DOMWrapperWorld::create):
        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
        (DOMWrapperWorld):
        * bindings/v8/IsolatedWorld.cpp: Copied from Source/WebCore/bindings/v8/DOMWrapperWorld.cpp.
        (WebCore):
        (WebCore::IsolatedWorld::IsolatedWorld):
        (WebCore::IsolatedWorld::~IsolatedWorld):
        * bindings/v8/IsolatedWorld.h: Copied from Source/WebCore/bindings/v8/DOMWrapperWorld.h.
        (WebCore):
        (IsolatedWorld):
        (WebCore::IsolatedWorld::create):
        (WebCore::IsolatedWorld::count):
        (WebCore::IsolatedWorld::id):
        (WebCore::IsolatedWorld::domDataStore):
        * bindings/v8/V8DOMWrapper.h:
        (WebCore::V8DOMWrapper::getCachedWrapper):
        * bindings/v8/V8IsolatedContext.cpp:
        (WebCore::V8IsolatedContext::V8IsolatedContext):
        (WebCore::V8IsolatedContext::destroy):
        * bindings/v8/V8IsolatedContext.h:
        (WebCore::V8IsolatedContext::getEntered):
        (WebCore::V8IsolatedContext::world):
        (V8IsolatedContext):

2012-08-16  Nico Weber  <thakis@chromium.org>

        Delete ThemeChromiumMac, use ThemeMac in chromium/mac instead
        https://bugs.webkit.org/show_bug.cgi?id=94260

        Reviewed by James Robinson.

        ThemeChromiumMac was introduced when ThemeMac assumed that an
        in-process Cocoa view existed. With WebKit2, that's no longer true,
        and the files can now be merged.

        No behavior change.

        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * platform/chromium/ThemeChromiumMac.h: Removed.
        * platform/chromium/ThemeChromiumMac.mm: Removed.
        * platform/mac/ThemeMac.mm:
        (WebCore::paintStepper):
        (WebCore::ThemeMac::ensuredView):

2012-08-16  Nate Chapin  <japhet@chromium.org>

        ProgressTracker never completes if iframe detached during parsing 
        https://bugs.webkit.org/show_bug.cgi?id=92272

        Reviewed by Adam Barth.

        Add a simple helper class to FrameLoader to ensure progressStarted/progressCompleted calls are matched,
        and balance the calls when the Frame is detached.

        No new tests, as this behavior has only been producing reliably by setting a breakpoint in a specific place.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::init):
        (WebCore::FrameLoader::FrameProgressTracker::progressStarted):
        (WebCore::FrameLoader::FrameProgressTracker::progressCompleted):
        (WebCore::FrameLoader::FrameProgressTracker::~FrameProgressTracker):
        (WebCore::FrameLoader::prepareForLoadStart):
        (WebCore::FrameLoader::clearProvisionalLoad):
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
        (WebCore::FrameLoader::detachFromParent):
        * loader/FrameLoader.h:
        (FrameProgressTracker):
        (WebCore::FrameLoader::FrameProgressTracker::create):
        (WebCore::FrameLoader::FrameProgressTracker::FrameProgressTracker):

2012-08-16  Arnaud Renevier  <a.renevier@sisa.samsung.com>

        Update TypedArrays to throw RangeError or similar instead of INDEX_SIZE_ERR
        https://bugs.webkit.org/show_bug.cgi?id=45118

        Reviewed by Kenneth Russell.

        Update TypedArrays to raise JavaScript RangeError instead of dom
        INDEX_SIZE_ERR exceptions. Also, update TypedArrays to raise TypeError
        instead of JavaScript SyntaxError or dom exceptions SYNTAX_ERR when
        calling set method with invalid arguments.

        Specification does not define the type of exceptions to raise, but
        other browsers raise JavaScript errors, so those changes will improve
        compatibility.

        New Test: fast/canvas/webgl/array-set-invalid-arguments.html

        Updated Tests expectations:
            fast/canvas/webgl/array-set-out-of-bounds.html
            fast/canvas/webgl/data-view-crash.html
            fast/canvas/webgl/data-view-test.html

        * bindings/js/JSArrayBufferViewHelper.h:
        (WebCore):
        (WebCore::setWebGLArrayWithTypedArrayArgument):
        (WebCore::setWebGLArrayHelper):
        (WebCore::constructArrayBufferViewWithTypedArrayArgument):
        (WebCore::constructArrayBufferViewWithArrayBufferArgument):
        (WebCore::constructArrayBufferView):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore):
        (WebCore::constructWebGLArrayWithArrayBufferArgument):
        (WebCore::setWebGLArrayHelper):

2012-08-16  Alexandre Elias  <aelias@google.com>

        [chromium] Replace destRect with destOffset in texture upload
        https://bugs.webkit.org/show_bug.cgi?id=94154

        Reviewed by James Robinson.

        Previously, texture upload code implicitly assumed that sourceRect and
        destRect have the same size. The behavior is undefined if they are
        different, since they are used interchangeably and there's no support
        for scaling from one rect to the other. This patch enforces that
        constraint at the interface level by replacing all instances of
        "IntRect destRect" by "IntSize destOffset".

        No new tests (no-op refactoring).

        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
        (WebCore::BitmapCanvasLayerTextureUpdater::Texture::updateRect):
        (WebCore::BitmapCanvasLayerTextureUpdater::updateTextureRect):
        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h:
        (Texture):
        (BitmapCanvasLayerTextureUpdater):
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::Texture::updateRect):
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
        (Texture):
        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::Texture::updateRect):
        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h:
        (Texture):
        (FrameBufferSkPictureCanvasLayerTextureUpdater):
        * platform/graphics/chromium/ImageLayerChromium.cpp:
        (WebCore::ImageLayerTextureUpdater::updateTextureRect):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        * platform/graphics/chromium/LayerTextureSubImage.cpp:
        (WebCore::LayerTextureSubImage::upload):
        (WebCore::LayerTextureSubImage::uploadWithTexSubImage):
        (WebCore::LayerTextureSubImage::uploadWithMapTexSubImage):
        * platform/graphics/chromium/LayerTextureSubImage.h:
        (LayerTextureSubImage):
        * platform/graphics/chromium/LayerTextureUpdater.h:
        (Texture):
        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        (WebCore::ScrollbarLayerChromium::updatePart):
        * platform/graphics/chromium/TextureUploader.h:
        (Parameters):
        * platform/graphics/chromium/ThrottledTextureUploader.cpp:
        (WebCore::ThrottledTextureUploader::uploadTexture):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::updateTileTextures):
        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
        (WebCore::CCHeadsUpDisplayLayerImpl::willDraw):
        * platform/graphics/chromium/cc/CCPrioritizedTexture.cpp:
        (WebCore::CCPrioritizedTexture::upload):
        * platform/graphics/chromium/cc/CCPrioritizedTexture.h:
        (CCPrioritizedTexture):
        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
        (WebCore::CCResourceProvider::upload):
        * platform/graphics/chromium/cc/CCResourceProvider.h:
        (CCResourceProvider):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::copyPlaneData):

2012-08-16  James Robinson  <jamesr@chromium.org>

        [chromium] Remove unnecessary tree hierarchy inspection APIs from WebLayer
        https://bugs.webkit.org/show_bug.cgi?id=94229

        Reviewed by Adrienne Walker.

        Tweak updateLayerPreserves3D() logic to use the existing GraphicsLayer tree hierarchy instead of pulling the
        hierarchy off of WebLayer.

        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D):

2012-08-16  Ryosuke Niwa  <rniwa@webkit.org>

        Let Xcode have its own way.

        * WebCore.xcodeproj/project.pbxproj:

2012-08-16  Mike West  <mkwst@chromium.org>

        Refactor CSPDirective to support non-sourcelist types.
        https://bugs.webkit.org/show_bug.cgi?id=94252

        Reviewed by Adam Barth.

        The 'CSPDirective' was built to support source list Content Security
        Policy directives like 'script-src' or 'object-src'. It doesn't support
        new directive types like 'script-nonce' or 'plugin-types'. That
        functionality has been implemented by hanging state off of
        CSPDirectiveList, which isn't a great solution.

        This patch pulls the source list functionality out of CSPDirective and
        into SourceListDirective, and likewise pulls the nonce and media list
        functionality into NonceDirective and MediaListDirective.

        No new tests have been added; this refactoring should be externally
        transparent, and the current CSP tests should continue to pass.

        * page/ContentSecurityPolicy.cpp:
        (WebCore::CSPDirective::CSPDirective):
        (CSPDirective):
        (WebCore::CSPDirective::text):
        (WebCore::CSPDirective::policy):
            CSPDirective is now a parent class for NonceDirective,
            MediaListDirective, and SourceListDirective. It stores a pointer
            to the ContentSecurityPolicy object in order to facilitate logging,
            which now needs to happen at this level, rather than higher up in
            CSPDirectiveList.
        (WebCore):
        (NonceDirective):
        (WebCore::NonceDirective::NonceDirective):
        (WebCore::NonceDirective::allows):
        (WebCore::NonceDirective::parse):
            Pull the nonce parsing code and state out of CSPDirectiveList
            and into this new class.
        (MediaListDirective):
        (WebCore::MediaListDirective::MediaListDirective):
        (WebCore::MediaListDirective::allows):
        (WebCore::MediaListDirective::parse):
            Pull the media list parsing code and state out of CSPDirectiveList
            and into this new class.
        (SourceListDirective):
        (WebCore::SourceListDirective::SourceListDirective):
        (WebCore::SourceListDirective::allows):
            Pull the source list functionality out of CSPDirective
            and into this new class.
        (CSPDirectiveList):
        (WebCore::CSPDirectiveList::checkEval):
        (WebCore::CSPDirectiveList::checkInline):
        (WebCore::CSPDirectiveList::checkNonce):
        (WebCore::CSPDirectiveList::checkSource):
        (WebCore::CSPDirectiveList::checkMediaType):
        (WebCore::CSPDirectiveList::operativeDirective):
        (WebCore::CSPDirectiveList::checkEvalAndReportViolation):
        (WebCore::CSPDirectiveList::checkNonceAndReportViolation):
        (WebCore::CSPDirectiveList::checkMediaTypeAndReportViolation):
        (WebCore::CSPDirectiveList::checkInlineAndReportViolation):
        (WebCore::CSPDirectiveList::checkSourceAndReportViolation):
        (WebCore::CSPDirectiveList::allowJavaScriptURLs):
        (WebCore::CSPDirectiveList::allowInlineEventHandlers):
        (WebCore::CSPDirectiveList::allowScriptNonce):
        (WebCore::CSPDirectiveList::allowPluginType):
        (WebCore::CSPDirectiveList::setCSPDirective):
        (WebCore::CSPDirectiveList::addDirective):
            Use the new classes rather than CSPDirective (or no directive
            at all, in the case of nonces and plugin types).

2012-08-16  Adam Barth  <abarth@webkit.org>

        Null checks of m_frame->document()->domWindow() aren't needed
        https://bugs.webkit.org/show_bug.cgi?id=94052

        Reviewed by Eric Seidel.

        If a document is attached to a frame, then its DOMWindow is necessarily
        non-0. Checking for 0 is needless.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::checkLoadComplete):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::stopLoading):
        (WebCore::FrameLoader::didOpenURL):
        (WebCore::FrameLoader::prepareForCachedPageRestore):

2012-08-16  Max Feil  <mfeil@rim.com>

        [BlackBerry] Some media controls are mispositioned for dynamic live streams (HLS)
        https://bugs.webkit.org/show_bug.cgi?id=94176

        Reviewed by Antonio Gomes.

        The default HTML5 media controls for dynamic live streams have
        no timeline or timeline container, which for BlackBerry results
        in mispositioning of the buttons that are supposed to be to
        the right of the timeline (fullscreen and mute). Instead of
        being right justified they incorrectly appear on the left next
        to the play button. The fix is to explicitly position these 2
        buttons whenever the media duration is infinite (indicating a
        live stream).

        Manual test: ManualTests/blackberry/video-hls-controls.html

        * platform/blackberry/RenderThemeBlackBerry.cpp:
        (WebCore::RenderThemeBlackBerry::adjustMediaControlStyle):

2012-08-16  Abhishek Arya  <inferno@chromium.org>

        Regression(r118248): Replaced element not layout
        https://bugs.webkit.org/show_bug.cgi?id=85804

        Reviewed by Levi Weintraub.

        r118248 moved the layout call of replaced elements to nextLineBreak.
        This was intended to delay the layout after all the lineboxes are cleared
        in RenderBlock::layoutInlineChildren. However, this caused the end line
        object to not layout at all. We revert to the old planned way to just
        keep a local vector of replaced elements to layout and then layout all of them
        after the lineboxes are cleared.

        Test: fast/replaced/replaced-last-line-layout.html

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::layoutInlineChildren):
        (WebCore::RenderBlock::LineBreaker::nextLineBreak):

2012-08-16  Benjamin Poulain  <bpoulain@apple.com>

        Do not perform 8 to 16bits characters conversion when converting a WTFString to NSString/CFString
        https://bugs.webkit.org/show_bug.cgi?id=90720

        Reviewed by Geoffrey Garen.

        In most String to CFString conversion, we should be able to use the "NoCopy" constructor and have
        a relatively cheap conversion from WTF::String to CFString.

        When the String is 8 bits, it was converted to 16 bits by getData16SlowCase() because of the call
        to String::characters().

        This patch adds a path for creating a CFString from a 8bits string using CFStringCreateWithBytes.

        This is covered by existing tests.

        * platform/text/cf/StringCF.cpp:
        (WTF::String::createCFString): CFSTR() create static CFString, it is unecessary to retain it.
        * platform/text/cf/StringImplCF.cpp:
        (WTF::StringImpl::createCFString): The logic to avoid the StringWrapperCFAllocator has also been simplified.
        The allocator creation is now closer to where it is useful.

        The function CFStringCreateWithBytesNoCopy() does not necessarilly allocate a new string, it can reuse
        existing strings. In those cases, the allocator is not used. For that reason, the assertion regarding
        currentString is moved to the branch that always allocate new strings.

2012-08-16  Adam Barth  <abarth@webkit.org>

        DirectoryEntry should use Dictionary rather than custom bindings code
        https://bugs.webkit.org/show_bug.cgi?id=94207

        Reviewed by Eric Seidel.

        Since this code was written, we added native support for WebIDL
        Dictionary objects. This patch moves DirectoryEntry to use this
        automatic facility instead of custom code.

        I've also renamed and simplified WebKitFlags. This is possible because
        this object was no longer exposed via IDL (even before to this patch).

        * GNUmakefile.list.am:
        * Modules/filesystem/DOMFileSystemBase.cpp:
        (WebCore::DOMFileSystemBase::getFile):
        (WebCore::DOMFileSystemBase::getDirectory):
        * Modules/filesystem/DOMFileSystemBase.h:
        (DOMFileSystemBase):
        * Modules/filesystem/DirectoryEntry.cpp:
        (WebCore::DirectoryEntry::getFile):
        (WebCore::DirectoryEntry::getDirectory):
        * Modules/filesystem/DirectoryEntry.h:
        (DirectoryEntry):
        * Modules/filesystem/DirectoryEntry.idl:
        * Modules/filesystem/DirectoryEntrySync.cpp:
        (WebCore::DirectoryEntrySync::getFile):
        (WebCore::DirectoryEntrySync::getDirectory):
        * Modules/filesystem/DirectoryEntrySync.h:
        (DirectoryEntrySync):
        * Modules/filesystem/DirectoryEntrySync.idl:
        * Modules/filesystem/FileSystemCallbacks.cpp:
        (WebCore):
        (WebCore::ResolveURICallbacks::didOpenFileSystem):
        * Modules/filesystem/FileSystemFlags.h: Renamed from Source/WebCore/Modules/filesystem/WebKitFlags.h.
        (WebCore):
        (WebCore::FileSystemFlags::FileSystemFlags):
        (FileSystemFlags):
        * Modules/filesystem/WorkerContextFileSystem.cpp:
        (WebCore::WorkerContextFileSystem::webkitResolveLocalFileSystemSyncURL):
        * Target.pri:
        * UseJSC.cmake:
        * UseV8.cmake:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSDirectoryEntryCustom.cpp: Removed.
        * bindings/js/JSDirectoryEntrySyncCustom.cpp: Removed.
        * bindings/v8/custom/V8DirectoryEntryCustom.cpp: Removed.
        * bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp: Removed.

2012-08-15  Antti Koivisto  <antti@apple.com>

        Remove StyleSheetContents::m_finalURL 
        https://bugs.webkit.org/show_bug.cgi?id=94140

        Reviewed by Andreas Kling.

        It is equal (or empty in case of inline stylesheets) to the baseURL passed in CSSParserContext.
        Removing it simplifies the constructors and the related code.

        * css/CSSStyleSheet.cpp:
        (WebCore::CSSStyleSheet::createInline):
        (WebCore::CSSStyleSheet::canAccessRules):
        (WebCore::CSSStyleSheet::rules):
        (WebCore::CSSStyleSheet::cssRules):

            - factor access check to a function
            - allow document always access rules of its inline stylesheets

        * css/StyleRuleImport.cpp:
        (WebCore::StyleRuleImport::setCSSStyleSheet):
        (WebCore::StyleRuleImport::requestStyleSheet):
        * css/StyleSheetContents.cpp:
        (WebCore::StyleSheetContents::StyleSheetContents):
        (WebCore::StyleSheetContents::parseAuthorStyleSheet):
        * css/StyleSheetContents.h:
        (WebCore::StyleSheetContents::create):
        (WebCore::StyleSheetContents::originalURL):
        (StyleSheetContents):
        * dom/ProcessingInstruction.cpp:
        (WebCore::ProcessingInstruction::setCSSStyleSheet):
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::setCSSStyleSheet):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::fillMediaListChain):
        (WebCore::InspectorStyleSheet::styleSheetURL):
        * xml/XSLImportRule.cpp:
        (WebCore::XSLImportRule::loadSheet):

2012-08-16  Justin Novosad  <junov@chromium.org>

        [Chromium] Changing Canvas2DLayerBridge to use SkDeferredCanvas's notification client API
        https://bugs.webkit.org/show_bug.cgi?id=94234

        Reviewed by James Robinson.

        The existing DeviceContext API in skia's SkDeferredCanvas is being
        deprecated in favor of the new NotificationClient interface, which is
        designed to allow WebKit to control deferred canvas global memory
        consumption.

        No new tests: this patch does not fix any bug and does not add new
        functionality. It is just a transition to a new skia interface.
        Coverage is assured by existing tests.

        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
        (WebCore):
        Removed the AcceleratedDeviceContext class completely and mixed it
        into Canvas2DLayerBridge by inheriting
        SkDeferredCanvas::NotificationClient
        (WebCore::Canvas2DLayerBridge::~Canvas2DLayerBridge):
        (WebCore::Canvas2DLayerBridge::deferredCanvas):
        (WebCore::Canvas2DLayerBridge::prepareForDraw):
        (WebCore::Canvas2DLayerBridge::skCanvas):
        * platform/graphics/chromium/Canvas2DLayerBridge.h:
        (Canvas2DLayerBridge):
        * platform/graphics/skia/ImageBufferSkia.cpp:
        Cleaning up unnecessary include of SkDeferredCanvas.h

2012-08-16  David Reveman  <reveman@chromium.org>

        [Chromium] Avoid aliasing global symbol monotonicallyIncreasingTime().
        https://bugs.webkit.org/show_bug.cgi?id=94233

        Reviewed by James Robinson.

        Rename virtual function CCDelayBasedTimeSource::monotonicallyIncreasingTime()
        that exist for testing purposes to CCDelayBasedTimeSource::monotonicTimeNow().

        No new tests.

        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp:
        (WebCore::CCDelayBasedTimeSource::setActive):
        (WebCore::CCDelayBasedTimeSource::onTimerFired):
        (WebCore::CCDelayBasedTimeSource::monotonicTimeNow):
        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.h:

2012-08-16  David Reveman  <reveman@chromium.org>

        [Chromium] Schedule texture uploads based on hard-coded timer and vsync.
        https://bugs.webkit.org/show_bug.cgi?id=84281

        Reviewed by James Robinson.

        Improve interaction between vsync and texture uploads by performing
        uploads in smaller batches and use a hard-coded timer to emulate
        upload completion. This greatly reduces the chance of the compositor
        missing a vsync due to being busy with texture uploads.

        The CCScheduler client is now given a time limit when told to update
        more resources. This time limit is passed to an instance of the
        CCTextureUpdateController class, which is responsible for performing
        texture updates until the limit is reached.

        Unit tests: CCSchedulerTest.RequestCommit
                    CCTextureUpdateControllerTest.UpdateMoreTextures
                    CCTextureUpdateControllerTest.HasMoreUpdates

        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
        (WebCore::CCFrameRateController::nextTickTime):
        (WebCore):
        * platform/graphics/chromium/cc/CCFrameRateController.h:
        (CCFrameRateController):
        * platform/graphics/chromium/cc/CCScheduler.cpp:
        (WebCore::CCScheduler::processScheduledActions):
        * platform/graphics/chromium/cc/CCScheduler.h:
        (CCSchedulerClient):
        * platform/graphics/chromium/cc/CCTextureUpdateController.cpp:
        (WebCore::CCTextureUpdateController::maxPartialTextureUpdates):
        (WebCore::CCTextureUpdateController::CCTextureUpdateController):
        (WebCore::CCTextureUpdateController::updateMoreTextures):
        (WebCore):
        (WebCore::CCTextureUpdateController::onTimerFired):
        (WebCore::CCTextureUpdateController::monotonicTimeNow):
        (WebCore::CCTextureUpdateController::updateMoreTexturesTime):
        (WebCore::CCTextureUpdateController::updateMoreTexturesSize):
        (WebCore::CCTextureUpdateController::updateMoreTexturesIfEnoughTimeRemaining):
        (WebCore::CCTextureUpdateController::updateMoreTexturesNow):
        * platform/graphics/chromium/cc/CCTextureUpdateController.h:
        (WebCore::CCTextureUpdateController::create):
        (CCTextureUpdateController):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::beginFrameCompleteOnImplThread):
        (WebCore::CCThreadProxy::scheduledActionUpdateMoreResources):
        * platform/graphics/chromium/cc/CCThreadProxy.h:

2012-08-16  Dana Jansens  <danakj@chromium.org>

        [chromium] Impl scrolling crashes when the renderer's initialization failed
        https://bugs.webkit.org/show_bug.cgi?id=94232

        Reviewed by James Robinson.

        CCLayerTreeHostImpl::calculateRenderSurfaceLayerList should not be
        called when there is no renderer present or it will crash.

        Chromium bug: crbug.com/125482

        Tests: CCLayerTreeHostImplTest.scrollWithoutRenderer

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
        (WebCore::CCLayerTreeHostImpl::ensureRenderSurfaceLayerList):

2012-08-15  Levi Weintraub  <leviw@chromium.org>

        Accumulate sub-pixel offsets through layers and transforms
        https://bugs.webkit.org/show_bug.cgi?id=89238

        Reviewed by Eric Seidel.

        Pixel snapping logic makes use of sub-pixel offsets accumulated when walking down
        the render tree. When we align RenderLayers to paint on pixel boundaries, we were
        also losing that accumulated value. This preserves the fractional offset and passes
        it to the RenderLayer's RenderObjects so they paint the proper size and offset.

        This also necessitates a new mode of mapLocalToContainer whereby we pixel snap the
        offset used in transforms. Otherwise, they wouldn't account for the pixel snapping
        done elsewhere in the render tree.

        Test: fast/sub-pixel/sub-pixel-accumulates-to-layers.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::pixelSnappedSizingBox): The LayoutUnit version of sizingBox returns a
        LayoutRect with the location zeroed out. This leads to incorrect pixel snapping, so
        we shouldn't put these numbers into a transform. Sadly, I couldn't figure out a
        test for this without the rest of the patch.
        (WebCore):
        (WebCore::computedTransform): Using pixel-snapped values when generating transforms.
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::mapLocalToContainer): Adding a mode whereby the values inputed
        into the transform are properly pixel snapped.
        (WebCore::RenderBox::computeRectForRepaint): Using pixel snapped values for the transform.
        * rendering/RenderBox.h:
        (RenderBox):
        * rendering/RenderGeometryMap.cpp:
        (WebCore::RenderGeometryMap::mapToAbsolute):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::mapLocalToContainer):
        * rendering/RenderInline.h:
        (RenderInline):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::updateTransform): Using pixel snapped values for the transform.
        (WebCore::RenderLayer::currentTransform): Ditto.
        (WebCore::RenderLayer::perspectiveTransform): Ditto.
        (WebCore::RenderLayer::paint): Support passing along the accumulated sub-pixel offset instead
        of rounding and use enclosingIntRect for the damageRect.
        (WebCore::RenderLayer::paintOverlayScrollbars): Updating to the new paintLayer contract
        (WebCore::RenderLayer::paintLayer): Adding a sub-pixel accumulation LayoutSize. We pass this
        delta to the Layer's RenderObject when we paint, but align the graphics context to the proper
        pixel value.
        (WebCore::RenderLayer::paintLayerContentsAndReflection): Ditto.
        (WebCore::RenderLayer::paintLayerContents): Ditto.
        (WebCore::RenderLayer::paintList): Ditto.
        (WebCore::RenderLayer::paintChildLayerIntoColumns): Ditto.
        (WebCore::RenderLayer::calculateClipRects): Avoid unnecessary rounding when sub-pixel is enabled.
        (WebCore::RenderLayer::calculateRects): Remove unnecessary pixel snapping.
        * rendering/RenderLayer.h:
        (RenderLayer):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateLayerTransform): Use pixel-snapped values for transforms.
        (WebCore::RenderLayerBacking::paintIntoLayer): Update to new paintLayer contract.
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::localToContainerQuad): Adding a mode for optionally pixel snapping.
        (WebCore::RenderObject::localToContainerPoint): Ditto.
        * rendering/RenderObject.h:
        (WebCore::RenderObject::localToAbsoluteQuad): Ditto.
        (RenderObject):
        * rendering/RenderReplica.cpp:
        (WebCore::RenderReplica::paint): Updating to new paintLayer contract.
        * rendering/RenderView.h:
        (RenderView):
        * rendering/svg/RenderSVGForeignObject.cpp:
        (WebCore::RenderSVGForeignObject::mapLocalToContainer):
        * rendering/svg/RenderSVGForeignObject.h:
        (RenderSVGForeignObject):
        * rendering/svg/RenderSVGInline.cpp:
        (WebCore::RenderSVGInline::mapLocalToContainer):
        * rendering/svg/RenderSVGInline.h:
        (RenderSVGInline):
        * rendering/svg/RenderSVGModelObject.cpp:
        (WebCore::RenderSVGModelObject::mapLocalToContainer):
        * rendering/svg/RenderSVGModelObject.h:
        (RenderSVGModelObject):
        * rendering/svg/RenderSVGRoot.h:
        (RenderSVGRoot):
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::mapLocalToContainer):
        * rendering/svg/RenderSVGText.h:
        (RenderSVGText):
        * rendering/svg/SVGRenderSupport.cpp:
        (WebCore::SVGRenderSupport::mapLocalToContainer):
        * rendering/svg/SVGRenderSupport.h:
        (SVGRenderSupport):

2012-08-16  Mario Sanchez Prada  <msanchez@igalia.com>

        [GTK] Bad utf8 data is being passed to enchant_dict_check
        https://bugs.webkit.org/show_bug.cgi?id=94202

        Reviewed by Martin Robinson.

        Pass the number of bytes instead of the number of UTF8 characters
        when calling enchant_dict_check.

        * platform/text/gtk/TextCheckerEnchant.cpp:
        (TextCheckerEnchant::checkSpellingOfString): Use 'bytes' instead
        of 'wordLength'.

2012-08-16  Sergey Rogulenko  <rogulenko@google.com>

        Web Inspector: added Paint events for Images to TimelineAgent
        https://bugs.webkit.org/show_bug.cgi?id=90277

        Reviewed by Pavel Feldman.

        - add DecodeImage & ResizeImage timeline events;
        - implement {will,did}DecodeImage and {will,did}ResizeImage methods of Timeline agent;

        Test: inspector/timeline/timeline-decode-resize.html

        * English.lproj/localizedStrings.js:
        * inspector/InspectorTimelineAgent.cpp:
        (TimelineRecordType):
        (WebCore::InspectorTimelineAgent::willDecodeImage):
        (WebCore::InspectorTimelineAgent::didDecodeImage):
        (WebCore::InspectorTimelineAgent::willResizeImage):
        (WebCore::InspectorTimelineAgent::didResizeImage):
        * inspector/TimelineRecordFactory.cpp:
        (WebCore::TimelineRecordFactory::createDecodeImageData):
        (WebCore):
        (WebCore::TimelineRecordFactory::createResizeImageData):
        * inspector/TimelineRecordFactory.h:
        (TimelineRecordFactory):
        * inspector/front-end/TimelineModel.js:
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.initRecordStyles_):
        (WebInspector.TimelinePresentationModel.Record.prototype._getRecordDetails):

2012-08-16  James Robinson  <jamesr@chromium.org>

        [chromium] Remove alwaysReserveTextures code - it doesn't do anything
        https://bugs.webkit.org/show_bug.cgi?id=94183

        Reviewed by Dimitri Glazkov.

        LayerChromium::setAlwaysReservesTextures doesn't do anything and hasn't since the prioritized texture manager
        landed. This deletes the associated code.

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::LayerChromium):
        * platform/graphics/chromium/LayerChromium.h:
        (LayerChromium):

2012-08-16  Adam Barth  <abarth@webkit.org>

        Unreviewed. Sort the xcodeproj file.

        * WebCore.xcodeproj/project.pbxproj:

2012-08-16  Adam Barth  <abarth@webkit.org>

        Unreviewed. Update bindings tests results from my recent VoidCallback
        patch. The new result is correct.

        * bindings/scripts/test/V8/V8TestCallback.cpp:

2012-08-16  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: CPU profiler status bar is broken.
        https://bugs.webkit.org/show_bug.cgi?id=94212

        Reviewed by Pavel Feldman.

        - properly compute floating status bar buttons offset for profile and timeline panels,
            taking actual number of panel status bar buttons and panel sidebar offset into account;

        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
        (WebInspector.ProfilesPanel.prototype.sidebarResized):
        (WebInspector.ProfilesPanel.prototype.onResize):
        * inspector/front-end/SplitView.js:
        (WebInspector.SplitView.prototype.sidebarWidth):
        * inspector/front-end/StatusBarButton.js:
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype.sidebarResized):
        (WebInspector.TimelinePanel.prototype.onResize):

2012-08-16  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>

        Fix the Mac build.

        Unreviewed build fix.

        * WebCore.exp.in: Export FrameView::didFirstLayout()

2012-08-16  Konrad Piascik  <kpiascik@rim.com>

        Add BB10 User Agent String to Web Inspector.
        https://bugs.webkit.org/show_bug.cgi?id=94217

        Reviewed by George Staikos.

        Add the new BlackBerry 10 User Agent String and device metrics for
        emulation.

        * inspector/front-end/SettingsScreen.js:
        (WebInspector.UserAgentSettingsTab.prototype._createUserAgentSelectRowElement.get const):

2012-08-16  Marcelo Lira  <marcelo.lira@openbossa.org>

        [Qt] Input method hints are not being set.
        https://bugs.webkit.org/show_bug.cgi?id=92386

        Reviewed by Kenneth Rohde Christiansen.

        Input method hints for an editable element must be obtained from a proper
        HTML element. If the editable element is a complex one, it will have elements
        in the Shadow DOM, and it's one of those that will be returned as the root
        editable element. This works for editable DIVs, but not for INPUT elements.
        Using Element::shadowHost() on the root editable element will provide the
        needed HTML element, and for further clarity a method that does this was added
        to FrameSelection.

        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::rootEditableElementRespectingShadowTree): Similar to
        WebCore::FrameSelection::rootEditableElement, but returns the first ancestor of
        the editable element outside the shadow tree.
        (WebCore):
        * editing/FrameSelection.h:
        (FrameSelection):

2012-08-16  Zeno Albisser  <zeno@webkit.org>

        Make GraphicsSurface double buffered by default.
        https://bugs.webkit.org/show_bug.cgi?id=93252

        Create only a single GraphicsSurface per canvas
        on both supported platforms Mac/Linux.
        The GraphicsSurface on Mac internally uses two IOSurface
        to provide a front and a back buffer.
        The GLX implementation of GraphicsSurface uses
        an XWindow which already provides a front and a back buffer.

        Reviewed by Noam Rosenthal.

        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        (GraphicsContext3DPrivate):
            Remove creation of second GraphicsSurface.
        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
        (WebCore::GraphicsContext3DPrivate::copyToGraphicsSurface):
        (WebCore):
        (WebCore::GraphicsContext3DPrivate::graphicsSurfaceToken):
        (WebCore::GraphicsContext3DPrivate::createGraphicsSurfaces):
        * platform/graphics/surfaces/GraphicsSurface.cpp:
        (WebCore::GraphicsSurface::create):
            Adjust token type to uint64_t.
        (WebCore::GraphicsSurface::exportToken):
            Adjust return type to uint64_t.
        (WebCore::GraphicsSurface::frontBuffer):
        (WebCore):
        (WebCore::GraphicsSurface::swapBuffers):
            Add forwarding function to swap buffers inside GraphicsSurface.
        * platform/graphics/surfaces/GraphicsSurface.h:
        (GraphicsSurface):
            Add SupportsSingleBuffered flag to allow for single buffered implementations.
            Currently single buffered surfaces are either not implemented or disabled.
        * platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp:
            Move implementation details into GraphicsSurfacePrivate.
            This way the platform specific code can be hidden in the specific cpp file
            instead of polluting the global GraphicsSurface header.
        (WebCore::createTexture):
        (GraphicsSurfacePrivate):
        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
        (WebCore::GraphicsSurfacePrivate::~GraphicsSurfacePrivate):
        (WebCore::GraphicsSurfacePrivate::swapBuffers):
        (WebCore::GraphicsSurfacePrivate::token):
        (WebCore::GraphicsSurfacePrivate::frontBufferTextureID):
        (WebCore::GraphicsSurfacePrivate::backBufferTextureID):
        (WebCore::GraphicsSurfacePrivate::frontBuffer):
        (WebCore::GraphicsSurfacePrivate::backBuffer):
        (WebCore):
        (WebCore::GraphicsSurface::platformExport):
        (WebCore::GraphicsSurface::platformGetTextureID):
        (WebCore::GraphicsSurface::platformCopyToGLTexture):
        (WebCore::GraphicsSurface::platformCopyFromFramebuffer):
        (WebCore::GraphicsSurface::platformFrontBuffer):
        (WebCore::GraphicsSurface::platformSwapBuffers):
        (WebCore::GraphicsSurface::platformCreate):
        (WebCore::GraphicsSurface::platformImport):
        (WebCore::ioSurfaceLockOptions):
        (WebCore::GraphicsSurface::platformLock):
        (WebCore::GraphicsSurface::platformUnlock):
        (WebCore::GraphicsSurface::platformDestroy):
        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp:
        (WebCore::OffScreenRootWindow::get):
        (WebCore::GraphicsSurfacePrivate::swapBuffers):
            Make sure that framebuffer bindings remain consistent
            after swapping buffers on the XWindow.
        (WebCore::GraphicsSurface::platformExport):
            Make sure the GLXPixmap is only bound to the texture once.
        (WebCore::GraphicsSurface::platformGetTextureID):
        (WebCore::GraphicsSurface::platformCopyFromFramebuffer):
        (WebCore):
        (WebCore::GraphicsSurface::platformFrontBuffer):
            The GLX surface does not know how to destinguish between
            the front and the back buffer by an id. This is not necessary
            for GraphicsSurfaceGLX, because the texture can just be
            read from the XWindow at any time.
        (WebCore::GraphicsSurface::platformSwapBuffers):
        (WebCore::GraphicsSurface::platformCreate):
        (WebCore::GraphicsSurface::platformImport):
        * platform/graphics/texmap/TextureMapperBackingStore.cpp:
            Remove code that was used for switching between two GraphicsSurfaces,
            as this is now handled directly inside GraphicsSurface.
        (WebCore::TextureMapperSurfaceBackingStore::setGraphicsSurface):
        (WebCore::TextureMapperSurfaceBackingStore::paintToTextureMapper):
        (WebCore::TextureMapperSurfaceBackingStore::setSurface):
        (WebCore):
        * platform/graphics/texmap/TextureMapperBackingStore.h:
            Remove GraphicsSurfaceData struct. This class is not needed anymore
            as we do not keep track of more than one GraphicsSurface at the time.
        (WebCore):
        (TextureMapperSurfaceBackingStore):
        (WebCore::TextureMapperSurfaceBackingStore::graphicsSurface):
        (WebCore::TextureMapperSurfaceBackingStore::TextureMapperSurfaceBackingStore):
        * platform/graphics/texmap/TextureMapperPlatformLayer.h:
        (WebCore::TextureMapperPlatformLayer::graphicsSurfaceToken):

2012-08-16  Mike West  <mkwst@chromium.org>

        Implement the form-action Content Security Policy directive.
        https://bugs.webkit.org/show_bug.cgi?id=93777

        Reviewed by Jochen Eisinger.

        The CSP 1.1 editor's draft defines the 'form-action' directive as a
        mechanism for whitelisting valid targets for form submission from a
        protected resource. A web author might desire to restrict form
        submissions to the same origin as the protected resource itself via
        a Content Security Policy of "form-action 'self'", or ensure that all
        submissions were sent over an SSL connection via "form-action https:".

        Specification details available at: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#form-action--experimental

        This experimental directive is gated on the ENABLE_CSP_NEXT flag, which
        is currently only enabled in Chromium.

        Tests: http/tests/security/contentSecurityPolicy/1.1/form-action-src-allowed.html
               http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html
               http/tests/security/contentSecurityPolicy/1.1/form-action-src-default-ignored.html
               http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-allowed.html
               http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked.html
               http/tests/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked.html
               http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::checkIfFormActionAllowedByCSP):
            Adding a callback to FrameLoader in order to allow the
            MainResourceLoader to check the relevant CSP status without knowing
            anything about CSP.
        (WebCore):
        * loader/FrameLoader.h:
        (FrameLoader):
        * loader/MainResourceLoader.cpp:
        (WebCore::MainResourceLoader::willSendRequest):
            Check against the protected resource's Content Security Policy when
            presented with a request that is itself a form submission, or is the
            result of a redirect in response to a form submission. If CSP would
            block the target, cancel the request.
        * page/ContentSecurityPolicy.cpp:
        (CSPDirectiveList):
        (WebCore::CSPDirectiveList::checkSourceAndReportViolation):
            Added explanatory text to the source violation console warning that
            specifically calls out sending form data (as opposed to "connect to"
            or "load the").
        (WebCore::CSPDirectiveList::allowFormAction):
            Check a URL against a directive list's the 'form-action' source list.
        (WebCore):
        (WebCore::CSPDirectiveList::addDirective):
            Recognize the 'form-action' CSP directive.
        (WebCore::ContentSecurityPolicy::allowFormAction):
            Public interface to check a form action.
        * page/ContentSecurityPolicy.h:

2012-08-16  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] WebGL and Canvas fail to display after being restored from page cache
        https://bugs.webkit.org/show_bug.cgi?id=94105

        Reviewed by George Staikos.

        The EGLImage was being destroyed when releasing layer resources on the
        compositing thread, but the WebKit thread layer never found out and
        failed to create a new image.

        Fixed by extending the release layer resources mechanism to also make a
        pass on the WebKit thread so that thread's layers have a chance to
        delete their textures and related resources.

        WebGL and canvas layers now take this opportunity to release their
        textures so the EGLImage gets recreated when compositing commits
        resume.

        The only detail that deserves extra explanation is the ownership of the
        EGLImage.

        Since the EGLImage is created in updateTextureContentsIfNeeded() and
        that one is always followed by commitPendingTextureUploads() which
        transfers the EGLImage to the compositing thread layer's custody, the
        EGLImage currently referenced by EGLImageLayerWebKitThread::m_image
        should never be deleted by the WebKit thread layer.

        Thus all we have to do in deleteFrontBuffer() is to set the m_image
        member to 0 so the image gets recreated on the next commit. It will be
        deleted by the part of releaseLayerResources() that executes on the
        compositing thread (which, if you recall, was the original source of
        this bug).

        Reviewed internally by Filip Spacek.

        PR 192899

        Not currently testable by the BlackBerry testing infrastructure.

        * platform/graphics/blackberry/CanvasLayerWebKitThread.cpp:
        (WebCore::CanvasLayerWebKitThread::deleteTextures):
        (WebCore):
        * platform/graphics/blackberry/CanvasLayerWebKitThread.h:
        (CanvasLayerWebKitThread):
        * platform/graphics/blackberry/EGLImageLayerWebKitThread.cpp:
        (WebCore::EGLImageLayerWebKitThread::~EGLImageLayerWebKitThread):
        (WebCore::EGLImageLayerWebKitThread::deleteFrontBuffer):
        * platform/graphics/blackberry/EGLImageLayerWebKitThread.h:
        (EGLImageLayerWebKitThread):
        * platform/graphics/blackberry/LayerWebKitThread.cpp:
        (WebCore::LayerWebKitThread::releaseLayerResources):
        (WebCore):
        * platform/graphics/blackberry/LayerWebKitThread.h:
        (LayerWebKitThread):
        (WebCore::LayerWebKitThread::deleteTextures):
        * platform/graphics/blackberry/WebGLLayerWebKitThread.cpp:
        (WebCore::WebGLLayerWebKitThread::~WebGLLayerWebKitThread):
        (WebCore::WebGLLayerWebKitThread::deleteTextures):
        (WebCore):
        * platform/graphics/blackberry/WebGLLayerWebKitThread.h:
        (WebGLLayerWebKitThread):

2012-08-16  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: enable instrumentation of platform code
        https://bugs.webkit.org/show_bug.cgi?id=94125

        Reviewed by Pavel Feldman.

        - add PlatformInstrumentation class that exposes instrumentation methods that may be used by code under WebCore/platform;
        - move TRACE_EVENT_XXX() macros into PlatformInstrumentation.h to minimize instrumentation hassle in the client code;
        - implement PlatformInstrumentationClient by InspectorTimelineAgent;
        - only install PlatformInstrumentationClient when we have outer events for which we expect low-level details

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::willDecodeImage): to be implemented by subsequent change;
        (WebCore::InspectorTimelineAgent::didDecodeImage): to be implemented by subsequent change;
        (WebCore::InspectorTimelineAgent::willResizeImage): to be implemented by subsequent change;
        (WebCore::InspectorTimelineAgent::didResizeImage): to be implemented by subsequent change;
        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
        (WebCore::InspectorTimelineAgent::clearRecordStack):
        * inspector/InspectorTimelineAgent.h:
        (InspectorTimelineAgent):
        * platform/PlatformInstrumentation.cpp: Added.
        (WebCore):
        (WebCore::PlatformInstrumentation::setClient):
        * platform/PlatformInstrumentation.h: Added.
        (WebCore):
        (PlatformInstrumentationClient):
        (PlatformInstrumentation):
        (WebCore::PlatformInstrumentation::hasClient):
        (WebCore::PlatformInstrumentation::willDecodeImage):
        (WebCore::PlatformInstrumentation::didDecodeImage):
        (WebCore::PlatformInstrumentation::willResizeImage):
        (WebCore::PlatformInstrumentation::didResizeImage):
        * platform/graphics/skia/NativeImageSkia.cpp:
        (WebCore::NativeImageSkia::resizedBitmap): added calls to PlatformInstrumentation, removed TRACE_EVENT();
        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
        (WebCore::BMPImageDecoder::frameBufferAtIndex): added calls to PlatformInstrumentation;
        (WebCore::BMPImageDecoder::decode): removed TRACE_EVENT()
        * platform/image-decoders/gif/GIFImageDecoder.cpp:
        (WebCore::GIFImageDecoder::frameBufferAtIndex): added calls to PlatformInstrumentation;
        (WebCore::GIFImageDecoder::decode): removed TRACE_EVENT()
        * platform/image-decoders/ico/ICOImageDecoder.cpp:
        (WebCore::ICOImageDecoder::frameBufferAtIndex): added calls to PlatformInstrumentation;
        (WebCore::ICOImageDecoder::decode): removed TRACE_EVENT()
        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
        (WebCore::JPEGImageDecoder::frameBufferAtIndex): added calls to PlatformInstrumentation;
        (WebCore::JPEGImageDecoder::decode): removed TRACE_EVENT()
        * platform/image-decoders/png/PNGImageDecoder.cpp:
        (WebCore::PNGImageDecoder::frameBufferAtIndex): added calls to PlatformInstrumentation;
        * platform/image-decoders/webp/WEBPImageDecoder.cpp:
        (WebCore::WEBPImageDecoder::frameBufferAtIndex): added calls to PlatformInstrumentation;
        (WebCore::WEBPImageDecoder::decode): removed TRACE_EVENT();
        * inspector/InspectorInstrumentation.cpp: removed orphan event support;
        (WebCore):
        * inspector/InspectorInstrumentation.h: ditto.

2012-08-16  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Breakpoints are not correctly restored on reload.
        https://bugs.webkit.org/show_bug.cgi?id=94209

        Reviewed by Pavel Feldman.

        BreakpointManager now resets uiLocations on workspace reset (was doing it on GlobalObjectCleared).
        Breakpoint manager now calls restoreBreakpoints automatically when uiSourceCode is added to workspace.

        * inspector/front-end/BreakpointManager.js:
        (WebInspector.BreakpointManager):
        (WebInspector.BreakpointManager.prototype._uiSourceCodeAdded):
        (WebInspector.BreakpointManager.prototype._workspaceReset):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode):
        * inspector/front-end/inspector.js:

2012-08-16  Pierre Rossi  <pierre.rossi@gmail.com>

        [Qt] Remove FontQt4, HAVE_QRAWFONT flag and the related dead code
        https://bugs.webkit.org/show_bug.cgi?id=93960

        Reviewed by Simon Hausmann.

        Following the removal of Qt 4 support from trunk in r124879.

        No new tests. Simple cleanup job.

        * Target.pri:
        * platform/graphics/Font.cpp:
        (WebCore::Font::codePath):
        * platform/graphics/Font.h:
        (Font):
        * platform/graphics/GraphicsContext.cpp:
        (WebCore):
        * platform/graphics/SimpleFontData.cpp:
        (WebCore::SimpleFontData::platformGlyphInit):
        (WebCore::SimpleFontData::glyphForCharacter):
        * platform/graphics/SimpleFontData.h:
        (SimpleFontData):
        (WebCore::SimpleFontData::widthForGlyph):
        * platform/graphics/qt/FontCacheQt.cpp:
        (WebCore::rawFontForCharacters):
        (WebCore::FontCache::getFontDataForCharacters):
        * platform/graphics/qt/FontCustomPlatformData.h:
        (FontCustomPlatformData):
        * platform/graphics/qt/FontCustomPlatformDataQt.cpp:
        (WebCore::FontCustomPlatformData::fontPlatformData):
        (WebCore::createFontCustomPlatformData):
        * platform/graphics/qt/FontPlatformData.h:
        (WebCore::FontPlatformDataPrivate::FontPlatformDataPrivate):
        (FontPlatformDataPrivate):
        (FontPlatformData):
        (WebCore::FontPlatformData::FontPlatformData):
        * platform/graphics/qt/FontPlatformDataQt.cpp:
        (WebCore::FontPlatformData::FontPlatformData):
        (WebCore::FontPlatformData::operator==):
        (WebCore::FontPlatformData::hash):
        * platform/graphics/qt/FontQt4.cpp: Removed.
        * platform/graphics/qt/GlyphPageTreeNodeQt.cpp:
        (WebCore::GlyphPage::fill):
        * platform/graphics/qt/SimpleFontDataQt.cpp:
        (WebCore::SimpleFontData::determinePitch):
        (WebCore::SimpleFontData::platformBoundsForGlyph):
        (WebCore::SimpleFontData::platformInit):
        (WebCore::SimpleFontData::platformCharWidthInit):
        * rendering/svg/SVGTextMetricsBuilder.cpp:
        (WebCore::SVGTextMetricsBuilder::advance):
        (WebCore::SVGTextMetricsBuilder::advanceSimpleText):
        (WebCore::SVGTextMetricsBuilder::initializeMeasurementWithTextRenderer):

2012-08-16  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: memory instrumentation for Resource{Request/Response}Base
        https://bugs.webkit.org/show_bug.cgi?id=94109

        Reviewed by Vsevolod Vlasov.

        Added reportMemoryUsage methods to ResourceRequestBase, ResourceResponseBase
        and several related classes.

        * dom/MemoryInstrumentation.cpp:
        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl): added overrides
        for String, StringImpl and AtomicString object types so that we can reuse
        existing addInstrumentedCollection method instead of adding a counterpart
        that would operate on not instrumented content. Next step would be to get
        rid od addObject overrides for these types so that all kinds of Strings are
        considered as instrumented classes despite they don't have reportMemoryUsage
        method.
        (WebCore):
        * dom/MemoryInstrumentation.h:
        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl):
        (MemoryInstrumentation):
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::reportMemoryUsage):
        * platform/network/FormData.cpp:
        (WebCore::FormData::reportMemoryUsage):
        (WebCore):
        * platform/network/FormData.h:
        (WebCore):
        (FormData):
        * platform/network/ResourceRequestBase.cpp:
        (WebCore::ResourceRequestBase::reportMemoryUsage):
        (WebCore):
        * platform/network/ResourceRequestBase.h:
        (ResourceRequestBase):
        * platform/network/ResourceResponseBase.cpp:
        (WebCore):
        (WebCore::ResourceResponseBase::reportMemoryUsage):
        * platform/network/ResourceResponseBase.h:
        (WebCore):
        (ResourceResponseBase):

2012-08-16  Adam Barth  <abarth@webkit.org>

        Delete DOMWindow::securityOrigin()
        https://bugs.webkit.org/show_bug.cgi?id=93991

        Reviewed by Eric Seidel.

        DOMWindow::securityOrigin() just calls through to
        document()->securityOrigin(). This patch updates all the callers to do
        that work themselves, making it clearer what's going on at each call
        site.

        * bindings/generic/BindingSecurity.cpp:
        (WebCore::canAccessDocument):
        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::allowsAccessFrom):
        * bindings/js/JSDOMWindowCustom.h:
        (WebCore::JSDOMWindowBase::allowsAccessFromPrivate):
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::collectIsolatedContexts):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::isInsecureScriptAccess):
        (WebCore::DOMWindow::createWindow):
        * page/DOMWindow.h:
        (DOMWindow):
        * page/Location.cpp:
        (WebCore::Location::reload):

2012-08-16  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r125751.
        http://trac.webkit.org/changeset/125751
        https://bugs.webkit.org/show_bug.cgi?id=94206

        we shouldn't be rolling out this patch without a formal
        review. (Requested by rniwa_ on #webkit).

        * dom/CharacterData.cpp:
        (WebCore::CharacterData::setDataAndUpdate):
        * editing/FrameSelection.cpp:
        (WebCore::updatePositionAfterAdoptingTextReplacement):
        (WebCore::FrameSelection::textWasReplaced):
        * editing/FrameSelection.h:
        (FrameSelection):

2012-08-16  Marja Hölttä  <marja@chromium.org>

        FormController, FileInputType: Enable reading selected file names from document state
        https://bugs.webkit.org/show_bug.cgi?id=91231

        Reviewed by Jochen Eisinger.

        This change enables Chromium to set up file permissions properly when
        the session restore feature restores a page with selected files.

        Test: fast/forms/file/selected-files-from-history-state.html

        * WebCore.exp.in: Exported FormController::getReferencedFilePaths.
        * html/FileInputType.cpp:
        (WebCore::FileInputType::filesFromFormControlState): Added. Extracts FileChooserFileInfos from a FormControlState.
        (WebCore):
        (WebCore::FileInputType::restoreFormControlState): Refactored to use filesFromFormControlState.
        * html/FileInputType.h:
        (FileInputType): Added filesFromFormControlState.
        * html/FormController.cpp:
        (SavedFormState): Added getReferencedFilePaths.
        (WebCore::SavedFormState::getReferencedFilePaths): Added. Extracts selected file paths from SavedFormState.
        (WebCore):
        (WebCore::FormController::setStateForNewFormElements): Refactored to use formStatesFromStateVector.
        (WebCore::FormController::formStatesFromStateVector):
        (WebCore::FormController::getReferencedFilePaths): Added. Static. Extracts selected file paths from a document state.
        * html/FormController.h:
        (FormController): Added getReferencedFilePaths and formStatesFromStateVector.
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::filesFromFileInputFormControlState): Added. Delegates to FileInputType::filesFromFormControlState.
        (WebCore):
        * html/HTMLInputElement.h: Added filesFromFileInputFormControlState.
        (HTMLInputElement):
        * testing/Internals.cpp:
        (WebCore::Internals::getReferencedFilePaths): Calls FormController::getReferencedFilePaths.
        (WebCore):
        * testing/Internals.h:
        (Internals): Added getReferencedFilePaths.
        * testing/Internals.idl: Added binding for getReferencedFilePaths.

2012-08-15  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] set scissorRect per quad so that quads are correctly clipped
        https://bugs.webkit.org/show_bug.cgi?id=94050

        Reviewed by Adrienne Walker.

        Certain quad types rely on scissoring to do correct
        clipping. Refactoring the quad types to remove this assumption
        will be done in a later patch, but for now, we have to apply the
        scissor rect to every quad to ensure that those quads are
        correctly clipped.

        Test: compositing/overflow/overflow-hidden-canvas-layer.html

        Also updated two unit tests to reflect the change in semantics.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawRenderPass):
        (WebCore::LayerRendererChromium::drawQuad):

2012-08-16  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Wheel event support in multiple fields time input UI
        https://bugs.webkit.org/show_bug.cgi?id=94166

        Reviewed by Kent Tamura.

        This patch makes multiple fields time input UI to handle wheel event
        on spin button.

        This patch affects if ENABLE_INPUT_TYPE_TIME and ENABLE_INPUT_TYPE_MULTIPLE_FIELDS
        are enabled.

        Test: fast/forms/time-multiple-fields/time-multiple-fields-wheel-event.html

        * html/shadow/DateTimeEditElement.cpp:
        (WebCore::DateTimeEditElement::defaultEventHandler): Changed to forward
        event to spin button if available.

2012-08-16  Zhigang Gong  <zhigang.gong@linux.intel.com>

        TextureMapperGL::beginPainting has a duplicate call to get GL_FRAMEBUFFER_BINDING.
        https://bugs.webkit.org/show_bug.cgi?id=94180

        Reviewed by Noam Rosenthal.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::beginPainting):

2012-08-16  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119705.
        http://trac.webkit.org/changeset/119705
        https://bugs.webkit.org/show_bug.cgi?id=94192

        Causing crash on ClusterFuzz due to incorrect layout ordering
        change (Requested by inferno-sec on #webkit).

        * dom/CharacterData.cpp:
        (WebCore::CharacterData::setDataAndUpdate):
        * editing/FrameSelection.cpp:
        (WebCore::updatePositionAfterAdoptingTextReplacement):
        (WebCore::FrameSelection::textWillBeReplaced):
        * editing/FrameSelection.h:
        (FrameSelection):

2012-08-15  Kent Tamura  <tkent@chromium.org>

        [Chromium] Refactoring: Introduce a new function for some part of PopupContainer::layoutAndCalculateWidgetRect()
        https://bugs.webkit.org/show_bug.cgi?id=94087

        Reviewed by Hajime Morita.

        Move some part of PopupContainer::layoutAndCalculateWidgetRect() to a
        new function which is not a member of PopupContainer because we'd like
        to add a unit test for the position calculation code, and to reduce the
        dependency.

        No new tests. Popup positioning code is not testable in WebKit.

        * platform/chromium/PopupContainer.cpp:
        (WebCore::layoutAndCalculateWidgetRectInternal):
        Added. Move the code from PopupContainer::layoutAndCalculateWidgetRect.
        In order to avoid to call member functions of PopupContainer, we
        don't call layoutAndGetRTLOffset() and height(). Use
        PopupListBox::layout() to recalculate the popup content size, and use
        PopupListBox::height() + kBorderSize * 2 instead of height(). We
        resize the view after finishing layoutAndCalculateWidgetRectInternal
        in PopupContainer::layoutAndCalculateWidgetRect.
        (WebCore::PopupContainer::layoutAndCalculateWidgetRect):
        Move some code to layoutAndCalculateWidgetRectInternal.
        (WebCore::PopupContainer::fitToListBox):
        Added. Move the code from PopupContainer::layoutAndGetRTLOffset.
        (WebCore::PopupContainer::layoutAndGetRTLOffset):
        Move some code to fitToListBox.
        * platform/chromium/PopupContainer.h:
        (PopupContainer): Added fitToListBox.

2012-08-15  Adam Barth  <abarth@webkit.org>

        VoidCallback should not be a special snowflake
        https://bugs.webkit.org/show_bug.cgi?id=94119

        Reviewed by Eric Seidel.

        VoidCallback is the oldest of the callbacks and it predates our ability
        to autogenerate callback objects. The existing implementation of
        VoidCallback is wrong because it doesn't call
        ActiveDOMCallback::canInvokeCallback. The net result of that is that
        void callbacks can race with navigations and occationally execute after
        the Frame has navigated to a new Document, which was causing the
        flakiness.

        This patch changes VoidCallback to no longer be a unique snowflake.
        Instead, we autogenerate the implementation, just like every other
        callback in WebCore.

        Tests: storage/websql/database-lock-after-reload.html is no longer flaky.

        * DerivedSources.make:
        * GNUmakefile.list.am:
        * Modules/filesystem/SyncCallbackHelper.h:
        (WebCore::SyncCallbackHelper::SuccessCallbackImpl::handleEvent):
        * Target.pri:
        * UseJSC.cmake:
        * UseV8.cmake:
        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/cpp/WebDOMCustomVoidCallback.cpp: Removed.
        * bindings/cpp/WebDOMCustomVoidCallback.h: Removed.
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSCustomVoidCallback.cpp: Removed.
        * bindings/js/JSCustomVoidCallback.h: Removed.
        * bindings/js/JSDesktopNotificationsCustom.cpp:
        (WebCore::JSNotificationCenter::requestPermission):
        * bindings/scripts/CodeGeneratorCPP.pm:
        (GetClassName):
        (AddIncludesForType):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GetCallbackClassName):
        (GenerateCallbackImplementation):
        (JSValueToNative):
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateCallbackImplementation):
        (TypeCanFailConversion):
        (GetCallbackClassName):
        * bindings/scripts/test/JS/JSTestCallback.cpp:
        (WebCore::JSTestCallback::callbackWithNoParam):
        * bindings/scripts/test/V8/V8TestCallback.cpp:
        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
        * bindings/v8/custom/V8CustomVoidCallback.cpp: Removed.
        * bindings/v8/custom/V8CustomVoidCallback.h: Removed.
        * bindings/v8/custom/V8MutationCallbackCustom.cpp:
        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
        (WebCore::V8NotificationCenter::requestPermissionCallback):
        * html/VoidCallback.h:
        (VoidCallback):
        * html/VoidCallback.idl:
        * inspector/InspectorDatabaseAgent.cpp:
        (WebCore):

2012-08-15  Hayato Ito  <hayato@chromium.org>

        [Shadow] Stop 'load' and 'error' events at shadow boundaries
        https://bugs.webkit.org/show_bug.cgi?id=93425

        Reviewed by Dimitri Glazkov.

        The shadow DOM spec has added these events as 'always-be-stopped' events at shadow boundaries.
        http://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#events-that-are-always-stopped

        Test: fast/dom/shadow/events-stopped-at-shadow-boundary.html

        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::determineDispatchBehavior):

2012-08-15  Kent Tamura  <tkent@chromium.org>

        Calendar Picker: Localize numbers in a calendar picker
        https://bugs.webkit.org/show_bug.cgi?id=93704

        Reviewed by Hajime Morita.

        Because Number.toLocaleString() of V8 returns no localized
        numbers, we provide a localization function via
        PagePopupController.

        No new tests. We have no ways to change the locale in layout tests.

        * Resources/pagepopups/calendarPicker.js:
        (localizeNumber): Added. A wrapper for pagePopupController.localizeNumberString().
        (formatJapaneseImperialEra): Use localizeNumber().
        (formatYearMonth): ditto.
        (DaysTable.prototype._renderMonth): ditto.
        * page/PagePopupController.cpp:
        (WebCore::PagePopupController::localizeNumberString):
        Added. Just calls WebCore::convertToLocalizedNumber().
        * page/PagePopupController.h:
        (PagePopupController): Declare localizeNumberString().
        * page/PagePopupController.idl: Add localizeNumberString().

2012-08-15  MORITA Hajime  <morrita@google.com>

        Regression(121518) TextFieldDecorationElement formatting is broken.
        https://bugs.webkit.org/show_bug.cgi?id=90913

        Reviewed by Dimitri Glazkov.

        NodeRenderingContext::nextRenderer() has a problem which cannot retrieve the renderer
        across an insertion point in some case. That is because ad-hoc composed tree traversal on
        NodeRenderingContext is broken. The problem is hidden before r121518 though.

        This change rewrite nextRenderer() using ComposedShadowTreeWalker to eliminate the ad-hoc
        traversal. previousRenderer() is also rewritten in the same way.

        Test: fast/dom/shadow/shadow-div-reflow.html

        * dom/NodeRenderingContext.cpp:
        (WebCore):
        (WebCore::NodeRenderingContext::nextRenderer):
        (WebCore::NodeRenderingContext::previousRenderer):

2012-08-15  Julien Chaffraix  <jchaffraix@webkit.org>

        Add a was-inserted-into-tree notification to RenderObject
        https://bugs.webkit.org/show_bug.cgi?id=93874

        Reviewed by Eric Seidel.

        This change adds insertedIntoTree to RenderObject so that renderers
        can now do their post-insertion task inside this function.

        Our current architecture has 2 ways of doing post-insertion tasks:
        - overriding RenderObject::addChild
        - RenderObjectChildList::insertChildNode / appendChildNode

        Because the former is not guaranteed to be called for each insertion
        (on top of being called on the parent and not the inserted child), the
        2 latter functions are the one that have been mostly used recently. This
        led to code duplication between the functions but also doesn't scale as
        other renderers need to hop on this notification and currently don't (for
        example, table parts). The other renderer's migration will be done in
        follow-up patches.

        Refactoring covered by existing tests.

        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::removeChildNode):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::enclosingRenderNamedFlowThread):
        Moved the code from renderNamedFlowThreadContainer to RenderObject::enclosingRenderNamedFlowThread.
        This is needed as now 2 classes need to access the function.

        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::appendChildNode):
        (WebCore::RenderObjectChildList::insertChildNode):
        Moved the code duplicated from those 2 functions into
        the instances of insertedIntoTree below.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::insertedIntoTree):
        Base function that needs to be called from all the other
        specialized functions below.

        * rendering/RenderListItem.cpp:
        (WebCore::RenderListItem::insertedIntoTree):
        * rendering/RenderListItem.h:
        * rendering/RenderObject.h:
        * rendering/RenderObjectChildList.h:
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::insertedIntoTree):
        * rendering/RenderRegion.h:
        Added the overriden insertedIntoTree function.

        * rendering/RenderQuote.h:
        Moved the comment from RenderObjectChildList about RenderQuote here.

2012-08-14  Jeffrey Pfau  <jpfau@apple.com>

        Allow blocking of Web SQL databases in third-party documents
        https://bugs.webkit.org/show_bug.cgi?id=94057

        Reviewed by Adam Barth.

        Add a check for pages in third-party pages to allow third-party storage blocking of Web SQL databases.

        Tests: http/tests/security/cross-origin-websql-allowed.html
               http/tests/security/cross-origin-websql.html

        * Modules/webdatabase/DOMWindowWebDatabase.cpp:
        (WebCore::DOMWindowWebDatabase::openDatabase): Pass top origin to canAccessDatabase
        * page/SecurityOrigin.cpp:
        (WebCore::SecurityOrigin::canAccessStorage): Common method for various types of storage that use the same criteria
        * page/SecurityOrigin.h:
        (WebCore::SecurityOrigin::canAccessDatabase): Use canAccessStorage
        (WebCore::SecurityOrigin::canAccessLocalStorage): Change to using canAccessStorage
        (SecurityOrigin):

2012-08-15  Nikhil Bhargava  <nbhargava@google.com>

        Improve Document.h compile time - reduce includes of ScriptCallStack.h
        https://bugs.webkit.org/show_bug.cgi?id=94161

        Reviewed by Eric Seidel.

        ScriptCallStack.h no longer included from ScriptExecutionContext. It's
        relatively expensive to compile and gets compiled a ton because
        Document.h indirectly includes it.

        No new tests. Functionality should remain the same

        * Modules/indexeddb/IDBDatabase.cpp:
        * Modules/indexeddb/IDBIndex.cpp:
        * Modules/indexeddb/IDBObjectStore.cpp:
        * bindings/js/ScriptController.cpp:
        * dom/ScriptElement.cpp:
        * dom/ScriptExecutionContext.h:
        (WebCore):
        * fileapi/Blob.cpp:
        * fileapi/WebKitBlobBuilder.cpp:
        * html/HTMLTrackElement.cpp:
        * loader/TextTrackLoader.cpp:
        * page/DOMSecurityPolicy.cpp:

2012-08-15  Alec Flett  <alecflett@chromium.org>

        IndexedDB: IDB*::keyPath should return IDBKeyPath, not IDBAny
        https://bugs.webkit.org/show_bug.cgi?id=92434

        Reviewed by Tony Chang.

        Clean up IDBKeyPath conversion to IDBAny objects. This gets rid of
        some implicit conversion from IDBKeyPath to IDBAny.

        No new tests, just changing method signatures.

        * Modules/indexeddb/IDBAny.cpp:
        (WebCore::IDBAny::set):
        (WebCore):
        * Modules/indexeddb/IDBAny.h:
        (WebCore):
        (WebCore::IDBAny::create):
        (IDBAny):
        * Modules/indexeddb/IDBIndex.h:
        (WebCore::IDBIndex::keyPathAny):
        (WebCore::IDBIndex::keyPath):
        * Modules/indexeddb/IDBIndex.idl:
        * Modules/indexeddb/IDBKeyPath.cpp:
        * Modules/indexeddb/IDBKeyPath.h:
        * Modules/indexeddb/IDBObjectStore.h:
        (WebCore::IDBObjectStore::keyPathAny):
        (WebCore::IDBObjectStore::keyPath):
        * Modules/indexeddb/IDBObjectStore.idl:

2012-08-15  Ryosuke Niwa  <rniwa@webkit.org>

        EFL build fix attempt after r125711. Touch an IDL file to regenerate derived sources.

        * html/HTMLAllCollection.idl:

2012-08-15  Alec Flett  <alecflett@chromium.org>

        IndexedDB: generate index keys for existing data in createIndex in front end
        https://bugs.webkit.org/show_bug.cgi?id=91125

        Reviewed by Tony Chang.

        Make createIndex() do index key generation in the frontend, rather
        than the backend. When an index is created, the frontend uses the
        cursor API to iterate through the values in the backend to
        generate keys, sending them back to the backend using
        IDBObjectStore::setIndexKeys()

        This confines all key injection/extraction to the frontend.

        The new test verifies the implemented behavior with respect to
        error handling in degenerate uses of put(), though that behavior
        is still in discussion as the spec is vague on the proper error
        behavior.

        Test: storage/indexeddb/lazy-index-population.html

        * Modules/indexeddb/IDBCursorBackendImpl.cpp: Make sure that the
        TaskType propagates throught the cursor and all subsequent
        continue() calls.
        (WebCore::IDBCursorBackendImpl::IDBCursorBackendImpl):
        (WebCore::IDBCursorBackendImpl::continueFunction):
        (WebCore::IDBCursorBackendImpl::prefetchContinue):
        * Modules/indexeddb/IDBCursorBackendImpl.h:
        (WebCore::IDBCursorBackendImpl::create):
        (IDBCursorBackendImpl):
        * Modules/indexeddb/IDBObjectStore.cpp: Add an IndexPopulator
        class to run a cursor from the frontend.
        (WebCore):
        (WebCore::IDBObjectStore::createIndex):
        (WebCore::IDBObjectStore::openCursor):
        * Modules/indexeddb/IDBObjectStore.h:
        (WebCore::IDBObjectStore::openCursor):
        (IDBObjectStore):
        (WebCore::IDBObjectStore::createIndex):
        * Modules/indexeddb/IDBObjectStore.idl: Pass along ScriptContext
        so that openCursor can be called from createIndex.
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore):
        (WebCore::makeIndexWriters):
        (WebCore::IDBObjectStoreBackendImpl::setIndexKeys):
        (WebCore::IDBObjectStoreBackendImpl::setIndexesReady):
        (WebCore::IDBObjectStoreBackendImpl::setIndexesReadyInternal):
        (WebCore::IDBObjectStoreBackendImpl::putInternal):
        (WebCore::IDBObjectStoreBackendImpl::deleteInternal):
        (WebCore::IDBObjectStoreBackendImpl::createIndexInternal):
        (WebCore::IDBObjectStoreBackendImpl::openCursor):
        (WebCore::IDBObjectStoreBackendImpl::openCursorInternal):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
        (IDBObjectStoreBackendImpl):
        (WebCore::IDBObjectStoreBackendImpl::iterIndexesBegin):
        (WebCore::IDBObjectStoreBackendImpl::iterIndexesEnd):
        (WebCore::IDBObjectStoreBackendImpl::backingStore):
        (WebCore::IDBObjectStoreBackendImpl::databaseId):
        * Modules/indexeddb/IDBObjectStoreBackendInterface.h:
        * Modules/indexeddb/IDBRequest.cpp:
        Allow requests to keep their own TaskType, to give certain
        requests priority over others.
        (WebCore::IDBRequest::create):
        (WebCore):
        (WebCore::IDBRequest::IDBRequest):
        (WebCore::IDBRequest::abort):
        * Modules/indexeddb/IDBRequest.h:
        (IDBRequest):
        (WebCore::IDBRequest::taskType):
        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
        Introduce a second, higher priority event queue, m_preemptiveTaskQueue,
        which takes priority over the regular task queue.
        (WebCore::IDBTransactionBackendImpl::IDBTransactionBackendImpl):
        (WebCore::IDBTransactionBackendImpl::scheduleTask):
        (WebCore::IDBTransactionBackendImpl::isTaskQueueEmpty):
        (WebCore):
        (WebCore::IDBTransactionBackendImpl::commit):
        (WebCore::IDBTransactionBackendImpl::taskTimerFired):
        (WebCore::IDBTransactionBackendImpl::taskEventTimerFired):
        * Modules/indexeddb/IDBTransactionBackendImpl.h:
        (WebCore::IDBTransactionBackendImpl::scheduleTask):
        (IDBTransactionBackendImpl):
        (WebCore::IDBTransactionBackendImpl::addEarlyEvent):
        (WebCore::IDBTransactionBackendImpl::didCompleteEarlyEvent):
        * Modules/indexeddb/IDBVersionChangeRequest.cpp:
        (WebCore::IDBVersionChangeRequest::IDBVersionChangeRequest):

2012-08-15  Hayato Ito  <hayato@chromium.org>

        A 'load' event should be fired on the shadow host directly, not on an inner image element of shadow dom subtree.
        https://bugs.webkit.org/show_bug.cgi?id=93920

        Reviewed by Dimitri Glazkov.

        A 'load' event is a must-stoppable event at shadow boundary. So we
        should fire a 'load' event on a shadow host directly, not on an
        inner image element.

        Test: fast/dom/shadow/shadowdom-for-image-event.html

        * html/HTMLImageLoader.cpp:
        (WebCore::HTMLImageLoader::dispatchLoadEvent):
        * loader/ImageLoaderClient.h:
        (WebCore::ImageLoaderClient::eventTarget):

2012-08-15  Otto Derek Cheung  <otcheung@rim.com>

        [BlackBerry] Show custom error page when 407 is received
        https://bugs.webkit.org/show_bug.cgi?id=94138

         Reviewed by George Staikos.
         Internally reviewed by Lianghui Chen

         Adding a new custom error page when the browser receieves
         a Wifi proxy authentication error. The previous behaviour
         is to ask for user credentials everytime, and silently fails
         when the username and password fields in the Wifi settings
         are not empty. UX suggests modifying the behaviour to simply
         asks the user to change their credentials in the Wifi settings
         when we receive such an error.

         The fix is to prevent notifyAuthReceived from sending another
         networkjob when authCallbacks are called, and to listen to any 407
         calls in notifyStatusReceived. Once we hit a 407, tell the frame we
         failed and should load the custom error page.

         Also removed checking functions in sendRequestWithCredentials because
         proxy auth requests won't get into that function anymore.

         #PR163400

         Tested by loading on device and loading/reloading pages under
         these scenarios:
         - Connected to wifi (no proxy)
         - Connected to wifi (proxy with no credentials)
         - Connected to wifi (proxy with invalid credentials)
         - Connected to wifi (proxy with valid credentials)

         * platform/network/blackberry/NetworkJob.cpp:
         (WebCore::NetworkJob::handleNotifyStatusReceived):
         (WebCore::NetworkJob::notifyAuthReceived):
         (WebCore::NetworkJob::sendRequestWithCredentials):

2012-08-15  Dan Carney  <dcarney@google.com>

        Refactor away IsolatedWorld
        https://bugs.webkit.org/show_bug.cgi?id=93971

        Reviewed by Adam Barth.

        Remove IsolatedWorld class as it was 1:1 with DOMWrapperWorld.
        This paves the way towards a JSC-like use of DOMWrapperWorld.

        No tests.  No change in functionality.

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/v8/DOMWrapperWorld.cpp:
        (WebCore):
        (WebCore::mainThreadNormalWorld):
        * bindings/v8/DOMWrapperWorld.h:
        (WebCore):
        (DOMWrapperWorld):
        (WebCore::DOMWrapperWorld::create):
        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
        (WebCore::DOMWrapperWorld::count):
        (WebCore::DOMWrapperWorld::worldId):
        (WebCore::DOMWrapperWorld::domDataStore):
        (WebCore::DOMWrapperWorld::DOMWrapperWorld):
        * bindings/v8/IsolatedWorld.cpp: Removed.
        * bindings/v8/IsolatedWorld.h: Removed.
        * bindings/v8/V8DOMWrapper.h:
        (WebCore::V8DOMWrapper::getCachedWrapper):
        * bindings/v8/V8IsolatedContext.cpp:
        (WebCore::V8IsolatedContext::V8IsolatedContext):
        (WebCore::V8IsolatedContext::destroy):
        * bindings/v8/V8IsolatedContext.h:
        (WebCore::V8IsolatedContext::getEntered):
        (WebCore::V8IsolatedContext::world):
        (V8IsolatedContext):

2012-08-15  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>

        [css3-text] Add CSS3 Text decoration compile flag
        https://bugs.webkit.org/show_bug.cgi?id=93863

        Reviewed by Julien Chaffraix.

        This patch handles the compile flag implementation, which will come disabled by
        default, thus not exposing the CSS3 text decoration features to the web, unless
        when explicitly enabling it with "--css3-text-decoration" build parameter.

        Changeset r125205 added "-webkit-text-decoration-line" support without proper
        compile flag. I am fixing this on this patch by adding #ifdef's along the added
        code and reverting getComputedStyle* layout test changes until further notice.
        The text-decoration-line.html layout test is now moved to
        fast/css3-text-decoration directory, which is skipped on all platforms until
        feature is sound and ready to be exposed to web.

        Test: fast/css3-text-decoration/text-decoration-line.html

        * Configurations/FeatureDefines.xcconfig:
        * GNUmakefile.am:
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::addTextDecorationProperty):
        (WebCore::CSSParser::parseTextDecoration):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        Added #ifdefs to enable/disable CSS3 Text Decoration code implemented by r125205.

2012-08-15  Iain Merrick  <husky@chromium.org>

        Refactoring: move EventHandler::targetNode into HitTestResult
        https://bugs.webkit.org/show_bug.cgi?id=94107

        Reviewed by Dimitri Glazkov.

        This static helper method in EventHandler was made public so that
        WebFrameImpl can call it. That's untidy because EventHandler isn't
        really involved. This patch turns it into an instance method of
        HitTestResult (with a wrapper in MouseEventWithHitTestResult for
        convenience).
    
        Pure refactoring, no behavior change, no new test needed.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::selectClosestWordFromMouseEvent):
        (WebCore::EventHandler::selectClosestWordOrLinkFromMouseEvent):
        (WebCore::EventHandler::handleMousePressEventTripleClick):
        (WebCore::EventHandler::handleMousePressEventSingleClick):
        (WebCore::EventHandler::handleMousePressEvent):
        (WebCore::EventHandler::handleMouseDraggedEvent):
        (WebCore::EventHandler::updateSelectionForMouseDrag):
        (WebCore::EventHandler::handleMouseReleaseEvent):
        (WebCore::EventHandler::subframeForHitTestResult):
        (WebCore::EventHandler::selectCursor):
        (WebCore::EventHandler::handleMouseDoubleClickEvent):
        (WebCore::EventHandler::handleMouseMoveEvent):
        (WebCore::EventHandler::updateDragAndDrop):
        (WebCore::EventHandler::handleGestureEvent):
        (WebCore::EventHandler::sendContextMenuEvent):
        * page/EventHandler.h:
        (EventHandler):
        * page/MouseEventWithHitTestResults.h:
        (WebCore::MouseEventWithHitTestResults::targetNode):
        * page/chromium/EventHandlerChromium.cpp:
        (WebCore::EventHandler::passMousePressEventToSubframe):
        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
        * page/efl/EventHandlerEfl.cpp:
        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
        * page/gtk/EventHandlerGtk.cpp:
        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
        (WebCore::EventHandler::passSubframeEventToSubframe):
        * page/wx/EventHandlerWx.cpp:
        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
        * rendering/HitTestResult.cpp:
        (WebCore::HitTestResult::targetNode):
        (WebCore):
        * rendering/HitTestResult.h:
        (HitTestResult):

2012-08-15  David Grogan  <dgrogan@chromium.org>

        IndexedDB: Add some ASSERTs
        https://bugs.webkit.org/show_bug.cgi?id=94055

        Reviewed by Ojan Vafai.

        These are just some additional ASSERTS and some ASSERT_WITH_MESSAGE in
        place of ASSERT. They are from the patch in
        https://bugs.webkit.org/show_bug.cgi?id=92897

        No new tests - we should never hit this behavior.

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::setVersion):
        (WebCore::IDBDatabase::registerFrontendCallbacks):
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::dispatchEvent):
        (WebCore::IDBRequest::enqueueEvent):
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::setActive):

2012-08-15  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r125687.
        http://trac.webkit.org/changeset/125687
        https://bugs.webkit.org/show_bug.cgi?id=94147

        It broke the whole world (Requested by Ossy_night on #webkit).

        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
        (WebCore::JSSQLStatementErrorCallback::handleEvent):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::addEventListener):
        (WebCore::JSDOMWindow::removeEventListener):
        * bindings/js/JSDataViewCustom.cpp:
        (WebCore::getDataViewMember):
        * bindings/js/JSDeviceMotionEventCustom.cpp:
        (WebCore::JSDeviceMotionEvent::initDeviceMotionEvent):
        * bindings/js/JSDeviceOrientationEventCustom.cpp:
        (WebCore::JSDeviceOrientationEvent::initDeviceOrientationEvent):
        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::convertValue):
        * bindings/js/JSDirectoryEntryCustom.cpp:
        (WebCore::JSDirectoryEntry::getFile):
        (WebCore::JSDirectoryEntry::getDirectory):
        * bindings/js/JSDirectoryEntrySyncCustom.cpp:
        (WebCore::getFlags):
        * bindings/js/JSHTMLCanvasElementCustom.cpp:
        (WebCore::JSHTMLCanvasElement::getContext):
        * bindings/js/JSInspectorFrontendHostCustom.cpp:
        (WebCore::populateContextMenuItems):
        * bindings/js/JSMessageEventCustom.cpp:
        (WebCore::handleInitMessageEvent):
        * bindings/js/JSWebGLRenderingContextCustom.cpp:
        (WebCore::dataFunctionMatrix):
        * bindings/js/JSXMLHttpRequestCustom.cpp:
        (WebCore::JSXMLHttpRequest::open):
        * bindings/js/JavaScriptCallFrame.cpp:
        * bindings/js/JavaScriptCallFrame.h:
        (JavaScriptCallFrame):
        * bindings/js/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::hasBreakpoint):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateEventListenerCall):
        (GenerateHeader):
        (JSValueToNative):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::jsTestEventTargetPrototypeFunctionAddEventListener):
        (WebCore::jsTestEventTargetPrototypeFunctionRemoveEventListener):
        * bindings/scripts/test/JS/JSTestEventTarget.h:
        (WebCore::JSTestEventTarget::create):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::setJSTestObjCreate):
        (WebCore::setJSTestObjReflectedBooleanAttr):
        (WebCore::setJSTestObjReflectedCustomBooleanAttr):
        (WebCore::jsTestObjPrototypeFunctionAddEventListener):
        (WebCore::jsTestObjPrototypeFunctionRemoveEventListener):
        * bridge/c/c_utility.cpp:
        (JSC::Bindings::convertValueToNPVariant):
        * bridge/jni/jni_jsobject.mm:
        (JavaJSObject::convertValueToJObject):
        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::convertValueToQVariant):

2012-08-15  Dominic Mazzoni  <dmazzoni@google.com>

        AX: Calls to AXObjectCache should prefer Node over Renderer
        https://bugs.webkit.org/show_bug.cgi?id=91794

        Reviewed by Chris Fleizach.

        Now that it's possible for nodes inside a canvas subtree to be focused and
        represent accessible content, accessibility notifications should be triggered
        with a Node* rather than with a RenderObject* whenever possible.

        Every public API in AXObjectCache that took a RenderObject* before now either
        takes a Node* instead, or has a parallel method that takes a Node*.

        Tests: accessibility/accessibility-node-memory-management.html
               accessibility/accessibility-node-reparent.html
               accessibility/canvas-fallback-content.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::focusedImageMapUIElement):
        (WebCore::AXObjectCache::focusedUIElementForPage):
        (WebCore::AXObjectCache::get):
        (WebCore::AXObjectCache::getOrCreate):
        (WebCore::AXObjectCache::contentChanged):
        (WebCore):
        (WebCore::AXObjectCache::updateCacheAfterNodeIsAttached):
        (WebCore::AXObjectCache::childrenChanged):
        (WebCore::AXObjectCache::postNotification):
        (WebCore::AXObjectCache::checkedStateChanged):
        (WebCore::AXObjectCache::selectedChildrenChanged):
        (WebCore::AXObjectCache::nodeTextChangeNotification):
        (WebCore::AXObjectCache::handleAriaExpandedChange):
        (WebCore::AXObjectCache::handleActiveDescendantChanged):
        (WebCore::AXObjectCache::handleAriaRoleChanged):
        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
        (WebCore::AXObjectCache::rootAXEditableElement):
        (WebCore::AXObjectCache::nodeIsTextControl):
        * accessibility/AXObjectCache.h:
        (AXObjectCache):
        (WebCore::AXObjectCache::setNodeInUse):
        (WebCore::AXObjectCache::removeNodeForUse):
        (WebCore::AXObjectCache::isNodeInUse):
        (WebCore::AXObjectCache::checkedStateChanged):
        (WebCore::AXObjectCache::childrenChanged):
        (WebCore::AXObjectCache::contentChanged):
        (WebCore::AXObjectCache::updateCacheAfterNodeIsAttached):
        (WebCore::AXObjectCache::handleActiveDescendantChanged):
        (WebCore::AXObjectCache::handleAriaExpandedChange):
        (WebCore::AXObjectCache::handleAriaRoleChanged):
        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
        (WebCore::AXObjectCache::nodeTextChangeNotification):
        (WebCore::AXObjectCache::postNotification):
        (WebCore::AXObjectCache::selectedChildrenChanged):
        * accessibility/AccessibilityListBoxOption.cpp:
        (WebCore::AccessibilityListBoxOption::parentObject):
        * accessibility/AccessibilityObject.cpp:
        (WebCore::appendAccessibilityObject):
        (WebCore::replacedNodeNeedsCharacter):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::menuForMenuButton):
        (WebCore::AccessibilityRenderObject::menuButtonForMenu):
        (WebCore::AccessibilityRenderObject::checkboxOrRadioRect):
        (WebCore::AccessibilityRenderObject::addRadioButtonGroupMembers):
        (WebCore::AccessibilityRenderObject::titleUIElement):
        (WebCore::AccessibilityRenderObject::isTabItemSelected):
        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
        (WebCore::AccessibilityRenderObject::nodeIsTextControl):
        (WebCore::AccessibilityRenderObject::activeDescendant):
        (WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
        (WebCore::AccessibilityRenderObject::correspondingLabelForControlElement):
        * accessibility/AccessibilityRenderObject.h:
        (AccessibilityRenderObject):
        * accessibility/AccessibilityScrollView.cpp:
        (WebCore::AccessibilityScrollView::webAreaObject):
        (WebCore::AccessibilityScrollView::parentObject):
        (WebCore::AccessibilityScrollView::parentObjectIfExists):
        * accessibility/chromium/AXObjectCacheChromium.cpp:
        (WebCore::AXObjectCache::postPlatformNotification):
        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
        * accessibility/gtk/AXObjectCacheAtk.cpp:
        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
        * accessibility/mac/AXObjectCacheMac.mm:
        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
        * accessibility/win/AXObjectCacheWin.cpp:
        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
        * bindings/cpp/WebDOMCustomVoidCallback.cpp:
        (toWebCore):
        * dom/Document.cpp:
        (WebCore::Document::setFocusedNode):
        * dom/Element.cpp:
        (WebCore::Element::attributeChanged):
        * dom/Node.cpp:
        (WebCore::Node::~Node):
        (WebCore::Node::attach):
        * editing/AppendNodeCommand.cpp:
        (WebCore::sendAXTextChangedIgnoringLineBreaks):
        * editing/DeleteFromTextNodeCommand.cpp:
        (WebCore::DeleteFromTextNodeCommand::doApply):
        (WebCore::DeleteFromTextNodeCommand::doUnapply):
        * editing/Editor.cpp:
        (WebCore::Editor::respondToChangedContents):
        (WebCore::Editor::markAndReplaceFor):
        * editing/InsertIntoTextNodeCommand.cpp:
        (WebCore::InsertIntoTextNodeCommand::doApply):
        (WebCore::InsertIntoTextNodeCommand::doUnapply):
        * editing/InsertNodeBeforeCommand.cpp:
        (WebCore::InsertNodeBeforeCommand::doApply):
        (WebCore::InsertNodeBeforeCommand::doUnapply):
        * editing/chromium/FrameSelectionChromium.cpp:
        (WebCore::FrameSelection::notifyAccessibilityForSelectionChange):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::setChecked):
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::childrenChanged):
        (WebCore::HTMLSelectElement::optionElementChildrenChanged):
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::setInnerTextValue):
        * html/InputType.cpp:
        (WebCore::InputType::applyStep):
        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::handleKeydownEvent):
        * page/FocusController.cpp:
        (WebCore::FocusController::setInitialFocus):

2012-08-15  Andreas Kling  <kling@webkit.org>

        NinePieceImage: Avoid unnecessary duplication of default data in assignment operator.
        <http://webkit.org/b/94046>

        Reviewed by Geoffrey Garen.

        If copying a NinePieceImage with a null m_data, don't create a copy of it's data()
        as that will point to the default NinePieceImageData. ~200kB progression on Membuster.

        * rendering/style/NinePieceImage.h:
        (WebCore::NinePieceImage::operator=):

2012-08-15  Gregg Tavares  <gman@google.com>

        Mark Skia and Compositor Contexts
        https://bugs.webkit.org/show_bug.cgi?id=94129

        Reviewed by James Robinson.

        Marks the Skia and Compositor contexts to aid in debugging.

        No new tests as no new functionality.

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
        * platform/graphics/skia/ImageBufferSkia.cpp:
        (WebCore::createAcceleratedCanvas):

2012-08-15  Ian Vollick  <vollick@chromium.org>

        [chromium] Must account for empty transformation lists when checking for big rotations.
        https://bugs.webkit.org/show_bug.cgi?id=93975

        Reviewed by James Robinson.

        AnimationTranslationUtil.cpp is supposed to reject large rotations 
        (>= 180 degrees between keyframes). The current code assumes that if 
        the lists of transforms at two consecutive keyframes do not match 
        (i.e., are different types), then do not need to reject. The rationale
        is that we will revert to matrix blending -- we will collapse the lists
        of transform operations to matrices at each keyframe and blend those. 
        Unfortunately, this is not true if a list is empty. It can be the case 
        that we transition from no transform to a rotation about the z axis of 
        360 degrees. In this case, the first list of transform operations will 
        be empty and the second will have a single rotation of 360 degrees. An 
        empty list should be treated as a rotation of zero degrees.

        Unit tested in: GraphicsLayerChromiumTest.createTransformAnimationWithBigRotationAndEmptyTransformOperationList

        * platform/graphics/chromium/AnimationTranslationUtil.cpp:
        (WebCore::causesRotationOfAtLeast180Degrees):

2012-08-15  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=93693
        [WK2] REGRESSION(125091): pixel results don't sow scrollbars 
        anymore

        Reviewed by Sam Weinig.

        This is a regression from http://trac.webkit.org/changeset/125091 
        in which I failed to noticed that 
        WKBundlePageCreateSnapshotInViewCoordinates() did actually do 
        something different than 
        WKBundlePageCreateSnapshotInDocumentCoordinates(). Specifically, 
        it used ScrollView::paint() to paint instead of 
        FrameView::paintContents(). So this patch restores that 
        functionality by adding a value to SnapshotOptions indicating 
        whether the snapshot should be taken in ViewCoordinates 
        (otherwise it defaults to DocumentCoordinates).

        FrameView:: paintContentsForSnapshot() now takes a new parameter 
        that indicates whether to take the snapshot in document 
        coordinates or view coordinates.
        * WebCore.exp.in:
        * page/FrameView.cpp:
        (WebCore::FrameView::paintContentsForSnapshot):
        * page/FrameView.h:

2012-08-15  Benjamin Poulain  <bpoulain@apple.com>

        Use literal initialization for CSS's pseudo types
        https://bugs.webkit.org/show_bug.cgi?id=94066

        Reviewed by Kenneth Rohde Christiansen.

        Initialize CSS pseudo type strings with the new initialization from literal.

        The first invocation of nameToPseudoTypeMap() becomes 20% faster and we use
        less memory to store the strings.

        * css/CSSSelector.cpp:
        (WebCore::nameToPseudoTypeMap):

2012-08-15  Brady Eidson  <beidson@apple.com>

        Removing a plug-in element from a page opened in a background tab in Safari crashes
        <rdar://problem/12057991> and https://bugs.webkit.org/show_bug.cgi?id=93913

        Reviewed by Beth Dakin.

        Expose Page::setCanStartMedia to regression tests so they can pretend to be in a non-windowed WebView.

        Test: platform/mac-wk2/plugins/asynchronous-destroy-before-initialization.html

        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::Backup):
        (WebCore::InternalSettings::Backup::restoreTo):
        (WebCore::InternalSettings::setCanStartMedia):
        (WebCore):
        * testing/InternalSettings.h:
        (Backup):
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-08-15  Levi Weintraub  <leviw@chromium.org>

        AutoTableLayout truncates preferred widths for cells when it needs to ceil them to contain the contents
        https://bugs.webkit.org/show_bug.cgi?id=93911

        Reviewed by Eric Seidel.

        Avoiding truncation of sub-pixel accumulated values when determining the preferred width of a table cell
        in AutoTableLayout. Since we continue to layout tables using integers, we need to ceil the contents to
        prevent premature wrapping of the contents.

        This only affects ports with sub-pixel layout enabled, and fixes regressions of a handful of tests that
        were missed when updating expectations when sub-pixel was enabled.

        Test: fast/sub-pixel/auto-table-layout-should-avoid-text-wrapping.html

        * rendering/AutoTableLayout.cpp:
        (WebCore::AutoTableLayout::recalcColumn):

2012-08-10  Ojan Vafai  <ojan@chromium.org>

        z-index should work without position on flexitems
        https://bugs.webkit.org/show_bug.cgi?id=91405

        Reviewed by Tony Chang.

        Require a layer on any RenderBox that has a non-auto z-index.
        Statically positioned, non-flex-item's have their z-index coerced to auto,
        so it's safe to check z-index unconditionally.

        Test: css3/flexbox/z-index.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::adjustRenderStyle):
        -Don't coerce z-index to auto on statically positioned flex-items.
        -Use the parentStyle to determine if the parent is a flexbox instead of
        looking at the element's parentNode's renderer.
        * rendering/RenderBox.h:
        -Add having a non-auto z-index to the list of things that require a layer.

2012-08-15  Joanmarie Diggs  <jdiggs@igalia.com>

        [Gtk] atk_text_set_caret_offset() fails for table cells
        https://bugs.webkit.org/show_bug.cgi?id=83501

        Reviewed by Chris Fleizach.

        Allow using text ranges in accessible table cells.

        * accessibility/gtk/AccessibilityObjectAtk.cpp:
        (WebCore::AccessibilityObject::allowsTextRanges):
        Add table cells to the list of accessibility objects supporting text ranges.

2012-08-15  Scott Graham  <scottmg@chromium.org>

        Rename window.internals.fastMallocStatistics to mallocStatistics
        https://bugs.webkit.org/show_bug.cgi?id=94033

        Reviewed by Adam Barth.

        Mechanical rename. In preparation for plumbing allocation information
        from allocators that aren't "fastMalloc".

        * CMakeLists.txt:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * WebCore.vcproj/WebCoreTestSupport.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * loader/DocumentLoader.h:
        (WebCore::DocumentLoader::didTellClientAboutLoad):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::loadResource):
        * testing/FastMallocStatistics.h: Removed.
        * testing/FastMallocStatistics.idl: Removed.
        * testing/Internals.cpp:
        (WebCore::Internals::mallocStatistics):
        * testing/Internals.h:
        (WebCore):
        (Internals):
        * testing/Internals.idl:
        * testing/MallocStatistics.h: Added.
        * testing/MallocStatistics.idl: Added.

2012-08-15  Joshua Netterfield  <jnetterfield@rim.com>

        [BlackBerry] Upstream BlackBerry build fixes
        https://bugs.webkit.org/show_bug.cgi?id=94121

        Reviewed by Rob Buis.

        This includes several build fixes due to incorrect upstream patches.
        These mistakes were never present downstream.

        No new tests, because no new functionality is added.

        * platform/graphics/GraphicsContext3D.cpp:
        (WebCore::GraphicsContext3D::computeFormatAndTypeParameters):
        * platform/graphics/GraphicsContext3D.h:
        (GraphicsContext3D):
        (WebCore::GraphicsContext3D::ShaderSourceEntry::ShaderSourceEntry):
        * platform/graphics/blackberry/LayerFilterRenderer.cpp:
        (WebCore::LayerFilterRendererAction::LayerFilterRendererAction):
        * platform/graphics/blackberry/LayerFilterRenderer.h:
        (LayerFilterRendererAction):

2012-08-15  Adam Barth  <abarth@webkit.org>

        JSDOMWrapper should ASSERT that it has an associated ScriptExecutionContext
        https://bugs.webkit.org/show_bug.cgi?id=94053

        Reviewed by Sam Weinig.

        Previously we were unable have this ASSERT because DOMWindow needed a
        Frame to find Document. Now that we can find the Document without a
        Frame, we can include the ASSERT and sanity will rein across the land.

        * bindings/js/JSDOMWrapper.h:
        (WebCore::JSDOMWrapper::globalObject):
        (WebCore::JSDOMWrapper::scriptExecutionContext):
        (WebCore::JSDOMWrapper::JSDOMWrapper):

2012-08-14  Mark Hahnenberg  <mhahnenberg@apple.com>

        Change behavior of MasqueradesAsUndefined to better accommodate DFG changes
        https://bugs.webkit.org/show_bug.cgi?id=93884

        Reviewed by Geoffrey Garen.

        With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of 
        MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines, 
        we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined 
        objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject). 
        For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not 
        masquerade as undefined within frame B, but it will continue to masquerade in frame A.

        Test: fast/js/document-all-between-frames.html

        All of the changes in WebCore are simply passing the additional ExecState argument to JSValue::toBoolean.

        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
        (WebCore::JSSQLStatementErrorCallback::handleEvent):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::addEventListener):
        (WebCore::JSDOMWindow::removeEventListener):
        * bindings/js/JSDataViewCustom.cpp:
        (WebCore::getDataViewMember):
        * bindings/js/JSDeviceMotionEventCustom.cpp:
        (WebCore::JSDeviceMotionEvent::initDeviceMotionEvent):
        * bindings/js/JSDeviceOrientationEventCustom.cpp:
        (WebCore::JSDeviceOrientationEvent::initDeviceOrientationEvent):
        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::convertValue):
        * bindings/js/JSDirectoryEntryCustom.cpp:
        (WebCore::JSDirectoryEntry::getFile):
        (WebCore::JSDirectoryEntry::getDirectory):
        * bindings/js/JSDirectoryEntrySyncCustom.cpp:
        (WebCore::getFlags):
        * bindings/js/JSHTMLCanvasElementCustom.cpp:
        (WebCore::JSHTMLCanvasElement::getContext):
        * bindings/js/JSInspectorFrontendHostCustom.cpp:
        (WebCore::populateContextMenuItems):
        * bindings/js/JSMessageEventCustom.cpp:
        (WebCore::handleInitMessageEvent):
        * bindings/js/JSWebGLRenderingContextCustom.cpp:
        (WebCore::dataFunctionMatrix):
        * bindings/js/JSXMLHttpRequestCustom.cpp:
        (WebCore::JSXMLHttpRequest::open):
        * bindings/js/JavaScriptCallFrame.cpp:
        (WebCore::JavaScriptCallFrame::exec):
        (WebCore):
        * bindings/js/JavaScriptCallFrame.h:
        (JavaScriptCallFrame):
        * bindings/js/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::hasBreakpoint):
        * bindings/scripts/CodeGeneratorJS.pm: Also add the custom create function for MasqueradesAsUndefined JS DOM wrappers.
        (GenerateEventListenerCall):
        (GenerateHeader):
        (JSValueToNative):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::jsTestEventTargetPrototypeFunctionAddEventListener):
        (WebCore::jsTestEventTargetPrototypeFunctionRemoveEventListener):
        * bindings/scripts/test/JS/JSTestEventTarget.h:
        (WebCore::JSTestEventTarget::create):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::setJSTestObjCreate):
        (WebCore::setJSTestObjReflectedBooleanAttr):
        (WebCore::setJSTestObjReflectedCustomBooleanAttr):
        (WebCore::jsTestObjPrototypeFunctionAddEventListener):
        (WebCore::jsTestObjPrototypeFunctionRemoveEventListener):
        * bridge/c/c_utility.cpp:
        (JSC::Bindings::convertValueToNPVariant):
        * bridge/jni/jni_jsobject.mm:
        (JavaJSObject::convertValueToJObject):
        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::convertValueToQVariant):

2012-08-15  Joanmarie Diggs  <jdiggs@igalia.com>

        [Gtk] atk_text_get_text_at_offset() fails to provide the correct line for paragraphs in list items whose text wraps
        https://bugs.webkit.org/show_bug.cgi?id=83435

        Reviewed by Chris Fleizach.

        Fix a logic error when checking if an object is a list marker.

        * accessibility/gtk/WebKitAccessibleInterfaceText.cpp:
        (textForRenderer):

2012-08-15  Arpita Bahuguna  <arpitabahuguna@gmail.com>

        There is additional space not belonged to a table between the table cells
        https://bugs.webkit.org/show_bug.cgi?id=74864

        Reviewed by Julien Chaffraix.

        Hittest for a point on the edge, i.e. between two table columns, currently
        does not return any matching underlying element.

        A hittest on such a point (on the edge of two table columns) should return
        the column that lies either on the logical right/bottom of the said point.

        Tests: fast/table/hittest-tablecell-bottom-edge.html
               fast/table/hittest-tablecell-right-edge.html
               fast/table/hittest-tablecell-with-borders-bottom-edge.html
               fast/table/hittest-tablecell-with-borders-right-edge.html

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::spannedRows):
        Removed the FIXME regarding the correctness of the usage of the upper_bound algorithm
        since that is now verified by the testcases in this patch. Also, the comment
        regarding the inconsistency between the algorithms used in spannedRows and spannedColumns
        is no longer valid.

        (WebCore::RenderTableSection::spannedColumns):
        Changed lower_bound() algorithm to upper_bound() for obtaining the next column.
        This is now similar to what is used for obtaining the next row in spannedRows().

2012-08-15  Anna Cavender  <annacc@chromium.org>

        Add the timestampOffset attribute to SourceBuffer.
        https://bugs.webkit.org/show_bug.cgi?id=93303

        Reviewed by Dimitri Glazkov.

        On the 30 July 2012 version of the Media Source Extensions spec, a timestampOffset 
        attribute was added to the SourceBuffer object:
        http://dvcs.w3.org/hg/html-media/raw-file/tip/media-source/media-source.html#dom-timestampoffset

        Tests: additions to http/tests/media/media-source/video-media-source-objects.html

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::setTimestampOffset): Set the timestampOffset on MediaPlayer.
        (WebCore):
        * Modules/mediasource/MediaSource.h:
        (MediaSource):
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::SourceBuffer): Let the timestampOffset be 0 initially
        (WebCore::SourceBuffer::timestampOffset): Return the last value set.
        (WebCore):
        (WebCore::SourceBuffer::setTimestampOffset): Forward the call onto MediaSouce.
        * Modules/mediasource/SourceBuffer.h:
        (SourceBuffer):
        * Modules/mediasource/SourceBuffer.idl: Create the new timestampOffset attr.
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::NullMediaPlayerPrivate::sourceSetTimestampOffset): A null media player
            should just return false (nothing to set).
        (WebCore):
        (WebCore::MediaPlayer::sourceSetTimestampOffset):  Forward the call.
        * platform/graphics/MediaPlayer.h:
        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::sourceSetTimestampOffset):

2012-08-15  Pavel Chadnov  <chadnov@google.com>

        Web Inspector: Incorrect XHR responses when two async xhrs are sent synchronously
        https://bugs.webkit.org/show_bug.cgi?id=91630
        
        Reviewed by Vsevolod Vlasov.

        CachedResource object for XHR response is now taken from ResourceLoader (if it's possible).

        Test: http/tests/inspector/network/network-xhr-async-double.html

        * inspector/InspectorInstrumentation.cpp:
        (WebCore):
        (WebCore::InspectorInstrumentation::didReceiveResourceResponseImpl):
        (WebCore::InspectorInstrumentation::didReceiveResourceResponseButCanceledImpl):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        (WebCore::InspectorInstrumentation::didReceiveResourceResponse):
        * inspector/InspectorResourceAgent.cpp:
        (WebCore::InspectorResourceAgent::willSendRequest):
        (WebCore::InspectorResourceAgent::didReceiveResponse):
        * inspector/InspectorResourceAgent.h:
        (WebCore):
        (InspectorResourceAgent):
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::didReceiveResponse):
        * loader/ResourceLoadNotifier.cpp:
        (WebCore::ResourceLoadNotifier::didReceiveResponse):
        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
        * loader/ResourceLoadNotifier.h:
        (ResourceLoadNotifier):
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::isSubresourceLoader):
        (WebCore):
        * loader/ResourceLoader.h:
        (ResourceLoader):
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::cachedResource):
        (WebCore):
        (WebCore::SubresourceLoader::isSubresourceLoader):
        * loader/SubresourceLoader.h:
        (SubresourceLoader):
        * loader/appcache/ApplicationCacheGroup.cpp:
        (WebCore::ApplicationCacheGroup::didReceiveResponse):

2012-08-15  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Use default parameter on reportResult in InspectorFileSystemAgent
        https://bugs.webkit.org/show_bug.cgi?id=93930

        Reviewed by Vsevolod Vlasov.

        No functional change.

        * inspector/InspectorFileSystemAgent.cpp:
        (WebCore):

2012-08-15  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: TabbedEditorContainer Doens't show '*' near modified file name sometimes.
        https://bugs.webkit.org/show_bug.cgi?id=94095

        Reviewed by Pavel Feldman.

        TabbedEditorContainer now correctly updates event listeners on UISourceCodeReplaced event.

        * inspector/front-end/TabbedEditorContainer.js:
        (WebInspector.TabbedEditorContainer.prototype._appendFileTab):
        (WebInspector.TabbedEditorContainer.prototype._tabClosed):
        (WebInspector.TabbedEditorContainer.prototype._addUISourceCodeListeners):
        (WebInspector.TabbedEditorContainer.prototype._removeUISourceCodeListeners):

2012-08-15  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Scroll/selection are not saved in sources panel editors sometimes.
        https://bugs.webkit.org/show_bug.cgi?id=94098

        Reviewed by Pavel Feldman.

        SourceFrame listeners and _currentFile field are now cleared only when currently open tab is closed.

        * inspector/front-end/TabbedEditorContainer.js:
        (WebInspector.TabbedEditorContainer.prototype._tabClosed):

2012-08-15  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: [REGRESSION] "save as" of edited source in developer mode fails to update saved file
        https://bugs.webkit.org/show_bug.cgi?id=94074

        Reviewed by Pavel Feldman.

        Added dirty flag check when saving uiSourceCode to save working copy in this case.

        * inspector/front-end/HandlerRegistry.js:
        (WebInspector.HandlerRegistry.prototype.appendApplicableItems.save):
        (WebInspector.HandlerRegistry.prototype.appendApplicableItems):

2012-08-15  Thiago Marcos P. Santos  <thiago.santos@intel.com>

        Relative units are not set when the canvas has not parent
        https://bugs.webkit.org/show_bug.cgi?id=93840

        Reviewed by Kenneth Rohde Christiansen.

        Set the default font when no parent style is set. It will make
        possible to apply relative units when a parent is not set.

        No new tests, unskipped the existing ones.

        * css/StyleBuilder.cpp:
        (WebCore::ApplyPropertyFontSize::applyValue):
        Make it possible to apply relative units if a parent style exist but
        not a parent node. It works like this for em and ex, but not for
        percent units.
        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore):
        (WebCore::CanvasRenderingContext2D::setFont):

2012-08-14  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: split standalone test runner, test scanner and test stub.
        https://bugs.webkit.org/show_bug.cgi?id=94001

        Reviewed by Vsevolod Vlasov.

        This change starts sending loacCompleted message to the embedder.

        * inspector/front-end/InspectorFrontendAPI.js:
        (InspectorFrontendAPI.loadCompleted):
        * inspector/front-end/test-runner.html: Added.

2012-08-15  Shinya Kawanaka  <shinyak@chromium.org>

        [Refactoring] The debug version and release version of toHTMLSelectElement can be merged without any penalty
        https://bugs.webkit.org/show_bug.cgi?id=94084

        Reviewed by Kent Tamura.

        We have two versions of toHTMLSelectElement. One has ASSERT() and the other one does not have ASSERT().
        We can merge them without any penalty.

        No new tests, no change in behavior.

        * html/HTMLSelectElement.cpp:
        * html/HTMLSelectElement.h:
        (WebCore::isHTMLSelectElement):
        (WebCore::toHTMLSelectElement):
        (WebCore):

2012-08-15  Shinya Kawanaka  <shinyak@chromium.org>

        AuthorShadowDOM for meter element
        https://bugs.webkit.org/show_bug.cgi?id=91970

        Reviewed by Hajime Morita.

        We add support for AuthorShadowDOM for a meter element.

        According to the Shadow DOM spec, a meter element should behave like having a UserAgentShadowRoot and
        an element in UserAgentShadowRoot draws a real 'meter' bar. In this patch, we change the inner structure
        of a meter element so that we can distribute an element having RenderMeter to AuthorShadowDOM.

        Before this patch, a meter element has the following inner structure.

            <meter>--UserAgentShadowRoot -- -- -- -- -- -- -- -- -- -- AuthorShadowRoot
                               |
                               +-- MeterBarElement
                               |
                               +-- MeterValueElement

        After this patch, a meter element will have the following inner structure.

            <meter>--UserAgentShadowRoot -- -- -- -- -- -- -- -- -- -- AuthorShadowRoot
                               |
                               +-- MeterInnerElement
                                           |
                                           +-- MeterBarElement
                                           |
                                           +-- MeterValueElement

        However, if RenderTheme supports rendering meter, MeterInnerElement will not create a renderer
        unless an AuthorShadowDOM is attached to it so that we can keep the current rendering style.

        Tests: fast/dom/shadow/shadowdom-for-meter-dynamic.html
               fast/dom/shadow/shadowdom-for-meter-multiple.html
               fast/dom/shadow/shadowdom-for-meter-with-style.html
               fast/dom/shadow/shadowdom-for-meter-without-appearance.html
               fast/dom/shadow/shadowdom-for-meter-without-shadow-element.html
               fast/dom/shadow/shadowdom-for-meter.html

        * css/html.css:
        (meter): Changed the display type. inline-box is not supported WebKit. inline-block is true.
        (meter::-webkit-meter-inner-element):
        * html/HTMLMeterElement.cpp:
        (WebCore::HTMLMeterElement::HTMLMeterElement):
        (WebCore::HTMLMeterElement::createRenderer):
        (WebCore):
        (WebCore::HTMLMeterElement::attach): Added didElementStateChange.
        (WebCore::HTMLMeterElement::didElementStateChange):
        (WebCore::HTMLMeterElement::willAddAuthorShadowRoot):
        (WebCore::HTMLMeterElement::renderMeter):
        (WebCore::HTMLMeterElement::createShadowSubtree):
        * html/HTMLMeterElement.h:
        (WebCore):
        (WebCore::HTMLMeterElement::hasAuthorShadowRoot):
        (HTMLMeterElement):
        (WebCore::isHTMLMeterElement):
        (WebCore::toHTMLMeterElement):
        * html/shadow/MeterShadowElement.cpp:
        (WebCore::MeterShadowElement::meterElement):
        (WebCore::MeterShadowElement::rendererIsNeeded):
        (WebCore):
        (WebCore::MeterInnerElement::MeterInnerElement): We introduce a new element having RenderMeter
        so that we can distribute an element having RenderMeter to AuthorShadowDOM.
        (WebCore::MeterInnerElement::rendererIsNeeded): Different from a progress element, meter element will not be
        rendered using a theme. So we don't need to check the style appearance.
        (WebCore::MeterInnerElement::createRenderer):
        (WebCore::MeterInnerElement::shadowPseudoId):
        * html/shadow/MeterShadowElement.h:
        (WebCore):
        (MeterInnerElement):
        (WebCore::MeterInnerElement::create):
        * rendering/RenderMeter.cpp:
        (WebCore::RenderMeter::RenderMeter):
        (WebCore::RenderMeter::meterElement):
        (WebCore):
        (WebCore::RenderMeter::valueRatio):
        * rendering/RenderMeter.h:
        (RenderMeter):
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::levelIndicatorFor):

2012-08-15  Adam Barth  <abarth@webkit.org>

        [Chromium] fast/dom/Window/dom-access-from-closure-window.html is flaky on Linux
        https://bugs.webkit.org/show_bug.cgi?id=94060

        Reviewed by Kentaro Hara.

        Previously, the V8 garbage collector might have collected the Document
        wrapper before the DOMWindow wrapper because we overwrite the
        "document" property of the DOMWindow during navigation.

        This patch adds a hidden document property on the global object to
        ensure that the Document wrapper lives at least as long as the
        DOMWindow wrapper, ensuring that DOMWindows that we obtain from V8
        always have non-null Document objects.

        The JavaScriptCore bindings already have this behavior.

        Test: fast/dom/Window/dom-access-from-closure-window-with-gc.html

        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::V8DOMWindowShell::updateDocumentWrapperCache):
        * bindings/v8/V8HiddenPropertyName.h:
        (WebCore):

2012-08-14  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: Calling getEventListeners() on element with malformed javascript event listeners crashes
        https://bugs.webkit.org/show_bug.cgi?id=93937

        Reviewed by Pavel Feldman.

        - check listener function to be non-null (happens upon an exception while compiling attribute listeners)

        * bindings/js/JSInjectedScriptHostCustom.cpp:
        (WebCore::getJSListenerFunctions):
        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
        (WebCore::getJSListenerFunctions):

2012-08-14  Jan Keromnes  <janx@linux.com>

        Web Inspector: CodeMirrorTextEditor doesn't clear execution line
        https://bugs.webkit.org/show_bug.cgi?id=94069

        Reviewed by Pavel Feldman.

        Make CodeMirrorTextEditor use line handles instead of numbers, remove
        typeof == "number" checks.

        * inspector/front-end/CodeMirrorTextEditor.js:
        (WebInspector.CodeMirrorTextEditor.prototype.clearExecutionLine):
        (WebInspector.CodeMirrorTextEditor.prototype.highlightLine):
        (WebInspector.CodeMirrorTextEditor.prototype.clearLineHighlight):

2012-08-14  Yuta Kitamura  <yutak@google.com>

        Unreviewed. Fix Chromium-Android builds.

        * html/TimeInputType.cpp:
        (WebCore::TimeInputType::TimeInputType):
        Declare the function as a constructor.

2012-08-14  Sukolsak Sakshuwong  <sukolsak@google.com>

        Text selection in text area in auto scroll mode goes wrong.
        https://bugs.webkit.org/show_bug.cgi?id=74346

        Reviewed by Ojan Vafai.

        WebKit triggers autoscroll in text area when the user drags the cursor from inside
        the text area to the outside. When that happens, it gets the local cursor position
        relative to the node under the cursor from hit-testing, converts it to
        the absolute position, and then converts it to the local position relative to the
        text area. However, the hit-testing method of text area did not take scrolling
        offset into account. This caused it to give an incorrect value of the local cursor
        position. Make the hit-testing take scrolling offset into account.

        Test: fast/events/autoscroll-in-textarea.html

        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::TextControlInnerTextElement::createRenderer):
        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::hitInnerTextElement):
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore):
        * rendering/RenderTextControlSingleLine.h:
        (WebCore::RenderTextControlInnerBlock::RenderTextControlInnerBlock):
        (WebCore::RenderTextControlInnerBlock::hasLineIfEmpty):

2012-08-14  Shinya Kawanaka  <shinyak@chromium.org>

        [Refactoring] RenderMenuList and RenderListBox should have a method to return HTMLSelectElement.
        https://bugs.webkit.org/show_bug.cgi?id=94061

        Reviewed by Kent Tamura.

        This is a preparation patch for Bug 91487. Since RenderMenuList::node() and RenderListBox::node()
        will not return HTMLSelectElement to fix Bug 91487, it would be good to have a method to HTMLSelectElement.

        No new tests, no change in behavior.

        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::selectElement):
        (WebCore):
        (WebCore::RenderListBox::updateFromElement):
        (WebCore::RenderListBox::scrollToRevealSelection):
        (WebCore::RenderListBox::size):
        (WebCore::RenderListBox::numItems):
        (WebCore::RenderListBox::addFocusRingRects):
        (WebCore::RenderListBox::paintItemForeground):
        (WebCore::RenderListBox::paintItemBackground):
        (WebCore::RenderListBox::panScroll):
        (WebCore::RenderListBox::autoscroll):
        (WebCore::RenderListBox::stopAutoscroll):
        (WebCore::RenderListBox::valueChanged):
        (WebCore::RenderListBox::nodeAtPoint):
        * rendering/RenderListBox.h:
        (WebCore):
        (RenderListBox):
        * rendering/RenderMenuList.cpp:
        (WebCore::RenderMenuList::selectElement):
        (WebCore):
        (WebCore::RenderMenuList::updateOptionsWidth):
        (WebCore::RenderMenuList::updateFromElement):
        (WebCore::RenderMenuList::setTextFromOption):
        (WebCore::RenderMenuList::showPopup):
        (WebCore::RenderMenuList::valueChanged):
        (WebCore::RenderMenuList::listBoxSelectItem):
        (WebCore::RenderMenuList::multiple):
        (WebCore::RenderMenuList::didSetSelectedIndex):
        (WebCore::RenderMenuList::didUpdateActiveOption):
        (WebCore::RenderMenuList::itemText):
        (WebCore::RenderMenuList::itemAccessibilityText):
        (WebCore::RenderMenuList::itemToolTip):
        (WebCore::RenderMenuList::itemIsEnabled):
        (WebCore::RenderMenuList::itemStyle):
        (WebCore::RenderMenuList::itemBackgroundColor):
        (WebCore::RenderMenuList::listSize):
        (WebCore::RenderMenuList::selectedIndex):
        (WebCore::RenderMenuList::itemIsSeparator):
        (WebCore::RenderMenuList::itemIsLabel):
        (WebCore::RenderMenuList::itemIsSelected):
        (WebCore::RenderMenuList::setTextFromItem):
        * rendering/RenderMenuList.h:
        (WebCore):
        (RenderMenuList):

2012-08-10  Kinuko Yasuda  <kinuko@chromium.org>

        FileWriter fails with assertion when trying to write empty Blob
        https://bugs.webkit.org/show_bug.cgi?id=93694

        Reviewed by Kent Tamura.

        if the given data size is zero (i.e. m_bytesToWrite is zero) the assertion 'bytes + m_bytesWritten > 0' should not be tested.

        Tests: fast/filesystem/file-writer-empty-blob.html
               fast/filesystem/workers/file-writer-empty-blob.html

        * Modules/filesystem/FileWriter.cpp:
        (WebCore::FileWriter::didWrite):

2012-08-14  Keishi Hattori  <keishi@webkit.org>

        Share common code between calendar picker and color suggestion picker
        https://bugs.webkit.org/show_bug.cgi?id=93802

        Reviewed by Kent Tamura.

        We want to share common code like utility functions between picker page popups.

        No new tests because no behavior change. Covered by existing tests, color-suggestion-picker-appearance.html and calendar-picker-apeparance.html.

        * Resources/pagepopups/calendarPicker.js:
        (YearMonthController.prototype.attachTo):
        (YearMonthController.prototype._showPopup):
        * Resources/pagepopups/colorSuggestionPicker.js:
        (handleMessage):
        (handleArgumentsTimeout):
        * Resources/pagepopups/pickerCommon.css: Added.
        (body):
        * Resources/pagepopups/pickerCommon.js: Added.
        (createElement):
        (resizeWindow):
        (getScrollbarWidth):
        * WebCore.gyp/WebCore.gyp: Add actions for pickerCommon.{css,js}
        * html/shadow/CalendarPickerElement.cpp:
        (WebCore::CalendarPickerElement::writeDocument):

2012-08-14  Ojan Vafai  <ojan@chromium.org>

        Fix access to m_markupBox in WebCore::EllipsisBox::paint
        https://bugs.webkit.org/show_bug.cgi?id=91138

        Reviewed by Abhishek Arya.

        EllipsisBox would hold on to m_markupBox, which would then get destroyed during
        the followup layoutIfNeeded in layoutVerticalBox. Instead, have EllipsisBox
        dynamically grab to pointer to the markup box during paint since there's no
        straightforward way to notify the EllipsisBox that the markupBox has been destroyed
        and/or point it at the new markupBox.

        Test: fast/overflow/line-clamp-and-columns.html

        * rendering/EllipsisBox.cpp:
        (WebCore::EllipsisBox::paint):
        (WebCore):
        (WebCore::EllipsisBox::paintMarkupBox):
        * rendering/EllipsisBox.h:
        (WebCore::EllipsisBox::EllipsisBox):
        Just store a boolean that we have a markup box that needs painting.
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::applyLineClamp):
        Clearing the override size right after setting it was incorrect because
        there are cases where we'll do a followup layout in layoutVerticalBox, at which
        point we'll still need the override size.
        (WebCore::RenderDeprecatedFlexibleBox::clearLineClamp):
        Clear the override size here to handle cases where line clamp is removed since
        we don't call applyLineClamp in those cases.

2012-08-14  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Make input type "time" to use multiple field time input UI
        https://bugs.webkit.org/show_bug.cgi?id=93929

        Reviewed by Kent Tamura.

        This patch changes input type "time" UI to use multiple field time
        input UI when build flag ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS
        enabled.

        No new tests. This patch doesn't change behavior for users, however,
        this patch changes behavior on layout tests. Tests will be added
        in another patch with runtime enabled feature flag is enabled.

        Test expectations for following tests are updated:
         - fast/forms/time/time-input-visible-string.html
         - fast/forms/time/time-stepup-stepdown-from-renderer.html

        * html/BaseDateAndTimeInputType.h:
        (BaseDateAndTimeInputType): Exposed serialize() to derived classes.
        * html/TimeInputType.cpp:
        (WebCore::TimeInputType::DateTimeEditControlOwnerImpl::DateTimeEditControlOwnerImpl):
        (WebCore::TimeInputType::DateTimeEditControlOwnerImpl::~DateTimeEditControlOwnerImpl):
        (WebCore::TimeInputType::DateTimeEditControlOwnerImpl::editControlMouseFocus):
        (WebCore::TimeInputType::DateTimeEditControlOwnerImpl::editControlValueChanged):
        (WebCore::TimeInputType::DateTimeEditControlOwnerImpl::isEditControlOwnerDisabled):
        (WebCore::TimeInputType::DateTimeEditControlOwnerImpl::isEditControlOwnerReadOnly):
        (WebCore::TimeInputType::TimeInputType):
        (WebCore::TimeInputType::~TimeInputType):
        (WebCore::TimeInputType::createRenderer):
        (WebCore::TimeInputType::createShadowSubtree):
        (WebCore::TimeInputType::destroyShadowSubtree):
        (WebCore::TimeInputType::forwardEvent):
        (WebCore::TimeInputType::disabledAttributeChanged):
        (WebCore::TimeInputType::handleKeydownEvent):
        (WebCore::TimeInputType::handleDOMActivateEvent):
        (WebCore::TimeInputType::isKeyboardFocusable):
        (WebCore::TimeInputType::isMouseFocusable):
        (WebCore::TimeInputType::minOrMaxAttributeChanged):
        (WebCore::TimeInputType::readonlyAttributeChanged):
        (WebCore::TimeInputType::isTextField):
        (WebCore::TimeInputType::setValue):
        (WebCore::TimeInputType::shouldUseInputMethod):
        (WebCore::TimeInputType::stepAttributeChanged):
        (WebCore::TimeInputType::updateEditElementLayout):
        (WebCore::TimeInputType::updateInnerTextValue):
        (WebCore::TimeInputType):
        * html/TimeInputType.h:
        (TimeInputType):
        (DateTimeEditControlOwnerImpl):

2012-08-14  Dean Jackson  <dino@apple.com>

        Initial call to webkitRequestAnimationFrame returns 0, Spec indicates the handle should always be > 0
        https://bugs.webkit.org/show_bug.cgi?id=85819

        Reviewed by James Robinson.

        The callback id returned by requestAnimationFrame was beginning at zero, when the spec
        says it should be above one. Use a pre-increment rather than a post-increment.

        Test: fast/animation/request-animation-frame-callback-id.html

        * dom/ScriptedAnimationController.cpp:
        (WebCore::ScriptedAnimationController::registerCallback): Pre-increment rather than post-increment.

2012-08-14  Levi Weintraub  <leviw@chromium.org>

        r125591 broke tests with SUBPIXEL_LAYOUT disabled
        https://bugs.webkit.org/show_bug.cgi?id=94027

        Reviewed by Eric Seidel.

        The previous patch to fix block preferred widths for subpixel layout broke ports
        without the flag enabled. This patch adds a static inline function --
        adjustFloatForSubPixelLayout -- that truncates with sub-pixel layout disabled, and
        ceil's to the nearest FractionalLayoutUnit when sub-pixel layout is enabled.

        A block's max preferred width should be enough to layout the entire line without
        wrapping. r125591 addressed a bug whereby converting floats to LayoutUnits with sub-
        pixel layout enabled lost precision in certain cases, and could result in a line
        being layed out to slightly over the max preferred width of the block.

        This patch reverts the behavior when sub-pixel layout is disabled to truncating
        sub-pixel values (such as those that originate in Length) when assigning them to
        LayoutUnits, and ceiling the length of the entire line to the next largest integer.

        Covered by existing tests.

        * rendering/RenderBlock.cpp:
        (WebCore):
        (WebCore::adjustFloatForSubPixelLayout):
        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):

2012-08-14  Chris Evans  <cevans@google.com>

        Handle the XPath / (root) operator correctly for nodes that aren't attached to the document.
        https://bugs.webkit.org/show_bug.cgi?id=36427

        Reviewed by Abhishek Arya.

        We now behave the same as Firefox 14.
        The consensus seems to be that the XPath spec is ambiguous for the case of detached nodes, and that using the fragment root is more intuitive than the document root for the case of detached nodes.
        For example, http://www.w3.org/TR/xpath/ section 2 "Location Paths" is only clear for attached nodes: "A / by itself selects the root node of the document containing the context node. If it is followed by a relative location path, then the location path selects the set of nodes that would be selected by the relative location path relative to the root node of the document containing the context node."

        Test: fast/xpath/xpath-detached-nodes.html

        * xml/XPathPath.cpp:
        (WebCore::XPath::LocationPath::evaluate): Jump to the root of the detached subtree instead of the parent document if the node isn't attached to the document.

2012-08-14  Alexandru Chiculita  <achicu@adobe.com>

        [CSS Shaders][Chromium] Filters area applied twice when CustomFilterOperation is in the list
        https://bugs.webkit.org/show_bug.cgi?id=93900

        Reviewed by James Robinson.

        Whenever the platform cannot render a shader in hardware it will fallback to software. 
        In such cases, the platform should remove any old filters applied, so that the filters do not apply twice.
        
        Test: css3/filters/custom/filter-fallback-to-software.html

        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::setFilters):

2012-08-14  Alec Flett  <alecflett@chromium.org>

        IndexedDB: add tracing to IDBLevelDBBackingStore
        https://bugs.webkit.org/show_bug.cgi?id=93914

        Reviewed by Tony Chang.

        Add a bunch of trace events to the lower level
        database layer, to separate database slowness
        from core IDB slowness.

        Also moving findKeyInIndex into IDBLevelDBBackingStore to
        eventually make it const.

        No new tests, just adding debug logging.

        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
        (WebCore::IDBLevelDBBackingStore::open):
        (WebCore::IDBLevelDBBackingStore::deleteDatabase):
        (WebCore::IDBLevelDBBackingStore::getObjectStores):
        (WebCore::IDBLevelDBBackingStore::createObjectStore):
        (WebCore::IDBLevelDBBackingStore::deleteObjectStore):
        (WebCore::IDBLevelDBBackingStore::getObjectStoreRecord):
        (WebCore):
        (WebCore::IDBLevelDBBackingStore::putObjectStoreRecord):
        (WebCore::IDBLevelDBBackingStore::clearObjectStore):
        (WebCore::IDBLevelDBBackingStore::deleteObjectStoreRecord):
        (WebCore::IDBLevelDBBackingStore::keyExistsInObjectStore):
        (WebCore::IDBLevelDBBackingStore::getIndexes):
        (WebCore::IDBLevelDBBackingStore::createIndex):
        (WebCore::IDBLevelDBBackingStore::deleteIndex):
        (WebCore::IDBLevelDBBackingStore::putIndexDataForRecord):
        (WebCore::IDBLevelDBBackingStore::findKeyInIndex):
        (WebCore::IDBLevelDBBackingStore::getPrimaryKeyViaIndex):
        (WebCore::IDBLevelDBBackingStore::keyExistsInIndex):
        (WebCore::IDBLevelDBBackingStore::openObjectStoreCursor):
        (WebCore::IDBLevelDBBackingStore::openIndexKeyCursor):
        (WebCore::IDBLevelDBBackingStore::openIndexCursor):
        (WebCore::IDBLevelDBBackingStore::Transaction::commit):
        (WebCore::IDBLevelDBBackingStore::Transaction::rollback):
        * Modules/indexeddb/IDBLevelDBBackingStore.h:
        (IDBLevelDBBackingStore):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore):
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::onAbort):
        (WebCore::IDBTransaction::onComplete):

2012-08-14  Hayato Ito  <hayato@chromium.org>

        Refactor EventDispatcher, moving code to make actual changes easier to review later.
        https://bugs.webkit.org/show_bug.cgi?id=93959

        Reviewed by Dimitri Glazkov.

        No new tests - no new functionality.

        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::dispatchScopedEvent):
        (WebCore):
        (WebCore::EventDispatcher::dispatchSimulatedClick):

2012-08-14  Kihong Kwon  <kihong.kwon@samsung.com>

        Clear pattern to prevent timing problem between cancelVibration and vibrate
        https://bugs.webkit.org/show_bug.cgi?id=93957

        Reviewed by Kentaro Hara.

        There is a timing issue in the cancelVibration.
        Since vibrate works based on timer, cancelVibration might be called
        eariler than vibrate when cancelVibration is called just after vibrate call.
        It can be prevented from clearing m_pattern in the cancelVibration.

        * Modules/vibration/Vibration.cpp:
        (WebCore::Vibration::cancelVibration):

2012-08-14  Alexandru Chiculita  <achicu@adobe.com>

        Layout Test css3/filters/custom/custom-filter-animation.html is failing
        https://bugs.webkit.org/show_bug.cgi?id=91769

        Reviewed by Dean Jackson.

        Mountain Lion added support for accelerated filter animations, but CSS Shaders are still
        rendered in software mode. The setFilters method is using PlatformCALayer::filtersCanBeComposited to check
        if the filters can be handled in hardwawre, so I've reused that in the createFilterAnimationsFromKeyframes
        to check if the animations can also run in hardware.

        Also the GraphicsContext3D doesn't update its own internal m_boundFBO when a framebuffer is deleted,
        so I've added that to the FECustomFilter. Otherwise, if the next framebuffer is created using the same
        identifier, bindFramebuffer will just return without calling the glBindFramebuffer because of this optimization.

        The documentation for glDeleteFramebuffer says that the bound framebuffer is unbound before deleting it.
        This is not reproduceable from WebGL, because WebGLRenderingContext::deleteFramebuffer
        already knows to unbind the framebuffer when needed. However, I'm also adding that in GraphicsContext3DOpenGLCommon.cpp
        and efl/GraphicsContext3DPrivate.cpp, to make sure that m_boundFBO is not used for other purposes.

        No new tests, this patch fixes a failing test.

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::createFilterAnimationsFromKeyframes):
        * platform/graphics/efl/GraphicsContext3DPrivate.cpp:
        (WebCore::GraphicsContext3DPrivate::deleteFramebuffer):
        * platform/graphics/filters/FECustomFilter.cpp:
        (WebCore::FECustomFilter::deleteRenderBuffers):
        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
        (WebCore::GraphicsContext3D::deleteFramebuffer):

2012-08-14  Adam Barth  <abarth@webkit.org>

        Delete Frame::domWindow() and Frame::existingDOMWindow()
        https://bugs.webkit.org/show_bug.cgi?id=93990

        Reviewed by Eric Seidel.

        These functions just call through to document()->domWindow(). This
        patch updates the callers so it's clearer what's going on.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::shouldAllowAccessToFrame):
        (WebCore::printErrorMessageForFrame):
        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::location):
        (WebCore::JSDocument::setLocation):
        * bindings/js/JSEventListener.cpp:
        (WebCore::JSEventListener::handleEvent):
        * bindings/js/ScriptCachedFrameData.cpp:
        (WebCore::ScriptCachedFrameData::restore):
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::createWindowShell):
        * bindings/objc/DOMAbstractView.mm:
        (core):
        * bindings/v8/NPV8Object.cpp:
        (WebCore::toV8Context):
        * bindings/v8/ScriptController.cpp:
        (WebCore::createScriptObject):
        (WebCore::ScriptController::createScriptObjectForPluginElement):
        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::V8DOMWindowShell::initContextIfNeeded):
        * bindings/v8/V8IsolatedContext.cpp:
        (WebCore::V8IsolatedContext::V8IsolatedContext):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::retrieveFrame):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::V8DOMWindow::indexedPropertyGetter):
        (WebCore::V8DOMWindow::namedPropertyGetter):
        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
        (WebCore::V8Document::locationAccessorGetter):
        (WebCore::V8Document::locationAccessorSetter):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::V8HTMLDocument::GetNamedProperty):
        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
        (WebCore::V8HTMLFrameSetElement::namedPropertyGetter):
        * dom/Document.cpp:
        (WebCore::printNavigationErrorMessage):
        * dom/ViewportArguments.cpp:
        (WebCore::reportViewportWarning):
        * editing/AlternativeTextController.cpp:
        (WebCore::AlternativeTextController::insertDictatedText):
        * editing/Editor.cpp:
        (WebCore::Editor::pasteAsPlainText):
        (WebCore::Editor::pasteAsFragment):
        (WebCore::Editor::setComposition):
        * history/PageCache.cpp:
        (WebCore::logCanCacheFrameDecision):
        (WebCore::PageCache::canCachePageContainingThisFrame):
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::validateInteractively):
        * html/HTMLFrameOwnerElement.cpp:
        (WebCore::HTMLFrameOwnerElement::contentWindow):
        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore):
        (WebCore::WebGLRenderingContext::printWarningToConsole):
        * inspector/InspectorDOMStorageAgent.cpp:
        (WebCore::InspectorDOMStorageAgent::storageId):
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::checkLoadComplete):
        * loader/DocumentWriter.cpp:
        (WebCore::DocumentWriter::begin):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::stopLoading):
        (WebCore::FrameLoader::didOpenURL):
        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
        (WebCore::FrameLoader::checkIfRunInsecureContent):
        (WebCore::FrameLoader::reportLocalLoadFailed):
        (WebCore::FrameLoader::prepareForCachedPageRestore):
        (WebCore::FrameLoader::open):
        (WebCore::FrameLoader::fireBeforeUnloadEvent):
        * loader/MainResourceLoader.cpp:
        (WebCore::MainResourceLoader::didReceiveResponse):
        * loader/appcache/ApplicationCacheGroup.cpp:
        (WebCore::ApplicationCacheGroup::abort):
        (WebCore::ApplicationCacheGroup::didReceiveResponse):
        (WebCore::ApplicationCacheGroup::didFinishLoading):
        (WebCore::ApplicationCacheGroup::didFail):
        (WebCore::ApplicationCacheGroup::didReceiveManifestResponse):
        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::printAccessDeniedMessage):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::isCurrentlyDisplayedInFrame):
        (WebCore::DOMWindow::self):
        (WebCore::DOMWindow::opener):
        (WebCore::DOMWindow::parent):
        (WebCore::DOMWindow::top):
        (WebCore::DOMWindow::createWindow):
        (WebCore::DOMWindow::open):
        * page/DOMWindowProperty.cpp:
        (WebCore::DOMWindowProperty::DOMWindowProperty):
        (WebCore::DOMWindowProperty::reconnectFrameFromPageCache):
        * page/DragController.cpp:
        (WebCore::DragController::dispatchTextInputEventFor):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleTextInputEvent):
        * page/Frame.cpp:
        * page/Frame.h:
        (Frame):
        * page/Location.cpp:
        (WebCore::Location::replace):
        (WebCore::Location::reload):
        (WebCore::Location::setLocation):
        * storage/StorageEventDispatcher.cpp:
        (WebCore::StorageEventDispatcher::dispatch):
        * svg/SVGDocumentExtensions.cpp:
        (WebCore::reportMessage):
        * xml/XSLStyleSheetLibxslt.cpp:
        (WebCore::XSLStyleSheet::parseString):
        * xml/XSLTProcessorLibxslt.cpp:
        (WebCore::docLoaderFunc):
        * xml/XSLTProcessorQt.cpp:
        (WebCore::XSLTMessageHandler::handleMessage):

2012-08-14  Mike West  <mkwst@chromium.org>

        Tighten up parsing the 'script-nonce' CSP directive value.
        https://bugs.webkit.org/show_bug.cgi?id=93783

        Reviewed by Adam Barth.

        Currently we're accepting any non-whitespace character. This patch
        limits the valid characters to VCHAR minus ',' and ';', and pulls the
        validity check out into a named function for clarity.

        Test: http/tests/security/contentSecurityPolicy/1.1/scriptnonce-separators-allowed.html

        * page/ContentSecurityPolicy.cpp:
        (WebCore::CSPDirectiveList::parseScriptNonce):

2012-08-14  Adam Barth  <abarth@webkit.org>

        Delete DOMWindow::m_url
        https://bugs.webkit.org/show_bug.cgi?id=93989

        Reviewed by Eric Seidel.

        There's no reason for DOMWindow to keep a separate copy of the
        Document's URL now that there is a predictable way to get a Document
        from a DOMWindow.

        * loader/DocumentWriter.cpp:
        (WebCore::DocumentWriter::begin):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::open):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::crossDomainAccessErrorMessage):
        * page/DOMWindow.h:
        (DOMWindow):

2012-08-14  Nikhil Bhargava  <nbhargava@google.com>

        De-inline stuff from RenderStyle.h
        https://bugs.webkit.org/show_bug.cgi?id=94019

        Reviewed by Eric Seidel.

        De-inline things from RenderStyle.h in preparation of fixing a series of
        errant includes.

        No new tests. Doesn't change functionality

        * WebCore.exp.in:
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::listStyleImage):
        (WebCore::RenderStyle::setListStyleImage):
        (WebCore):
        (WebCore::RenderStyle::color):
        (WebCore::RenderStyle::visitedLinkColor):
        (WebCore::RenderStyle::setColor):
        (WebCore::RenderStyle::setVisitedLinkColor):
        (WebCore::RenderStyle::horizontalBorderSpacing):
        (WebCore::RenderStyle::verticalBorderSpacing):
        (WebCore::RenderStyle::setHorizontalBorderSpacing):
        (WebCore::RenderStyle::setVerticalBorderSpacing):
        (WebCore::RenderStyle::font):
        (WebCore::RenderStyle::fontMetrics):
        (WebCore::RenderStyle::fontDescription):
        (WebCore::RenderStyle::fontSize):
        (WebCore::RenderStyle::wordSpacing):
        (WebCore::RenderStyle::letterSpacing):
        (WebCore::RenderStyle::setFontDescription):
        (WebCore::RenderStyle::lineHeight):
        (WebCore::RenderStyle::setLineHeight):
        (WebCore::RenderStyle::computedLineHeight):
        (WebCore::RenderStyle::setWordSpacing):
        (WebCore::RenderStyle::setLetterSpacing):
        * rendering/style/RenderStyle.h:

2012-08-14  Andrei Onea  <onea@adobe.com>

        [CSSRegions]Region overset property is incorectly computed when content has negative letter spacing and is flowed near to the edge of a region
        https://bugs.webkit.org/show_bug.cgi?id=92506

        Reviewed by Eric Seidel.

        When the content which is flowed inside a region creates visual overflow in
        the writing direction, the overflow rect is also extended in the other direction, and
        that forces regionOverset to become "fit" for all regions.

        Tests: fast/regions/element-region-overset-state-negative-letter-spacing.html
               fast/regions/element-region-overset-state-vertical-rl-negative-letter-spacing.html

        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::computeOverflowStateForRegions):

2012-08-14  Florin Malita  <fmalita@chromium.org>

        beginElement() does not observe updated animation attributes
        https://bugs.webkit.org/show_bug.cgi?id=93972

        Reviewed by Dirk Schulze.

        The SVG animation attributes 'from', 'to' and 'by' should be registered as supported
        SVGSMILElement attributes in order to trigger animationAttributeChanged() on dynamic
        updates.

        Test: svg/animations/updated-attributes.html

        * svg/SVGAnimationElement.cpp:
        (WebCore::SVGAnimationElement::updateAnimation):
        Minor optimization - avoid recalculating animationMode().

        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::isSupportedAttribute):
        Register 'from', 'to' and 'by' as supported SVGSMILElement attributes.

2012-08-14  Filip Spacek  <fspacek@rim.com>

        [BlackBerry] Don't crash on OOM in AC
        https://bugs.webkit.org/show_bug.cgi?id=93999

        Reviewed by George Staikos.

        Internally reviewed by George Staikos.

        Fail gracefully in case we fail to allocate the bitmap
        for the AC layer contents.

        * platform/graphics/blackberry/InstrumentedPlatformCanvas.h:
        (WebCore::InstrumentedPlatformCanvas::InstrumentedPlatformCanvas):
        * platform/graphics/blackberry/LayerWebKitThread.cpp:
        (WebCore::LayerWebKitThread::paintContents):

2012-08-14  Lauro Neto  <lauro.neto@openbossa.org>

        Convert signals/slots to Q_* macros.

        [Qt] Use Q_SLOTS and Q_SIGNALS instead of slots and signals
        https://bugs.webkit.org/show_bug.cgi?id=93996

        Reviewed by Kenneth Rohde Christiansen.

        Change usage of keyword-conflicting 'signals' and 'slots' for
        Q_SIGNALS and Q_SLOTS macro.

        * bridge/testqtbindings.cpp:
        (MyObject):
        * platform/graphics/gstreamer/PlatformVideoWindowPrivate.h:
        * platform/graphics/qt/MediaPlayerPrivateQt.h:
        (MediaPlayerPrivateQt):
        * platform/network/qt/DnsPrefetchHelper.h:
        (DnsPrefetchHelper):
        * platform/network/qt/NetworkStateNotifierPrivate.h:
        (NetworkStateNotifierPrivate):
        * platform/network/qt/QNetworkReplyHandler.h:
        (QNetworkReplyHandler):
        * platform/network/qt/QtMIMETypeSniffer.h:
        (QtMIMETypeSniffer):
        * platform/network/qt/SocketStreamHandlePrivate.h:
        (SocketStreamHandlePrivate):
        * platform/qt/GamepadsQt.cpp:
        (GamepadDeviceLinuxQt):
        (GamepadsQt):
        * platform/qt/SharedTimerQt.cpp:
        (SharedTimerQt):

2012-08-14  Andrei Onea  <onea@adobe.com>

        [CSSRegions]regionOverset is computed as "overset" even though the region is not the last in the chain
        https://bugs.webkit.org/show_bug.cgi?id=93102

        Reviewed by Eric Seidel.

        Making Element.webkitRegionOverset return "overset" only for the last region in a region chain, 
        if the content cannot fit inside it, to reflect current spec. http://www.w3.org/TR/css3-regions/#dom-region-regionoverset

        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::computeOverflowStateForRegions):

2012-08-14  Jan Keromnes  <janx@linux.com>

        Web Inspector: Render breakpoint gutter markers and execution line in CodeMirrorTextEditor
        https://bugs.webkit.org/show_bug.cgi?id=93686

        Reviewed by Pavel Feldman.

        Divided TextEditor.addDecoration into addBreakpoint, setExecutionLine
        and addDecoration. Same for removeDecoration. Render breakpoint
        markers and execution line in CodeMirrorTextEditor.

        * inspector/front-end/CodeMirrorTextEditor.js:
        (WebInspector.CodeMirrorTextEditor):
        (WebInspector.CodeMirrorTextEditor.prototype._onGutterClick):
        (WebInspector.CodeMirrorTextEditor.prototype.addBreakpoint):
        (WebInspector.CodeMirrorTextEditor.prototype.removeBreakpoint):
        (WebInspector.CodeMirrorTextEditor.prototype.setExecutionLine):
        (WebInspector.CodeMirrorTextEditor.prototype.clearExecutionLine):
        (WebInspector.CodeMirrorTextEditor.prototype.addDecoration):
        (WebInspector.CodeMirrorTextEditor.prototype.removeDecoration):
        (WebInspector.CodeMirrorTextEditor.prototype.highlightLine):
        (WebInspector.CodeMirrorTextEditor.prototype.clearLineHighlight):
        (WebInspector.CodeMirrorTextEditor.prototype.removeAttribute):
        * inspector/front-end/DefaultTextEditor.js:
        (WebInspector.DefaultTextEditor.prototype._onMouseDown):
        (WebInspector.DefaultTextEditor.prototype.addBreakpoint):
        (WebInspector.DefaultTextEditor.prototype.removeBreakpoint):
        (WebInspector.DefaultTextEditor.prototype.setExecutionLine):
        (WebInspector.DefaultTextEditor.prototype.clearExecutionLine):
        (WebInspector.DefaultTextEditor.prototype.addDecoration):
        (WebInspector.DefaultTextEditor.prototype.removeDecoration):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame):
        (WebInspector.JavaScriptSourceFrame.prototype._addBreakpointDecoration):
        (WebInspector.JavaScriptSourceFrame.prototype._removeBreakpointDecoration):
        (WebInspector.JavaScriptSourceFrame.prototype.setExecutionLine):
        (WebInspector.JavaScriptSourceFrame.prototype.clearExecutionLine):
        (WebInspector.JavaScriptSourceFrame.prototype._handleGutterClick):
        * inspector/front-end/TextEditor.js:
        (WebInspector.TextEditor.prototype.addBreakpoint):
        (WebInspector.TextEditor.prototype.removeBreakpoint):
        (WebInspector.TextEditor.prototype.setExecutionLine):
        (WebInspector.TextEditor.prototype.clearExecutionLine):
        (WebInspector.TextEditor.prototype.addDecoration):
        (WebInspector.TextEditor.prototype.removeDecoration):
        * inspector/front-end/cmdevtools.css:
        (.CodeMirror):
        (.cm-highlight):
        (@-webkit-keyframes fadeout):
        (to):
        (.cm-breakpoint):
        (.cm-breakpoint-disabled):
        (.cm-breakpoint-conditional):
        (.cm-execution-line):
        (.webkit-html-message-bubble):
        (.webkit-html-warning-message):
        (.webkit-html-error-message):
        (.webkit-html-message-line):
        (.webkit-html-message-line-hover):

2012-08-13  Adrienne Walker  <enne@google.com>

        REGRESSION (r109851): Video controls do not render
        https://bugs.webkit.org/show_bug.cgi?id=93859

        Reviewed by Simon Fraser.

        Because video layers can't act as an ancestor composited layer whose
        backing can be shared by child layers, any child layer of a video
        layer needs to be put into its own composited layer. Because this is
        technically overlap, the "overlap" indirect compositing reason is
        reused for this case.

        Test: compositing/video/video-controls-layer-creation.html

        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::computeCompositingRequirements):

2012-08-14  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>

        WebKitTestRunner needs layoutTestController.dumpResourceLoadCallbacks
        https://bugs.webkit.org/show_bug.cgi?id=42332

        Reviewed by Kenneth Rohde Christiansen.

        Provide build for mac.

        * WebCore.exp.in: Added __ZNK7WebCore19ResourceRequestBase20firstPartyForCookiesEv.

2012-08-14  Adam Barth  <abarth@webkit.org>

        DOMWindow::document() should not reach through Frame
        https://bugs.webkit.org/show_bug.cgi?id=27640

        Reviewed by Eric Seidel.

        Originally, the lifetime of DOMWindow was similar to that of Frame in
        that it was reused for each document that was displayed in the Frame.
        To fix some tricky security issues, all modern browsers use a "split
        window" architecture whereby the DOMWindow is not reused by each
        Document in a Frame. Instead a JavaScript "window shell" object
        redirects JavaScript references to the active Document's DOMWindow.

        When we implemented split windows, we left DOMWindow attached to the
        Frame and attempted to keep it in sync with the Document via a lot of
        delicate code. One of the main problems with this approach is that
        finding the DOMWindow associated with a Document or the Document
        associated with a DOMWindow required traversing through the Frame.
        Because there is a many-to-one relationship between both Documents and
        Frames (as well as DOMWindows and Frames), this traversal is error
        prone and not always available (e.g., for inactive documents).

        This patch moves the "owning" reference for DOMWindow to Document so
        that we can directly traverse from Document to DOMWindow. For
        traversing from DOMWindow to Document, each DOMWindow keeps a Document
        pointer via a ContextDestructionObserver base class.

        The main sublties in this patch are related to situations in which
        there isn't precisely a one-to-one relationship between Documents and
        DOMWindows. Previously, these situations were handled implicitly by the
        "flex and slop" of having separate Document and DOMWindow pointers in
        Frame. In this patch, these sublties are made explicit via
        Document::takeDOMWindowFrom, which explicitly transfers the DOMWindow
        (as well as ASSERTs that all the relevant objects exist in a sensible
        constellation).

        * WebCore.exp.in:
            - These functions are no longer exported because they're inline.
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::clearWindowShell):
        * bindings/js/ScriptController.h:
        (ScriptController):
            - clearWindowShell now explicitly takes the new DOMWindow that will
              be pointed to by the WindowShell. Previously, clearWindowShell
              would implicitly create the new DOMWindow by accessing
              Frame::domWindow (which used to lazily create the DOMWindow).
        * bindings/v8/BindingState.cpp:
        (WebCore::currentDocument):
        * bindings/v8/BindingState.h:
        (WebCore):
            - currentDocument provides a directly path from the current
              v8::Context to the Document (by way of DOMWindow). Previously,
              code transited via the Frame using currentFrame.
        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::clearWindowShell):
        * bindings/v8/ScriptController.h:
        (ScriptController):
            - Mirror JSC changes to clearWindowShell.
        * bindings/v8/V8Utilities.cpp:
        (WebCore::getScriptExecutionContext):
            - Update getScriptExecutionContext to transit directly from the
              DOMWindow to the Document rather than detouring via the Frame.
        * dom/ContextDestructionObserver.cpp:
        (WebCore::ContextDestructionObserver::ContextDestructionObserver):
        (WebCore::ContextDestructionObserver::~ContextDestructionObserver):
        (WebCore):
        (WebCore::ContextDestructionObserver::observeContext):
        * dom/ContextDestructionObserver.h:
        (ContextDestructionObserver):
            - When we transfer a DOMWindow from one Document to another, we
              need to update the Document pointer in the DOMWindow to point to
              the new Document. The DOMWindow holds the Document pointer via
              ContextDestructionObserver, so this patch teaches
              ContextDestructionObserver how to change which
              ScriptExecutionContext it is observing. This code mirrors similar
              code in FrameDestructionObserver.
        * dom/Document.cpp:
        (WebCore::Document::~Document):
        (WebCore::Document::detach):
        (WebCore::Document::createDOMWindow):
            - createDOMWindow now explicitly creates the DOMWindow. Previously,
              we created the DOMWindow implicitly in Frame::domWindow when it
              was first accessed.
        (WebCore::Document::takeDOMWindowFrom):
            - takeDOMWindowFrom explicitly transfers the DOMWindow from one
              Document to another. The main benefit of this function is the
              ASSERTs that ensure that the Document, DOMWindow, and Frame all
              point to each other the correct configuration.
        (WebCore::Document::didUpdateSecurityOrigin):
            - We no longer need to keep the SecurityOrigin pointer in DOMWindow
              in sync with the Document because DOMWindow no longer has a
              SecurityOrigin object.
        * dom/Document.h:
        (Document):
        (WebCore::Document::domWindow):
        * history/CachedFrame.cpp:
        (WebCore::CachedFrame::CachedFrame):
        (WebCore::CachedFrame::destroy):
        * history/CachedFrame.h:
        (CachedFrameBase):
            - Previously, CachedFrame held the Document and the DOMWindow with
              separate pointers. Now, the CachedFrame holds the DOMWnidow via
              the Document, which makes adding and removing Documents from the
              PageCache simpler because we don't need to keep the Frame's
              DOMWindow pointer synchronized.
        * loader/DocumentWriter.cpp:
        (WebCore::DocumentWriter::begin):
            - begin now explicitly creates the DOMWindow and transfers
              DOMWindow when performing a "secure transition." Previously, both
              of these processes were handled implicitly: the DOMWindow was
              created implicitly by Frame::domWindow, and the DOMWindow was
              reused during navigation by not clearing Frame::m_domWindow.
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::cancelAndClear):
        (WebCore::FrameLoader::clear):
            - These functions now pass the new Document so that we have access
              to the new DOMWindow in clearDOMWindowShell.
        (WebCore::FrameLoader::setOpener):
            - We no longer need to keep the DOMWindow's SecurityOrigin in sync
              with the Document's SecurityOrigin because DOMWindow no longer
              has a duplicate SecurityOrigin pointer.
        (WebCore::FrameLoader::open):
            - We no longer need to keep the Frame::m_domWindow in sync with the
              Document because the Document carries its own DOMWindow.
        * loader/FrameLoader.h:
        (FrameLoader):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::DOMWindow):
            - DOMWindow now uses Document as its primary context object. In a
              future patch, we should remove the FrameDestructionObserver base
              class and instead access the frame via DOMWindow::document().
        (WebCore::DOMWindow::didSecureTransitionTo):
            - Notify the DOMWindow that it is now associated with a new
              Document.
        (WebCore::DOMWindow::scriptExecutionContext):
        (WebCore::DOMWindow::document):
        (WebCore::DOMWindow::securityOrigin):
            - These functions now retrieve the Document directly rather than
              transiting via the Frame.
        * page/DOMWindow.h:
        (WebCore::DOMWindow::create):
        (DOMWindow):
        * page/Frame.cpp:
        (WebCore::Frame::setDocument):
            - Add more ASSERTs that the Document and its DOMWindow are properly
              wired up to this Frame.
        (WebCore::Frame::domWindow):
            - Rather than lazily creating the DOMWindow, this function now just
              accesses the already-created DOMWindow on Document. Eventually,
              all callers should retreive the DOMWindow from the Document
              directly.
        * page/Frame.h:
        (WebCore::Frame::existingDOMWindow):
            - The DOMWindow always exists, so there is no distinction between
              domWindow() and existingDOMWindow().
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::open):
            - Previously, open would exit early if it was unable to find its
              ScriptExecutionContext (e.g., if the ScriptExecutionContext was
              inactive). Now we can always locate the ScriptExecutionContext
              and so we need to test whether the ScriptExecutionContext is
              still attached to the Page before accessing Settings. Tests
              verify that the platform-visible behaviors of XMLHttpRequest are
              unchanged, even for XMLHttpRequest constructors associated with
              inactive Documents.
        * xml/XSLTProcessor.cpp:
        (WebCore::XSLTProcessor::createDocumentFromSource):
            - Make it explicit that XSLT re-uses the DOMWindow from the source
              Document in the transformed Document.

2012-08-14  Levi Weintraub  <leviw@chromium.org>

        Accumulating LayoutUnits with floats for determining block preferred width can lead to wrapping
        https://bugs.webkit.org/show_bug.cgi?id=93513

        Reviewed by Eric Seidel.

        Sub-pixel values from floats are subject to small losses in precision when accumulated with
        floating point values, as we do in RenderBlock. This patch adds a new method to FractionalLayoutUnit --
        ceilToFloat -- which guarantees us a floating point value at least as big as our original LayoutUnit
        value, and uses it along with ceiledLayoutUnit to avoid underprovisioning RenderBlock's preferred
        widths due to lost precision.

        Test: fast/sub-pixel/block-preferred-widths-with-sub-pixel-floats.html

        * platform/FractionalLayoutUnit.h:
        (WebCore::FractionalLayoutUnit::ceilToFloat): Returns a float value the same or larger than the
        FractionalLayoutUnit value.
        (FractionalLayoutUnit):
        (WebCore::FractionalLayoutUnit::epsilon): Now returns 0 when sub-pixel is disabled.
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeLogicalLocationForFloat): Adding a LayoutUnit::epsilon fudge factor
        for fitting floats. This is probably necessary due to precision being lost elsewhere.
        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths): Ensure no precision is lost due to conversion
        when accumulating our min/max width with floats.

2012-08-14  Jer Noble  <jer.noble@apple.com>

        Fullscreen/normal volume sliders don't stay in sync
        https://bugs.webkit.org/show_bug.cgi?id=93867

        Reviewed by Eric Carlson.

        Change the full screen volume slider, if present, when the media element's volume
        changes.

        Test: media/video-controls-fullscreen-volume.html

        * html/shadow/MediaControlRootElement.cpp:
        (WebCore::MediaControlRootElement::changedVolume):

2012-08-14  Olivier Blin  <olivier.blin@softathome.com>

        Remove unused yyparse method in CSSParser
        https://bugs.webkit.org/show_bug.cgi?id=93986

        Reviewed by Darin Adler.

        This method is unused and not even declared.

        No new tests, it just removes unused code.

        * css/CSSParser.h:

2012-08-14  Zan Dobersek  <zandobersek@gmail.com>

        [Gtk] Include all files guarded by ENABLE_* guards in Source/WebCore/GNUmakefile.list.am into the build
        https://bugs.webkit.org/show_bug.cgi?id=90696

        Reviewed by Philippe Normand.

        Include all files in the Autotools build that are currently guarded by ENABLE_* guards in
        the WebCore GNUmakefile.list.am, regardless of the feature being enabled. Compilation should
        rely on proper use of guards inside source files and preprocessor work to keep the disabled
        features out.

        The only exception left is the ENABLE_WEBGL guard that includes the ANGLE into compilation
        only if WebGL feature is enabled.

        No new tests - no new functionality.

        * GNUmakefile.am:
        * GNUmakefile.list.am:
        * bindings/gobject/GNUmakefile.am: Add StorageInfo to the DOM bindings, despite
        the feature being currently disabled.

2012-08-14  Gregg Tavares  <gman@google.com>

        Plumb through EXT_debug_marker entry points
        https://bugs.webkit.org/show_bug.cgi?id=93860

        Reviewed by Kenneth Russell.

        insertEventMarkerEXT, pushGroupMarkerEXT, popGroupMarkerEXT,
        are all entry points exposed by the OpenGL ES
        EXT_debug_marker extension

        No new tests as no new functionality exposed to web.

        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore):
        (WebCore::WebGLRenderingContext::create):
        * platform/chromium/support/Extensions3DChromium.cpp:
        (WebCore::Extensions3DChromium::insertEventMarkerEXT):
        (WebCore):
        (WebCore::Extensions3DChromium::pushGroupMarkerEXT):
        (WebCore::Extensions3DChromium::popGroupMarkerEXT):
        * platform/graphics/Extensions3D.h:
        (Extensions3D):
        * platform/graphics/chromium/Extensions3DChromium.h:
        (Extensions3DChromium):
        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
        (WebCore::Extensions3DOpenGL::insertEventMarkerEXT):
        (WebCore):
        (WebCore::Extensions3DOpenGL::pushGroupMarkerEXT):
        (WebCore::Extensions3DOpenGL::popGroupMarkerEXT):
        * platform/graphics/opengl/Extensions3DOpenGL.h:
        (Extensions3DOpenGL):
        * platform/graphics/opengl/Extensions3DOpenGLES.cpp:
        (WebCore::Extensions3DOpenGLES::insertEventMarkerEXT):
        (WebCore):
        (WebCore::Extensions3DOpenGLES::pushGroupMarkerEXT):
        (WebCore::Extensions3DOpenGLES::popGroupMarkerEXT):
        * platform/graphics/opengl/Extensions3DOpenGLES.h:
        (Extensions3DOpenGLES):

2012-06-24  Robert Hogan  <robert@webkit.org>

        CSS 2.1 failure: Word-spacing affects each space and non-breaking space
        https://bugs.webkit.org/show_bug.cgi?id=89826

        Reviewed by Eric Seidel.

        Add word spacing to consecutive spaces in a run per http://www.w3.org/TR/CSS21/text.html#spacing-props.

        Test: fast/css/word-spacing-characters.html
              fast/css/word-spacing-characters-complex-text.html
              fast/css/word-spacing-characters-linebreak.html
              css2.1/20110323/word-spacing-characters-002.htm
              css2.1/20110323/word-spacing-characters-003.htm
              css2.1/20110323/word-spacing-remove-space-001.htm
              css2.1/20110323/word-spacing-remove-space-002.htm
              css2.1/20110323/word-spacing-remove-space-003.htm
              css2.1/20110323/word-spacing-remove-space-004.htm
              css2.1/20110323/word-spacing-remove-space-005.htm
              css2.1/20110323/word-spacing-remove-space-006.htm
              css2.1/20110323/c541-word-sp-001.htm
              css2.1/20110323/c541-word-sp-000.htm

        * platform/graphics/WidthIterator.cpp:
        (WebCore::WidthIterator::advance): All spaces (ordinary space or &nbsp;) get word-spacing added, even
          if they are consecutive.
        * platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp:
        (WebCore::HarfBuzzShaperBase::isWordEnd): ditto, but for the complex text case on Chromium. Had to use
          m_run rather than m_normalizedBuffer here as m_normalizedBuffer turns tabs into spaces! Unlike the simple
          text path, '\n' gets word-spacing - I observed this from fast/text/atsui-spacing-features.html but can't
          find it specified anywhere.
        * platform/graphics/harfbuzz/HarfBuzzShaperBase.h:
        (WebCore::HarfBuzzShaperBase::isCodepointSpace):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::LineBreaker::nextLineBreak): Tested by word-spacing-linebreak.html

2012-08-14  Antoine Labour  <piman@chromium.org>

        [chromium] race between CCLayerTreeHostImpl::releaseContentsTextures and CCThreadProxy::beginFrameCompleteOnImplThread
        https://bugs.webkit.org/show_bug.cgi?id=93684

        Reviewed by James Robinson.

        This keeps track of whether we're between the beginFrame post and the
        commit when releaseContentsTextures comes, and if that is the case, we
        prune the texture uploads, keep the "textures purged" flag on and kick a
        new commit.

        Added CCLayerTreeHostTestEvictTextures test.

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::beginFramePosted):
        (WebCore):
        (WebCore::CCLayerTreeHostImpl::commitComplete):
        (WebCore::CCLayerTreeHostImpl::canDraw):
        (WebCore::CCLayerTreeHostImpl::releaseContentsTextures):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::contentsTexturesPurged):
        (WebCore::CCLayerTreeHostImpl::contentsTexturesWerePurgedSinceLastBeginFrame):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::stop):
        (WebCore::CCSingleThreadProxy::commitAndComposite):
        * platform/graphics/chromium/cc/CCTextureUpdateController.h:
        (CCTextureUpdateController):
        * platform/graphics/chromium/cc/CCTextureUpdateQueue.cpp:
        (WebCore::CCTextureUpdateQueue::clearUploads):
        (WebCore):
        * platform/graphics/chromium/cc/CCTextureUpdateQueue.h:
        (CCTextureUpdateQueue):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::scheduledActionBeginFrame):
        (WebCore::CCThreadProxy::beginFrameCompleteOnImplThread):
        (WebCore::CCThreadProxy::layerTreeHostClosedOnImplThread):

2012-08-14  Yong Li  <yoli@rim.com>

        [BlackBerry] Pass URL String's 8-bit buffer directly to platform layer when possible
        https://bugs.webkit.org/show_bug.cgi?id=93861

        Reviewed by Rob Buis.

        PR# 187605.
        URL strings and HTTP header strings usually use 8-bit buffers internally. We can
        just pass the buffers to platform calls when only Latin1 strings are needed.

        * platform/blackberry/ReadOnlyLatin1String.h: Added.
        (WebCore):
        (ReadOnlyLatin1String): A utility class that uses either WTF::CString or WTF::String's 8-bit buffer.
        (WebCore::ReadOnlyLatin1String::ReadOnlyLatin1String): Can only be constructed with WTF::String for now.
        (WebCore::ReadOnlyLatin1String::data):
        (WebCore::ReadOnlyLatin1String::length):
        * platform/network/blackberry/ResourceRequestBlackBerry.cpp:
        (WebCore::ResourceRequest::initializePlatformRequest):
        * platform/network/blackberry/SocketStreamHandleBlackBerry.cpp:
        (WebCore::SocketStreamHandle::SocketStreamHandle):

2012-08-14  Christophe Dumez  <christophe.dumez@intel.com>

        Fix  LayoutTests/canvas/philip/tests/2d.text.draw.space.collapse.nonspace.html
        https://bugs.webkit.org/show_bug.cgi?id=92974

        Reviewed by Kenneth Rohde Christiansen.

        Replace space characters by U+0020 SPACE characters in
        CanvasRenderingContext2D::drawTextInternal() in order to
        comply with the HTML Canvas 2D Context specification:
        - http://www.w3.org/TR/2dcontext/#drawing-text-to-the-canvas

        No new tests, already tested by canvas/philip/tests/2d.text.draw.space.collapse.nonspace.html.

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::replaceCharacterInString):
        (WebCore):
        (WebCore::CanvasRenderingContext2D::drawTextInternal):

2012-08-14  George Staikos  <staikos@webkit.org>

        [BlackBerry] Avoid assertion failure in App Cache.
        https://bugs.webkit.org/show_bug.cgi?id=93926

        Reviewed by Rob Buis.

        Short-circuit data url decoding if we know it's not a data URL to
        avoid an assertion failure in debug mode.  No functional change.

        No new tests since this is just a debug mode assertion failure.

        * loader/appcache/ApplicationCacheGroup.cpp:
        (WebCore::ApplicationCacheGroup::createResourceHandle):

2012-08-14  Thiago Marcos P. Santos  <thiago.santos@intel.com>

        [EFL] Do not warn when the default theme is not found
        https://bugs.webkit.org/show_bug.cgi?id=93968

        Reviewed by Kenneth Rohde Christiansen.

        Even if you are using a custom theme, we always try to load first the
        theme at the default path (that may or may not exist). In the case it
        doesn't exist and you have a custom theme, we were always getting a
        misleading error message.

        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::createEdje):

2012-08-14  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Pass cursor continue results back in callback
        https://bugs.webkit.org/show_bug.cgi?id=92278

        Reviewed by Tony Chang.

        Supply the updated cursor key/primaryKey/value in the success callback,
        rather than forcing the callee to make three calls into the back end to
        fetch them. Callbacks onSuccess(cursor) and onSuccessWithContinuation()
        are given the three new payload parameters (and the latter is renamed.)

        No new tests - no behavioral changes.

        * Modules/indexeddb/IDBCallbacks.h: Updated callbacks.
        (IDBCallbacks):
        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::setValueReady): Takes values rather than fetching them.
        * Modules/indexeddb/IDBCursor.h:
        (IDBCursor):
        * Modules/indexeddb/IDBCursorBackendImpl.cpp: Delete accessors.
        (WebCore::IDBCursorBackendImpl::advanceInternal): Pass along updated cursor state.
        (WebCore::IDBCursorBackendImpl::continueFunctionInternal): Ditto.
        * Modules/indexeddb/IDBCursorBackendImpl.h:
        (IDBCursorBackendImpl): Delete accessors from interface...
        (WebCore::IDBCursorBackendImpl::key): ...but keep them for use within back-end.
        (WebCore::IDBCursorBackendImpl::primaryKey):
        (WebCore::IDBCursorBackendImpl::value):
        * Modules/indexeddb/IDBCursorBackendInterface.h: Delete accessors.
        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
        (WebCore::IDBIndexBackendImpl::openCursorInternal): Pass along new cursor state.
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::openCursorInternal): Ditto.
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::setResultCursor): Stash updated cursor state until dispatch.
        (WebCore::IDBRequest::onSuccess):
        (WebCore::IDBRequest::dispatchEvent): Update cursor with new state.
        * Modules/indexeddb/IDBRequest.h:
        (IDBRequest):
        * inspector/InspectorIndexedDBAgent.cpp: Update iteration code to use new callbacks.
        (WebCore):

2012-08-14  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] Get rid of glCopyTexImage2D in Canvas and WebGL code paths
        https://bugs.webkit.org/show_bug.cgi?id=93614

        Reviewed by Antonio Gomes.

        We used to set up resource sharing between the compositing thread
        context and the Canvas and WebGL contexts, and use glCopyTexImage2D to
        get a copy of the framebuffer to use as front buffer for compositing
        purposes.

        Now we instead create an EGLImage and blit the Canvas/WebGL output to
        it. The compositing thread creates a texture from the EGLImage in order
        to composite the output.

        Created a new EGLImageLayerWebKitThread base class that handles the
        EGLImage and does the blitting. CanvasLayerWebKitThread and
        WebGLLayerWebKitThread now inherit from this new base class.

        However, we need to be careful to restore state after the blit because
        it's done using the Canvas/WebGL context.

        The BlackBerry implementation of GraphicsContext3D::prepareTexture()
        was changed to no longer call glCopyTexImage, and
        GraphicsContext3D::platformLayer() now returns the target texture
        directly.

        Reviewed internally by Filip Spacek.

        PR 188472

        No change in behavior, new tests.

        * PlatformBlackBerry.cmake:
        * platform/graphics/blackberry/CanvasLayerWebKitThread.cpp:
        (WebCore::CanvasLayerWebKitThread::CanvasLayerWebKitThread):
        (WebCore::CanvasLayerWebKitThread::~CanvasLayerWebKitThread):
        (WebCore::CanvasLayerWebKitThread::setDevice):
        (WebCore::CanvasLayerWebKitThread::makeContextCurrent):
        (WebCore::CanvasLayerWebKitThread::textureSize):
        (WebCore):
        (WebCore::CanvasLayerWebKitThread::textureID):
        * platform/graphics/blackberry/CanvasLayerWebKitThread.h:
        (CanvasLayerWebKitThread):
        * platform/graphics/blackberry/EGLImageLayerCompositingThreadClient.cpp: Added.
        (WebCore):
        (WebCore::EGLImageLayerCompositingThreadClient::~EGLImageLayerCompositingThreadClient):
        (WebCore::EGLImageLayerCompositingThreadClient::uploadTexturesIfNeeded):
        (WebCore::EGLImageLayerCompositingThreadClient::drawTextures):
        (WebCore::EGLImageLayerCompositingThreadClient::deleteTextures):
        (WebCore::EGLImageLayerCompositingThreadClient::bindContentsTexture):
        (WebCore::EGLImageLayerCompositingThreadClient::setImage):
        * platform/graphics/blackberry/EGLImageLayerCompositingThreadClient.h: Added.
        (WebCore):
        (EGLImageLayerCompositingThreadClient):
        (WebCore::EGLImageLayerCompositingThreadClient::create):
        (WebCore::EGLImageLayerCompositingThreadClient::layerCompositingThreadDestroyed):
        (WebCore::EGLImageLayerCompositingThreadClient::layerVisibilityChanged):
        (WebCore::EGLImageLayerCompositingThreadClient::EGLImageLayerCompositingThreadClient):
        * platform/graphics/blackberry/EGLImageLayerWebKitThread.cpp: Added.
        (WebCore):
        (WebCore::EGLImageLayerWebKitThread::EGLImageLayerWebKitThread):
        (WebCore::EGLImageLayerWebKitThread::~EGLImageLayerWebKitThread):
        (WebCore::EGLImageLayerWebKitThread::setNeedsDisplay):
        (WebCore::EGLImageLayerWebKitThread::makeContextCurrent):
        (WebCore::EGLImageLayerWebKitThread::updateTextureContentsIfNeeded):
        (WebCore::EGLImageLayerWebKitThread::commitPendingTextureUploads):
        (WebCore::EGLImageLayerWebKitThread::createImageIfNeeded):
        (WebCore::EGLImageLayerWebKitThread::createShaderIfNeeded):
        (WebCore::EGLImageLayerWebKitThread::drawTexture):
        * platform/graphics/blackberry/EGLImageLayerWebKitThread.h: Copied from Source/WebCore/platform/graphics/blackberry/CanvasLayerWebKitThread.h.
        (WebCore):
        (EGLImageLayerWebKitThread):
        * platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp:
        (WebCore::GraphicsContext3D::prepareTexture):
        (WebCore):
        (WebCore::GraphicsContext3D::platformTexture):
        * platform/graphics/blackberry/LayerCompositingThread.cpp:
        (WebCore::LayerCompositingThread::drawTextures):
        (WebCore::LayerCompositingThread::releaseTextureResources):
        * platform/graphics/blackberry/LayerCompositingThread.h:
        (WebCore::LayerCompositingThread::setClient):
        (LayerCompositingThread):
        * platform/graphics/blackberry/LayerData.h:
        (WebCore::LayerData::LayerData):
        (LayerData):
        * platform/graphics/blackberry/LayerWebKitThread.cpp:
        (WebCore::LayerWebKitThread::~LayerWebKitThread):
        (WebCore::LayerWebKitThread::updateTextureContentsIfNeeded):
        (WebCore::LayerWebKitThread::commitPendingTextureUploads):
        (WebCore::LayerWebKitThread::commitOnCompositingThread):
        * platform/graphics/blackberry/LayerWebKitThread.h:
        (LayerWebKitThread):
        * platform/graphics/blackberry/WebGLLayerWebKitThread.cpp:
        (WebCore::WebGLLayerWebKitThread::WebGLLayerWebKitThread):
        (WebCore::WebGLLayerWebKitThread::updateTextureContentsIfNeeded):
        (WebCore::WebGLLayerWebKitThread::makeContextCurrent):
        (WebCore):
        (WebCore::WebGLLayerWebKitThread::textureSize):
        (WebCore::WebGLLayerWebKitThread::textureID):
        * platform/graphics/blackberry/WebGLLayerWebKitThread.h:
        (WebGLLayerWebKitThread):
        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
        (WebCore):
        (WebCore::GraphicsContext3D::prepareTexture):

2012-08-14  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] Texture cache must adapt to HashMap changes
        https://bugs.webkit.org/show_bug.cgi?id=93955

        Reviewed by Rob Buis.

        This was fixed locally, but not upstreamed yet.

        Based on an original patch by Konrad Piascik.

        * platform/graphics/blackberry/TextureCacheCompositingThread.cpp:
        (WebCore::TextureCacheCompositingThread::textureForTiledContents):

2012-08-14  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] LayerCompositingThread.h doesn't compile
        https://bugs.webkit.org/show_bug.cgi?id=93956

        Reviewed by Rob Buis.

        I forgot to upstream this local change.

        * platform/graphics/blackberry/LayerCompositingThread.h:
        (WebCore::LayerOverride::setBounds):
        (WebCore::LayerOverride::setOpacity):

2012-08-14  Ed Baker  <edbaker@rim.com>

        [BlackBerry] LayerAnimation is not immutable, which makes dereferencing an expensive operation
        https://bugs.webkit.org/show_bug.cgi?id=93946

        Reviewed by Antonio Gomes.

        Make LayerAnimation immutable so it can be dereferenced from the main
        WebKit thread without having to dispatch to the compositing thread,
        which is an expensive operation.

        TransformOperation and TimingFunction need to be made thread safe as
        they are referenced in LayerAnimation, but that effort is being tracked
        by a separate bug, #86483.

        Reviewed internally by Arvid Nilsson.

        No change in behavior, no new tests.

        * platform/graphics/blackberry/LayerAnimation.h:
        (WebCore::LayerAnimation::name):
        (LayerAnimation):
        (WebCore::LayerAnimation::LayerAnimation):
        (WebCore::LayerAnimation::setName):
        * platform/graphics/blackberry/LayerCompositingThread.cpp:
        (WebCore):
        * platform/graphics/blackberry/LayerCompositingThread.h:
        (LayerCompositingThread):
        * platform/graphics/blackberry/LayerWebKitThread.cpp:
        (WebCore::LayerWebKitThread::~LayerWebKitThread):

2012-08-14  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] GraphicsLayerBlackBerry::willBeDestroyed() must call superclass implementation
        https://bugs.webkit.org/show_bug.cgi?id=93947

        Reviewed by Rob Buis.

        This was fixed locally, but not upstreamed yet.

        Based on an original patch by Konrad Piascik.

        * platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp:
        (WebCore::GraphicsLayerBlackBerry::willBeDestroyed):

2012-08-14  Vineet Chaudhary  <rgf748@motorola.com>

        Remove custom JSC bindings from ConvolverNode.idl
        https://bugs.webkit.org/show_bug.cgi?id=93952

        Reviewed by Kentaro Hara.

        We should remove custom bindings as CodeGenerator uses UNUSED_PARAM macro.

        No new tests. No behavioural changes.
        All tests under webaudio/* should behave same.

        * GNUmakefile.list.am: Removed JSConvolverNodeCustom.cpp from builds.
        * Modules/webaudio/ConvolverNode.idl: Removed [JSCustomSetter].
        * UseJSC.cmake: Removed JSConvolverNodeCustom.cpp from builds.
        * WebCore.gypi: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto
        * bindings/js/JSConvolverNodeCustom.cpp: Removed.

2012-08-14  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: add external test runner for running inspector front-end tests with no TestRunner infrastructure.
        https://bugs.webkit.org/show_bug.cgi?id=93833

        Reviewed by Yury Semikhatsky.

        Added mock test runner that allows running front-end layout tests.
        InspectorFrontendAPI can now dispatch whatever it receives from its embedder (opener).

        * inspector/front-end/InspectorFrontendAPI.js:
        (InspectorFrontendAPI.evaluateForTest):
        (InspectorFrontendAPI.dispatch):
        (InspectorFrontendAPI.loadCompleted):
        (.onMessageFromOpener):

2012-08-14  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        [Qt] Incomplete repaint of link underline
        https://bugs.webkit.org/show_bug.cgi?id=66034

        Reviewed by Kenneth Rohde Christiansen.

        When trying to point a line of width 30, we end up painting on of width 31, because Qt 
        interprets the line as end-inclusive. So adjust for end-include/exclusive difference 
        before requesting the draw from Qt.

        * platform/graphics/qt/GraphicsContextQt.cpp:
        (WebCore::GraphicsContext::drawLine):

2012-08-14  Mike West  <mkwst@chromium.org>

        Fix crash in http/tests/plugins/plugin-document-has-focus
        https://bugs.webkit.org/show_bug.cgi?id=93949

        Reviewed by Jochen Eisinger.

        Covered by http/tests/plugins/plugin-document-has-focus.html. If that
        doesn't crash, we're good!

        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::pluginIsLoadable):
            Check the PluginDocument's ownerElement before derefing.

2012-08-14  KwangYong Choi  <ky0.choi@samsung.com>

        [EFL] Fixed displaying buffering progress in the media control.
        https://bugs.webkit.org/show_bug.cgi?id=75681

        Reviewed by Kenneth Rohde Christiansen.

        It is required "rangeRect" instead of "rect" to display buffering
        progress properly.

        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::paintMediaSliderTrack):

2012-08-14  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Copy Source/WebCore/html/shadow/TextControlInnerElements.{cpp,h} to SpinButtonElement.{cpp,h}
        https://bugs.webkit.org/show_bug.cgi?id=93943

        Reviewed by Kent Tamura.

        This patch copys html/shadow/TextControlInnerElement.{cpp,h} to SpinButtonElement.{cpp,h} for
        preparation of bug 93941, Set SpinButtonElement free from HTMLInputElement.

        No new tests. This patch doesn't change behavior.

        * html/shadow/SpinButtonElement.cpp: Copied from Source/WebCore/html/shadow/TextControlInnerElements.cpp.
        * html/shadow/SpinButtonElement.h: Copied from Source/WebCore/html/shadow/TextControlInnerElements.h.

2012-08-14  Mike West  <mkwst@chromium.org>

        Implement the plugin-types Content Security Policy directive.
        https://bugs.webkit.org/show_bug.cgi?id=91919

        Reviewed by Adam Barth.

        The CSP 1.1 editor's draft defines the 'plugin-types' directive as a
        mechanism for whitelisting only specific types of plugin content on a
        page. A protected resource might trust only Flash content, for instance,
        and could enforce that preference via a Content Security Policy of
        'plugin-types application/x-shockwave-flash'. Flash would load, no other
        plugin type would.

        Specification details available at: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#plugin-types--experimental

        This experimental directive is gated on the ENABLE_CSP_NEXT flag, which
        is currently only enabled in Chromium.

        Tests: http/tests/security/contentSecurityPolicy/1.1/plugintypes-invalid.html
               http/tests/security/contentSecurityPolicy/1.1/plugintypes-mismatched-data.html
               http/tests/security/contentSecurityPolicy/1.1/plugintypes-mismatched-url.html
               http/tests/security/contentSecurityPolicy/1.1/plugintypes-notype-data.html
               http/tests/security/contentSecurityPolicy/1.1/plugintypes-notype-url.html
               http/tests/security/contentSecurityPolicy/1.1/plugintypes-nourl-allowed.html
               http/tests/security/contentSecurityPolicy/1.1/plugintypes-nourl-blocked.html
               http/tests/security/contentSecurityPolicy/1.1/plugintypes-url-01.html
               http/tests/security/contentSecurityPolicy/1.1/plugintypes-url-02.html

        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::pluginIsLoadable):
            Adding a check against 'allowPluginType', and passing in both the
            MIME type of the plugin, as well as the declared MIME type from the
            object/embed element (ensuring that we do this correctly, even if
            we're inside a PluginDocument).
        (WebCore::SubframeLoader::createJavaAppletWidget):
            Same as 'pluginIsLoadable', but hard-coded to
            'application/x-java-applet'.
        * page/ContentSecurityPolicy.cpp:
        (CSPDirectiveList):
        (WebCore::CSPDirectiveList::logInvalidPluginTypes):
            Plugin types that don't match the grammar ('not/a/mime/type') are
            logged to the console, and ignored for purposes of matching.
        (WebCore):
        (WebCore::CSPDirectiveList::checkPluginType):
            Given both the plugin type and the declared type attribute, returns
            true if both types match, and are contained in the list of accepted
            plugin types.
        (WebCore::CSPDirectiveList::checkPluginTypeAndReportViolation):
            Calls out to checkPluginType, and reports a violation if that check
            fails.
        (WebCore::CSPDirectiveList::allowPluginType):
            Analog to the other 'CSPDirectiveList::allowXXX' methods, this
            branches between simply checking the type against the policy, and
            checking against the policy and then reporting violations.
        (WebCore::CSPDirectiveList::parsePluginTypes):
            Given a directive value, parse out the media types contained within
            by splitting on spaces, and validating each token. Valid tokens are
            added to 'm_pluginTypes' for use in 'checkPluginType'.
        (WebCore::CSPDirectiveList::addDirective):
            Wire up 'plugin-types' as a valid directive (if the ENABLE_CSP_NEXT
            flag is set). This has been combined with the other implemented 1.1
            header, 'script-nonce'.
        (WebCore::ContentSecurityPolicy::allowPluginType):
            The public interface to this set of functionality.
        * page/ContentSecurityPolicy.h:

2012-08-14  Charles Wei  <charles.wei@torchmobile.com.cn>

        [BlackBerry] Enable DNS prefetch
        https://bugs.webkit.org/show_bug.cgi?id=93846

        Reviewed by George Staikos.

        No new tests.

        * PlatformBlackBerry.cmake:
        * platform/blackberry/TemporaryLinkStubs.cpp:
        * platform/network/blackberry/DNSBlackBerry.cpp: Copied from Source/WebCore/platform/blackberry/TemporaryLinkStubs.cpp.
        (WebCore):
        (WebCore::prefetchDNS):

2012-08-14  Hans Wennborg  <hans@chromium.org>

        Speech Input: wrong position was reported for scolled-down elements
        https://bugs.webkit.org/show_bug.cgi?id=93634

        Reviewed by Kent Tamura.

        When clicking on a speech-enabled input element, WebKit reports
        the position of the element to the embedder, so that it can show
        a bubble indicating that speech recognition is in progress for
        the element that the user clicked on.

        On a page that was scrolled, this position was being reported
        erroneously: it was given relative to the frame content as opposed to
        the root view, and the in-progress bubble would be shown in the wrong
        place.

        Test: fast/speech/bubble-position-scrolled.html

        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::InputFieldSpeechButtonElement::startSpeechInput):

2012-08-14  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Drop "Loading..." message from FileContentView
        https://bugs.webkit.org/show_bug.cgi?id=91732

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/FileContentView.js:
        (WebInspector.FileContentView.prototype.wasShown):

2012-08-14  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r125519.
        http://trac.webkit.org/changeset/125519
        https://bugs.webkit.org/show_bug.cgi?id=93945

        New ref-tests caused image failures on chromium-mac bots.
        (Requested by yutak on #webkit).

        * css/html.css:
        (meter):
        * html/HTMLMeterElement.cpp:
        (WebCore::HTMLMeterElement::HTMLMeterElement):
        (WebCore::HTMLMeterElement::createRenderer):
        (WebCore::HTMLMeterElement::didElementStateChange):
        (WebCore::HTMLMeterElement::createShadowSubtree):
        * html/HTMLMeterElement.h:
        (WebCore):
        (HTMLMeterElement):
        * html/shadow/MeterShadowElement.cpp:
        (WebCore::MeterShadowElement::meterElement):
        (WebCore::MeterShadowElement::rendererIsNeeded):
        (WebCore):
        * html/shadow/MeterShadowElement.h:
        (WebCore):
        * rendering/RenderMeter.cpp:
        (WebCore::RenderMeter::RenderMeter):
        (WebCore::RenderMeter::valueRatio):
        * rendering/RenderMeter.h:
        (RenderMeter):

2012-08-14  Keishi Hattori  <keishi@webkit.org>

        Move page popup resources to separate directory
        https://bugs.webkit.org/show_bug.cgi?id=93932

        Reviewed by Kent Tamura.

        Keeping the resources organized.

        No new tests.

        * Resources/pagepopups/calendarPicker.css: Renamed from Source/WebCore/Resources/calendarPicker.css.
        * Resources/pagepopups/calendarPicker.js: Renamed from Source/WebCore/Resources/calendarPicker.js.
        * Resources/pagepopups/calendarPickerMac.css: Renamed from Source/WebCore/Resources/calendarPickerMac.css.
        * Resources/pagepopups/colorSuggestionPicker.css: Renamed from Source/WebCore/Resources/colorSuggestionPicker.css.
        * Resources/pagepopups/colorSuggestionPicker.js: Renamed from Source/WebCore/Resources/colorSuggestionPicker.js.
        * WebCore.gyp/WebCore.gyp:

2012-08-14  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Move wheel event handler to spin button class
        https://bugs.webkit.org/show_bug.cgi?id=93928

        Reviewed by Kent Tamura.

        This patch moves implmentation of wheel event handling from TextFieldInput
        class to SpinButtonElement class to share implementation in TextFieldInput
        class, and DateTimeEditElement.

        No new tests. This patch doesn't change behavior. fast/orms/number/number-wheel.html
        covers this change.

        * html/BaseDateAndTimeInputType.cpp: Removed handleWheelEvent() implementation.
        * html/BaseDateAndTimeInputType.h:
        (BaseDateAndTimeInputType): Removed handleWheelEvent() declaration.
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::defaultEventHandler): Removed wheel event handling.
        * html/InputType.cpp: Removed handleWheelEvent() implementation.
        * html/InputType.h:
        (InputType): Removed handleWheelEvent() declaration.
        * html/NumberInputType.cpp: Removed handleWheelEvent() implementation.
        * html/NumberInputType.h:
        (NumberInputType): Removed handleWheelEvent() declaration.
        * html/TextFieldInputType.cpp: Removed handleWheelEventForSpinButton() declaration.
        (WebCore::TextFieldInputType::forwardEvent): Changed to call SpinButtonElement::forwardEvent().
        * html/TextFieldInputType.h:
        (TextFieldInputType): Removed handleWheelEventForSpinButton() declaration.
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::SpinButtonElement::forwardEvent): Moved implementation of wheel event handling code
        from TextFieldInputType::handleWheelEventForSpinButton().
        * html/shadow/TextControlInnerElements.h:
        (SpinButtonElement): Added forwardEvent() declaration.

2012-08-14  Shinya Kawanaka  <shinyak@chromium.org>

        AuthorShadowDOM for meter element
        https://bugs.webkit.org/show_bug.cgi?id=91970

        Reviewed by Hajime Morita.

        We add support for AuthorShadowDOM for a meter element.

        According to the Shadow DOM spec, a meter element should behave like having a UserAgentShadowRoot and
        an element in UserAgentShadowRoot draws a real 'meter' bar. In this patch, we change the inner structure
        of a meter element so that we can distribute an element having RenderMeter to AuthorShadowDOM.

        Before this patch, a meter element has the following inner structure.

            <meter>--UserAgentShadowRoot -- -- -- -- -- -- -- -- -- -- AuthorShadowRoot
                               |
                               +-- MeterBarElement
                               |
                               +-- MeterValueElement

        After this patch, a meter element will have the following inner structure.

            <meter>--UserAgentShadowRoot -- -- -- -- -- -- -- -- -- -- AuthorShadowRoot
                               |
                               +-- MeterInnerElement
                                           |
                                           +-- MeterBarElement
                                           |
                                           +-- MeterValueElement

        However, if RenderTheme supports rendering meter, MeterInnerElement will not create a renderer
        unless an AuthorShadowDOM is attached to it so that we can keep the current rendering style.

        Tests: fast/dom/shadow/shadowdom-for-meter-dynamic.html
               fast/dom/shadow/shadowdom-for-meter-multiple.html
               fast/dom/shadow/shadowdom-for-meter-with-style.html
               fast/dom/shadow/shadowdom-for-meter-without-appearance.html
               fast/dom/shadow/shadowdom-for-meter-without-shadow-element.html
               fast/dom/shadow/shadowdom-for-meter.html

        * css/html.css:
        (meter): Changed the display type. inline-box is not supported WebKit. inline-block is true.
        (meter::-webkit-meter-inner-element):
        * html/HTMLMeterElement.cpp:
        (WebCore::HTMLMeterElement::HTMLMeterElement):
        (WebCore::HTMLMeterElement::createRenderer):
        (WebCore):
        (WebCore::HTMLMeterElement::didElementStateChange):
        (WebCore::HTMLMeterElement::willAddAuthorShadowRoot):
        (WebCore::HTMLMeterElement::renderMeter):
        (WebCore::HTMLMeterElement::createShadowSubtree):
        * html/HTMLMeterElement.h:
        (WebCore):
        (WebCore::HTMLMeterElement::hasAuthorShadowRoot):
        (HTMLMeterElement):
        (WebCore::isHTMLMeterElement):
        (WebCore::toHTMLMeterElement):
        * html/shadow/MeterShadowElement.cpp:
        (WebCore::MeterShadowElement::meterElement):
        (WebCore::MeterShadowElement::rendererIsNeeded):
        (WebCore):
        (WebCore::MeterInnerElement::MeterInnerElement): We introduce a new element having RenderMeter
        so that we can distribute an element having RenderMeter to AuthorShadowDOM.
        (WebCore::MeterInnerElement::rendererIsNeeded): Different from a progress element, meter element will not be
        rendered using a theme. So we don't need to check the style appearance.
        (WebCore::MeterInnerElement::createRenderer):
        (WebCore::MeterInnerElement::shadowPseudoId):
        * html/shadow/MeterShadowElement.h:
        (WebCore):
        (MeterInnerElement):
        (WebCore::MeterInnerElement::create):
        * rendering/RenderMeter.cpp:
        (WebCore::RenderMeter::RenderMeter):
        (WebCore::RenderMeter::meterElement):
        (WebCore):
        (WebCore::RenderMeter::valueRatio):
        * rendering/RenderMeter.h:
        (RenderMeter):

2012-08-14  Christophe Dumez  <christophe.dumez@intel.com>

        regression(r124510) webintents/web-intents-obj-constructor.html is crashing
        https://bugs.webkit.org/show_bug.cgi?id=93096

        Reviewed by Kentaro Hara.

        Add null-check for JSC::ExecState pointer in JSDictionary constructor
        before using it. The exec may indeed be null, thus causing crashes.

        No new test, already tested by webintents/web-intents-obj-constructor.html

        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::tryGetProperty):
        (WebCore::JSDictionary::getWithUndefinedOrNullCheck):
        * bindings/js/JSDictionary.h:
        (WebCore::JSDictionary::JSDictionary):

2012-08-13  Keishi Hattori  <keishi@webkit.org>

        Remove fade in transition from calendar picker
        https://bugs.webkit.org/show_bug.cgi?id=93816

        Reviewed by Kent Tamura.

        The fade in transition was incomplete because it was only fading in the
        popup content and not the popup itself. Removing the effect for now.

        No new tests. Can't test animation.

        * Resources/calendarPicker.css:
        (#main):
        * Resources/calendarPicker.js:
        (initialize):
        (fixWindowSize):

2012-08-13  Alex Christensen  <alex.christensen@flexsim.com>

        WPARAM and LPARAM are incorrectly defined for x64
        https://bugs.webkit.org/show_bug.cgi?id=89902

        Reviewed by Brent Fulgham.

        Include WindowsExtras.h for PLATFORM(WIN) to define WPARAM and LPARAM correctly
        * platform/PlatformKeyboardEvent.h:
        * platform/PlatformMouseEvent.h:
        * platform/PlatformWheelEvent.h:
        * platform/graphics/win/MediaPlayerPrivateFullscreenWindow.h:
        * platform/win/WindowMessageListener.h:

2012-08-13  John Bates  <jbates@google.com>

        [Chromium] Patch CCThreadProxy to call setTimebaseAndInterval on CCScheduler
        https://bugs.webkit.org/show_bug.cgi?id=93918

        Reviewed by James Robinson.

        Also, update some trace events.

        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp:
        (WebCore::CCDelayBasedTimeSource::setActive):
        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
        (WebCore::CCFrameRateController::setActive):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::onVSyncParametersChanged):

2012-08-13  Douglas Stockwell  <dstockwell@chromium.org>

        Crash in WebCore::RenderBlock::LineBreaker::nextLineBreak
        https://bugs.webkit.org/show_bug.cgi?id=93806

        Reviewed by Abhishek Arya.

        When looking for line breaks on the first line, existing code was
        checking for text-combine only in the first-line style. Since
        text-combine isn't inherited this resulted in a line break being
        chosen before combineText was called. When this happened and then
        combineText was called subsequently, the position of the line break
        iterator would be invalid.

        This patch changes the check to use the regular style as in
        skipLeadingWhitespace and textWidth.

        Test: fast/text/text-combine-first-line-crash.html

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::LineBreaker::nextLineBreak): Don't use the
        first-line style when checking text-combine.

2012-08-13  Kwang Yul Seo  <skyul@company100.net>

        Remove unused method HTMLDocumentParser::script()
        https://bugs.webkit.org/show_bug.cgi?id=93916

        Reviewed by Eric Seidel.

        The use of HTMLDocumentParser::script() was removed in r61640 and has never been used since then.

        No behavior change, so no new tests.

        * html/parser/HTMLDocumentParser.cpp:
        * html/parser/HTMLDocumentParser.h:

2012-08-13  Tom Sepez  <tsepez@chromium.org>

        [chromium] release FrameLoaderClientImpl::m_pluginWidget refptr upon Plugin Document detach.
        https://bugs.webkit.org/show_bug.cgi?id=93283

        Reviewed by Eric Seidel.

        Chromium has a refptr that needs to be NULLed at this point.
        
        The approach is to change the client redirectDataToPlugin method(s) to expect
        the possibility of a NULL argument, and the use this to clear the refptr on
        the chromium platform.  Other platforms can merely ignore the NULL case, thereby
        maintaining the existing behaviour.

        Formal testing is nearly impossible without some chrome-specific plugins.

        * html/PluginDocument.cpp:
        (WebCore::PluginDocument::detach):

2012-08-13  Eric Penner  <epenner@google.com>

        [chromium] Paint animated layers immediately to avoid animation hiccups.
        https://bugs.webkit.org/show_bug.cgi?id=93028

        Reviewed by Adrienne Walker.

        This is a technique used on Android, which is very prone
        to hiccups in animations. Paint the entire layer if it is
        of reasonable size such that there is no hiccups when the
        animation reaches unpainted content. The reasonable size
        is choosen for page-transitions specifically, as this was
        the problem case (animations would just jump to the end).

        Since we already have a special case this just modifies it
        and replaces the unit test with a new one. This can be
        improved/simplified further when distances/directions are
        available for the animated layers.

        Replaced one test.
        Fixed bugs in and improved idlePaintNonVisibleLayers test.

        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (UpdatableTile):
        (WebCore::UpdatableTile::resetUpdateState):
        (WebCore::UpdatableTile::markForUpdate):
        (WebCore::UpdatableTile::UpdatableTile):
        (WebCore::TiledLayerChromium::TiledLayerChromium):
        (WebCore::TiledLayerChromium::pushPropertiesTo):
        (WebCore):
        (WebCore::TiledLayerChromium::updateTiles):
        (WebCore::TiledLayerChromium::markOcclusionsAndRequestTextures):
        (WebCore::TiledLayerChromium::haveTexturesForTiles):
        (WebCore::TiledLayerChromium::markTilesForUpdate):
        (WebCore::TiledLayerChromium::updateTileTextures):
        (WebCore::TiledLayerChromium::setTexturePrioritiesInRect):
        (WebCore::TiledLayerChromium::resetUpdateState):
        (WebCore::TiledLayerChromium::updateContentRect):
        (WebCore::TiledLayerChromium::needsIdlePaint):
        (WebCore::TiledLayerChromium::idlePaintRect):
        * platform/graphics/chromium/TiledLayerChromium.h:
        (TiledLayerChromium):
        * platform/graphics/chromium/cc/CCLayerTilingData.cpp:
        (WebCore::CCLayerTilingData::contentRectToTileIndices):
        * platform/graphics/chromium/cc/CCPriorityCalculator.h:
        (WebCore::CCPriorityCalculator::maxPriority):

2012-08-13  Kentaro Hara  <haraken@chromium.org>

        Unreviewed. Simple refactoring that I forgot to apply in r125495.

        * bindings/v8/V8ThrowException.cpp:
        (WebCore::domExceptionStackGetter):
        (WebCore::domExceptionStackSetter):
        (WebCore::V8ThrowException::setDOMException):
        * bindings/v8/V8ThrowException.h:

2012-08-13  Ryuan Choi  <ryuan.choi@samsung.com>

        [CMAKE][EFL] Fix build break with --tiled-backing-store
        https://bugs.webkit.org/show_bug.cgi?id=93487

        Unreviewed build fix for Efl with --tiled-backing-store.

        * CMakeLists.txt:
        Checked bison version and selected proper glslang files.

2012-08-12  Kentaro Hara  <haraken@chromium.org>

        [V8] Factor out exception related methods of V8Proxy
        https://bugs.webkit.org/show_bug.cgi?id=93792

        Reviewed by Adam Barth.

        To remove V8Proxy, this patch factors out exception related methods of V8Proxy
        to a separate file.

        (1) Move exception related methods from V8Proxy.{h,cpp} to V8ThrowException.{h,cpp}.
        (2) To avoid writing V8ThrowException::throwError() here and there in V8 binding,
        implement WebCore::throwError() in V8Binding.{h,cpp}. Ideally, we want to list up
        all V8 binding APIs in V8Binding.h.
        (3) Replace all V8Proxy::throwError() with throwError().

        Nit: I couldn't write the definition of WebCore::throwError() in V8BInding.h
        due to circular dependency issues. Either way, these methods wouldn't be
        performance-critical.

        No tests. No change in behavior.

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrGetter):
        (GenerateNormalAttrSetter):
        (GenerateOverloadedFunctionCallback):
        (GenerateFunctionCallback):
        (GenerateArgumentsCountCheck):
        (GenerateParametersCheck):
        (GenerateConstructorCallback):
        (GenerateEventConstructorCallback):
        (GenerateNamedConstructorCallback):
        (GenerateFunctionCallString):
        * bindings/scripts/test/V8/V8Float64Array.cpp:
        (WebCore::Float64ArrayV8Internal::fooCallback):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        (WebCore::TestActiveDOMObjectV8Internal::excitingFunctionCallback):
        (WebCore::TestActiveDOMObjectV8Internal::postMessageCallback):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
        (WebCore::TestCustomNamedGetterV8Internal::anotherFunctionCallback):
        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
        (WebCore::V8TestEventConstructor::constructorCallback):
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        (WebCore::TestEventTargetV8Internal::itemCallback):
        (WebCore::TestEventTargetV8Internal::dispatchEventCallback):
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore::TestInterfaceV8Internal::supplementalMethod2Callback):
        (WebCore::V8TestInterface::constructorCallback):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
        (WebCore::TestMediaQueryListListenerV8Internal::methodCallback):
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        (WebCore::V8TestNamedConstructorConstructorCallback):
        * bindings/scripts/test/V8/V8TestNode.cpp:
        (WebCore::V8TestNode::constructorCallback):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::attrWithGetterExceptionAttrGetter):
        (WebCore::TestObjV8Internal::attrWithGetterExceptionAttrSetter):
        (WebCore::TestObjV8Internal::attrWithSetterExceptionAttrSetter):
        (WebCore::TestObjV8Internal::stringAttrWithGetterExceptionAttrGetter):
        (WebCore::TestObjV8Internal::stringAttrWithGetterExceptionAttrSetter):
        (WebCore::TestObjV8Internal::stringAttrWithSetterExceptionAttrSetter):
        (WebCore::TestObjV8Internal::withScriptStateAttributeRaisesAttrGetter):
        (WebCore::TestObjV8Internal::withScriptStateAttributeRaisesAttrSetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAttributeRaisesAttrGetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAttributeRaisesAttrSetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateAttributeRaisesAttrGetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateAttributeRaisesAttrSetter):
        (WebCore::TestObjV8Internal::voidMethodWithArgsCallback):
        (WebCore::TestObjV8Internal::MethodWithArgsCallback):
        (WebCore::TestObjV8Internal::objMethodWithArgsCallback):
        (WebCore::TestObjV8Internal::methodWithSequenceArgCallback):
        (WebCore::TestObjV8Internal::methodReturningSequenceCallback):
        (WebCore::TestObjV8Internal::methodThatRequiresAllArgsAndThrowsCallback):
        (WebCore::TestObjV8Internal::serializedValueCallback):
        (WebCore::TestObjV8Internal::idbKeyCallback):
        (WebCore::TestObjV8Internal::optionsObjectCallback):
        (WebCore::TestObjV8Internal::methodWithExceptionCallback):
        (WebCore::TestObjV8Internal::withScriptStateVoidExceptionCallback):
        (WebCore::TestObjV8Internal::withScriptStateObjExceptionCallback):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateObjExceptionCallback):
        (WebCore::TestObjV8Internal::methodWithNonOptionalArgAndOptionalArgCallback):
        (WebCore::TestObjV8Internal::methodWithNonOptionalArgAndTwoOptionalArgsCallback):
        (WebCore::TestObjV8Internal::methodWithCallbackArgCallback):
        (WebCore::TestObjV8Internal::methodWithNonCallbackArgAndCallbackArgCallback):
        (WebCore::TestObjV8Internal::methodWithCallbackAndOptionalArgCallback):
        (WebCore::TestObjV8Internal::overloadedMethod1Callback):
        (WebCore::TestObjV8Internal::overloadedMethod2Callback):
        (WebCore::TestObjV8Internal::overloadedMethod3Callback):
        (WebCore::TestObjV8Internal::overloadedMethod4Callback):
        (WebCore::TestObjV8Internal::overloadedMethod5Callback):
        (WebCore::TestObjV8Internal::overloadedMethod6Callback):
        (WebCore::TestObjV8Internal::overloadedMethod7Callback):
        (WebCore::TestObjV8Internal::overloadedMethod8Callback):
        (WebCore::TestObjV8Internal::overloadedMethod9Callback):
        (WebCore::TestObjV8Internal::overloadedMethod10Callback):
        (WebCore::TestObjV8Internal::overloadedMethodCallback):
        (WebCore::TestObjV8Internal::overloadedMethod11Callback):
        (WebCore::TestObjV8Internal::overloadedMethod12Callback):
        (WebCore::TestObjV8Internal::classMethodWithClampCallback):
        (WebCore::TestObjV8Internal::enabledAtRuntimeMethod1Callback):
        (WebCore::TestObjV8Internal::enabledAtRuntimeMethod2Callback):
        (WebCore::TestObjV8Internal::enabledPerContextMethod1Callback):
        (WebCore::TestObjV8Internal::enabledPerContextMethod2Callback):
        (WebCore::TestObjV8Internal::stringArrayFunctionCallback):
        (WebCore::TestObjV8Internal::getSVGDocumentCallback):
        (WebCore::TestObjV8Internal::convert1Callback):
        (WebCore::TestObjV8Internal::convert2Callback):
        (WebCore::TestObjV8Internal::convert3Callback):
        (WebCore::TestObjV8Internal::convert4Callback):
        (WebCore::TestObjV8Internal::convert5Callback):
        (WebCore::TestObjV8Internal::strictFunctionCallback):
        (WebCore::V8TestObj::constructorCallback):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::acceptTransferListCallback):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::multiTransferListCallback):
        (WebCore::V8TestSerializedScriptValueInterface::constructorCallback):
        * bindings/v8/DateExtension.cpp:
        (WebCore::DateExtension::OnSleepDetected):
        * bindings/v8/NPV8Object.cpp:
        (_NPN_SetException):
        * bindings/v8/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::transferArrayBuffers):
        (WebCore::SerializedScriptValue::SerializedScriptValue):
        * bindings/v8/V8Binding.cpp:
        (WebCore::setDOMException):
        (WebCore):
        (WebCore::throwError):
        (WebCore::throwTypeError):
        (WebCore::throwNotEnoughArgumentsError):
        * bindings/v8/V8Binding.h:
        (WebCore):
        (WebCore::toV8Sequence):
        * bindings/v8/V8Collection.cpp:
        (WebCore::toOptionsCollectionSetter):
        * bindings/v8/V8NPObject.cpp:
        (WebCore::npObjectInvokeImpl):
        (WebCore::npObjectGetProperty):
        (WebCore::npObjectSetProperty):
        (WebCore::npObjectPropertyEnumerator):
        * bindings/v8/V8NodeFilterCondition.cpp:
        (WebCore::V8NodeFilterCondition::acceptNode):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::handleMaxRecursionDepthExceeded):
        (WebCore::V8Proxy::checkNewLegal):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):
        (WebCore):
        * bindings/v8/V8ThrowException.cpp: Added.
        (WebCore):
        (WebCore::DOMExceptionStackGetter):
        (WebCore::DOMExceptionStackSetter):
        (WebCore::V8ThrowException::setDOMException):
        (WebCore::V8ThrowException::throwError):
        (WebCore::V8ThrowException::throwTypeError):
        (WebCore::V8ThrowException::throwNotEnoughArgumentsError):
        * bindings/v8/V8ThrowException.h: Added.
        (WebCore):
        (V8ThrowException):
        * bindings/v8/V8Utilities.cpp:
        (WebCore::extractTransferables):
        (WebCore::getMessagePortArray):
        (WebCore::setTypeMismatchException):
        * bindings/v8/WorkerContextExecutionProxy.cpp:
        (WebCore::WorkerContextExecutionProxy::evaluate):
        * bindings/v8/custom/V8ArrayBufferCustom.cpp:
        (WebCore::V8ArrayBuffer::constructorCallback):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore::constructWebGLArrayWithArrayBufferArgument):
        (WebCore::constructWebGLArray):
        (WebCore::setWebGLArrayHelper):
        * bindings/v8/custom/V8AudioBufferSourceNodeCustom.cpp:
        (WebCore::V8AudioBufferSourceNode::bufferAccessorSetter):
        * bindings/v8/custom/V8AudioContextCustom.cpp:
        (WebCore::V8AudioContext::constructorCallback):
        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::V8Blob::constructorCallback):
        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
        (WebCore::V8CSSStyleDeclaration::namedPropertySetter):
        * bindings/v8/custom/V8ClipboardCustom.cpp:
        (WebCore::V8Clipboard::clearDataCallback):
        (WebCore::V8Clipboard::setDragImageCallback):
        * bindings/v8/custom/V8DOMFormDataCustom.cpp:
        (WebCore::V8DOMFormData::constructorCallback):
        (WebCore::V8DOMFormData::appendCallback):
        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        (WebCore::V8DOMStringMap::namedPropertySetter):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::WindowSetTimeoutImpl):
        (WebCore::handlePostMessageCallback):
        * bindings/v8/custom/V8DataViewCustom.cpp:
        (WebCore::V8DataView::constructorCallback):
        (WebCore::V8DataView::getInt8Callback):
        (WebCore::V8DataView::getUint8Callback):
        (WebCore::V8DataView::setInt8Callback):
        (WebCore::V8DataView::setUint8Callback):
        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
        (WebCore::handlePostMessageCallback):
        * bindings/v8/custom/V8DirectoryEntryCustom.cpp:
        (WebCore::V8DirectoryEntry::getDirectoryCallback):
        (WebCore::V8DirectoryEntry::getFileCallback):
        * bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp:
        (WebCore::V8DirectoryEntrySync::getDirectoryCallback):
        (WebCore::V8DirectoryEntrySync::getFileCallback):
        * bindings/v8/custom/V8DocumentCustom.cpp:
        (WebCore::V8Document::evaluateCallback):
        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
        (WebCore::V8HTMLCanvasElement::toDataURLCallback):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::V8HTMLDocument::openCallback):
        * bindings/v8/custom/V8HTMLElementCustom.cpp:
        (WebCore::V8HTMLElement::itemValueAccessorSetter):
        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
        (WebCore::v8HTMLImageElementConstructorCallback):
        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
        (WebCore::V8HTMLInputElement::selectionStartAccessorGetter):
        (WebCore::V8HTMLInputElement::selectionStartAccessorSetter):
        (WebCore::V8HTMLInputElement::selectionEndAccessorGetter):
        (WebCore::V8HTMLInputElement::selectionEndAccessorSetter):
        (WebCore::V8HTMLInputElement::selectionDirectionAccessorGetter):
        (WebCore::V8HTMLInputElement::selectionDirectionAccessorSetter):
        (WebCore::V8HTMLInputElement::setSelectionRangeCallback):
        * bindings/v8/custom/V8HTMLMediaElementCustom.cpp:
        (WebCore::V8HTMLMediaElement::controllerAccessorSetter):
        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
        (WebCore::V8HTMLOptionsCollection::addCallback):
        (WebCore::V8HTMLOptionsCollection::lengthAccessorSetter):
        * bindings/v8/custom/V8HistoryCustom.cpp:
        (WebCore::V8History::pushStateCallback):
        (WebCore::V8History::replaceStateCallback):
        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
        (WebCore::V8InjectedScriptHost::inspectedObjectCallback):
        * bindings/v8/custom/V8IntentConstructor.cpp:
        (WebCore::V8Intent::constructorCallback):
        * bindings/v8/custom/V8LocationCustom.cpp:
        (WebCore::V8Location::protocolAccessorSetter):
        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
        (WebCore::V8MessageChannel::constructorCallback):
        * bindings/v8/custom/V8MessagePortCustom.cpp:
        (WebCore::handlePostMessageCallback):
        * bindings/v8/custom/V8MutationObserverCustom.cpp:
        (WebCore::V8MutationObserver::constructorCallback):
        * bindings/v8/custom/V8NodeCustom.cpp:
        (WebCore::V8Node::insertBeforeCallback):
        (WebCore::V8Node::replaceChildCallback):
        (WebCore::V8Node::removeChildCallback):
        (WebCore::V8Node::appendChildCallback):
        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
        (WebCore::V8NotificationCenter::createHTMLNotificationCallback):
        (WebCore::V8NotificationCenter::createNotificationCallback):
        (WebCore::V8NotificationCenter::requestPermissionCallback):
        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
        (WebCore::V8SQLResultSetRowList::itemCallback):
        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
        (WebCore::V8SQLTransaction::executeSqlCallback):
        * bindings/v8/custom/V8SQLTransactionSyncCustom.cpp:
        (WebCore::V8SQLTransactionSync::executeSqlCallback):
        * bindings/v8/custom/V8SVGLengthCustom.cpp:
        (WebCore::V8SVGLength::valueAccessorGetter):
        (WebCore::V8SVGLength::valueAccessorSetter):
        (WebCore::V8SVGLength::convertToSpecifiedUnitsCallback):
        * bindings/v8/custom/V8StorageCustom.cpp:
        (WebCore::storageSetter):
        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
        (WebCore::getObjectParameter):
        (WebCore::V8WebGLRenderingContext::getAttachedShadersCallback):
        (WebCore::V8WebGLRenderingContext::getExtensionCallback):
        (WebCore::V8WebGLRenderingContext::getFramebufferAttachmentParameterCallback):
        (WebCore::V8WebGLRenderingContext::getParameterCallback):
        (WebCore::V8WebGLRenderingContext::getProgramParameterCallback):
        (WebCore::V8WebGLRenderingContext::getShaderParameterCallback):
        (WebCore::V8WebGLRenderingContext::getUniformCallback):
        (WebCore::vertexAttribAndUniformHelperf):
        (WebCore::uniformHelperi):
        (WebCore::uniformMatrixHelper):
        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
        (WebCore::V8WebKitPoint::constructorCallback):
        * bindings/v8/custom/V8WebSocketCustom.cpp:
        (WebCore::V8WebSocket::constructorCallback):
        (WebCore::V8WebSocket::sendCallback):
        * bindings/v8/custom/V8WorkerContextCustom.cpp:
        (WebCore::V8WorkerContext::importScriptsCallback):
        * bindings/v8/custom/V8WorkerCustom.cpp:
        (WebCore::handlePostMessageCallback):
        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
        (WebCore::V8XMLHttpRequest::constructorCallback):
        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
        (WebCore::V8XMLHttpRequest::responseTextAccessorGetter):
        (WebCore::V8XMLHttpRequest::responseAccessorGetter):
        (WebCore::V8XMLHttpRequest::openCallback):
        (WebCore::V8XMLHttpRequest::sendCallback):

2012-08-13  Kentaro Hara  <haraken@chromium.org>

        [V8] Move GCEventData class from V8Binding.h to ScriptGCEvent.h
        https://bugs.webkit.org/show_bug.cgi?id=93818

        Reviewed by Adam Barth.

        (1) This patch moves GCEventData class from V8Binding.h to ScriptGCEvent.h.
        (2) This patch makes GCEventData::startTime and GCEventData::usedHeapSize
        private members.
        (3) This patch removes unused forward declarations from V8Binding.h.

        No tests. No change in behavior.

        * bindings/v8/ScriptGCEvent.cpp:
        (WebCore::ScriptGCEvent::gcPrologueCallback):
        (WebCore::ScriptGCEvent::gcEpilogueCallback):
        * bindings/v8/ScriptGCEvent.h:
        (GCEventData):
        (WebCore::GCEventData::GCEventData):
        (WebCore::GCEventData::clear):
        (WebCore::GCEventData::listeners):
        (WebCore::GCEventData::startTime):
        (WebCore::GCEventData::setStartTime):
        (WebCore::GCEventData::usedHeapSize):
        (WebCore::GCEventData::setUsedHeapSize):
        (WebCore):
        * bindings/v8/V8Binding.h:
        (WebCore):
        * bindings/v8/V8PerIsolateData.cpp:

2012-08-13  Kentaro Hara  <haraken@chromium.org>

        [V8] Move checkNewLegal() from V8Proxy.h to SafeAllocation.h
        https://bugs.webkit.org/show_bug.cgi?id=93830

        Reviewed by Adam Barth.

        This patch moves checkNewLegal() from V8Proxy.h to SafeAllocation.h.
        In addition, this patch renames checkNewLegal() to isValidConstructorMode()
        for clarification.

        No tests. No change in behavior.

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/v8/SafeAllocation.cpp: Added.
        * bindings/v8/SafeAllocation.h:
        (WebCore::SafeAllocation::newInstance):
        (WebCore):
        * bindings/v8/V8Binding.cpp:
        (WebCore::createRawTemplate):
        * bindings/v8/V8Proxy.cpp:
        * bindings/v8/V8Proxy.h:
        (V8Proxy):

2012-08-13  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove unused methods from V8Binding.h
        https://bugs.webkit.org/show_bug.cgi?id=93836

        Reviewed by Adam Barth.

        enableStringImplCache() and v8UndetectableString() are not used by anybody.

        No tests. No change in behavior.

        * bindings/v8/V8Binding.h:

2012-08-13  Kentaro Hara  <haraken@chromium.org>

        [V8] Move hintForGCIfNecessary() from V8Proxy.h to V8GCController.h
        https://bugs.webkit.org/show_bug.cgi?id=93834

        Reviewed by Adam Barth.

        This patch moves hintForGCIfNecessary() from V8Proxy.h to V8GCController.h.

        No tests. No change in behavior.

        * bindings/v8/V8GCController.cpp:
        (WebCore::V8GCController::hintForGCIfNecessary):
        * bindings/v8/V8GCController.h:
        (V8GCController):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::clearForClose):
        (WebCore::V8Proxy::clearForNavigation):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):

2012-08-13  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124970.
        http://trac.webkit.org/changeset/124970
        https://bugs.webkit.org/show_bug.cgi?id=93495

        Postponing the merge in a clearer context (Requested by
        Michelangelo on #webkit).

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseTransform):
        * css/CSSParser.h:

2012-08-12  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] renderSurface in incorrect space if owning layer has empty but non-zero bounds
        https://bugs.webkit.org/show_bug.cgi?id=93795

        Reviewed by Adrienne Walker.

        If a renderSurface is created by a layer that had zero
        area (empty) but non-zero bounds (either width or height was
        non-zero), then one translation transform was accidentally being
        skipped, causing the renderSurface drawTransform to be incorrect.
        The fix is simply to move that transform outside of the
        if-statement so it is not skipped.

        Unit test added:
          CCLayerTreeHostCommonTest.verifyTransformsForDegenerateIntermediateLayer()

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateDrawTransformsInternal):

2012-08-13  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove [TreatReturnedNullAs=False]
        https://bugs.webkit.org/show_bug.cgi?id=93835

        Reviewed by Adam Barth.

        [TreatReturnedNullAs=False] is neither defined in the Web IDL spec
        nor used in any WebKit IDL file.

        No tests. No change in behavior.

        * WebCore.order:
        * bindings/js/JSDOMBinding.cpp:
        * bindings/js/JSDOMBinding.h:
        (WebCore):
        * bindings/scripts/CodeGeneratorJS.pm:
        (NativeToJSValue):
        * bindings/scripts/CodeGeneratorV8.pm:
        (NativeToJSValue):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/test/CPP/WebDOMTestObj.cpp:
        * bindings/scripts/test/CPP/WebDOMTestObj.h:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore):
        * bindings/scripts/test/JS/JSTestObj.h:
        (WebCore):
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        * bindings/scripts/test/TestObj.idl:
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::ConfigureV8TestObjTemplate):
        * bindings/v8/V8Binding.h:

2012-08-13  Kentaro Hara  <haraken@chromium.org>

        [V8] Rename v8ValueToWebCoreDOMStringList() to toDOMStringList()
        https://bugs.webkit.org/show_bug.cgi?id=93839

        Reviewed by Adam Barth.

        For naming consistency with toWebCoreString() and toWebCoreAtomicString(),
        this patch renames v8ValueToWebCoreDOMStringList() to toDOMStringList().
        ("WebCore" wouldn't be needed because it's clear from "DOMStringList".)

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (JSValueToNative):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::overloadedMethod6Callback):
        (WebCore::TestObjV8Internal::overloadedMethod7Callback):
        (WebCore::TestObjV8Internal::overloadedMethod9Callback):
        (WebCore::TestObjV8Internal::stringArrayFunctionCallback):
        * bindings/v8/V8Binding.cpp:
        (WebCore::toDOMStringList):
        * bindings/v8/V8Binding.h:
        (WebCore):

2012-08-13  Kentaro Hara  <haraken@chromium.org>

        [V8] Rename v8ValueToAtomicWebCoreString() to toWebCoreAtomicString()
        https://bugs.webkit.org/show_bug.cgi?id=93824

        Reviewed by Adam Barth.

        For naming consistency with toWebCoreString(), we can rename
        v8ValueToAtomicWebCoreString() to toWebCoreAtomicString().
        Also we can rename v8ValueToAtomicWebCoreStringWithNullCheck()
        to toWebCoreAtomicStringWithNullCheck().

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrSetter):
        (GenerateEventListenerCallback):
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        (WebCore::TestEventTargetV8Internal::addEventListenerCallback):
        (WebCore::TestEventTargetV8Internal::removeEventListenerCallback):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::addEventListenerCallback):
        (WebCore::TestObjV8Internal::removeEventListenerCallback):
        * bindings/v8/V8Binding.cpp:
        (WebCore::toWebCoreAtomicString):
        * bindings/v8/V8Binding.h:
        (WebCore::toWebCoreStringWithNullOrUndefinedCheck):
        (WebCore::toWebCoreAtomicStringWithNullCheck):
        * bindings/v8/V8Collection.h:
        (WebCore::getNamedPropertyOfCollection):
        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::getter):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::V8DOMWindow::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
        (WebCore::V8HTMLAllCollection::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
        (WebCore::V8HTMLCollection::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
        (WebCore::V8HTMLFormElement::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
        (WebCore::V8HTMLFrameSetElement::namedPropertyGetter):
        * bindings/v8/custom/V8NodeListCustom.cpp:
        (WebCore::V8NodeList::namedPropertyGetter):

2012-08-13  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove v8ValueToWebCoreString()
        https://bugs.webkit.org/show_bug.cgi?id=93822

        Reviewed by Adam Barth.

        There are two equivalent ways to convert a V8 value to a WebCore String;
        i.e. v8ValueToWebCoreString() and toWebCoreString(). We can remove the former.

        In a follow-up patch, I will replace v8ValueToAtomicWebCoreString()
        with toWebCoreAtomicString(), for consistency with toWebCoreString().

        No tests. No change in behavior.

        * bindings/v8/Dictionary.cpp:
        (WebCore::Dictionary::get):
        (WebCore::Dictionary::getWithUndefinedOrNullCheck):
        (WebCore::Dictionary::getOwnPropertiesAsStringHashMap):
        * bindings/v8/IDBBindingUtilities.cpp:
        (WebCore::createIDBKeyFromValue):
        * bindings/v8/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::setBreakpoint):
        * bindings/v8/V8Binding.cpp:
        (WebCore::toWebCoreString):
        (WebCore::v8ValueToWebCoreDOMStringList):
        * bindings/v8/V8Binding.h:
        (WebCore::toWebCoreStringWithNullCheck):
        * bindings/v8/custom/V8MessageEventCustom.cpp:
        (WebCore::V8MessageEvent::initMessageEventCallback):

2012-08-13  Kentaro Hara  <haraken@chromium.org>

        [V8] Move the ConstructorMode class from V8Binding.h to SafeAllocation.h
        https://bugs.webkit.org/show_bug.cgi?id=93821

        Reviewed by Adam Barth.

        This patch factors out the ConstructorMode class from V8Binding.h to SafeAllocation.h.

        No tests. No change in behavior.

        * bindings/v8/SafeAllocation.h:
        (ConstructorMode):
        (WebCore::ConstructorMode::ConstructorMode):
        (WebCore::ConstructorMode::~ConstructorMode):
        (WebCore::ConstructorMode::current):
        (WebCore):
        * bindings/v8/V8Binding.h:
        * bindings/v8/V8RecursionScope.h:

2012-08-13  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove V8BindingHelpers
        https://bugs.webkit.org/show_bug.cgi?id=93807

        Reviewed by Adam Barth.

        V8BindingHelpers contains toV8Context() and toV8Proxy(), which are used
        by NPV8Object.cpp only.

        (1) Move these methods to NPV8Object.cpp as static methods.
        (2) Remove V8BindingHelpers.{h,cpp}.

        No tests. No change in behavior.

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/v8/NPV8Object.cpp:
        (WebCore::toV8Context):
        (WebCore):
        (WebCore::toV8Proxy):
        * bindings/v8/V8Binding.h:
        * bindings/v8/V8BindingHelpers.cpp: Removed.
        * bindings/v8/V8BindingHelpers.h: Removed.

2012-08-13  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove unused methods and headers from V8Utilities
        https://bugs.webkit.org/show_bug.cgi?id=93805

        Reviewed by Adam Barth.

        This patch removes unused methods, forward declarations and
        headers from V8Utilities.{h,cpp}.

        No tests. No change in behavior.

        * bindings/v8/V8Utilities.cpp:
        * bindings/v8/V8Utilities.h:
        (WebCore):

2012-08-13  Kentaro Hara  <haraken@chromium.org>

        [V8] Move V8PerIsolateData::visitExternalStrings() to V8PerIsolateData.cpp
        https://bugs.webkit.org/show_bug.cgi?id=93803

        Reviewed by Adam Barth.

        In r125015, I forgot to move V8PerIsolateData::visitExternalStrings()
        to V8PerIsolateData.cpp. This patch moves it.

        No tests. No change in behavior.

        * bindings/v8/V8Binding.cpp:
        * bindings/v8/V8PerIsolateData.cpp:
        (WebCore):
        (WebCore::V8PerIsolateData::visitExternalStrings):

2012-08-13  Elliott Sprehn  <esprehn@chromium.org>

        Expand list of supported languages for RenderQuote to match WHATWG spec
        https://bugs.webkit.org/show_bug.cgi?id=93424

        Reviewed by Eric Seidel.

        Expand the table of quotes to include the 148 lang values and associated quotes
        from the WHATWG web-apps recommended styling spec.

        Test: fast/css-generated-content/quotes-lang-case-insensitive.html

        * rendering/RenderQuote.cpp: Added missing copyright.
        (WebCore::quotesDataLanguageMap): Expanded the table of quotes.
        (WebCore::basicQuotesData): Added a FIXME to switch to using stylized "en" quotes.
        * rendering/RenderQuote.h: Added missing copyright.

2012-08-09  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove evaluateInIsolatedWorld() from V8Proxy
        https://bugs.webkit.org/show_bug.cgi?id=93679

        Reviewed by Adam Barth.

        To remove V8Proxy, this patch moves V8Proxy::evaluateInIsolatedWorld()
        to ScriptController.

        No tests. No change in behavior.

        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::evaluateInIsolatedWorld):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::precompileScript):

2012-08-13  Bear Travis  <betravis@adobe.com>

        [CSS Exclusions] Remove unused CSSWrapShapes header includes
        https://bugs.webkit.org/show_bug.cgi?id=93395

        Reviewed by Kentaro Hara.

        Removing the #include "CSSWrapShapes.h" lines from StyleBuilder.cpp and
        RenderStyle.cpp. Both files now use the length-based WrapShapes.h classes.

        * css/StyleBuilder.cpp:
        * rendering/style/RenderStyle.cpp:

2012-08-13  Pravin D  <pravind.2k4@gmail.com>

        Bad cast in RenderBox::computeReplacedLogicalHeightUsing
        https://bugs.webkit.org/show_bug.cgi?id=93875

        Reviewed by Abhishek Arya.

        Pointer to the container of a replaced element was being type casted to renderbox
        without checking if the container is a renderbox or not.

        Test: fast/replaced/render-inline-cast-to-render-box-crash.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
         Scrollbar height is retrieved only if the container is a renderBox. Otherwise scrollbar is taken as zero.

2012-08-13  James Robinson  <jamesr@chromium.org>

        [chromium] Make WebAnimation a pure virtual interface to hide implementation and avoid unresolved symbols
        https://bugs.webkit.org/show_bug.cgi?id=93907

        Reviewed by Darin Fisher.

        Updates WebAnimation users for interface changes.

        * platform/graphics/chromium/AnimationTranslationUtil.cpp:
        (WebCore::createWebAnimation):
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::addAnimation):

2012-08-11  Raphael Kubo da Costa  <rakuco@webkit.org>

        [CMake] Rewrite FindLibSoup2.cmake.
        https://bugs.webkit.org/show_bug.cgi?id=93191

        Reviewed by Rob Buis.

        * PlatformEfl.cmake: Use LIBSOUP_FOO instead of LIBSOUP24_FOO,
        also link against GObject, which is needed by libsoup.

2012-08-10  James Robinson  <jamesr@chromium.org>

        [chromium] Clean up dependencies for Canvas2DLayerBridgeTest and GraphicsLayerChromiumTest unit tests
        https://bugs.webkit.org/show_bug.cgi?id=93757

        Reviewed by Adrienne Walker.

        Exposes the current contentsScale for tests.

        * platform/graphics/chromium/GraphicsLayerChromium.h:
        (GraphicsLayerChromium):

2012-08-13  Andreas Kling  <kling@webkit.org>

        Reduce the size of empty NinePieceImage objects.
        <http://webkit.org/b/93747>

        Reviewed by Antti Koivisto.

        Move the members of NinePieceImage into a NinePieceImageData class, leaving NinePieceImage
        with a single OwnPtr<NinePieceImageData> member. The constant NinePieceImage::defaultData()
        provides default values for objects with null m_data.

        RenderStyle's "StyleSurroundData" member has a BorderData, which in turn holds a NinePieceImage.
        This means that anything with left/right/top/bottom, margin, padding or border style but *no*
        border-image will save 104 bytes (assuming their RenderStyle is unshared, which is fairly common.)

        This reduces the size of StyleSurroundData by 104 bytes, effectively reducing memory consumption
        by 1.72MB when viewing the full HTML5 spec at <http://whatwg.org/c>

        * rendering/style/NinePieceImage.cpp:
        (WebCore::NinePieceImageData::operator==):
        (WebCore::NinePieceImage::defaultData):
        (WebCore):
        * rendering/style/NinePieceImage.h:
        (WebCore::NinePieceImageData::NinePieceImageData):
        (NinePieceImageData):
        (WebCore::NinePieceImageData::operator!=):
        (WebCore):
        (NinePieceImage):
        (WebCore::NinePieceImage::NinePieceImage):
        (WebCore::NinePieceImage::operator=):
        (WebCore::NinePieceImage::operator==):
        (WebCore::NinePieceImage::operator!=):
        (WebCore::NinePieceImage::hasImage):
        (WebCore::NinePieceImage::image):
        (WebCore::NinePieceImage::setImage):
        (WebCore::NinePieceImage::imageSlices):
        (WebCore::NinePieceImage::setImageSlices):
        (WebCore::NinePieceImage::fill):
        (WebCore::NinePieceImage::setFill):
        (WebCore::NinePieceImage::borderSlices):
        (WebCore::NinePieceImage::setBorderSlices):
        (WebCore::NinePieceImage::outset):
        (WebCore::NinePieceImage::setOutset):
        (WebCore::NinePieceImage::horizontalRule):
        (WebCore::NinePieceImage::setHorizontalRule):
        (WebCore::NinePieceImage::verticalRule):
        (WebCore::NinePieceImage::setVerticalRule):
        (WebCore::NinePieceImage::copyImageSlicesFrom):
        (WebCore::NinePieceImage::copyBorderSlicesFrom):
        (WebCore::NinePieceImage::copyOutsetFrom):
        (WebCore::NinePieceImage::copyRepeatFrom):
        (WebCore::NinePieceImage::setMaskDefaults):
        (WebCore::NinePieceImage::ensureData):
        (WebCore::NinePieceImage::data):

2012-08-13  Florin Malita  <fmalita@chromium.org>

        WebKit+SVG does not support color-interpolation-filters or draw filters in correct colorspace
        https://bugs.webkit.org/show_bug.cgi?id=6033

        Reviewed by Dirk Schulze.

        This patch adds support for SVG color-interpolation-filters. All non-CG plarforms now
        perform color space conversions as needed (CG performs color space adjustments internally),
        and the new default color space for filters is linearRGB
        (http://www.w3.org/TR/SVG/filters.html#FilterPrimitivesOverviewIntro).

        FilterEffect tracks the color-interpolation-filters attribute (m_colorSpace) and the
        current result color space (m_resultColorSpace). When applying, the input results are
        converted to the current FilterEffect's color space, and at the end of the filter effect
        chain the result is finally converted to ColorSpaceDeviceRGB.

        FilterEffect::transformResultColorSpace() handles non-CG color space converion (CG has
        built in support for different color spaces) by first converting the result to an image
        buffer, and then using the platform specific ImageBuffer::transformColorSpace(). This can
        be expensive for filter chains with alternating color-interpolation-filters, but can be
        optimized if/when color space support is added to all the graphics backends similarly to CG.

        As expected, lots of filter-related pixel results will require rebaselining after this lands.

        Test: svg/filters/color-interpolation-filters.svg

        * platform/graphics/filters/FilterEffect.cpp:
        (WebCore::FilterEffect::FilterEffect):
        (WebCore::FilterEffect::apply):
        (WebCore::FilterEffect::asImageBuffer):
        (WebCore::FilterEffect::createImageBufferResult):
        (WebCore::FilterEffect::transformResultColorSpace):
        (WebCore):
        * platform/graphics/filters/FilterEffect.h:
        (WebCore::FilterEffect::colorSpace):
        (WebCore::FilterEffect::setColorSpace):
        (FilterEffect):
        * platform/graphics/filters/SourceGraphic.h:
        (WebCore::SourceGraphic::SourceGraphic):
        * rendering/FilterEffectRenderer.cpp:
        (WebCore::FilterEffectRenderer::apply):
        * rendering/svg/RenderSVGResourceFilter.cpp:
        (WebCore::RenderSVGResourceFilter::buildPrimitives):
        (WebCore::RenderSVGResourceFilter::postApplyResource):

2012-08-13  Raymond Toy  <rtoy@google.com>

        Oscillator node should throw exception if type is assigned an invalid value
        https://bugs.webkit.org/show_bug.cgi?id=93490

        Reviewed by Chris Rogers.

        New tests added to oscillator-basic to catch exceptions.

        * Modules/webaudio/Oscillator.cpp:
        (WebCore::Oscillator::Oscillator):
        (WebCore::Oscillator::setType): Return exception
        * Modules/webaudio/Oscillator.h:
        (Oscillator): Update setType declaration
        * Modules/webaudio/Oscillator.idl: setType can raise exception.

2012-08-13  Chris Rogers  <crogers@google.com>

        AudioContext::createMediaStreamSource() must create a provider for local MediaStreams
        https://bugs.webkit.org/show_bug.cgi?id=93756

        Reviewed by Eric Carlson.

        There are two main kinds of MediaStreams (local and from remote peers).
        Internally we need to know the difference so a MediaStreamAudioSourceNode will "just work".

        Tested by existing test: mediastreamaudiosourcenode.html
        Full testing can only be verified by manual tests.

        * Modules/mediastream/LocalMediaStream.h:
        (LocalMediaStream):
        * Modules/mediastream/MediaStream.h:
        (WebCore::MediaStream::isLocal):
        (MediaStream):
        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::createMediaStreamSource):

2012-08-13  Simon Hausmann  <simon.hausmann@nokia.com>

        Unreviewed, rolling out r125444.
        http://trac.webkit.org/changeset/125444
        https://bugs.webkit.org/show_bug.cgi?id=93872

        Broke some tests

        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::QtRuntimeMethod::~QtRuntimeMethod):
        (JSC::Bindings::QtRuntimeMethod::jsObjectRef):
        * bridge/qt/qt_runtime.h:
        (QtRuntimeMethod):

2012-08-13  Thiago Marcos P. Santos  <thiago.santos@intel.com>

        CanvasRenderContext2D::font() does not re-serialize the font
        https://bugs.webkit.org/show_bug.cgi?id=50859

        Reviewed by Kenneth Rohde Christiansen.

        Added proper serialization for the font property.

        No new tests, unskipped the existing ones.

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::font):

2012-08-13  Elliott Sprehn  <esprehn@chromium.org>

        CSS quotes output quotes when depth is negative
        https://bugs.webkit.org/show_bug.cgi?id=92690

        Reviewed by Eric Seidel.

        Previously if the quote depth would go negative we would output the close quote from the
        first pair of quotes again instead of outputting no quotes as required by the spec.
 
        See: http://www.w3.org/TR/CSS21/generate.html#quotes-insert

        Test: fast/css-generated-content/nested-quote-more-than-pairs.html

        * rendering/RenderQuote.cpp:
        (WebCore::RenderQuote::originalText): Allow the value passed to getOpenQuote to go negative by removing std::max.
        * rendering/style/QuotesData.cpp:
        (WebCore::QuotesData::getOpenQuote): Bounds check for negative values for safety.
        (WebCore::QuotesData::getCloseQuote): Allow index to be >= -1 and return an empty string for -1.

2012-08-13  Vangelis Kokkevis  <vangelis@chromium.org>

        [chromium] Clear HUD canvas contents before drawing into it.
        https://bugs.webkit.org/show_bug.cgi?id=93759

        Reviewed by Adrienne Walker.

        Not clearing the bitmaps before drawing into it results into
        random noise. This patch also caches the SkCanvas used by the HUD
        to avoid reallocating it every frame.

        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
        (WebCore::CCHeadsUpDisplayLayerImpl::willDraw):
        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.h:

2012-08-13  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] Replace use of internal Weak smart pointer with JSWeakObjectMap
        https://bugs.webkit.org/show_bug.cgi?id=93872

        Reviewed by Kenneth Rohde Christiansen.

        The intention of this patch series is to replace use of internal JSC
        API with use of the stable and public C API.

        The JSC::Weak template is internal API and the only part of the C API
        that exposes similar functionality is the JSWeakObjectMap. It is
        special in the sense that its life-time is tied to the life-time of the
        JS global object, which in turn is subject to garbage collection. In
        order to maximize re-use of the same map across different JSContextRef
        instances, we use the associated global context ref as owner of the
        weak maps. The key in the weak map is the identity (pointer) of the
        runtime method object itself.  The iteration through the maps is
        tedious, but should usually not go beyond just a few.

        * bridge/qt/qt_runtime.cpp:
        (Bindings):
        (JSC::Bindings::methodMapCleaner):
        (JSC::Bindings::QtRuntimeMethod::~QtRuntimeMethod):
        (JSC::Bindings::QtRuntimeMethod::jsObjectRef):
        * bridge/qt/qt_runtime.h:
        (QtRuntimeMethod):

2012-08-13  Raphael Kubo da Costa  <rakuco@webkit.org>

        [CMake] Remove glib-related Find modules and write single new one instead.
        https://bugs.webkit.org/show_bug.cgi?id=93786

        Reviewed by Rob Buis.

        No new tests, build system plumbing.

        * PlatformEfl.cmake: Use GLIB_* instead of Glib_*, and link
        directly against GIO, as code in the soup network backend uses
        that.

2012-08-13  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] Simplify storage and reduce size of QtConnectionObject
        https://bugs.webkit.org/show_bug.cgi?id=93868

        Reviewed by Kenneth Rohde Christiansen.

        The connection object is a child of the sender QObject, so we can use parent()
        whenever we need the sender instead of keeping an extra QObject pointer. Also
        QtConnectionObject kept a RefPtr to the Instance, but actually only needed the
        root object, so we can store a pointer to that instead.

        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::QtConnectionObject::QtConnectionObject):
        (JSC::Bindings::QtConnectionObject::~QtConnectionObject):
        (JSC::Bindings::QtConnectionObject::execute):
        (JSC::Bindings::QtConnectionObject::match):
        * bridge/qt/qt_runtime.h:
        (QtConnectionObject):

2012-08-13  Zan Dobersek  <zandobersek@gmail.com>

        Media(Stream|Element)AudioSourceNode should be guarded by the WEB_AUDIO condition as well
        https://bugs.webkit.org/show_bug.cgi?id=93864

        Reviewed by Eric Carlson.

        Add the WEB_AUDIO to the Conditional attribute in MediaElementAudioSourceNode
        IDL file and the ENABLE(WEB_AUDIO) compilation guard to the header files for both
        MediaStreamAudioSourceNode and MediaElementAudioSourceNode.

        No new tests - no new functionality.

        * Modules/webaudio/MediaElementAudioSourceNode.h:
        * Modules/webaudio/MediaStreamAudioSourceNode.h:
        * Modules/webaudio/MediaStreamAudioSourceNode.idl:

2012-08-13  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] Clean up exception handling
        https://bugs.webkit.org/show_bug.cgi?id=93880

        Reviewed by Kenneth Rohde Christiansen.

        The JSC C API uses a JSValueRef* exception parameter to indicate to the
        caller that an exception was thrown. Naturally the caller must store
        that ValueRef on the stack in order to get seen and marked by the
        garbage collector, otherwise the callee would have to use
        JSValueProtect on it.

        This patch fixes one such case where in fact the exception pointer was passed as zero to the
        callee and thus ignored. The patch also removes an unused exception parameter.

        * bridge/qt/qt_class.cpp:
        (JSC::Bindings::QtClass::fallbackObject):
        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::QtRuntimeMethod::QtRuntimeMethod):
        * bridge/qt/qt_runtime.h:

2012-08-13  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: remove commitEditing from the text editor delegate.
        https://bugs.webkit.org/show_bug.cgi?id=93858

        Reviewed by Vsevolod Vlasov.

        This should be up to the source frame.

        * inspector/front-end/DefaultTextEditor.js:
        (WebInspector.DefaultTextEditor.prototype._registerShortcuts):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame):
        (WebInspector.SourceFrame.prototype.scrollChanged):
        (WebInspector.SourceFrame.prototype._handleKeyDown):
        (WebInspector.SourceFrame.prototype._commitEditing):
        * inspector/front-end/TextEditor.js:

2012-08-13  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r125430.
        http://trac.webkit.org/changeset/125430
        https://bugs.webkit.org/show_bug.cgi?id=93881

        Caused css2.1/t1604-c541-word-sp-00-b-a.html to regress on Mac
        builds (Requested by mwenge on #webkit).

        * platform/graphics/WidthIterator.cpp:
        (WebCore::WidthIterator::advance):
        * platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp:
        (WebCore::HarfBuzzShaperBase::isWordEnd):
        * platform/graphics/harfbuzz/HarfBuzzShaperBase.h:
        (HarfBuzzShaperBase):
        (WebCore::HarfBuzzShaperBase::isCodepointSpace):
        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::ComplexTextController::adjustGlyphsAndAdvances):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
        * rendering/RenderText.cpp:
        (WebCore::RenderText::widthFromCache):

2012-08-13  Mike West  <mkwst@chromium.org>

        FrameLoader::receivedMainResourceError doesn't handle GET cancellations well.
        https://bugs.webkit.org/show_bug.cgi?id=93850

        Reviewed by Adam Barth.

        'FrameLoader::cancel' should reset the loader's state, and it mostly
        does. In the case of a GET form submission, however, the submitted form
        URL that's stored doesn't match the URL that's requested (query string).
        This leads to the loader getting a bit confused about what's going on,
        and not clearing the stored form submission URL.

        This patch moves to storing the form submission's actual request URL
        as opposed to the form action URL.

        None of the current tests should break, and when issue 93777 lands, it
        won't be broken either.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::submitForm):
            Switched to using 'FormSubmission::requestURL', as that matches the
            URL that's actually requested during a form submission via GET.

2012-08-13  Antonio Gomes  <agomes@rim.com>

        [BlackBerry] Hardware accelerated scrolling of <select> content
        https://bugs.webkit.org/show_bug.cgi?id=93856

        Reviewed by Rob Buis.

        Internally reviewed by Matthew Staikos.

        * Resources/blackberry/selectControlBlackBerry.css: add -webkit-overflow-scrolling: touch (EOM).
        (.select-area):

2012-08-13  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        [Qt] Assertion in RenderObject::offsetFromAncestorContainer
        https://bugs.webkit.org/show_bug.cgi?id=93845

        Reviewed by Kenneth Rohde Christiansen.

        Do not attempt to clip using layers that are not containers of the renderer.

        * page/GestureTapHighlighter.cpp:

2012-08-13  Dominik Röttsches  <dominik.rottsches@intel.com>

        [Cairo] canvas/philip/tests/2d.drawImage.self.2.html test failing on ports using Cairo
        https://bugs.webkit.org/show_bug.cgi?id=93244

        Reviewed by Kenneth Rohde Christiansen.

        Similar to Skia's and Qt's ImageBuffer implementation we need to make sure that buffers
        for images are copied when the destination canvas is identical to the
        image buffer's context. This happens mostly in JS calls to canvas' drawImage method.
        For now fixing the drawImage case, drawPattern case is handled in bug 93854.

        No new tests, covered by canvas/philip/tests/2d.drawImage.self.2.html

        * platform/graphics/cairo/ImageBufferCairo.cpp:
        (WebCore::ImageBuffer::draw): Making sure buffer is copied when source and destination contexts are identical.

2012-06-24  Robert Hogan  <robert@webkit.org>

        CSS 2.1 failure: Word-spacing affects each space and non-breaking space
        https://bugs.webkit.org/show_bug.cgi?id=89826

        Reviewed by Eric Seidel.

        Add word spacing to consecutive spaces in a run per http://www.w3.org/TR/CSS21/text.html#spacing-props.

        Test: fast/css/word-spacing-characters.html
              fast/css/word-spacing-characters-complex-text.html
              fast/css/word-spacing-characters-linebreak.html
              css2.1/20110323/word-spacing-characters-002.htm
              css2.1/20110323/word-spacing-characters-003.htm
              css2.1/20110323/word-spacing-remove-space-001.htm
              css2.1/20110323/word-spacing-remove-space-002.htm
              css2.1/20110323/word-spacing-remove-space-003.htm
              css2.1/20110323/word-spacing-remove-space-004.htm
              css2.1/20110323/word-spacing-remove-space-005.htm
              css2.1/20110323/word-spacing-remove-space-006.htm
              css2.1/20110323/c541-word-sp-001.htm

        * platform/graphics/WidthIterator.cpp:
        (WebCore::WidthIterator::advance): All spaces (ordinary space or &nbsp;) get word-spacing added, even
          if they are consecutive.
        * platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp:
        (WebCore::HarfBuzzShaperBase::isWordEnd): ditto, but for the complex text case on Chromium. Had to use
          m_run rather than m_normalizedBuffer here as m_normalizedBuffer turns tabs into spaces! Unlike the simple
          text path, '\n' gets word-spacing - I observed this from fast/text/atsui-spacing-features.html but can't
          find it specified anywhere.
        * platform/graphics/harfbuzz/HarfBuzzShaperBase.h:
        (WebCore::HarfBuzzShaperBase::isCodepointSpace):
        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): ditto, but for the complext text case on Mac.
           The change to this file is speculative, I don't have a Mac build.
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::LineBreaker::nextLineBreak): Tested by word-spacing-linebreak.html
        * rendering/RenderText.cpp:
        (WebCore::RenderText::widthFromCache): This code-path is not covered by any existing layout tests!
          I've tried to come up with a test to hit it but have failed.

2012-08-13  Anna Cavender  <annacc@chromium.org>

        Remove webkitMediaSourceURL from HTMLMediaElement.idl
        https://bugs.webkit.org/show_bug.cgi?id=93619

        Reviewed by Adam Barth.

        The webkitMediaSourceURL attribute is no longer needed now that we use
        createObjectURL() to generate a media source URL.

        Test: update http/test/media/media-source/media-source.js

        * html/HTMLMediaElement.h:
        * html/HTMLMediaElement.idl:

2012-08-13  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] Port meta method/signal/slot handling in run-time bridge to use JSC C API
        https://bugs.webkit.org/show_bug.cgi?id=93476

        Reviewed by Kenneth Rohde Christiansen.

        Based on patch by No'am Rosenthal and lots of good suggestions by Caio Marcelo.

        Ported the code that mapped invokable methods (and signals/slots) as
        well as the code that provides the connect() and disconnect() functions
        over to use the JSC C API. In the process one behavioural change was
        implemented: Previously meta methods were actually function objects
        that through Function.prototype allowed calling via
        object.method.call(object). Through the use of plain JS objects that is
        not possible anymore.

        If we tried to continue to use function objects (JSObjectMakeFunction)
        then we would loose the ability to store the private pointer. An
        alternative approach would be to use a regular object and install the
        Function prototype (Function.prototype), but unfortunately we cannot do
        that without loosing the common prototype for signals and slots.

        * bridge/qt/qt_class.cpp:
        (JSC::Bindings::QtClass::fallbackObject):
        * bridge/qt/qt_instance.cpp:
        (JSC::Bindings::QtInstance::~QtInstance):
        (JSC::Bindings::QtInstance::newRuntimeObject):
        * bridge/qt/qt_instance.h:
        (Bindings):
        (QtInstance):
        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::prototypeForSignalsAndSlots):
        (JSC::Bindings::QtRuntimeMethod::QtRuntimeMethod):
        (JSC::Bindings::QtRuntimeMethod::~QtRuntimeMethod):
        (JSC::Bindings::QtRuntimeMethod::call):
        (JSC::Bindings::QtRuntimeMethod::connect):
        (JSC::Bindings::QtRuntimeMethod::disconnect):
        (JSC::Bindings::QtRuntimeMethod::jsObjectRef):
        (JSC::Bindings::QtRuntimeMethod::connectOrDisconnect):
        (Bindings):
        (JSC::Bindings::QtConnectionObject::~QtConnectionObject):
        * bridge/qt/qt_runtime.h:
        (JSC::Bindings::QtRuntimeMethod::name):
        (QtRuntimeMethod):
        (QtConnectionObject):

2012-08-13  Leandro Gracia Gil  <leandrogracia@chromium.org>

        [Chromium] Fix nits in the find-in-page match rects API
        https://bugs.webkit.org/show_bug.cgi?id=93817

        Reviewed by Adam Barth.

        This patch fixes a few pending nits from 93111.

        Tests: existing WebKit unit test WebFrameTest.FindInPageMatchRects

        * dom/Range.cpp:
        (WebCore::Range::transformFriendlyBoundingBox): add call to updateLayoutIgnorePendingStylesheets.

2012-08-13  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: get rid of beforeTextChanged
        https://bugs.webkit.org/show_bug.cgi?id=93851

        Reviewed by Vsevolod Vlasov.

        Merged beforeTextChanged and afterTextChanged into a single
        onTextChanged event.

        * inspector/front-end/CodeMirrorTextEditor.js:
        (WebInspector.CodeMirrorTextEditor.prototype.editRange):
        (WebInspector.CodeMirrorTextEditor.prototype._onChange):
        * inspector/front-end/DefaultTextEditor.js:
        (WebInspector.DefaultTextEditor.prototype._enterInternalTextChangeMode):
        (WebInspector.DefaultTextEditor.prototype._exitInternalTextChangeMode):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.onTextChanged):
        (WebInspector.JavaScriptSourceFrame.prototype._removeBreakpointsBeforeEditing):
        (WebInspector.JavaScriptSourceFrame.prototype._addBreakpointDecoration):
        (WebInspector.JavaScriptSourceFrame.prototype._removeBreakpointDecoration):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame.prototype.onTextChanged):
        (WebInspector.TextEditorDelegateForSourceFrame.prototype.onTextChanged):
        * inspector/front-end/TextEditor.js:
        (WebInspector.TextEditorDelegate.prototype.onTextChanged):
        * inspector/front-end/UISourceCodeFrame.js:
        (WebInspector.UISourceCodeFrame.prototype.onTextChanged):

2012-08-13  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>

        [css] Remove "default" switch case from CSS primitive value mappings
        https://bugs.webkit.org/show_bug.cgi?id=93781

        Reviewed by Alexey Proskuryakov.

        Removing the "default" switch case allows compile-time early warning check,
        specially useful for newly added or removed enumeration values.

        * css/CSSPrimitiveValueMappings.h:

2012-08-13  Anna Cavender  <annacc@chromium.org>

        Cap the number of SourceBuffers that may be added to a MediaSource.
        https://bugs.webkit.org/show_bug.cgi?id=93406

        Reviewed by Eric Carlson.

        Make sure that no more SourceBuffer objects are added to a MediaSource
        than can fit into the sourceBuffers SourceBufferList (internally stored
        as a Vector). Also, make sure that new SourceBuffers are added with a
        unique id even if the variable we are using to generate id wraps around.

        No new tests.  It would not be realistic to add so many SourceBuffers to
        test the id variable wrapping.  Existing tests should not be affected.

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::MediaSource):
        (WebCore::MediaSource::addSourceBuffer): Obtain a unique id before creating
            a new SourceBuffer.
        * Modules/mediasource/MediaSource.h:
        * Modules/mediasource/SourceBufferList.cpp:
        (WebCore::SourceBufferList::SourceBufferList):
        (WebCore::SourceBufferList::generateUniqueId): Search for and generate a
            unique id.
        (WebCore):
        (WebCore::SourceBufferList::contains): Check if a SourceBuffer with a
            given id already exists in this SourceBufferList.
        * Modules/mediasource/SourceBufferList.h:
        (SourceBufferList):

2012-08-13  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: when status bar is too narrow, cut panel status bar, not main status bar items
        https://bugs.webkit.org/show_bug.cgi?id=93814

        Reviewed by Pavel Feldman.

        - set shrink factor of bottom-status-bar-container to 1;
        - set bottom-status-bar-container's width to 0 to workaround for flex-basis being ignored;

        * inspector/front-end/inspector.css:
        (#bottom-status-bar-container):

2012-08-13  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add memory instrumentation for Attribute
        https://bugs.webkit.org/show_bug.cgi?id=93827

        Reviewed by Pavel Feldman.

        Attribute's name and value footprint is counted as part of the DOM
        component.

        * dom/Attribute.h:
        (WebCore::Attribute::reportMemoryUsage):
        (Attribute):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::reportMemoryUsage):

2012-08-13  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Polish search/replace toolbar buttons style.
        https://bugs.webkit.org/show_bug.cgi?id=93826

        Reviewed by Pavel Feldman.

        * inspector/front-end/inspector.css:
        (.toolbar-search button):

2012-08-13  Kwang Yul Seo  <skyul@company100.net>

        [Qt] Add gprof.prf to build WebKit with gprof enabled
        https://bugs.webkit.org/show_bug.cgi?id=90283

        Reviewed by Eric Seidel.

        No behavior change, so no new tests.

        * WebCore.pri:
        -ffunction-sections conflicts with -pg option, so don't use
        -ffunction-sections option when gprof is enabled.

2012-08-13  Zan Dobersek  <zandobersek@gmail.com>

        Unreviewed build fix after r125408, removing another usage of SVG_FEATURES.

        * GNUmakefile.am:

2012-08-13  Zan Dobersek  <zandobersek@gmail.com>

        [Gtk] Remove SVG_FEATURES and HTML_FEATURES from Source/WebCore/GNUmakefile.am
        https://bugs.webkit.org/show_bug.cgi?id=90693

        Reviewed by Philippe Normand.

        Remove SVG_FEATURES and HTML_FEATURES variables. They can be replaced by the
        FEATURE_DEFINES variable wherever they are used.

        No new tests - no new functionality.

        * GNUmakefile.am:

2012-08-13  Mario Sanchez Prada  <msanchez@igalia.com>

        [GTK] Implementation of atk_editable_text_insert_text ignores 'length' parameter
        https://bugs.webkit.org/show_bug.cgi?id=93804

        Reviewed by Carlos Garcia Campos.

        Use the 'length' parameter to insert a substring of the full
        string passed to this method from AtkEditableText interface.

        * accessibility/gtk/WebKitAccessibleInterfaceEditableText.cpp:
        (webkitAccessibleEditableTextInsertText): Don't ignore 'length'.

2012-08-13  Sam D  <dsam2912@gmail.com>

        Web Inspector: Feature Request - Adding mouse gesture for editing attribute values in elements/css panel
        https://bugs.webkit.org/show_bug.cgi?id=93581

        Reviewed by Alexander Pavlov.

        Added functionality to modify valuesAdding support for updating number values in attributes in element
        panel/ css panel using mouse gestures as well.

        No new tests.

        * inspector/front-end/StylesSidebarPane.js:
        handling mousewheel event
        * inspector/front-end/TextPrompt.js:
        adding mouse event listener
        (WebInspector.TextPrompt.prototype._attachInternal):
        (WebInspector.TextPrompt.prototype.defaultKeyHandler):
        (WebInspector.TextPrompt.prototype.onMouseWheel):
        * inspector/front-end/UIUtils.js:
        handling mouse event gesture and updating number based on mouse wheel
        scroll direction as well.
        (WebInspector._valueModificationDirection):
        (WebInspector._modifiedHexValue):
        (WebInspector._modifiedFloatNumber):
        (WebInspector.handleElementValueModifications):

2012-08-13  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix make distcheck.

        * GNUmakefile.list.am: Add missing header file.

2012-08-10  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: [Protocol] Force elements pseudo state via a separate InspectorCSSAgent method
        https://bugs.webkit.org/show_bug.cgi?id=93721

        Reviewed by Pavel Feldman.

        Introduce InspectorCSSAgent::forcePseudoState() to modify the element's forced pseudo state.

        * inspector/Inspector.json:
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::getMatchedStylesForNode):
        (WebCore::InspectorCSSAgent::getComputedStyleForNode):
        (WebCore::InspectorCSSAgent::forcePseudoState):
        (WebCore):
        * inspector/InspectorCSSAgent.h:
        (InspectorCSSAgent):
        * inspector/InspectorDOMAgent.h:
        (InspectorDOMAgent):
        * inspector/front-end/AuditRules.js:
        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.getStyles):
        * inspector/front-end/CSSStyleModel.js:
        (WebInspector.CSSStyleModel.prototype.getMatchedStylesAsync):
        (WebInspector.CSSStyleModel.prototype.getComputedStyleAsync):
        (WebInspector.CSSStyleModel.prototype.forcePseudoState):
        * inspector/front-end/ElementsPanel.js:
        (WebInspector.ElementsPanel.prototype._setPseudoClassForNodeId):
        * inspector/front-end/MetricsSidebarPane.js:
        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylesSidebarPane.prototype._refreshUpdate):
        (WebInspector.StylesSidebarPane.prototype._rebuildUpdate):

2012-08-13  Shinya Kawanaka  <shinyak@chromium.org>

        Cannot select the AuthorShadowDOM inner element of an img element
        https://bugs.webkit.org/show_bug.cgi?id=91591

        Reviewed by Dimitri Glazkov.

        Since HTMLImageElement::canStartSelection always returns false, we cannot start selection
        from any children (including shadow dom) of an img element. When the img element has a shadow dom,
        we should be able to start selection.

        Test: fast/dom/shadow/select-image-with-shadow.html

        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::canStartSelection):
        (WebCore):
        * html/HTMLImageElement.h:
        (HTMLImageElement):
        * html/shadow/ImageInnerElement.h:
        (WebCore::ImageInnerElement::canStartSelection): Since ImageInnerElement is really an image,
        this should return always false to obey the exising behavior.
        (ImageInnerElement):

2012-08-13  Peter Wang  <peter.wang@torchmobile.com.cn>

        REGRESSION (r124723-r124741): 5 inspector/debugger tests failing on Apple Lion Debug WK1 (Tests)
        https://bugs.webkit.org/show_bug.cgi?id=93387

        Reviewed by Pavel Feldman.

        Now the front-end has problem when setting the positon of breakpoint, so remove the comparing
        of "column" to make the behavior back to the time as JSC cannot provide "column" info.
        Refer to https://bugs.webkit.org/show_bug.cgi?id=93473.  

        No new test case for this bug.

        * bindings/js/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::hasBreakpoint):

2012-08-10  Kinuko Yasuda  <kinuko@chromium.org>

        Support creating File object from FileSystem URL for files in FileSystem API
        https://bugs.webkit.org/show_bug.cgi?id=93706

        Reviewed by Darin Fisher.

        Current File code assumes the existence of local file (i.e. requires a platform local file path) but for FileSystem
        files it may not be always the case. For example some implementation may want to use in-memory filesystem to realize
        sandboxed filesystem, or others may have the filesystem in remote servers.

        This patch adds basic support for making File object constructible not only from a file path but from a FileSystem URL.
        Since File can be appended to FormData or included in another Blob this patch also extends BlobData and FormData to support URL.

        FileChooser and Drag-and-drop changes are not included in this patch.

        No new tests: will add tests when we implement the platform side changes to wire this change.

        * Modules/filesystem/DOMFileSystem.cpp:
        (WebCore::DOMFileSystem::createFile):
        * Modules/filesystem/DOMFileSystemSync.cpp:
        (WebCore::DOMFileSystemSync::createFile):
        * fileapi/Blob.cpp:
        (WebCore::Blob::sliceInternal):
        * fileapi/File.cpp:
        (WebCore::createBlobDataForFileSystemURL): Added.
        (WebCore::File::File):
        * fileapi/File.h:
        (WebCore::File::createForFileSystemFile):
        (WebCore::File::fileSystemURL): Added.
        * fileapi/WebKitBlobBuilder.cpp:
        (WebCore::WebKitBlobBuilder::append):
        * platform/chromium/support/WebHTTPBody.cpp:
        (WebKit::WebHTTPBody::elementAt):
        (WebKit::WebHTTPBody::appendURL): Added.
        (WebKit::WebHTTPBody::appendURLRange): Added.
        (WebKit::WebHTTPBody::appendBlob):
        * platform/network/BlobData.cpp:
        (WebCore::BlobData::appendURL):
        * platform/network/BlobData.h:
        (BlobDataItem):
        (WebCore::BlobDataItem::BlobDataItem):
        * platform/network/BlobRegistryImpl.cpp:
        (WebCore::BlobRegistryImpl::appendStorageItems):
        (WebCore::BlobRegistryImpl::registerBlobURL):
        * platform/network/FormData.cpp:
        (WebCore::FormData::deepCopy):
        (WebCore::FormData::appendURL): Added.
        (WebCore::FormData::appendURLRange): Added.
        (WebCore::FormData::appendKeyValuePairItems):
        * platform/network/FormData.h:
        (WebCore::FormDataElement::FormDataElement):
        (FormDataElement):
        (WebCore::operator==):

2012-08-12  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/11442485> off-screen or inactive pages can change the mouse pointer

        Reviewed by Adele Peterson.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::fakeMouseMoveEventTimerFired): Added a check that the page is
        on-screen and active before dispatching the fake mouse event.

2012-08-12  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>

        [BlackBerry] use MediaPlayer::userAgent() in MediaPlayerPrivateBlackBerry to avoid layering violation
        https://bugs.webkit.org/show_bug.cgi?id=93588

        Reviewed by Antonio Gomes.

        Removed helper function MediaPlayerPrivate::userAgent() which has
        introduced abstraction layering violation and replaced with
        MediaPlayer::userAgent().

        No new tests since there's no functional change.

        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
        (WebCore::MediaPlayerPrivate::load):

2012-07-04  Kinuko Yasuda  <kinuko@chromium.org>

        Record metrics to measure the usage of WebKitBlobBuilder to eventually deprecate it
        https://bugs.webkit.org/show_bug.cgi?id=90535

        Reviewed by Eric Seidel.

        No new tests as this has no functional changes.

        * bindings/js/JSBlobCustom.cpp:
        (WebCore::JSBlobConstructor::constructJSBlob):
        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::V8Blob::constructorCallback):
        * fileapi/WebKitBlobBuilder.cpp:
        (WebCore::WebKitBlobBuilder::getBlob):
        * fileapi/WebKitBlobBuilder.h:
        (WebKitBlobBuilder):

2012-08-12  Ojan Vafai  <ojan@chromium.org>

        Remove unnecessary null checks from pseudoStyleForElement and adjustRenderStyle
        https://bugs.webkit.org/show_bug.cgi?id=93730

        Reviewed by Tony Chang.

        All the callers of both methods make sure to pass in a non-null parentStyle.

        No change in behavior.

        * css/StyleResolver.cpp:
        * css/StyleResolver.h:

2012-08-12  Pravin D  <pravind.2k4@gmail.com>

        table cell.cellIndex should return -1 if there is no parent table
        https://bugs.webkit.org/show_bug.cgi?id=93738

        Reviewed by Eric Seidel.

        According to the HTML5 spec the cellIndex of a table cell(td/th) whose parent is not a table row
        must be -1. Currently we are returning zero. This patch fixes this behavior. 

        Test: fast/table/cellIndex-of-cell-with-different-parents.html

        * html/HTMLTableCellElement.cpp:
        (WebCore::HTMLTableCellElement::cellIndex):
          If the parent of the cell is not a table row, -1 is returned. Otherwise a value greater
          than or equal to zero is return.

        * rendering/RenderTableCell.h:
        (RenderTableCell):
         Removed dead code and made minor webkit style related fix.

2012-08-12  Leandro Gracia Gil  <leandrogracia@chromium.org>

        [Chromium] Implement the find-in-page match rects API
        https://bugs.webkit.org/show_bug.cgi?id=93111

        Reviewed by Adam Barth.

        Introduce the find-in-page coordinate system. This system tries to solve
        the unintuitive tickmark results presented in pages with multiple frames
        and scrolled contents where the find results might not be in the visible
        area of a frame, which might lead to tickmarks below the container frame.

        To achieve this, this coordinate system goes up the render tree
        normalizing the coordinates by the actual contents size of its container.
        This leads to tickmarks scaled to the visible size of their frame
        independently of its scroll. This coordinate system supports also CSS
        scroll:overflow, transforms and the different positions.

        Also add an auxiliary method to Range in order to provide a transform
        friendly way to retrieve the absolute coordinates of the enclosing
        bounding box without the adjustment operations that the existing
        enclosingRect method does.

        Tested by WebFrameTest WebKit unit test.

        * dom/Range.cpp:
        (WebCore::Range::transformFriendlyBoundingBox): add a transform-friendly equivalent of boundingBox.
        (WebCore):
        * dom/Range.h: move boundingBox to the group of non-transform-friendly methods.
        (Range):

2012-08-12  Ami Fischman  <fischman@chromium.org>

        Stop Y-flipping CROS/ARM video textures
        https://bugs.webkit.org/show_bug.cgi?id=93769

        Reviewed by Eric Seidel.

        No new tests; there's no cros/arm bot yet, sadly.

        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::appendQuads): drop the single-platform Y-flipping in prep for the platform doing the flip natively.

2012-08-12  Mihnea Ovidenie  <mihnea@adobe.com>

        CSSRegions: Crash when using style in region for removed element.
        https://bugs.webkit.org/show_bug.cgi?id=93276

        Reviewed by Abhishek Arya.

        When a RenderInline object from within a render flow thread is split, the cloned
        hierarchy built during the split process does not have the inRenderFlowThread bit
        set properly. If the cloned hierarchy is flowed into a region with region style rules,
        we compute the style in region also for objects that do not have inRenderFlowThread bit
        set and we store the computed style in region for caching purposes. But we only remove
        an object style in region information if that object has the inRenderFlowThread bit set.
        Under these circumstances, it is possible to remove a object with cached style in region
        and without inRenderFlowThread bit set from the render tree and leave the associated cached
        information un-removed. Such information will be accesses during the next paint phase of
        the region, thus resulting a crash.

        The fix is to modify RenderBlock::clone() and RenderInline::clone() functions to also copy the inRenderFlowThread bit
        from the source into the clone, therefore the cloned hierarchies will have the inRenderFlowThread
        bit set properly.

        Test: fast/regions/removed-element-style-in-region-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::clone):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::clone): Replace former static RenderInline::cloneInline with member RenderInline::clone.
        (WebCore::RenderInline::splitInlines):
        * rendering/RenderInline.h:
        (RenderInline):
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::setObjectStyleInRegion):
        Added an assert to make sure that when we are computing style in region, we are doing for objects
        with inRenderFlowThread set. Also, bail out early in this case to prevent further crashes.

2012-08-12  Huang Dongsung  <luxtella@company100.net>

        Set the access qualifier of two methods to query frame specific info of BitmapImage to protected.
        https://bugs.webkit.org/show_bug.cgi?id=90505

        Reviewed by Eric Seidel.

        Following 4 methods are protected.
          size_t frameCount();
          NativeImagePtr frameAtIndex(size_t);
          bool frameIsCompleteAtIndex(size_t);
          float frameDurationAtIndex(size_t);

        So, 2 methds also should be protected because the frame info is only specific of
        BitmapImage.
          bool frameHasAlphaAtIndex(size_t);
          ImageOrientation frameOrientationAtIndex(size_t);

        On the other hand, this patch amended GraphicsContext3DCG.
        - static_cast<BitmapImage*>(image)->frameHasAlphaAtIndex(0)
        + image->currentFrameHasAlpha()

        This patch does not affect PNG, JPEG, BMP, and WEBP because those images
        have only 0 indexed frame.
        Thus, GIF, and ICO are affected. However, an above query to get Alpha
        is for the image that is created by image->nativeImageForCurrentFrame(), so it
        is proper to use image->currentFrameHasAlpha() instead of
        image->frameHasAlphaAtIndex(0).

        No new tests, because it is hard to test. We need an animated GIF that
        one frame has alpha and another frame does not have alpha. However, I
        cannot find the animated GIF file that suffices the requirement.

        * platform/graphics/BitmapImage.h:
        (BitmapImage):
        * platform/graphics/cg/GraphicsContext3DCG.cpp:
        (WebCore::GraphicsContext3D::getImageData):

2012-08-12  Takashi Sakamoto  <tasak@google.com>

        webkit fails IETC namespaces/prefix-007.xml
        https://bugs.webkit.org/show_bug.cgi?id=86137

        Reviewed by Eric Seidel.

        If a namespace prefix or default namespace is declared more than once
        only the last declaration shall be used.

        parseAddNamespace doesn't check return value of WTF::HashMap<>::add.
        If the return value's isNewEntry is true, the new entry is added with
        the specified value. However, if isNewEntry is false, it is required
        to update the store value.

        No new tests. ietestcenter/css3/namespaces/prefix-007.xml and
        ietestcenter/css3/namespaces/prefix-010.xml covers this change.

        * css/StyleSheetContents.cpp:
        (WebCore::StyleSheetContents::parserAddNamespace):
        Modified to check m_namespaces.add's return value.
        If the result says not a new entry, updated the value stored in
        m_namespaces by using iterator in the result.

2012-08-12  Benjamin Poulain  <benjamin@webkit.org>

        Move CSS's propertyNameStrings[] to from the header to the cpp file
        https://bugs.webkit.org/show_bug.cgi?id=93771

        Reviewed by Eric Seidel.

        The names of propertyNameStrings[] should never be accessed directly. The function getPropertyName()
        return the correct string of propertyNameStrings.

        To ensure the values are not accessed by mistake, move them from the header to the implementation.

        * css/makeprop.pl:

2012-08-12  Benjamin Poulain  <benjamin@webkit.org>

        CSSComputedStyleDeclaration::cssText() should use StringBuilder
        https://bugs.webkit.org/show_bug.cgi?id=93776

        Reviewed by Eric Seidel.

        String::append() is fairly inefficient when used to create a long string by appending a lot of small
        pieces. StringBuilder is more approriate for the kind of operations done by CSSComputedStyleDeclaration::cssText().

        This changes makes CSSComputedStyleDeclaration::cssText() about 6 times faster.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::cssText):

2012-08-11  Benjamin Poulain  <bpoulain@apple.com>

        Do the DecimalNumber to String conversion on 8 bits
        https://bugs.webkit.org/show_bug.cgi?id=93683

        Reviewed by Andreas Kling.

        Numbers converted to string for CSS are unlikely to ever be concatenated with a 16bits string.
        This patch change the conversion to be done to 8bits string in order to reduce memory allocations.

        * css/CSSPrimitiveValue.cpp:
        (WebCore::formatNumber):
        * inspector/InspectorValues.cpp:
        (WebCore::InspectorBasicValue::writeJSON):
        * platform/graphics/Color.cpp:
        (WebCore::Color::serialized): Instead of allocating a static WTF::String, we can simply append the
        string literal to the output vector.

2012-08-11  Benjamin Poulain  <benjamin@webkit.org>

        WebCore::findAtomicString(PropertyName) always convert the name to 16bits
        https://bugs.webkit.org/show_bug.cgi?id=93685

        Reviewed by Geoffrey Garen.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::findAtomicString):
        Use the new AtomicString::find() to avoid calling StringImpl::characters().

2012-08-11  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>

        [Qt] Remove QtSenderStack now we do not support __qt_sender__ anymore in Qt bridge
        https://bugs.webkit.org/show_bug.cgi?id=93767

        Reviewed by Kenneth Rohde Christiansen.

        Dead code after patch of bug 93649.

        * bridge/qt/qt_instance.h:
        (QtInstance):

2012-08-11  Abhishek Arya  <inferno@chromium.org>

        Unreviewed. 

        Removing newly added assert in r125351 since it is exposing
        legitimate layout bugs in few tests. We will re-add the assert
        after fixing those bugs. Failures are tracked in webkit bug 93766. 

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removeFromTrackedRendererMaps):

2012-08-11  Levi Weintraub  <leviw@chromium.org>

        Track block's positioned objects like percent-height descendants
        https://bugs.webkit.org/show_bug.cgi?id=89848

        Reviewed by Abhishek Arya.

        The previous method for tracking a RenderBlock's out-of-flow positioned descendants was error prone,
        subject to becoming inconsistent, and in the case of removePositionedObjects, inefficient. This patch 
        extracts the algorithm used for percent height descendants and re-uses it for positioned objects. This same
        method could further be re-used for floats.

        This change removes the m_positionedObjects pointer, which brings RenderBlock's size down (yay!).

        Test: fast/block/positioning/relayout-nested-positioned-elements-crash-2.html

        * rendering/RenderBlock.cpp:
        (SameSizeAsRenderBlock):
        (WebCore):
        (WebCore::removeBlockFromDescendantAndContainerMaps):
        (WebCore::RenderBlock::~RenderBlock):
        (WebCore::RenderBlock::addOverflowFromPositionedObjects):
        (WebCore::RenderBlock::layoutBlockChildren):
        (WebCore::RenderBlock::layoutPositionedObjects):
        (WebCore::RenderBlock::markPositionedObjectsForLayout):
        (WebCore::clipOutPositionedObjects):
        (WebCore::RenderBlock::selectionGaps):
        (WebCore::RenderBlock::insertIntoTrackedRendererMaps):
        (WebCore::RenderBlock::removeFromTrackedRendererMaps):
        (WebCore::RenderBlock::positionedObjects):
        (WebCore::RenderBlock::insertPositionedObject):
        (WebCore::RenderBlock::removePositionedObject):
        (WebCore::RenderBlock::removePositionedObjects):
        (WebCore::RenderBlock::addPercentHeightDescendant):
        (WebCore::RenderBlock::removePercentHeightDescendant):
        (WebCore::RenderBlock::percentHeightDescendants):
        (WebCore::RenderBlock::checkPositionedObjectsNeedLayout):
        * rendering/RenderBlock.h:
        (WebCore):
        (RenderBlock):
        (WebCore::RenderBlock::hasPositionedObjects):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::moveChildTo): Changing the fixme to reflect the assumption that the caller
        has taken care of updating the positioned renderer maps is a decision not a bug. The ASSERT should help
        assure this.
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::layoutRows):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::setFixedPositionedObjectsNeedLayout):

2012-08-10  Joshua Netterfield  <jnetterfield@rim.com>

        [WebGL] Add support for EXT_robustness
        https://bugs.webkit.org/show_bug.cgi?id=93379

        Reviewed by George Staikos.

        Take advantage of EXT robustness in WebKit.

        This commit makes WebKit use readnPixelsEXT, getnUniformfvEXT and
        getnUniformivEXT instead of readPixels, getUniformfv and getUniformiv
        when possible, and sets up the reset notification behaviour for
        GLES platforms.

        The reset behaviour has not yet been implemented in the BlackBerry
        compositing thread, so for now on BlackBerry we just abort when
        the context has been reset. This prevents undefined behaviour, but
        can be improved in the future.

        No new tests are needed because no new functionality is introduced.
        Support for ARB robustness reset notification behaviour is already
        in WebKit, and EXT robustness' reset notifcation behaviour is the
        same. readnPixelsEXT replaces WebKit's existing mechanisms of
        preventing buffer overflows.

        RIM PR# 147510
        Internally reviewed by Arvid Nilsson.

        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore):
        (WebCore::WebGLRenderingContext::setupFlags):
        (WebCore::WebGLRenderingContext::getUniform):
        (WebCore::WebGLRenderingContext::readPixels):
        * html/canvas/WebGLRenderingContext.h:
        (WebGLRenderingContext):
        * platform/chromium/support/Extensions3DChromium.cpp:
        (WebCore::Extensions3DChromium::readnPixelsEXT):
        (WebCore):
        (WebCore::Extensions3DChromium::getnUniformfvEXT):
        (WebCore::Extensions3DChromium::getnUniformivEXT):
        * platform/graphics/Extensions3D.h:
        * platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp:
        (WebCore::GraphicsContext3D::setContextLostCallback):
        * platform/graphics/blackberry/LayerRenderer.cpp:
        (WebCore::LayerRenderer::LayerRenderer):
        (WebCore::LayerRenderer::makeContextCurrent):
        * platform/graphics/blackberry/LayerRenderer.h:
        (LayerRenderer):
        * platform/graphics/chromium/Extensions3DChromium.h:
        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:
        (WebCore::Extensions3DOpenGLCommon::readnPixelsEXT):
        (WebCore):
        (WebCore::Extensions3DOpenGLCommon::getnUniformfvEXT):
        (WebCore::Extensions3DOpenGLCommon::getnUniformivEXT):
        * platform/graphics/opengl/Extensions3DOpenGLCommon.h:
        (Extensions3DOpenGLCommon):
        * platform/graphics/opengl/Extensions3DOpenGLES.cpp:
        (WebCore::Extensions3DOpenGLES::Extensions3DOpenGLES):
        (WebCore::Extensions3DOpenGLES::getGraphicsResetStatusARB):
        (WebCore):
        (WebCore::Extensions3DOpenGLES::setEXTContextLostCallback):
        (WebCore::Extensions3DOpenGLES::readnPixelsEXT):
        (WebCore::Extensions3DOpenGLES::getnUniformfvEXT):
        (WebCore::Extensions3DOpenGLES::getnUniformivEXT):
        (WebCore::Extensions3DOpenGLES::supportsExtension):
        * platform/graphics/opengl/Extensions3DOpenGLES.h:
        (Extensions3DOpenGLES):

2012-08-10  Arko Saha  <arko@motorola.com>

        Microdata: item with itemprop attribute should not include the item itself in the HTMLPropertiesCollection.
        https://bugs.webkit.org/show_bug.cgi?id=93717

        Reviewed by Ryosuke Niwa.

        Tests: fast/dom/MicroData/item-with-itemprop-attr.html
               fast/dom/MicroData/item-with-itemref-pointing-to-itself.html

        * dom/PropertyNodeList.cpp:
        (WebCore::PropertyNodeList::nodeMatches): Do not process the testElement if it is the owner node.
        * html/HTMLPropertiesCollection.cpp:
        (WebCore::nextNodeWithProperty): Traverse the next node only if previous node is microdata item
        i.e, ownerNode or previous element does not have itemscope attribute specified.
        (WebCore::HTMLPropertiesCollection::virtualItemAfter): Try to find the next property if current
        is ownerNode.

2012-08-10  Ryuan Choi  <ryuan.choi@samsung.com>

        [BlackBerry][EFL][GTK][WIN][WX] Remove ScriptControllerXXX.cpp to reduce duplication
        https://bugs.webkit.org/show_bug.cgi?id=61424

        Reviewed by Rob Buis.

        ScriptControllerBlackBerry, ScriptControllerEfl, ScriptControllerGtk,
        ScriptControllerWin and ScriptControllerWx are almost same.
        In order to reduce duplication, this patch moves codes to ScriptController
        and removes them.

        No behavior change. Just a refactoring.

        * GNUmakefile.list.am:
        * PlatformBlackBerry.cmake:
        * PlatformEfl.cmake:
        * PlatformWinCE.cmake:
        * WebCore.gypi:
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/ScriptController.cpp:
        (WebCore):
        (WebCore::ScriptController::createScriptInstanceForWidget):
        Moved from ScriptControllerXXX.cpp
        * bindings/js/ScriptControllerBlackBerry.cpp: Removed.
        * bindings/js/ScriptControllerEfl.cpp: Removed.
        * bindings/js/ScriptControllerGtk.cpp: Removed.
        * bindings/js/ScriptControllerWin.cpp: Removed.
        * bindings/js/ScriptControllerWx.cpp: Removed.

2012-08-10  Elliott Sprehn  <esprehn@gmail.com>

        RenderQuote corrupts doubly linked list on insertion before head of list
        https://bugs.webkit.org/show_bug.cgi?id=93750

        Reviewed by Abhishek Arya.

        Fix bug where moving a RenderQuote instance before the first one in
        the document would not update the m_previous pointer of the original
        first RenderQuote to point back at the new one.

        Test: fast/css-generated-content/quote-crash-93750.html

        * rendering/RenderQuote.cpp:
        (WebCore::RenderQuote::attachQuote):

2012-08-09  James Robinson  <jamesr@chromium.org>

        [chromium] Remove forwarding headers for compositor-related WebKit API and update includes
        https://bugs.webkit.org/show_bug.cgi?id=93669

        Reviewed by Adam Barth.

        Updates all includes for compositor-related headers to refer consistently to the Platform API location.

        * platform/chromium/support/WebCompositorImpl.h:

2012-08-10  James Robinson  <jamesr@chromium.org>

        Unreviewed build fix.

        r125337 added a call to WTF::currentTime() in MediaController.cpp, but that file didn't #include
        <wtf/CurrentTime.h>. This file is indirectly picked up on the include paths for some ports, but not all.

        * html/MediaController.cpp:

2012-08-10  Jer Noble  <jer.noble@apple.com>

        no timeupdate events emitted for media controller
        https://bugs.webkit.org/show_bug.cgi?id=93745

        Reviewed by Eric Carlson.

        Generate timeupdate events while the current position is changing.

        Test: media/media-controller-timeupdate.html

        Enforce the spec requirement that the timeupdate event is fired no more often
        than every 250ms.
        * html/MediaController.cpp:
        (MediaController::scheduleTimeupdateEvent):

        Add a periodic firing timer to generate timeupdate events during playback.
        * html/MediaController.cpp:
        (MediaController::startTimeupdateTimer):
        (MediaController::timeupdateTimerFired):

        * html/MediaController.cpp:
        (MediaController::MediaController): Initialize m_previousTimeupdateTime.
        (MediaController::setCurrentTime): Call scheduleTimeUpdateEvent.
        (MediaController::updatePlaybackState): Start and stop the timeupdate timer.
        * html/MediaController.h:
        
2012-08-09  Jeffrey Pfau  <jpfau@apple.com>

        Allow blocking of third-party localStorage and sessionStorage
        https://bugs.webkit.org/show_bug.cgi?id=93390

        Reviewed by Adam Barth.

        Add checks for if a page is third-party and third-party storage blocking is enabled while accessing storage.

        Tests: http/tests/security/cross-origin-local-storage-allowed.html
               http/tests/security/cross-origin-local-storage.html
               http/tests/security/cross-origin-session-storage-allowed.html
               http/tests/security/cross-origin-session-storage.html
               http/tests/security/same-origin-document-domain-storage-allowed.html

        * dom/Document.cpp:
        (WebCore::Document::initSecurityContext): Initialize securityOrigin with knowledge of if we should block third-party storage.
        * page/DOMWindow.cpp: Check if the origin trying to access storage is third-party relative to the top document.
        (WebCore::DOMWindow::sessionStorage):
        (WebCore::DOMWindow::localStorage):
        * page/SecurityOrigin.cpp: Add a call in Security origin to see if another origin counts as a third-party.
        (WebCore::SecurityOrigin::SecurityOrigin):
        (WebCore::SecurityOrigin::canAccessLocalStorage):
        (WebCore):
        (WebCore::SecurityOrigin::isThirdParty):
        * page/SecurityOrigin.h:
        (WebCore::SecurityOrigin::blockThirdPartyStorage):
        (SecurityOrigin):
        * testing/InternalSettings.cpp: Add an internals.settings hook for setting third-party storage blocking enabled.
        (WebCore::InternalSettings::setThirdPartyStorageBlockingEnabled):
        (WebCore):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-08-10  Arko Saha  <arko@motorola.com>

        REGRESSION(r125159): ASSERTION FAILED: m_listsInvalidatedAtDocument.contains(list) in Document::unregisterNodeListCache.
        https://bugs.webkit.org/show_bug.cgi?id=93729

        Reviewed by Ryosuke Niwa.

        In Document::registerNodeListCache() it was not adding PropertyNodeList
        cache to m_listsInvalidatedAtDocument the as node list currently not rooted
        at the document. Where in Document::unregisterNodeListCache() it was trying
        to remove PropertyNodeList cache from m_listsInvalidatedAtDocument. Hence it
        caused the assertion failure.

        We need to check if m_rootType is NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr,
        not that it's currently rooted at the document.

        Test: fast/dom/MicroData/propertynodelist-crash.html

        * dom/DynamicNodeList.h:
        (WebCore::DynamicNodeListCacheBase::isRootedAtDocument):

2012-08-10  Florin Malita  <fmalita@chromium.org>

        Improved RuleData packing on some 32-bit platforms
        https://bugs.webkit.org/show_bug.cgi?id=93737

        Reviewed by Andreas Kling.

        Certain 32-bit plarforms use an 8-byte alignment for uint64_t. We can save 4 bytes per
        object on these platforms by using two naturally-aligning unsigned ints instead.

        * css/StyleResolver.cpp:
        (RuleData):
        (SameSizeAsRuleData):

2012-08-10  Max Vujovic  <mvujovic@adobe.com>

        [CSS Shaders] Add blend mode and composite op to compiled program cache key
        https://bugs.webkit.org/show_bug.cgi?id=93623

        Reviewed by Dirk Schulze.

        Right now, only the vertex shader string and the fragment shader string are hashed
        to create a key for the compiled program. However, in a future patch, WebKit will
        rewrite the fragment shader based on the blend mode and composite op specified by
        the author. This means that the unique key for a compiled program is (original
        vertex shader string, original fragment shader string, blend mode, composite
        operator). This patch adds blend mode and composite operator in the hash for the
        key.

        No new tests. The state of the compiled program cache is not exposed to a web
        page. Existing tests should ensure this change doesn't break current
        functionality. Additional tests will be added in a future patch that implements
        shader rewriting based on blend mode and composite op.

        * platform/graphics/filters/CustomFilterProgram.cpp:
        (WebCore::CustomFilterProgram::programInfo):
        * platform/graphics/filters/CustomFilterProgram.h:
        (WebCore):
        * platform/graphics/filters/CustomFilterProgramInfo.cpp:
        (WebCore::CustomFilterProgramInfo::CustomFilterProgramInfo):
        (WebCore::CustomFilterProgramInfo::hash):
        (WebCore::CustomFilterProgramInfo::operator==):
        * platform/graphics/filters/CustomFilterProgramInfo.h:
        (WebCore::CustomFilterProgramMixSettings::CustomFilterProgramMixSettings):
        (CustomFilterProgramMixSettings):
        (WebCore::CustomFilterProgramMixSettings::operator==):
        (WebCore):
        (CustomFilterProgramInfo):

2012-08-10  Alice Cheng  <alice_cheng@apple.com>

        Part 1 of: Extend -webkit-user-select with a new value "all"
        <rdar://problem/10161404>
        https://bugs.webkit.org/show_bug.cgi?id=93562

        Reviewed by Dan Bernstein.

        Parse the new "all" value for -webkit-user-select

        Test: editing/selection/user-select-all-parsing.html

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue): Add new value all
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Add new value all
        (WebCore::CSSPrimitiveValue::operator EUserSelect): Add one more bit to store the new property value
        * rendering/style/RenderStyleConstants.h: Add new value all
        * rendering/style/StyleRareInheritedData.h: Add new value all
        (StyleRareInheritedData):

2012-08-10  Iain Merrick  <husky@google.com>

        [chromium] Upstream Android changes to WebFrameImpl::selectRange
        https://bugs.webkit.org/show_bug.cgi?id=92513

        Reviewed by Ryosuke Niwa.

        Make this function public we so can call it from the WebKit layer.

        * page/EventHandler.h:
        (EventHandler):

2012-08-10  Mario Sanchez Prada  <msanchez@igalia.com>

        [GTK] Broken implementation of AtkText and AtkEditableText for password fields
        https://bugs.webkit.org/show_bug.cgi?id=93621

        Rubber-stamped by Ryosuke Niwa.

        Fix Apple Win build, by avoiding to generate unreachable sections
        of code in AccessibilityRenderObject::passwordFieldValue().

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::passwordFieldValue):

2012-08-10  Dana Jansens  <danakj@chromium.org>

        [chromium] Remove targetSurface pointer from CCRenderPass
        https://bugs.webkit.org/show_bug.cgi?id=93734

        Reviewed by Adrienne Walker.

        This removes the CCRenderSurface pointer from the CCRenderPass
        structure, allowing it to be serialized and used across processes
        freely.

        No new tests; no intended change in behaviour.

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::drawLayers):
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::CCRenderPass):
        * platform/graphics/chromium/cc/CCRenderPass.h:
        (CCRenderPass):

2012-08-10  Mario Sanchez Prada  <msanchez@igalia.com>

        [GTK] Broken implementation of AtkText and AtkEditableText for password fields
        https://bugs.webkit.org/show_bug.cgi?id=93621

        Reviewed by Chris Fleizach.

        Fix broken implementation of AtkText and AtkEditableText
        interfaces in the GTK port for password input fields.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::stringValue): Call the new
        function passwordFieldValue() for password input fields.
        (WebCore::AccessibilityRenderObject::text): Ditto.
        (WebCore::AccessibilityRenderObject::textLength): Return the
        actual length of the password in the field for GTK, return -1
        otherwise (not to break current behavior in other platforms).
        (WebCore::AccessibilityRenderObject::doAXStringForRange): Don't
        early return for password fields in GTK (will rely on text()).
        (WebCore::AccessibilityRenderObject::passwordFieldValue): New, it
        returns the text being actually rendered for a password input
        field (normally a masked string) in GTK. It returns String() in
        the rest of platforms, to ensure we don't break anything there.
        (WebCore):
        * accessibility/AccessibilityRenderObject.h:
        (AccessibilityRenderObject):
        * accessibility/AccessibilityObject.h:
        (WebCore::AccessibilityObject::passwordFieldValue): Default
        implementation of this new method, returning an empty string.
        (AccessibilityObject):

        Ensure the 'text-insert' and 'text-remove' signals for the AtkText
        interface are properly emitted for password input fields.

        * accessibility/gtk/AXObjectCacheAtk.cpp:
        (WebCore::AXObjectCache::nodeTextChangePlatformNotification): Make
        sure we never emit the password value for an input field in plain
        text when inserting or removing text. Emit the masked text instead.

2012-08-09  Jer Noble  <jer.noble@apple.com>

        Use the new AVPlayerItemVideoOutput API in MediaPlayerPrivateAVFoundation.
        https://bugs.webkit.org/show_bug.cgi?id=93591

        Reviewed by Eric Carlson.

        Support the new AVPlayerItemVideoOutput API from Mountain Lion, which has much increased performance over
        AVAssetImageGenerator.

        No new tests; Performance change only, no net change in functionality.

        AVPlayerItemVideoOutput requires an attached CALayer for rendering to occur.  Make the rendering modes non-exclusive, 
        so layer-rendering and context-rendering can exist simultaneously:
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h: Make the MediaRenderingMode enum
            a bitfield.
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::currentRenderingModes): Renamed from currentRenderingMode().
        (WebCore::MediaPlayerPrivateAVFoundation::setUpVideoRendering): Check for the presence of the MediaRenderingToLayer bit.
        (WebCore::MediaPlayerPrivateAVFoundation::prepareForRendering): Ditto.
        (WebCore::MediaPlayerPrivateAVFoundation::updateStates): Ditto.

        Pull out existing the AVAssetImageGenerator into its own functions:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createImageGenerator):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyImageGenerator):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::paintWithImageGenerator):

        Add new AVPlayerItemVideoOutput equivalent functions:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoOutput):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoOutput):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createPixelBuffer):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::paintWithVideoOutput):

        Switch between the AVAssetImageGenerator and AVPlayerItemVideoOutput functions from
        within the original functions:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createContextVideoRenderer):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyContextVideoRenderer):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::hasContextRenderer):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::paint):

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createImageForTimeInRect): Call the 
            AVAssetImageGenerator creation function directly.

2012-08-10  Abhishek Arya  <inferno@chromium.org>

        Crash on accessing a removed layout root in FrameView::scheduleRelayout.
        https://bugs.webkit.org/show_bug.cgi?id=91368

        Reviewed by Levi Weintraub.

        We were calling setNeedsLayoutAndPrefWidthsRecalc() in RenderBlock::collapseAnonymousBoxChild
        even when documentBeingDestroyed() was true. This ends up accessing stale layout root and bypasses
        mitigation added in r109406. There is no need to waste time merging up anonymous blocks in
        RenderBlock::removeChild when documentBeingDestroyed() is true.

        No new tests. The test is time sensitive, requires a bunch of reloads, and only reproduces on chromium linux.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::collapseAnonymousBoxChild):
        (WebCore::RenderBlock::removeChild):

2012-08-10  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/11855229> When in paginated mode, the layout timer fires continually
        https://bugs.webkit.org/show_bug.cgi?id=91038

        Reviewed by Simon Fraser.

        * page/Page.cpp:
        (WebCore::Page::pageCount): Changed to only trigger layout if needed.

2012-08-10  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        [CMAKE] Fix wrong idl include path in CMakeList.txt
        https://bugs.webkit.org/show_bug.cgi?id=93715

        Reviewed by Rob Buis.

        No new tests. No change in behavior.

        * CMakeLists.txt: Fix notifications path.

2012-08-10  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        [Transforms] Hit test issue with large scale() transform
        https://bugs.webkit.org/show_bug.cgi?id=23170

        Reviewed by Simon Fraser.

        By using normal rounding to determine the top-left corner of the
        hit-tested rectangle, we end up offsetting the hit test by up to
        half a pixel, once scaled to x60, this creates a 30px error.

        Normal rounding is replaced with floored rounding which means the
        hit-tested pixel will now always be the pixel containing the
        point.

        Test: fast/transforms/hit-test-large-scale.html

        * rendering/HitTestResult.cpp:
        (WebCore::HitTestPoint::HitTestPoint):
        (WebCore::HitTestPoint::intersectsRect):
        (WebCore::HitTestPoint::rectForPoint):

2012-08-10  Florin Malita  <fmalita@chromium.org>

        Unreviewed gardening: build fix for 32bit platforms after 125294.

        * css/StyleResolver.cpp:
        (RuleData):

2012-08-10  Takashi Sakamoto  <tasak@google.com>

        box-shadow creates incorrect shadow when border-radius is too large
        https://bugs.webkit.org/show_bug.cgi?id=72103

        Reviewed by Simon Fraser.

        Added a code for adjusting a rounded rect before paintBoxShadow in
        a similar way to getRoundedRectFor.

        Test: fast/borders/border-shadow-large-radius.html

        * platform/graphics/RoundedRect.cpp:
        (WebCore::RoundedRect::adjustRadii):
        Added a new method to set radii's scale to fit into rect.
        * platform/graphics/RoundedRect.h:
        (RoundedRect):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintBoxShadow):
        A rounded rect for box-shadow is not checked whether the raii matches
        the rect or not. Added the code to adjust radii's scale if the rounded
        rect is not renderable, the case: RoundedRect::isRenderable is false.

2012-08-10  Ojan Vafai  <ojan@chromium.org>

        Wrap INLINE_FLEX in a #if ENABLE(CSS3_FLEXBOX).
        Unreviewed build fix.

        * rendering/style/RenderStyle.h:

2012-08-10  Dan Bernstein  <mitz@apple.com>

        Renamed the “Modules/webaudio” group in the Xcode project to “webaudio” and moved it into
        the Modules group.

        Rubber-stamped by Simon Fraser.

        * WebCore.xcodeproj/project.pbxproj:

2012-08-10  Erik Arvidsson  <arv@chromium.org>

        [V8] Enable es5_readonly
        https://bugs.webkit.org/show_bug.cgi?id=91031

        Reviewed by Adam Barth.

        This turns on the es5_readonly flag for V8. This makes V8 match the ES5 spec regarding
        non writable properties on the prototype chain. JSC already behaves the right so this
        just makes V8 behave the same.

        Updated test expectations.

        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::V8DOMWindowShell::initContextIfNeeded):
        * bindings/v8/WorkerContextExecutionProxy.cpp:
        (WebCore::WorkerContextExecutionProxy::initIsolate):

2012-08-10  Kentaro Hara  <haraken@chromium.org>

        [V8] Introduce V8DOMConfiguration class and make batchConfigureXXX() methods static
        https://bugs.webkit.org/show_bug.cgi?id=93615

        Reviewed by Adam Barth.

        Per the discussion in bug 93239,

        (1) Rename V8ConfigureDOMAttributesAndMethods to V8DOMConfiguration.
        (2) Introduce V8DOMConfiguration class and make batchConfigureXXX() methods static.

        No tests. No change in behavior.

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateImplementation):
        * bindings/scripts/test/V8/V8Float64Array.cpp:
        (WebCore):
        (WebCore::ConfigureV8Float64ArrayTemplate):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        (WebCore):
        (WebCore::ConfigureV8TestActiveDOMObjectTemplate):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
        (WebCore):
        (WebCore::ConfigureV8TestCustomNamedGetterTemplate):
        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
        (WebCore):
        (WebCore::ConfigureV8TestEventConstructorTemplate):
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        (WebCore):
        (WebCore::ConfigureV8TestEventTargetTemplate):
        * bindings/scripts/test/V8/V8TestException.cpp:
        (WebCore):
        (WebCore::ConfigureV8TestExceptionTemplate):
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore):
        (WebCore::ConfigureV8TestInterfaceTemplate):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
        (WebCore):
        (WebCore::ConfigureV8TestMediaQueryListListenerTemplate):
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        (WebCore::ConfigureV8TestNamedConstructorTemplate):
        * bindings/scripts/test/V8/V8TestNode.cpp:
        (WebCore::ConfigureV8TestNodeTemplate):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore):
        (WebCore::ConfigureV8TestObjTemplate):
        (WebCore::V8TestObj::installPerContextProperties):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore):
        (WebCore::ConfigureV8TestSerializedScriptValueInterfaceTemplate):
        * bindings/v8/V8Binding.h:
        * bindings/v8/V8ConfigureDOMAttributesAndMethods.h: Removed.
        * bindings/v8/V8DOMConfiguration.cpp: Renamed from Source/WebCore/bindings/v8/V8ConfigureDOMAttributesAndMethods.cpp.
        (WebCore):
        (WebCore::V8DOMConfiguration::batchConfigureAttributes):
        (WebCore::V8DOMConfiguration::batchConfigureConstants):
        (WebCore::V8DOMConfiguration::batchConfigureCallbacks):
        (WebCore::V8DOMConfiguration::configureTemplate):
        * bindings/v8/V8DOMConfiguration.h: Added.
        (WebCore):
        (V8DOMConfiguration):
        (BatchedAttribute):
        (WebCore::V8DOMConfiguration::configureAttribute):
        (BatchedConstant):
        (BatchedCallback):

2012-08-10  Andreas Kling  <kling@webkit.org>

        CSS: Shrink RuleData by storing selector as index rather than pointer.
        <http://webkit.org/b/93712>

        Reviewed by Antti Koivisto.

        Pack the selector's index in the rule in the RuleData bitfield, effectively
        shrinking each RuleData by 8 bytes.

        * css/CSSSelectorList.h:
        (WebCore::CSSSelectorList::selectorAt):
        (WebCore::CSSSelectorList::indexOfNextSelectorAfter):

            Add helpers to CSSSelectorList to iterate by index.

        * css/StyleResolver.cpp:
        (RuleData):
        (WebCore::RuleData::selector):
        (WebCore::RuleData::selectorIndex):
        (SameSizeAsRuleData):
        (RuleSet):
        (WebCore::makeRuleSet):
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleResolver.h:
        (WebCore::StyleResolver::RuleFeature::RuleFeature):
        (RuleFeature):

            Store selector indices instead of CSSSelector* pointers.

2012-08-10  Vineet Chaudhary  <rgf748@motorola.com>

        Remove custom bindings from WaveShaperNode.
        https://bugs.webkit.org/show_bug.cgi?id=93613

        Reviewed by Kentaro Hara.

        We should remove custom bindings as CodeGenerator uses UNUSED_PARAM macro.

        TestObj.idl
        No behavioural changes.
        All tests under webaudio/* should behave same.

        * GNUmakefile.list.am: Removed JSWaveShaperNodeCustom.cpp from builds.
        * Modules/webaudio/WaveShaperNode.idl: Removed [JSCustomSetter].
        * UseJSC.cmake: Removed JSWaveShaperNodeCustom.cpp from builds.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * bindings/js/JSWaveShaperNodeCustom.cpp: Removed.
        * bindings/scripts/CodeGeneratorCPP.pm:
        (SkipAttribute): Skip TypedArray attribute.
        * bindings/scripts/CodeGeneratorGObject.pm:
        (SkipAttribute): Skip TypedArray attribute.
        * bindings/scripts/CodeGeneratorObjC.pm:
        (SkipAttribute): Skip TypedArray attribute.
        * bindings/scripts/test/JS/JSTestObj.cpp: Bindings tests.
        (WebCore::jsTestObjTypedArrayAttr):
        (WebCore::setJSTestObjReflectedCustomURLAttr):
        (WebCore::setJSTestObjTypedArrayAttr):
        * bindings/scripts/test/JS/JSTestObj.h:
        * bindings/scripts/test/TestObj.idl: Test.
        * bindings/scripts/test/V8/V8TestObj.cpp: Bindings tests.
        (WebCore::TestObjV8Internal::typedArrayAttrAttrGetter):
        (TestObjV8Internal):
        (WebCore::TestObjV8Internal::typedArrayAttrAttrSetter):

2012-08-10  Huang Dongsung  <luxtella@company100.net>

        REGRESSION (r123848): Heap-use-after-free in WebCore::CachedResource::didAddClient.
        https://bugs.webkit.org/show_bug.cgi?id=93632
        -and corresponding-
        <http://crbug.com/140656>

        Reviewed by Antti Koivisto.

        CachedCSSStyleSheet::didAddClient() calls CachedStyleSheetClient::setCSSStyleSheet
        and HTMLLnkElement can be CachedStyleSheetClient.
        HTMLLinkElement::setCSSStyleSheet may cause scripts to be executed, which could
        destroy the HTMLLinkElement instance. After calliing
        CachedStyleSheetClient::setCSSStyleSheet, using the CachedStyleSheetClient
        instance can cause Heap-use-after-free.

        r115625 prevents HTMLLinkElement from being destroyed during
        HTMLLinkElement::setCSSStyleSheet, but r115625 doesn't prevent HTMLLinkElement
        from being destroyed after HTMLLinkElement::setCSSStyleSheet.

        So this patch calls CachedResource::didAddClient() before calling
        setCSSStyleSheet() to make sure its client is not destroyed.

        No new tests. it's covered by fast/css/cached-sheet-restore-crash.html.

        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::didAddClient):

2012-08-10  Kevin Ellis  <kevers@chromium.org>

        Horizontal scrollbar appears in the month-year selector of input[type=date]
        https://bugs.webkit.org/show_bug.cgi?id=93517

        Reviewed by Kent Tamura.

        Update size of the month-year selector popup to account for the
        width of the vertical scrollbar being platform dependent.

        * Resources/calendarPicker.css:
        (.month-selector-popup): Suppress horizontal scrolling.
        * Resources/calendarPicker.js:
        (YearMonthController.prototype.attachTo): Add a sizer element to facilitate determining the scrollbar width.
        (YearMonthController.prototype._showPopup): Use computed scrollbar width for popup resizing.

2012-08-10  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Unreviewed, fix frontend compilability after r125268.

        * inspector/front-end/CSSStyleModel.js:
        (WebInspector.NamedFlow):
        (WebInspector.NamedFlow.parsePayloadArray):

2012-08-10  Martin Leutelt  <martin.leutelt@basyskom.com>

        [Qt] Dotted borders not drawn with rounded dots
        https://bugs.webkit.org/show_bug.cgi?id=92383

        Reviewed by Noam Rosenthal.

        The dots in borders with dotted style were previously drawn with
        rectangular dots. The CSS spec specifies that the dots should be
        rounded dots. This patch fixes this behavior for the Qt port.

        No new tests, existing ones have been updated with new expected
        results.

        * platform/graphics/qt/GraphicsContextQt.cpp:
        (WebCore::adjustPointsForDottedLine):
        (WebCore):
        (WebCore::drawLineEndpointsForStyle):
        (WebCore::GraphicsContext::drawLine):

2012-08-10  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: render arrays as dir in case they were logged into console prior to the front-end opening.
        https://bugs.webkit.org/show_bug.cgi?id=93713

        Reviewed by Vsevolod Vlasov.

        Dumping potentially outdated arrays using the "dir" representation.

        * inspector/front-end/ConsoleMessage.js:
        (WebInspector.ConsoleMessageImpl):
        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsArray):
        (WebInspector.ConsoleMessageImpl.prototype.clone):
        * inspector/front-end/ConsoleModel.js:
        (WebInspector.ConsoleModel.prototype.enableAgent.callback):
        (WebInspector.ConsoleModel.prototype.enablingConsole):
        (WebInspector.ConsoleMessage.create):
        (WebInspector.ConsoleDispatcher.prototype.messageAdded):
        * inspector/front-end/ConsoleView.js:
        (WebInspector.ConsoleMessage.create):

2012-08-10  Dana Jansens  <danakj@chromium.org>

        [chromium] Fix the colors in the debugging HUD
        https://bugs.webkit.org/show_bug.cgi?id=93656

        Reviewed by Adrienne Walker.

        The R and B channels became swapped in our compositor debug HUD when
        wkb.ug/92182 happened. This corrects the problem by swizzling the
        color channels when we draw to the SkCanvas, so that it matches the
        expectations of the shader.

        Chromium bug: crbug.com/139908

        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
        (WebCore::CCFontAtlas::drawText):
        (WebCore::CCFontAtlas::drawOneLineOfTextInternal):
        * platform/graphics/chromium/cc/CCFontAtlas.h:
        (CCFontAtlas):
        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
        (WebCore::createPaint):
        (WebCore):
        (WebCore::CCHeadsUpDisplayLayerImpl::drawHudContents):
        (WebCore::CCHeadsUpDisplayLayerImpl::drawFPSCounter):
        (WebCore::CCHeadsUpDisplayLayerImpl::drawFPSCounterText):
        (WebCore::CCHeadsUpDisplayLayerImpl::drawDebugRects):

2012-08-10  Dana Jansens  <danakj@chromium.org>

        [chromium] Remove scissor from the namings in CCOcclusionTracker
        https://bugs.webkit.org/show_bug.cgi?id=93630

        Reviewed by Adrienne Walker.

        As a followup to wkb.ug/91800 which stops using partial-swap scissor
        in the occlusion tracker, this does a large rename to the occlusion
        tracker and affected tests to remove "scissor" from the names of its
        variables and methods, instead reflecting their new behaviour.

        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::::CCOcclusionTrackerBase):
        (WebCore::addOcclusionBehindLayer):
        (WebCore::::markOccludedBehindLayer):
        (WebCore::testContentRectOccluded):
        (WebCore::::occluded):
        (WebCore::computeUnoccludedContentRect):
        (WebCore::::unoccludedContentRect):
        (WebCore::::unoccludedContributingSurfaceContentRect):
        (WebCore::::layerClipRectInTarget):
        (WebCore):
        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
        (CCOcclusionTrackerBase):
        (WebCore::CCOcclusionTrackerBase::computeVisibleRegionInScreen):

2012-08-10  Jon Lee  <jonlee@apple.com>

        Change Notification.permissionLevel() to Notification.permission
        https://bugs.webkit.org/show_bug.cgi?id=88919
        <rdar://problem/11650319>

        Reviewed by Kentaro Hara.

        Retrieving the permission level has changed to Notification.permission, per this discussion:
        http://lists.w3.org/Archives/Public/public-web-notification/2012Jun/0000.html

        Test: fast/notifications/notifications-permission.html

        * Modules/notifications/Notification.cpp: Rename to match attribute name.
        (WebCore::Notification::permission):
        * Modules/notifications/Notification.h: Rename to match attribute name.
        (Notification):
        * Modules/notifications/Notification.idl: Change to static readonly attribute.

2012-08-10  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove collectIsolatedContexts() from V8Proxy
        https://bugs.webkit.org/show_bug.cgi?id=93682

        Reviewed by Adam Barth.

        We want to remove V8Proxy. This patch removes V8Proxy::collectIsolatedContexts().

        No tests. No change in behavior.

        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::collectIsolatedContexts):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::collectIsolatedContexts):

2012-08-10  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] Unreviewed trivial build fix: Avoid passing a non-existance WebCore/websockets directory
        to the generators, which produces unnecessary warnings. The module lives now in WebCore/Modules/websockets.

        * DerivedSources.pri:

2012-08-10  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: add frame ids to TimeStamp, Time and TimeEnd records in Timeline
        https://bugs.webkit.org/show_bug.cgi?id=93699

        Reviewed by Pavel Feldman.

        - plumb Frame from Console to TimelineAgent and use it to add frameId to 3 timeline records;

        * inspector/InspectorConsoleInstrumentation.h:
        (WebCore::InspectorInstrumentation::startConsoleTiming):
        (WebCore::InspectorInstrumentation::stopConsoleTiming):
        (WebCore::InspectorInstrumentation::consoleTimeStamp):
        * inspector/InspectorInstrumentation.cpp:
        (WebCore):
        (WebCore::InspectorInstrumentation::startConsoleTimingImpl):
        (WebCore::InspectorInstrumentation::stopConsoleTimingImpl):
        (WebCore::InspectorInstrumentation::consoleTimeStampImpl):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::didTimeStamp):
        (WebCore::InspectorTimelineAgent::time):
        (WebCore::InspectorTimelineAgent::timeEnd):
        * inspector/InspectorTimelineAgent.h:
        (InspectorTimelineAgent):
        * page/Console.cpp:
        (WebCore::Console::markTimeline):
        (WebCore::Console::time):
        (WebCore::Console::timeEnd):
        (WebCore::Console::timeStamp):

2012-08-10  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] Fix failing assertions when using JSC C API in QObject bridge
        https://bugs.webkit.org/show_bug.cgi?id=93720

        Reviewed by Kenneth Rohde Christiansen.

        Avoid calling JSValueProtect and JSValueIsEqual with null JSValueRefs, as in debug
        builds they trigger failing assertions about the arguments being non-null.

        In these signal & slot connections the receiver can be null, when the signal is connected
        just to a function, for example using obj.mySignal.connect(function() { .... }).

        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::QtConnectionObject::QtConnectionObject):
        (JSC::Bindings::QtConnectionObject::~QtConnectionObject):
        (JSC::Bindings::QtConnectionObject::match):

2012-08-10  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] Remove QRegExp <> JS RegExp conversion
        https://bugs.webkit.org/show_bug.cgi?id=93716

        Reviewed by Kenneth Rohde Christiansen.

        Removed automatic conversion between QRegExp and JS regular expressions. The semantics
        between the expressions are totally different, which can cause data loss and unexpected
        behaviour. QJSEngine/Value doesn't have this conversion anymore neither.

        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::operator<<):
        (JSC::Bindings::valueRealType):
        (JSC::Bindings::convertValueToQVariant):
        (JSC::Bindings::convertQVariantToValue):

2012-08-10  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: console.timeStamp() marked are not shown in Timeline overview
        https://bugs.webkit.org/show_bug.cgi?id=93697

        Reviewed by Pavel Feldman.

        - ignore frameId on TimeStamp records, consider it's always an event divider.

        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.isEventDivider):

2012-08-10  Mihnea Ovidenie  <mihnea@adobe.com>

        [CSS Regions] region-overflow: break still renders the content that does not fit in the last region.
        https://bugs.webkit.org/show_bug.cgi?id=92996

        Reviewed by Julien Chaffraix.

        Flow content that follows the last break in the last region, if any, should not be rendered
        for the regions with region-overflow: break.
        http://www.w3.org/TR/css3-regions/#the-region-overflow-property

        Modified the expected result for existing test fast/regions/region-overflow-break.html
        to reflect the correct behavior.

        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::regionOversetRect):

2012-08-10  Andrei Poenaru  <poenaru@adobe.com>

        Web Inspector: Protocol Extension: Refactor protocol extension for CSS Regions
        https://bugs.webkit.org/show_bug.cgi?id=92089

        Reviewed by Pavel Feldman.

        Replaced "WebKitNamedFlowCollection::namedFlowsNames" with "WebKitNamedFlowCollection::namedFlows" to return a Vector of "WebKitNamedFlow"s,
        instead of a Vector of Strings.

        Added the "Region" type to Inspector.json.
        Changed the "NamedFlow" type and the "getNamedFlowCollection" function in Inspector.json.

        Modified existing test: inspector/styles/protocol-css-regions-commands.html

        * dom/WebKitNamedFlowCollection.cpp:
        (WebCore::WebKitNamedFlowCollection::namedFlows):
        * dom/WebKitNamedFlowCollection.h:
        (WebKitNamedFlowCollection):
        * inspector/Inspector.json:
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::getNamedFlowCollection):
        (WebCore::InspectorCSSAgent::getFlowByName):
        (WebCore::InspectorCSSAgent::buildArrayForRegions):
        (WebCore):
        (WebCore::InspectorCSSAgent::buildObjectForNamedFlow):
        * inspector/InspectorCSSAgent.h:
        (InspectorCSSAgent):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::pushNodeToFrontend):
        (WebCore):
        * inspector/InspectorDOMAgent.h:
        (InspectorDOMAgent):
        * inspector/front-end/CSSStyleModel.js:
        (WebInspector.CSSStyleModel.prototype.getNamedFlowCollectionAsync):
        (WebInspector.NamedFlow):
        (WebInspector.NamedFlow.parsePayloadArray):

2012-08-10  Keishi Hattori  <keishi@webkit.org>

        Resize calandar and color suggestion popups to show error message
        https://bugs.webkit.org/show_bug.cgi?id=93695

        Reviewed by Kent Tamura.

        r125169 made PagePopupClient::contentSize() return zero size and so to
        see the error message, we need to resize the page popup.

        No new tests. Not user facing.

        * Resources/calendarPicker.js:
        (resizeWindow): Resizes popup window to given size.
        (showMain): Initiates transition to show the main element.
        (initialize):
        (fixWindowSize):
        * Resources/colorSuggestionPicker.js:
        (resizeWindow):
        (initialize):
        (ColorPicker.prototype._layout):

2012-08-10  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: further ResourceLoader memory instrumentation
        https://bugs.webkit.org/show_bug.cgi?id=93692

        Reviewed by Vsevolod Vlasov.

        Added missing parts to ResourceLoader and its descendants memory instrumentation.
        Added special logic for KURL and report the urls where we have them in instrumented classes.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * css/StyleSheetContents.cpp:
        (WebCore::StyleSheetContents::reportMemoryUsage):
        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        * dom/MemoryInstrumentation.cpp:
        (WebCore::MemoryInstrumentation::addObject):
        (WebCore):
        * dom/MemoryInstrumentation.h:
        (WebCore):
        (MemoryInstrumentation):
        (WebCore::MemoryClassInfo::addMember):
        * loader/MainResourceLoader.cpp:
        (WebCore::MainResourceLoader::reportMemoryUsage):
        (WebCore):
        * loader/MainResourceLoader.h:
        (MainResourceLoader):
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::reportMemoryUsage):
        (WebCore):
        * loader/SubresourceLoader.h:
        (SubresourceLoader):
        * loader/SubstituteData.cpp: Copied from Source/WebCore/dom/MemoryInstrumentation.cpp.
        (WebCore):
        (WebCore::SubstituteData::reportMemoryUsage):
        * loader/SubstituteData.h:
        (WebCore):
        (SubstituteData):

2012-08-10  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Introduce shadow elements for multiple fields time input UI
        https://bugs.webkit.org/show_bug.cgi?id=92960

        Reviewed by Kent Tamura.

        This patch introduces shadow elements for multiple fields time input UI:
            - DateTimeAMPMFieldElement - field UI for AM/PM
            - DateTimeEditElement - container of multiple DateTimeFieldElement
            - DateTimeFieldElement - base class of field UI
            - DateTimeHourFieldElement - field UI for hour
            - DateTimeMillisecondFieldElement - field UI for millisecond
            - DateTimeMinuteFieldElement - field UI for minute
            - DateTimeNumericFieldElement - base class of numeric field UI.
            - DateTimeSecondFieldElement - field UI for second
            - DateTimeSymbolicFieldElement - base class for symbolic field UI
        inside of ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS build flag.

        No new tests. This patch doesn't change behavior.

        * WebCore.gypi: Changed to include html/shadow/DateTimeEditElement.cpp,
        html/shadow/DateTimeEdditElement.h, html/shadow/DateTimeFieldElement.cpp,
        html/shadow/DateTimeFieldElement.h, html/shadow/DateTimeFieldElements.cpp,
        html/shadow/DateTimeFieldElements.h, html/shadow/DateTimeNumericFieldElement.cpp,
        html/shadow/DateTimeNumericFieldElement.h, html/shadow/DateTimeSymbolicFieldElement.cpp,
        and html/shadow/DateTimeSymbolicFieldElement.h.
        * html/shadow/DateTimeEditElement.cpp: Added.
        (DateTimeEditBuilder):
        (WebCore::DateTimeEditBuilder::DateTimeEditBuilder):
        (WebCore::DateTimeEditBuilder::build):
        (WebCore::DateTimeEditBuilder::needMillisecondField):
        (WebCore::DateTimeEditBuilder::needMinuteField):
        (WebCore::DateTimeEditBuilder::needSecondField):
        (WebCore::DateTimeEditBuilder::shouldMillisecondFieldReadOnly):
        (WebCore::DateTimeEditBuilder::shouldMinuteFieldReadOnly):
        (WebCore::DateTimeEditBuilder::shouldSecondFieldReadOnly):
        (WebCore::DateTimeEditBuilder::visitField):
        (WebCore::DateTimeEditBuilder::visitLiteral):
        (WebCore::DateTimeEditElement::EditControlOwner::~EditControlOwner):
        (WebCore::DateTimeEditElement::DateTimeEditElement):
        (WebCore::DateTimeEditElement::~DateTimeEditElement):
        (WebCore::DateTimeEditElement::addField):
        (WebCore::DateTimeEditElement::create):
        (WebCore::DateTimeEditElement::disabledStateChanged): Called when owner's disabled state is changed.
        (WebCore::DateTimeEditElement::fieldAt):
        (WebCore::DateTimeEditElement::focusFieldAt):
        (WebCore::DateTimeEditElement::handleKeyboardEvent):
        (WebCore::DateTimeEditElement::fieldValueChanged):
        (WebCore::DateTimeEditElement::focusOnNextField):
        (WebCore::DateTimeEditElement::handleMouseEvent):
        (WebCore::DateTimeEditElement::isDisabled):
        (WebCore::DateTimeEditElement::isReadOnly):
        (WebCore::DateTimeEditElement::layout):
        (WebCore::DateTimeEditElement::nextFieldIndex):
        (WebCore::DateTimeEditElement::previousFieldIndex):
        (WebCore::DateTimeEditElement::readOnlyStateChanged): Called when owner's readOnly state is changed.
        (WebCore::DateTimeEditElement::resetLayout):
        (WebCore::DateTimeEditElement::defaultEventHandler):
        (WebCore::DateTimeEditElement::setValueAsDate):
        (WebCore::DateTimeEditElement::setEmptyValue):
        (WebCore::DateTimeEditElement::spinButtonStepDown):
        (WebCore::DateTimeEditElement::spinButtonStepUp):
        (WebCore::DateTimeEditElement::updateUIState):
        (WebCore::DateTimeEditElement::valueAsDouble):
        * html/shadow/DateTimeEditElement.h: Added.
        (DateTimeEditElement):
        (EditControlOwner):
        (WebCore::DateTimeEditElement::removeEditControlOwner):
        * html/shadow/DateTimeFieldElement.cpp: Added.
        (WebCore::DateTimeFieldElement::FieldEventHandler::~FieldEventHandler):
        (WebCore::DateTimeFieldElement::DateTimeFieldElement):
        (WebCore::DateTimeFieldElement::defaultEventHandler):
        (WebCore::DateTimeFieldElement::defaultKeyboardEventHandler):
        (WebCore::DateTimeFieldElement::focusOnNextField):
        (WebCore::DateTimeFieldElement::initialize):
        (WebCore::DateTimeFieldElement::isReadOnly):
        (WebCore::DateTimeFieldElement::setReadOnly):
        (WebCore::DateTimeFieldElement::updateVisibleValue):
        (WebCore::DateTimeFieldElement::valueAsDouble):
        * html/shadow/DateTimeFieldElement.h: Added.
        (DateTimeFieldElement):
        (FieldEventHandler):
        (WebCore::DateTimeFieldElement::removeEventHandler):
        * html/shadow/DateTimeFieldElements.cpp: Added.
        (WebCore::DateTimeAMPMFieldElement::DateTimeAMPMFieldElement):
        (WebCore::DateTimeAMPMFieldElement::create):
        (WebCore::DateTimeAMPMFieldElement::setValueAsDate):
        (WebCore::DateTimeAMPMFieldElement::unitInMillisecond):
        (WebCore::DateTimeHourFieldElement::DateTimeHourFieldElement):
        (WebCore::DateTimeHourFieldElement::create):
        (WebCore::DateTimeHourFieldElement::setValueAsDate):
        (WebCore::DateTimeHourFieldElement::setValueAsInteger):
        (WebCore::DateTimeHourFieldElement::unitInMillisecond):
        (WebCore::DateTimeHourFieldElement::valueAsInteger):
        (WebCore::DateTimeMillisecondFieldElement::DateTimeMillisecondFieldElement):
        (WebCore::DateTimeMillisecondFieldElement::create):
        (WebCore::DateTimeMillisecondFieldElement::setValueAsDate):
        (WebCore::DateTimeMillisecondFieldElement::unitInMillisecond):
        (WebCore::DateTimeMinuteFieldElement::DateTimeMinuteFieldElement):
        (WebCore::DateTimeMinuteFieldElement::create):
        (WebCore::DateTimeMinuteFieldElement::setValueAsDate):
        (WebCore::DateTimeMinuteFieldElement::unitInMillisecond):
        (WebCore::DateTimeSecondFieldElement::DateTimeSecondFieldElement):
        (WebCore::DateTimeSecondFieldElement::create):
        (WebCore::DateTimeSecondFieldElement::setValueAsDate):
        (WebCore::DateTimeSecondFieldElement::unitInMillisecond):
        * html/shadow/DateTimeFieldElements.h: Added.
        (DateTimeAMPMFieldElement):
        (DateTimeHourFieldElement):
        (DateTimeMillisecondFieldElement):
        (DateTimeMinuteFieldElement):
        (DateTimeSecondFieldElement):
        * html/shadow/DateTimeNumericFieldElement.cpp: Added.
        (WebCore::displaySizeOfNumber):
        (WebCore::DateTimeNumericFieldElement::Range::Range):
        (WebCore::DateTimeNumericFieldElement::Range::clumpValue):
        (WebCore::DateTimeNumericFieldElement::DateTimeNumericFieldElement):
        (WebCore::DateTimeNumericFieldElement::handleKeyboardEvent):
        (WebCore::DateTimeNumericFieldElement::hasValue):
        (WebCore::DateTimeNumericFieldElement::setEmptyValue):
        (WebCore::DateTimeNumericFieldElement::setValueAsInteger):
        (WebCore::DateTimeNumericFieldElement::stepDown):
        (WebCore::DateTimeNumericFieldElement::stepUp):
        (WebCore::DateTimeNumericFieldElement::value):
        (WebCore::DateTimeNumericFieldElement::valueAsInteger):
        (WebCore::DateTimeNumericFieldElement::visibleValue):
        * html/shadow/DateTimeNumericFieldElement.h: Added.
        (DateTimeNumericFieldElement):
        (WebCore::DateTimeNumericFieldElement::clumpValue):
        (WebCore::DateTimeNumericFieldElement::range):
        * html/shadow/DateTimeSymbolicFieldElement.cpp: Added.
        (WebCore::DateTimeSymbolicFieldElement::DateTimeSymbolicFieldElement):
        (WebCore::DateTimeSymbolicFieldElement::handleKeyboardEvent):
        (WebCore::DateTimeSymbolicFieldElement::hasValue):
        (WebCore::DateTimeSymbolicFieldElement::setEmptyValue):
        (WebCore::DateTimeSymbolicFieldElement::setValueAsInteger):
        (WebCore::DateTimeSymbolicFieldElement::stepDown):
        (WebCore::DateTimeSymbolicFieldElement::stepUp):
        (WebCore::DateTimeSymbolicFieldElement::value):
        (WebCore::DateTimeSymbolicFieldElement::valueAsInteger):
        (WebCore::DateTimeSymbolicFieldElement::visibleValue):
        * html/shadow/DateTimeSymbolicFieldElement.h: Added.
        (DateTimeSymbolicFieldElement):

2012-08-10  Tony Chang  <tony@chromium.org>

        implement display: -webkit-inline-flex
        https://bugs.webkit.org/show_bug.cgi?id=77772

        Reviewed by Ojan Vafai.

        The crashes last time were because we were marking too much of the tree for relayout. During some editing
        operations, this causes a layout when we're in an inconsistent state.

        Tests: css3/flexbox/inline-flex-crash.html
               css3/flexbox/inline-flex-crash2.html
               css3/flexbox/inline-flex.html

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes): Only layout the child.
        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren): Only layout the child.
        (WebCore::RenderFlexibleBox::applyStretchAlignmentToChild): Only layout the child.
        * rendering/style/RenderStyle.h: Include INLINE_FLEX as an inline and replaced display type.

2012-08-10  Vineet Chaudhary  <rgf748@motorola.com>

        Moving the common code from CodegeneratorJS/V8.pm to Codegenerator.pm
        https://bugs.webkit.org/show_bug.cgi?id=93616

        Reviewed by Adam Barth.

        IsArrayType() IsConstructorTemplate() IsTypedArrayType() these methods
        has the common implementaion for both V8 and JS and can be moved to
        common place Codegenerator.pm

        No new tests. There should be no behavioural changes.

        * bindings/scripts/CodeGenerator.pm: Moved common code here.
        (IsArrayType):
        (IsConstructorTemplate):
        (IsSVGTypeWithWritablePropertiesNeedingTearOff):
        (IsTypedArrayType):
        * bindings/scripts/CodeGeneratorJS.pm:
        (AddIncludesForType):
        (AddClassForwardIfNeeded):
        (GenerateHeader):
        (GenerateParametersCheckExpression):
        (GenerateImplementation):
        (NativeToJSValue):
        (GenerateConstructorDeclaration):
        (GenerateConstructorDefinition):
        (IsConstructable):
        * bindings/scripts/CodeGeneratorV8.pm:
        (AddIncludesForType):
        (GenerateHeader):
        (GetHeaderClassInclude):
        (GenerateParametersCheckExpression):
        (GenerateImplementation):
        (GetTypeNameOfExternalTypedArray):

2012-08-10  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r125230 and r125238.
        http://trac.webkit.org/changeset/125230
        http://trac.webkit.org/changeset/125238
        https://bugs.webkit.org/show_bug.cgi?id=93698

        Broke ChromiumOS browser tests. (Requested by yutak on
        #webkit).

        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::setTexturePrioritiesInRect):
        (WebCore::TiledLayerChromium::updateContentRect):
        (WebCore::TiledLayerChromium::needsIdlePaint):
        (WebCore::TiledLayerChromium::idlePaintRect):
        * platform/graphics/chromium/cc/CCLayerTilingData.cpp:
        (WebCore::CCLayerTilingData::contentRectToTileIndices):
        (WebCore::CCLayerTilingData::setBounds):
        * platform/graphics/chromium/cc/CCPriorityCalculator.h:

2012-08-09  Carlos Garcia Campos  <cgarcia@igalia.com>

        Handle SSL errors for SOUP
        https://bugs.webkit.org/show_bug.cgi?id=90267

        Reviewed by Martin Robinson.

        No new tests, this is covered by existing tests.

        * platform/LocalizedStrings.h:
        (WebCore): Add unacceptableTLSCertificate() for SOUP.
        * platform/efl/LocalizedStringsEfl.cpp:
        (WebCore::unacceptableTLSCertificate):
        * platform/gtk/LocalizedStringsGtk.cpp:
        (WebCore::unacceptableTLSCertificate):
        * platform/network/ResourceHandle.h:
        * platform/network/soup/ResourceError.h:
        (WebCore::ResourceError::ResourceError): Add new constructor for
        SSL errors that receives a certificate and TLS errors.
        (WebCore::ResourceError::tlsErrors): Return TLS errors.
        (WebCore::ResourceError::certificate): Return the certificate.
        * platform/network/soup/ResourceHandleSoup.cpp:
        (HostTLSCertificates): Helper class to store certificates for a
        host.
        (WebCore::HostTLSCertificateSet::add): Add a new certificate.
        (WebCore::HostTLSCertificateSet::contains): Check whether
        certificate is stored.
        (WebCore::HostTLSCertificateSet::computeCertificateHash): Compute
        the SHA1 of the certificate data.
        (WebCore::allowsAnyHTTPSCertificateHosts): Global set to store
        hostnames for which SSL errors should be ignored.
        (WebCore::clientCertificates): Global map to store client
        certificates.
        (WebCore::hasUnignoredTLSErrors): Helper function to check whether
        current message contains TLS errors that shouldn't be ignored and
        certificate hasn't been approved already.
        (WebCore::sendRequestCallback): Finish the load with an error in
        case of SSL errors not handled by the SoupSession.
        (WebCore::ResourceHandle::setHostAllowsAnyHTTPSCertificate): Add
        the given hostname to the list of hosts for which SSL errors are
        ignored.
        (WebCore::ResourceHandle::setClientCertificate): Store the client
        certificate for the given host.
        (WebCore::ResourceHandle::setIgnoreSSLErrors): Set whether all SSL
        errors should be ignored.

2012-08-10  Arko Saha  <arko@motorola.com>

        itemType.add should treat \t as a space.
        https://bugs.webkit.org/show_bug.cgi?id=92991

        Reviewed by Ryosuke Niwa.

        Earlier we used to append a space character i.e, ' ' to the string builder
        if the last character of input string is not a space character in addToken()
        method. We should add an space character if the last character of input is
        not a HTML Space character like, '\n', '\r', '\t', '\f' or ' '.

        We can observe the same behavior in FireFox, Opera and IE. They also treat
        HTML space character as a space.

        Test: fast/dom/MicroData/domsettabletokenlist-attributes-add-token.html

        * html/DOMTokenList.cpp:
        (WebCore::DOMTokenList::addToken):

2012-08-10  Tony Chang  <tony@chromium.org>

        Remove unused isFlexingChildren and make m_flexingChildren a local variable
        https://bugs.webkit.org/show_bug.cgi?id=93689

        Reviewed by Ojan Vafai.

        isFlexingChildren() is never called, so we can remove it.

        m_flexingChildren is now only used locally, so remove the member variable and use a local variable.

        No new tests, this is just a refactoring.

        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::RenderDeprecatedFlexibleBox):
        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
        (WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox): Make flexingChildren a local.
        (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox): Make flexingChildren a local.
        (WebCore::RenderDeprecatedFlexibleBox::applyLineClamp): No need to set m_flexingChildren since it's not used
        outside of RenderDeprecatedFlexibleBox.
        * rendering/RenderDeprecatedFlexibleBox.h:
        (RenderDeprecatedFlexibleBox): Remove m_flexingChildren and don't bit pack the remaining bool since it doesn't
        do anything for 1 bool.
        * rendering/RenderObject.h:

2012-08-10  Sam D  <dsam2912@gmail.com>

        Web Inspector: Search matches count view is flaky.
        https://bugs.webkit.org/show_bug.cgi?id=93451

        Reviewed by Pavel Feldman.

        Modified css properties for aligning search panel.

        No new tests.UI change.

        * inspector/front-end/inspector.css:
        (.search-results-matches):

2012-08-09  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] Remove support for __qt_sender__ in QObject bridge
        https://bugs.webkit.org/show_bug.cgi?id=93649

        Reviewed by Kenneth Rohde Christiansen.

        Support for __qt_sender__ has also been removed from QtScript/QJSEngine. The right
        JavaScript solution to the problem is Function.prototype.bind.

        * bridge/qt/qt_instance.cpp:
        (Bindings):
        * bridge/qt/qt_instance.h:
        * bridge/qt/qt_runtime.cpp:
        (Bindings):
        (JSC::Bindings::QtConnectionObject::execute):

2012-08-09  Shane Stephens  <shanestephens@google.com>

        Convert CSSParser's m_reusableSelectorVector to OwnPtr and rename to m_selectorVector.
        https://bugs.webkit.org/show_bug.cgi?id=93574

        Reviewed by Ojan Vafai.

        This is preparatory work for CSS Hierarchies (see wkb.ug/79939).
        CSS Hierarchies works by pushing selectorVectors onto a stack while nested selectorVectors are parsed.
        For this reason, the selectorVector in CSSParser can't be re-used between selector parses within a set of
        nested selectors. This patch wraps the selectorVector in an OwnPtr but does not otherwise modify its use.

        Similarly, CSSParser::m_parsedProperties is converted from a direct ParsedPropertyVector included
        as a member of CSSParser to an OwnPtr.

        Once Hierarchies are introduced, when a selectorVector is stacked a new one will be created 
        and stored in m_selectorVector (see wkb.ug/79939 for context). However, an accompanying unstacking
        mechanism ensures that selectorVectors will be reused in all circumstances where they currently are.

        This patch also introduces a CSSSelectorVector typedef to simplify and improve readability of 
        type signatures in and around CSSParser.

        No new tests as this patch doesn't introduce new functionality.

        * css/CSSGrammar.y:
        * css/CSSParser.cpp:
        (WebCore::CSSParser::CSSParser):
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseColor):
        (WebCore::CSSParser::parseDeclaration):
        (WebCore):
        (WebCore::filterProperties):
        (WebCore::CSSParser::createStylePropertySet):
        (WebCore::CSSParser::addProperty):
        (WebCore::CSSParser::rollbackLastProperties):
        (WebCore::CSSParser::clearProperties):
        (WebCore::CSSParser::parse4Values):
        (WebCore::CSSParser::parseFlowThread):
        (WebCore::CSSParser::createFloatingSelectorVector):
        (WebCore::CSSParser::sinkFloatingSelectorVector):
        (WebCore::CSSParser::createStyleRule):
        (WebCore::CSSParser::createFontFaceRule):
        (WebCore::CSSParser::createPageRule):
        (WebCore::CSSParser::setReusableRegionSelectorVector):
        (WebCore::CSSParser::startDeclarationsForMarginBox):
        (WebCore::CSSParser::endDeclarationsForMarginBox):
        (WebCore::CSSParser::deleteFontFaceOnlyValues):

        m_reusableSelectorVector renamed to m_selectorVector and wrapped in OwnPtr.
        m_parsedProperties wrapped in OwnPtr.
        * css/CSSParser.h:
        (WebCore::CSSParser::hasProperties):
        (WebCore::CSSParser::selectorVector): function renamed from reusableSelectorVector
        (CSSParser): 
        (WebCore::CSSParser::reusableRegionSelectorVector):
        * css/CSSParserValues.cpp:
        (WebCore::CSSParserSelector::adoptSelectorVector):
        * css/CSSParserValues.h: CSSSelectorVector typedef added
        (WebCore):
        (CSSParserSelector):
        * css/CSSSelectorList.cpp:
        (WebCore::CSSSelectorList::adoptSelectorVector):
        * css/CSSSelectorList.h:
        (CSSSelectorList):
        * css/SVGCSSParser.cpp:
        (WebCore::CSSParser::parseSVGValue):
        * css/StyleRule.cpp:
        (WebCore::StyleRuleRegion::StyleRuleRegion):
        * css/StyleRule.h:
        (WebCore::StyleRule::parserAdoptSelectorVector):
        (WebCore::StyleRulePage::parserAdoptSelectorVector):
        (WebCore::StyleRuleRegion::create):
        (StyleRuleRegion):

2012-08-02  Dominic Cooney  <dominicc@chromium.org>

        SVGElementInstance should have EventTarget on the prototype chain
        https://bugs.webkit.org/show_bug.cgi?id=88232

        Reviewed by Adam Barth.

        SVG 1.1 specifies that SVGElementInstance has EventTarget as its
        parent interface:
        <http://www.w3.org/TR/SVG/struct.html#InterfaceSVGElementInstance>
        Match the spec by putting EventTarget on the prototype chain of
        SVGElementInstance instead of redundantly declaring
        addEventListener, removeEventListener and dispatchEvent on the
        SVGElementInstance interface. This is an incremental step to make
        all EventTargets do it this way, being tracked in bug 67312.

        Covered by existing tests, eg
        svg/custom/use-instanceRoot-as-event-target.xhtml

        * CMakeLists.txt: Finding base interface types requires
        searching directories with the IDLs of base interfaces.
        * DerivedSources.cpp: Add generated JSEventTarget.cpp.
        * DerivedSources.make: (Search paths again -- see CMakeLists.txt)
        * DerivedSources.pri: "
        * bindings/js/JSEventTargetCustom.cpp:
        (WebCore::toEventTarget): Try to unwrap EventTargets simply as
        EventTargets. When all EventTargets do this consistently this
        function will be simplified.
        * bindings/js/JSSVGElementInstanceCustom.cpp:
        (WebCore::JSSVGElementInstance::visitChildren): SVGElementInstance
        skips walking its event listener list because it forwards
        listeners to its corresponding element.
        * bindings/scripts/CodeGenerator.pm:
        (IsStrictSubtype): For finding what is an EventTarget based on
        parent interface.
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader): Extend the heuristic for what is an
        EventTarget. When all EventTargets are handled consistently this
        will be simplified.
        (GenerateImplementation):
        * bindings/scripts/CodeGeneratorV8.pm: Extend the heuristic for
        what is an EventTarget, and remove some of the special-casing for
        EventTarget.
        (GenerateHeader):
        (GetInternalFields):
        (GenerateImplementation):
        (BaseInterfaceName):
        (GenerateToV8Converters):
        (GetNativeType):
        (JSValueToNative):
        (GetV8HeaderName):
        * bindings/scripts/test/V8/V8Float64Array.cpp:
        (WebCore::V8Float64Array::wrapSlow): Add assertions.
        * bindings/scripts/test/V8/V8TestNode.cpp:
        (WebCore::V8TestNode::wrapSlow):
        * svg/SVGElementInstance.h: Must extend EventTarget first so that
        static_cast<EventTarget*>(elementInstance) is the same pointer as
        elementInstance, similar to how static_cast<Node*>(element) is the
        same pointer as element.
        * svg/SVGElementInstance.idl: Extend EventTarget; no longer need
        to declare add/removeEventListener and dispatchEvent.

2012-08-09  Vivek Galatage  <vivekgalatage@gmail.com>

        Web Inspector: Remove unused method InspectorResourceAgent::clearCache from Resource Agent.
        https://bugs.webkit.org/show_bug.cgi?id=93675

        Reviewed by Pavel Feldman.

        Removing unused method declaration for clearCache in InspectorResourceAgent. It's marked as FIXME.
        Hence cleaning up.

        No new tests as cleanup.

        * inspector/InspectorResourceAgent.h:
        (InspectorResourceAgent):

2012-08-09  Peter Rybin  <peter.rybin@gmail.com>

        Web Inspector: CodeGeneratorInspector.py: add complete support for TypeBuilder::Array
        https://bugs.webkit.org/show_bug.cgi?id=93559

        Reviewed by Pavel Feldman.

        Missing binding methods are added to templates. Core assert methods are declared in a helper class now.

        * inspector/CodeGeneratorInspector.py:
        (RawTypes.BaseType.generate_validate_method):
        (RawTypes.BaseType.get_raw_validator_call_text):
        (RawTypes.generate_validate_methods):
        (RawTypes.Int.generate_validate_method):
        (RawTypes.Int.get_raw_validator_call_text):
        (RawTypes.Number.get_validate_method_params.ValidateMethodParams):
        (RawTypes.Any.generate_validate_method):
        (RawTypes.Any.get_raw_validator_call_text):
        (RawTypes.Array.get_validate_method_params.ValidateMethodParams):
        (RawTypes.Array.get_validate_method_params):
        (PlainObjectBinding.get_validator_call_text):
        (RuntimeCastHelper):
        (Generator):
        (Generator.go):

2012-08-09  Sukolsak Sakshuwong  <sukolsak@google.com>

        Mouse-select then Cut, results in preceding character being lost
        https://bugs.webkit.org/show_bug.cgi?id=60830

        Reviewed by Ryosuke Niwa.

        This bug happened only in text fields and text areas, not in other
        content-editable elements. That's because when we cut or copied text
        in a text control, we called Pasteboard::writePlainText instead of
        Pasteboard::writeSelection. writePlainText did not record the smart replace
        information. Make writePlainText record the smart replace information.

        Test: editing/pasteboard/smart-paste-in-text-control.html

        * editing/Editor.cpp:
        (WebCore::Editor::cut):
        (WebCore::Editor::copy):
        * inspector/InjectedScriptHost.cpp:
        (WebCore::InjectedScriptHost::copyText):
        * inspector/InspectorFrontendHost.cpp:
        (WebCore::InspectorFrontendHost::copyText):
        * platform/Pasteboard.h:
        * platform/blackberry/PasteboardBlackBerry.cpp:
        (WebCore::Pasteboard::writePlainText):
        * platform/chromium/PasteboardChromium.cpp:
        (WebCore::Pasteboard::writePlainText):
        * platform/efl/PasteboardEfl.cpp:
        (WebCore::Pasteboard::writePlainText):
        * platform/gtk/PasteboardGtk.cpp:
        (WebCore::Pasteboard::writePlainText):
        * platform/mac/ClipboardMac.mm:
        (WebCore::ClipboardMac::writePlainText):
        * platform/mac/PasteboardMac.mm:
        (WebCore::Pasteboard::writePlainText):
        * platform/qt/PasteboardQt.cpp:
        (WebCore::Pasteboard::writePlainText):
        * platform/win/PasteboardWin.cpp:
        (WebCore::Pasteboard::writePlainText):
        * platform/wince/PasteboardWinCE.cpp:
        (WebCore::Pasteboard::writePlainText):
        * platform/wx/ClipboardWx.cpp:
        (WebCore::ClipboardWx::writePlainText):
        * platform/wx/PasteboardWx.cpp:
        (WebCore::Pasteboard::writePlainText):

2012-08-09  Kentaro Hara  <haraken@chromium.org>

        Unreviewed. Updated run-binding-tests results.

        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        (WebCore::TestActiveDOMObjectV8Internal::TestActiveDOMObjectDomainSafeFunctionSetter):

2012-08-09  Luke Macpherson   <macpherson@chromium.org>

        Fix null pointer deref in RenderFileUploadControl::computePreferredLogicalWidth().
        https://bugs.webkit.org/show_bug.cgi?id=93579

        Reviewed by Kent Tamura.

        Checks the upload control has a non-null button renderer before dereferencing.

        Test: fast/forms/file/file-crash-by-display-none-button.html

        * rendering/RenderFileUploadControl.cpp:
        (WebCore::RenderFileUploadControl::computePreferredLogicalWidths):

2012-08-09  Kentaro Hara  <haraken@chromium.org>

        [V8] Rename V8BindingPerContextData to V8PerContextData
        https://bugs.webkit.org/show_bug.cgi?id=93595

        Reviewed by Adam Barth.

        For a better name. See discussion in bug 93333.

        No tests. No change in behavior.

        * UseV8.cmake: Added V8PerContextData.cpp. The fact that missing V8BindingPerContextData.cpp
        has not caused any problem indicates that UseV8.cmake is not used at all?
        * WebCore.gypi:
        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::V8DOMWindowShell::initContextIfNeeded):
        * bindings/v8/V8DOMWindowShell.h:
        (WebCore::V8DOMWindowShell::perContextData):
        (V8DOMWindowShell):
        * bindings/v8/V8DOMWrapper.cpp:
        (WebCore::V8DOMWrapper::constructorForType):
        (WebCore::V8DOMWrapper::perContextData):
        (WebCore::V8DOMWrapper::instantiateV8Object):
        * bindings/v8/V8DOMWrapper.h:
        (WebCore):
        (V8DOMWrapper):
        * bindings/v8/V8IsolatedContext.cpp:
        (WebCore::V8IsolatedContext::V8IsolatedContext):
        * bindings/v8/V8IsolatedContext.h:
        (WebCore):
        (WebCore::V8IsolatedContext::perContextData):
        (V8IsolatedContext):
        * bindings/v8/V8PerContextData.cpp: Renamed from Source/WebCore/bindings/v8/V8BindingPerContextData.cpp.
        (WebCore):
        (WebCore::V8PerContextData::dispose):
        (WebCore::V8PerContextData::init):
        (WebCore::V8PerContextData::createWrapperFromCacheSlowCase):
        (WebCore::V8PerContextData::constructorForTypeSlowCase):
        * bindings/v8/V8PerContextData.h: Renamed from Source/WebCore/bindings/v8/V8BindingPerContextData.h.
        (WebCore):
        (V8PerContextData):
        (WebCore::V8PerContextData::create):
        (WebCore::V8PerContextData::~V8PerContextData):
        (WebCore::V8PerContextData::createWrapperFromCache):
        (WebCore::V8PerContextData::constructorForType):
        (WebCore::V8PerContextData::V8PerContextData):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::retrievePerContextData):
        * bindings/v8/V8Proxy.h:
        (WebCore):
        (V8Proxy):
        * bindings/v8/WorkerContextExecutionProxy.cpp:
        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
        * bindings/v8/WorkerContextExecutionProxy.h:
        (WebCore):
        (WebCore::WorkerContextExecutionProxy::perContextData):
        (WorkerContextExecutionProxy):

2012-08-09  Erik Arvidsson  <arv@chromium.org>

        HTMLElement.classList cannot remove classnames with uppercase characters
        https://bugs.webkit.org/show_bug.cgi?id=93628

        Reviewed by Alexey Proskuryakov.

        Before this patch we were trying to be smart and determine whether we needed the update m_classNamesForQuirksMode
        based on whether m_classNamesForQuirksMode.isNull(), however, m_classNamesForQuirksMode.isNull() is true when the
        class name is the empty string.

        We also did not update m_classNamesForQuirksMode when the class attribute was cleared.

        Updated tests.

        * dom/StyledElement.cpp:
        (WebCore::StyledElement::classAttributeChanged):
        * html/ClassList.cpp:
        (WebCore::ClassList::reset):
        (WebCore::ClassList::classNames):

2012-08-09  Yuta Kitamura  <yutak@chromium.org>

        Unreviewed, Chromium-mac (clang) build fix for r125230.

        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore):

2012-08-09  MORITA Hajime  <morrita@google.com>

        https://bugs.webkit.org/show_bug.cgi?id=93587
        Node::replaceChild() can create bad DOM topology with MutationEvent, Part 2

        Reviewed by Kent Tamura.

        This is a followup of r124156. replaceChild() has yet another hidden
        MutationEvent trigger. This change added a guard for it.

        Test: fast/events/mutation-during-replace-child-2.html

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::replaceChild):

2012-08-09  Kentaro Hara  <haraken@chromium.org>

        [V8] V8Utilities::throwTypeMismatchException() should use setDOMException()
        https://bugs.webkit.org/show_bug.cgi?id=93610

        Reviewed by Adam Barth.

        Given that V8Utilities::throwTypeMismatchException() throws a DOM exception,
        we should use setDOMException() instead of throwError().

        This patch also renames throwTypeMismatchException() to setTypeMismatchException().

        No tests. I couldn't figure out how to trigger the call path.
        Either way this is just a minor change of error message.

        * bindings/v8/V8Utilities.cpp:
        (WebCore::setTypeMismatchException):
        * bindings/v8/V8Utilities.h:
        (WebCore::createFunctionOnlyCallback):

2012-08-09  Julien Chaffraix  <jchaffraix@webkit.org>

        Crash in WebCore::RenderTable::cellBefore
        https://bugs.webkit.org/show_bug.cgi?id=91160

        Reviewed by Abhishek Arya.

        The issue was that we wouldn't properly set the row index on row in a newly split table. When inserting
        the cell into the new row, we would try to repaint the cell which would access the row index and crash.
        This came from splitAnonymousBoxesAroundChild calling RenderObjectChildList::insertChildNode directly
        which doesn't invoke the row setting logic (RenderTableSection::addChild for example but we cannot call
        addChild due to concern over splitting flows in the general case).

        Test: fast/table/split-anonymous-boxes-around-table-repaint-crash.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::splitAnonymousBoxesAroundChild):
        Dirty our parent box, which forces a cell recomputation which will set the row index. This needs to
        be done *before* we insert the child to avoid crashing when repainting the new child.

2012-08-09  Erik Arvidsson  <arv@chromium.org>

        [V8] Fix issues with [DoNotCheckSecurity] which depended on non ES5 compliant behavior
        https://bugs.webkit.org/show_bug.cgi?id=93555

        Reviewed by Kentaro Hara.

        Before this change we were relying on a V8 bug where instance properties could be shadow
        read only properties on the prototype. With this change we no longer depend on this incorrect
        V8 behavior and instead use a hidden v8 property that is only returned if the code can access
        the frame.

        No new tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateDomainSafeFunctionGetter):
        (GenerateDomainSafeFunctionSetter):
        (GenerateNonStandardFunction):
        (GenerateImplementation):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        (WebCore::TestActiveDOMObjectV8Internal::postMessageAttrGetter):
        (WebCore::TestActiveDOMObjectV8Internal::TestActiveDOMObjectDomainSafeFunctionSetter):
        (TestActiveDOMObjectV8Internal):
        (WebCore::ConfigureV8TestActiveDOMObjectTemplate):

2012-08-09  David Grogan  <dgrogan@chromium.org>

        IndexedDB: intversion-long-queue.html fails an assert
        https://bugs.webkit.org/show_bug.cgi?id=92783

        Reviewed by Tony Chang.

        onBlocked needs the same shouldEnqueueEvent check that the other
        event generators have.

        Tests: intversion-long-queue is no longer skipped.

        * Modules/indexeddb/IDBRequest.h:
        (IDBRequest):
        * Modules/indexeddb/IDBVersionChangeRequest.cpp:
        (WebCore::IDBVersionChangeRequest::onBlocked):

2012-08-09  Eric Penner  <epenner@google.com>

        [chromium] Paint animated layers immediately to avoid animation hiccups.
        https://bugs.webkit.org/show_bug.cgi?id=93028

        Reviewed by Adrienne Walker.

        This is a technique used on Android, which is very prone
        to hiccups in animations. Paint the entire layer if it is
        of reasonable size such that there is no hiccups when the
        animation reaches unpainted content. The reasonable size
        is choosen for page-transitions specifically, as this was
        the problem case (animations would just jump to the end).

        Since we already have a special case this just modifies it
        and replaces the unit test with a new one. This can be
        improved/simplified further when distances/directions are
        available for the animated layers.

        Replaced one test.

        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (UpdatableTile):
        (WebCore::UpdatableTile::resetUpdateState):
        (WebCore::UpdatableTile::markForUpdate):
        (WebCore::UpdatableTile::UpdatableTile):
        (WebCore::TiledLayerChromium::TiledLayerChromium):
        (WebCore::TiledLayerChromium::pushPropertiesTo):
        (WebCore):
        (WebCore::TiledLayerChromium::updateTiles):
        (WebCore::TiledLayerChromium::markOcclusionsAndRequestTextures):
        (WebCore::TiledLayerChromium::haveTexturesForTiles):
        (WebCore::TiledLayerChromium::markTilesForUpdate):
        (WebCore::TiledLayerChromium::updateTileTextures):
        (WebCore::TiledLayerChromium::setTexturePrioritiesInRect):
        (WebCore::TiledLayerChromium::resetUpdateState):
        (WebCore::TiledLayerChromium::updateContentRect):
        (WebCore::TiledLayerChromium::needsIdlePaint):
        (WebCore::TiledLayerChromium::idlePaintRect):
        * platform/graphics/chromium/TiledLayerChromium.h:
        (TiledLayerChromium):
        * platform/graphics/chromium/cc/CCLayerTilingData.cpp:
        (WebCore::CCLayerTilingData::contentRectToTileIndices):
        * platform/graphics/chromium/cc/CCPriorityCalculator.h:
        (WebCore::CCPriorityCalculator::maxPriority):

2012-08-09  Julien Chaffraix  <jchaffraix@webkit.org>

        REGRESSION(r117339): cell in block-level table in inline-block are aligned with their last line box
        https://bugs.webkit.org/show_bug.cgi?id=91137

        Reviewed by Tony Chang.

        Fixed the code to properly ignore any inline-table's baseline for the purpose of 'inline-block' baseline computation.
        See http://lists.w3.org/Archives/Public/www-style/2012Jul/0721.html about the discussion.

        While touching the code, properly fixed the table baseline logic that was wrong because it wrongly piggy-backed
        on the inline-block baseline logic.

        Tests: fast/table/anonymous-table-no-baseline-align.html
               fast/table/inline-table-in-inline-block-last-baseline-align.html

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::baselinePosition):
        Overrode this function: this is needed as RenderBlock assumes that isReplaced() == true
        means it is handling an inline-block, not a table.

        (WebCore::RenderTable::lastLineBoxBaseline):
        Table are ignored for the purpose of inline-block baseline determination.

        (WebCore::RenderTable::firstLineBoxBaseline):
        Inlined the code from getLineBoxBaseline. Added some comments to explain
        why this code works as expected in the 'table' case.

        * rendering/RenderTable.h:
        Added baselinePosition.

2012-08-09  Adam Barth  <abarth@webkit.org>

        Sandboxing view source documents is ineffective
        https://bugs.webkit.org/show_bug.cgi?id=93660

        Reviewed by Eric Seidel.

        Prior to this patch, Document::setIsViewSource changed the
        SecurityOrigin object on Document but didn't update the copy on
        DOMWindow. As a consequence, the security checks that use the copy on
        DOMWindow didn't notice the change and acted as if the document wasn't
        sandboxed.

        This bug wasn't present for most view source documents because
        HTMLViewSourceDocument sets the flag in its constructor. However, for
        view source documents created by the XMLTreeViewer, the bit was set at
        the end of parsing rather than during construction.

        This mechansim is really more of a mitigation than an important
        security check, and I was tempted to remove the sandboxing entirely
        given that sandboxing a document at the end of parsing isn't overly
        effective anyway. However, we can worry about that issue in a future
        patch.

        For the time being, this patch just synchronizes DOMWindow and
        Document's copy of the SecurityOrigin. The long-term solution here, of
        course, is to keep working on fixing
        https://bugs.webkit.org/show_bug.cgi?id=75793, which this patch gets us
        one (small) step closer to fixing.

        * dom/Document.cpp:
        (WebCore::Document::setIsViewSource):

2012-08-09  Benjamin Poulain  <bpoulain@apple.com>

        Append the unit in place when generating the text value of a CSSPrimitiveValue
        https://bugs.webkit.org/show_bug.cgi?id=93572

        Reviewed by Andreas Kling.

        Previously, the units were added to the formatted number by the operator+. This would create
        a new WTF::String for the unit, then use String::append() to add it to the number.

        This was ineffective because it required one malloc for the unit, followed by a realloc + copying
        the bytes.

        This patch adds handling for the unit directly in formatNumber() so that we only do one malloc
        and append the units in place.

        Avoiding the intermediate string is both more efficient (9% faster as seen from JavaScript)
        and generate more compact code (~8kb less code on x86_64).

        * css/CSSPrimitiveValue.cpp:
        (WebCore::formatNumber):
        (WebCore::CSSPrimitiveValue::customCssText):

2012-08-09  Elliott Sprehn  <esprehn@gmail.com>

        Reimplement RenderQuote placement algorithm
        https://bugs.webkit.org/show_bug.cgi?id=93056

        Reviewed by Eric Seidel.

        Greatly simplify the code that maintains the linked list of RenderQuotes. Now RenderQuote
        is placed into the linked list in computePreferredLogicalWidths on first access and is
        detached when destroyed (or explicitly removed).

        The new algorithm doesn't require walking up the tree of renderers when there are no
        RenderQuotes in the tree yet, and also removes the need to walk over every subtree
        when inserting in rendererSubtreeAttached.

        No new tests because this patch doesn't change any behavior.

        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::removeChildNode): Call detachQuote when removing from a child list.
        (WebCore::RenderObjectChildList::appendChildNode):
        (WebCore::RenderObjectChildList::insertChildNode):
        * rendering/RenderQuote.cpp:
        (WebCore::RenderQuote::RenderQuote):
        (WebCore::RenderQuote::~RenderQuote):
        (WebCore::RenderQuote::willBeDestroyed): Call detachQuote to ensure all destroyed quotes are detached.
        (WebCore::RenderQuote::originalText):
        (WebCore::RenderQuote::computePreferredLogicalWidths): Attach quote before computing the width.
        (WebCore):
        (WebCore::RenderQuote::attachQuote): Puts the RenderQuote in the linked list of quotes and computes the depth.
        (WebCore::RenderQuote::detachQuote): Removes the quote from the linked list.
        (WebCore::RenderQuote::updateDepth):
        * rendering/RenderQuote.h:
        (RenderQuote):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::diff): Return StyleDifferenceLayout if quotes change and remove check in styleDidChange in RenderQuote.
        * rendering/RenderView.cpp:
        (WebCore::RenderView::RenderView):
        * rendering/RenderView.h:
        (WebCore):
        (WebCore::RenderView::setRenderQuoteHead):
        (WebCore::RenderView::renderQuoteHead): Stores the first quote in the document.
        (RenderView):

2012-08-06  Nat Duca  <nduca@chromium.org>

        [chromium] Expose CCGraphicsContext as WebCompositorOutputSurface
        https://bugs.webkit.org/show_bug.cgi?id=92890

        Reviewed by James Robinson.

        * platform/graphics/chromium/cc/CCGraphicsContext.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
        (WebCore::CCLayerTreeHost::recreateContext):
        (WebCore::CCLayerTreeHost::createContext):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore):
        (CCLayerTreeHostClient):
        (WebCore::CCLayerTreeSettings::CCLayerTreeSettings):
        (CCLayerTreeSettings):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::onVSyncParametersChanged):
        (WebCore):
        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImplClient):
        * platform/graphics/chromium/cc/CCProxy.h:
        (WebKit):
        (WebCore):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (CCRendererClient):
        (WebCore::CCRendererClient::~CCRendererClient):
        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
        * platform/graphics/chromium/cc/CCResourceProvider.h:
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::recreateContext):
        (WebCore::CCThreadProxy::onVSyncParametersChanged):
        (WebCore):
        (WebCore::CCThreadProxy::beginFrame):
        * platform/graphics/chromium/cc/CCThreadProxy.h:

2012-08-09  Nat Duca  <nduca@chromium.org>

        Unreviewed, rolling out r125212.
        http://trac.webkit.org/changeset/125212
        https://bugs.webkit.org/show_bug.cgi?id=92890

        Compile failure on mac dbg builder

        * platform/graphics/chromium/cc/CCGraphicsContext.h:
        (WebCore):
        (CCGraphicsContext):
        (WebCore::CCGraphicsContext::create2D):
        (WebCore::CCGraphicsContext::create3D):
        (WebCore::CCGraphicsContext::context3D):
        (WebCore::CCGraphicsContext::CCGraphicsContext):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
        (WebCore::CCLayerTreeHost::recreateContext):
        (WebCore::CCLayerTreeHost::createContext):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore):
        (CCLayerTreeHostClient):
        (WebCore::CCLayerTreeSettings::CCLayerTreeSettings):
        (CCLayerTreeSettings):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImplClient):
        * platform/graphics/chromium/cc/CCProxy.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (CCRendererClient):
        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
        * platform/graphics/chromium/cc/CCResourceProvider.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::recreateContext):
        (WebCore::CCThreadProxy::beginFrame):
        * platform/graphics/chromium/cc/CCThreadProxy.h:

2012-08-09  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove V8Proxy::throwError(ExceptionCode&)
        https://bugs.webkit.org/show_bug.cgi?id=93605

        Reviewed by Adam Barth.

        (1) Pass Isolate around to V8Utilities::extractTransferables().
        (2) Replace throwError(ExceptionCode&) in V8Utilities::extractTransferables()
        with setDOMException(ExceptionCode&, Isolate*), which completely removes
        V8Proxy::throwError(ExceptionCode&) from the code base.
        (3) Remove V8Proxy::throwError(ExceptionCode&).

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateParametersCheck):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::acceptTransferListCallback):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::multiTransferListCallback):
        (WebCore::V8TestSerializedScriptValueInterface::constructorCallback):
        * bindings/v8/Dictionary.cpp:
        (WebCore::Dictionary::get):
        * bindings/v8/V8Proxy.h:
        (WebCore):
        * bindings/v8/V8Utilities.cpp:
        (WebCore::extractTransferables):
        (WebCore::getMessagePortArray):
        * bindings/v8/V8Utilities.h:
        (WebCore):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::handlePostMessageCallback):
        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
        (WebCore::handlePostMessageCallback):
        * bindings/v8/custom/V8IntentConstructor.cpp:
        (WebCore::V8Intent::constructorCallback):
        * bindings/v8/custom/V8MessageEventCustom.cpp:
        (WebCore::V8MessageEvent::initMessageEventCallback):
        * bindings/v8/custom/V8MessagePortCustom.cpp:
        (WebCore::handlePostMessageCallback):
        * bindings/v8/custom/V8WorkerCustom.cpp:
        (WebCore::handlePostMessageCallback):

2012-08-09  Kentaro Hara  <haraken@chromium.org>

        [V8] Rename V8BindingPerIsolateData to V8PerIsolateData
        https://bugs.webkit.org/show_bug.cgi?id=93592

        Reviewed by Adam Barth.

        For a better name. See discussion in bug 93333.

        No tests. No change in behavior.

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateImplementation):
        * bindings/scripts/test/V8/V8Float64Array.cpp:
        (WebCore::V8Float64Array::GetRawTemplate):
        (WebCore::V8Float64Array::GetTemplate):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        (WebCore::V8TestActiveDOMObject::GetRawTemplate):
        (WebCore::V8TestActiveDOMObject::GetTemplate):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
        (WebCore::V8TestCustomNamedGetter::GetRawTemplate):
        (WebCore::V8TestCustomNamedGetter::GetTemplate):
        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
        (WebCore::V8TestEventConstructor::GetRawTemplate):
        (WebCore::V8TestEventConstructor::GetTemplate):
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        (WebCore::V8TestEventTarget::GetRawTemplate):
        (WebCore::V8TestEventTarget::GetTemplate):
        * bindings/scripts/test/V8/V8TestException.cpp:
        (WebCore::V8TestException::GetRawTemplate):
        (WebCore::V8TestException::GetTemplate):
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore::V8TestInterface::GetRawTemplate):
        (WebCore::V8TestInterface::GetTemplate):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
        (WebCore::V8TestMediaQueryListListener::GetRawTemplate):
        (WebCore::V8TestMediaQueryListListener::GetTemplate):
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        (WebCore::V8TestNamedConstructor::GetRawTemplate):
        (WebCore::V8TestNamedConstructor::GetTemplate):
        * bindings/scripts/test/V8/V8TestNode.cpp:
        (WebCore::V8TestNode::GetRawTemplate):
        (WebCore::V8TestNode::GetTemplate):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::V8TestObj::GetRawTemplate):
        (WebCore::V8TestObj::GetTemplate):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore::V8TestSerializedScriptValueInterface::GetRawTemplate):
        (WebCore::V8TestSerializedScriptValueInterface::GetTemplate):
        * bindings/v8/DOMData.cpp:
        (WebCore::DOMData::getCurrentStore):
        * bindings/v8/DOMDataStore.cpp:
        (WebCore::DOMDataStore::allStores):
        * bindings/v8/ScriptGCEvent.cpp:
        (WebCore::isolateGCEventData):
        * bindings/v8/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::visitExternalStrings):
        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
        * bindings/v8/StaticDOMDataStore.cpp:
        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
        (WebCore::StaticDOMDataStore::~StaticDOMDataStore):
        * bindings/v8/V8Binding.cpp:
        (WebCore::V8PerIsolateData::visitExternalStrings):
        (WebCore::getToStringName):
        (WebCore::getToStringTemplate):
        * bindings/v8/V8Binding.h:
        (WebCore::ConstructorMode::ConstructorMode):
        (WebCore::ConstructorMode::~ConstructorMode):
        (WebCore::ConstructorMode::current):
        (WebCore::v8ExternalString):
        (WebCore::v8Integer):
        (WebCore::v8UnsignedInteger):
        * bindings/v8/V8DOMMap.cpp:
        (WebCore::DOMDataStoreHandle::DOMDataStoreHandle):
        (WebCore::DOMDataStoreHandle::~DOMDataStoreHandle):
        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::V8DOMWindowShell::initContextIfNeeded):
        * bindings/v8/V8GCController.cpp:
        (WebCore::currentGlobalHandleMap):
        (WebCore::V8GCController::gcPrologue):
        * bindings/v8/V8HiddenPropertyName.cpp:
        (WebCore):
        * bindings/v8/V8LazyEventListener.cpp:
        (WebCore::V8LazyEventListener::prepareListenerObject):
        * bindings/v8/V8PerIsolateData.cpp: Renamed from Source/WebCore/bindings/v8/V8BindingPerIsolateData.cpp.
        (WebCore):
        (WebCore::V8PerIsolateData::V8PerIsolateData):
        (WebCore::V8PerIsolateData::~V8PerIsolateData):
        (WebCore::V8PerIsolateData::create):
        (WebCore::V8PerIsolateData::ensureInitialized):
        (WebCore::V8PerIsolateData::dispose):
        (WebCore::V8PerIsolateData::reportMemoryUsage):
        * bindings/v8/V8PerIsolateData.h: Renamed from Source/WebCore/bindings/v8/V8BindingPerIsolateData.h.
        (WebCore):
        (V8PerIsolateData):
        (WebCore::V8PerIsolateData::current):
        (WebCore::V8PerIsolateData::rawTemplateMap):
        (WebCore::V8PerIsolateData::templateMap):
        (WebCore::V8PerIsolateData::toStringName):
        (WebCore::V8PerIsolateData::toStringTemplate):
        (WebCore::V8PerIsolateData::lazyEventListenerToStringTemplate):
        (WebCore::V8PerIsolateData::stringCache):
        (WebCore::V8PerIsolateData::integerCache):
        (WebCore::V8PerIsolateData::allStores):
        (WebCore::V8PerIsolateData::hiddenPropertyName):
        (WebCore::V8PerIsolateData::auxiliaryContext):
        (WebCore::V8PerIsolateData::registerDOMDataStore):
        (WebCore::V8PerIsolateData::unregisterDOMDataStore):
        (WebCore::V8PerIsolateData::domDataStore):
        (WebCore::V8PerIsolateData::setDOMDataStore):
        (WebCore::V8PerIsolateData::recursionLevel):
        (WebCore::V8PerIsolateData::incrementRecursionLevel):
        (WebCore::V8PerIsolateData::decrementRecursionLevel):
        (WebCore::V8PerIsolateData::globalHandleMap):
        (WebCore::V8PerIsolateData::internalScriptRecursionLevel):
        (WebCore::V8PerIsolateData::incrementInternalScriptRecursionLevel):
        (WebCore::V8PerIsolateData::decrementInternalScriptRecursionLevel):
        (WebCore::V8PerIsolateData::gcEventData):
        (WebCore::V8PerIsolateData::setShouldCollectGarbageSoon):
        (WebCore::V8PerIsolateData::clearShouldCollectGarbageSoon):
        (WebCore::V8PerIsolateData::shouldCollectGarbageSoon):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::hintForGCIfNecessary):
        * bindings/v8/V8RecursionScope.h:
        (WebCore::V8RecursionScope::V8RecursionScope):
        (WebCore::V8RecursionScope::~V8RecursionScope):
        (WebCore::V8RecursionScope::recursionLevel):
        (WebCore::V8RecursionScope::properlyUsed):
        (WebCore::V8RecursionScope::MicrotaskSuppression::MicrotaskSuppression):
        (WebCore::V8RecursionScope::MicrotaskSuppression::~MicrotaskSuppression):
        * bindings/v8/V8Utilities.cpp:
        (WebCore::V8AuxiliaryContext::auxiliaryContext):
        * bindings/v8/V8ValueCache.cpp:
        (WebCore::cachedStringCallback):
        * bindings/v8/WorkerContextExecutionProxy.cpp:
        (WebCore::WorkerContextExecutionProxy::initIsolate):
        * bindings/v8/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::WorkerScriptController):
        (WebCore::WorkerScriptController::~WorkerScriptController):
        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
        (WebCore::V8HTMLCanvasElement::getContextCallback):

2012-08-09  Mike West  <mkwst@chromium.org>

        Invalid Content Security Policy sources should generate console warnings.
        https://bugs.webkit.org/show_bug.cgi?id=93599

        Reviewed by Adam Barth.

        Given a Content Security Policy directive, we're currently correctly
        ignoring sources that we can't parse: "'slef'", "http:///", etc. have
        no effect on the protected resource's active policy. We're not, however
        telling the developer what we're doing, which can lead to confusion.
        This patch adds a console warning whenever an invalid source expression
        is encountered while parsing a directive in order to make WebKit's
        behavior more transparent to the developer.

        There should be no functional change as a result of this patch: the
        policy should be parsed exactly as before, it should simply be more
        verbose.

        Test: http/tests/security/contentSecurityPolicy/source-list-parsing-07.html

        * page/ContentSecurityPolicy.cpp:
        (WebCore::CSPSourceList::parse):
            Two changes: First, if 'parseSource' returns false, then log a
            warning to the developer's console. Second, if both the source and
            host are empty, but parsing succeeded, then we know we're dealing
            with either a wildcard- or keyword-source that was properly handled
            inside 'parseSource', so jump to the next source.
        (WebCore::CSPSourceList::parseSource):
            Wildcard- and keyword-sources now return 'true'. They parsed
            correctly, after all.
        (WebCore::ContentSecurityPolicy::reportInvalidSourceExpression):
            Log a console warning if an invalid source expression is present in
            a CSP directive's value.
        (WebCore):
        * page/ContentSecurityPolicy.h:

2012-08-06  Nat Duca  <nduca@chromium.org>

        [chromium] Expose CCGraphicsContext as WebCompositorOutputSurface
        https://bugs.webkit.org/show_bug.cgi?id=92890

        Reviewed by James Robinson.

        * platform/graphics/chromium/cc/CCGraphicsContext.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
        (WebCore::CCLayerTreeHost::recreateContext):
        (WebCore::CCLayerTreeHost::createContext):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore):
        (CCLayerTreeHostClient):
        (WebCore::CCLayerTreeSettings::CCLayerTreeSettings):
        (CCLayerTreeSettings):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::onVSyncParametersChanged):
        (WebCore):
        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImplClient):
        * platform/graphics/chromium/cc/CCProxy.h:
        (WebKit):
        (WebCore):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (CCRendererClient):
        (WebCore::CCRendererClient::~CCRendererClient):
        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
        * platform/graphics/chromium/cc/CCResourceProvider.h:
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::recreateContext):
        (WebCore::CCThreadProxy::onVSyncParametersChanged):
        (WebCore):
        (WebCore::CCThreadProxy::beginFrame):
        * platform/graphics/chromium/cc/CCThreadProxy.h:

2012-08-09  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>

        [css3-text] Add suport for -webkit-text-decoration-line
        https://bugs.webkit.org/show_bug.cgi?id=90959

        Reviewed by Kenneth Rohde Christiansen.

        This patch implements the "text-decoration-line" property specified in CSS3
        working draft, with "-webkit-" prefix. The specification can be found below:
        http://dev.w3.org/csswg/css3-text/#text-decoration-line

        Additionally, Mozilla implementation details can be found here:
        https://developer-dev.allizom.org/en-US/docs/CSS/text-decoration-line

        It is important to notice that "-webkit-text-decoration-line" and
        "text-decoration" properties shares the same property handlers, however, the
        former resets the latter if value from latter doesn't have "important" value
        set (same behavior as Firefox). In a rare case where both properties have
        "important" value set, the text decoration gets value from the last parsed
        property.

        Test: fast/css/text-decoration-line.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::renderTextDecorationFlagsToCSSValue):
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::addTextDecorationProperty):
        (WebCore::CSSParser::parseTextDecoration):
        * css/CSSParser.h:
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-08-09  Huang Dongsung  <luxtella@company100.net>

        Extract the definition of NativeImagePtr from ImageSource.h into NativeImagePtr.h.
        https://bugs.webkit.org/show_bug.cgi?id=93466

        Reviewed by Adam Barth.

        Image.h includes ImageSource.h in order to know the definition of NativeImagePtr.
        But Image does not need to know the definition of ImageSource. So, this patch
        extracts the definition of NativeImagePtr from ImageSource.h into NativeImagePtr.h.

        This is a preparation for asynchronous image decoding. Async decoding
        will need a callback function, which sends a NativeImagePtr to clients, and the
        callback must know the definition of NativeImagePtr, not ImageSource.

        No new tests, behavior is unchanged.

        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/BitmapImage.h:
        * platform/graphics/Image.h:
        * platform/graphics/ImageSource.h:
        (WebCore):
        * platform/graphics/NativeImagePtr.h: Added.
        (WebCore):

2012-08-09  Robert Hogan  <robert@webkit.org>

        CSS 2.1 failure: 'Text-indent' only affects a line if it is the first formatted line of an element
        https://bugs.webkit.org/show_bug.cgi?id=63185

        Reviewed by Eric Seidel.

        Per CSS 2.1 (http://www.w3.org/TR/CSS21/text.html) : "'Text-indent' only affects a line if it is the 
        first formatted line of an element. For example, the first line of an anonymous block box is only 
        affected if it is the first child of its parent element."

        Tests: fast/css/text-indent-first-line-001.html
               fast/css/text-indent-first-line-002.html
               fast/css/text-indent-first-line-003.html
               fast/css/text-indent-first-line-004.html
               fast/css/text-indent-first-line-005.html
               fast/css/text-indent-first-line-006.html

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine): As well as being the first line under a parent block,
          check that this is also the first *formatted* line of an element by ensuring that we are at the start of a 
          formatting context and not just a continuation of a previous anonymous block in an existing formatting context.

2012-08-09  Jan Keromnes  <janx@linux.com>

        Web Inspector: replace the Web Inspector editor with CodeMirror
        https://bugs.webkit.org/show_bug.cgi?id=92769

        Reviewed by Pavel Feldman.

        Integrating CodeMirror as a devtools experiment. Currently supporting
        basic editing, search/replacing, and saving. Missing proper breakpoints
        wiring, debugging, message bubbles, popovers and context menus. WIP.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/CodeMirrorTextEditor.js: Added.
        (WebInspector.CodeMirrorTextEditor.this._codeMirror.CodeMirror):
        (WebInspector.CodeMirrorTextEditor):
        (WebInspector.CodeMirrorTextEditor.prototype.set mimeType):
        (WebInspector.CodeMirrorTextEditor.prototype.setReadOnly):
        (WebInspector.CodeMirrorTextEditor.prototype.readOnly):
        (WebInspector.CodeMirrorTextEditor.prototype.defaultFocusedElement):
        (WebInspector.CodeMirrorTextEditor.prototype.focus):
        (WebInspector.CodeMirrorTextEditor.prototype.revealLine):
        (WebInspector.CodeMirrorTextEditor.prototype.addDecoration):
        (WebInspector.CodeMirrorTextEditor.prototype.removeDecoration):
        (WebInspector.CodeMirrorTextEditor.prototype.markAndRevealRange):
        (WebInspector.CodeMirrorTextEditor.prototype.highlightLine):
        (WebInspector.CodeMirrorTextEditor.prototype.clearLineHighlight):
        (WebInspector.CodeMirrorTextEditor.prototype.freeCachedElements):
        (WebInspector.CodeMirrorTextEditor.prototype.elementsToRestoreScrollPositionsFor):
        (WebInspector.CodeMirrorTextEditor.prototype.inheritScrollPositions):
        (WebInspector.CodeMirrorTextEditor.prototype.beginUpdates):
        (WebInspector.CodeMirrorTextEditor.prototype.endUpdates):
        (WebInspector.CodeMirrorTextEditor.prototype.onResize):
        (WebInspector.CodeMirrorTextEditor.prototype.editRange):
        (WebInspector.CodeMirrorTextEditor.prototype._onChange):
        (WebInspector.CodeMirrorTextEditor.prototype._commitEditing):
        (WebInspector.CodeMirrorTextEditor.prototype.scrollToLine):
        (WebInspector.CodeMirrorTextEditor.prototype.selection):
        (WebInspector.CodeMirrorTextEditor.prototype.lastSelection):
        (WebInspector.CodeMirrorTextEditor.prototype.setSelection):
        (WebInspector.CodeMirrorTextEditor.prototype.setText):
        (WebInspector.CodeMirrorTextEditor.prototype.text):
        (WebInspector.CodeMirrorTextEditor.prototype.range):
        (WebInspector.CodeMirrorTextEditor.prototype.line):
        (WebInspector.CodeMirrorTextEditor.prototype.get linesCount):
        (WebInspector.CodeMirrorTextEditor.prototype.setAttribute):
        (WebInspector.CodeMirrorTextEditor.prototype.getAttribute):
        (WebInspector.CodeMirrorTextEditor.prototype.removeAttribute):
        (WebInspector.CodeMirrorTextEditor.prototype.wasShown):
        (WebInspector.CodeMirrorTextEditor.prototype.willHide):
        (WebInspector.CodeMirrorTextEditor.prototype._textChanged):
        (WebInspector.CodeMirrorTextEditor.prototype._toPos):
        (WebInspector.CodeMirrorTextEditor.prototype._toRange):
        * inspector/front-end/Settings.js:
        (WebInspector.ExperimentsSettings):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/cmdevtools.css: Added.
        * inspector/front-end/inspector.html:

2012-08-09  Dana Jansens  <danakj@chromium.org>

        [chromium] Do partial-swap scissoring on quads during draw instead of on layers
        https://bugs.webkit.org/show_bug.cgi?id=91800

        Reviewed by Adrienne Walker.

        Computing the scissor rect for each render pass is now done in
        LayerRendererChromium::drawRenderPass() instead of being done for each
        layer and then copied into the quads. This allows us to always push a
        full frame of quads (and include damage rects) from a child compositor,
        and do partial-swap scissoring in the host compositor.

        This also make partial-swap functionality completely contained within
        LayerRendererChromium!

        The scissorRect is removed from all layers, and the concept of
        scissorRect is now misplaced in CCOcclusionTracker, so the variables
        and methods in the tracker should be renamed to more appropriate
        things.

        Covered by existing tests, as well as: CCLayerTreeHostImplTest.textureCachingWithScissor

        * platform/graphics/chromium/LayerChromium.h:
        (LayerChromium):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::clearFramebuffer):
        (WebCore::LayerRendererChromium::renderPassTextureSize):
        (WebCore::LayerRendererChromium::drawFrame):
        (WebCore::LayerRendererChromium::drawRenderPass):
        (WebCore::LayerRendererChromium::drawQuad):
        (WebCore::LayerRendererChromium::drawDebugBorderQuad):
        (WebCore::LayerRendererChromium::drawBackgroundFilters):
        (WebCore::LayerRendererChromium::drawTileQuad):
        (WebCore::LayerRendererChromium::swapBuffers):
        (WebCore::LayerRendererChromium::useRenderPass):
        (WebCore::LayerRendererChromium::setScissorToRect):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        (DrawingFrame):
        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
        * platform/graphics/chromium/RenderSurfaceChromium.h:
        (RenderSurfaceChromium):
        * platform/graphics/chromium/cc/CCDrawQuad.h:
        (WebCore::CCDrawQuad::clippedRectInTarget):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::createSharedQuadState):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::updateLayers):
        (WebCore::CCLayerTreeHost::paintLayerContents):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateVisibleRectsInternal):
        (WebCore::CCLayerTreeHostCommon::calculateVisibleRects):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.h:
        (CCLayerTreeHostCommon):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::CCLayerTreeHostImpl::drawLayers):
        (WebCore::CCLayerTreeHostImpl::swapBuffers):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::::layerScissorRectInTargetSurface):
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::CCRenderPass):
        (WebCore::CCRenderPass::appendQuadsToFillScreen):
        * platform/graphics/chromium/cc/CCRenderPass.h:
        (CCRenderPass):
        (WebCore::CCRenderPass::transformToRootTarget):
        (WebCore::CCRenderPass::outputRect):
        (WebCore::CCRenderPass::damageRect):
        (WebCore::CCRenderPass::setDamageRect):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::computeClippedRectInTarget):
        (WebCore):
        (WebCore::CCRenderSurface::createSharedQuadState):
        (WebCore::CCRenderSurface::createReplicaSharedQuadState):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (CCRenderSurface):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (CCRenderer):
        * platform/graphics/chromium/cc/CCSharedQuadState.cpp:
        (WebCore::CCSharedQuadState::create):
        (WebCore::CCSharedQuadState::CCSharedQuadState):
        * platform/graphics/chromium/cc/CCSharedQuadState.h:
        (CCSharedQuadState):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
        (WebCore::CCTiledLayerImpl::appendQuads):

2012-08-09  Mike West  <mkwst@chromium.org>

        Content Security Policy directives that begin with an invalid character should log a console warning.
        https://bugs.webkit.org/show_bug.cgi?id=93622

        Reviewed by Adam Barth.

        CSP directives containing unrecognized characters somewhere in the
        middle were caught and logged by the current algorithm. We additionally
        caught the case in which the directive begins with an invalid character,
        but we silently ignored it. Now we're slightly more vocal.

        This change also exits 'parseDirective' early in the case where the
        directive text is empty, or filled only with whitespace. There doesn't
        seem to be any value in flagging that case, as it has no impact on the
        way the policy would have been interpreted (that is, 'img-src *;;...'
        doesn't change in meaning by ignoring the empty directive between the
        semicolons).

        Test: http/tests/security/contentSecurityPolicy/directive-parsing-05.html

        * page/ContentSecurityPolicy.cpp:
        (WebCore::CSPDirectiveList::parseDirective):
            Two changes: first, we now exit early if the entire directive text
            is empty (e.g. ';;;' or ';      ;'); second, if the directive begins
            with a character that doesn't match 'isDirectiveNameCharacter', then
            we advance either to the next space, or the end of the value, and
            report an unrecognized directive to the policy.

2012-08-09  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Pass mask scale and offset to shaders for correct masking
        https://bugs.webkit.org/show_bug.cgi?id=93558

        Reviewed by Adrienne Walker.

        In chromium compositor code, the mask was accidentally mapped 1:1
        to the layer's renderSurface, rather than the layer itself. This
        patch adds a layout test that reproduces the error and fixes the
        problem. The solution we opted for in this patch is to pass a
        scale and offset to the fragment shader, so that the correct
        texture coordinate lookup is computed by the fragment shader.

        Test: compositing/masks/mask-of-clipped-layer.html

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
        * platform/graphics/chromium/ShaderChromium.cpp:
        (WebCore::FragmentShaderRGBATexAlphaMask::FragmentShaderRGBATexAlphaMask):
        (WebCore::FragmentShaderRGBATexAlphaMask::init):
        (WebCore::FragmentShaderRGBATexAlphaMask::getShaderString):
        (WebCore::FragmentShaderRGBATexAlphaMaskAA::FragmentShaderRGBATexAlphaMaskAA):
        (WebCore::FragmentShaderRGBATexAlphaMaskAA::init):
        (WebCore::FragmentShaderRGBATexAlphaMaskAA::getShaderString):
        * platform/graphics/chromium/ShaderChromium.h:
        (WebCore::FragmentShaderRGBATexAlphaMask::maskTexCoordScaleLocation):
        (WebCore::FragmentShaderRGBATexAlphaMask::maskTexCoordOffsetLocation):
        (FragmentShaderRGBATexAlphaMask):
        (WebCore::FragmentShaderRGBATexAlphaMaskAA::maskTexCoordScaleLocation):
        (WebCore::FragmentShaderRGBATexAlphaMaskAA::maskTexCoordOffsetLocation):
        (FragmentShaderRGBATexAlphaMaskAA):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
        (WebCore::CCRenderPassDrawQuad::create):
        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
        (CCRenderPassDrawQuad):
        (WebCore::CCRenderPassDrawQuad::maskTexCoordScaleX):
        (WebCore::CCRenderPassDrawQuad::maskTexCoordScaleY):
        (WebCore::CCRenderPassDrawQuad::maskTexCoordOffsetX):
        (WebCore::CCRenderPassDrawQuad::maskTexCoordOffsetY):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::appendQuads):

2012-08-09  Mihnea Ovidenie  <mihnea@adobe.com>

        CSSRegions: Crash when attaching a region to the removed named flow
        https://bugs.webkit.org/show_bug.cgi?id=93204

        Reviewed by Abhishek Arya.

        The crash happens because the flow thread reference is passed to the RenderRegion object
        when the RenderRegion object is created. However, it is only in RenderRegion::attachRegion method
        when the region is taken into account and stored in flow thread regions list. Under these circumstances,
        it is possible that the flow thread passed to the region at the moment of region creation be destroyed
        before the region gets the chance to be attached to the flow thread and a crash will occur.

        This patch moves the moment when the RenderRegion object stores its 'weak' reference to the flow thread
        from RenderRegion constructor to attachRegion method, preventing the situation in which the region is attached
        to a wrong flow thread object.

        Test: fast/regions/region-attached-wrong-flow-crash.html

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::createObject): Pass 0 instead of a reference to the flow thread.
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::checkRegionStyle): Added this function to check whether the region has region style rules attached.
        (WebCore):
        (WebCore::RenderRegion::styleDidChange): Use checkRegionStyle.
        (WebCore::RenderRegion::attachRegion): Store the reference to the flow thread. If the flow thread does not exist, it will be created.
        Also, check whether the region has region style rules attached, since at this moment the region has a flow thread. Checking whether
        the region has region style rules is not enough in styleDidChange, because styleDidChange is sometimes triggered before attachRegion.
        * rendering/RenderRegion.h:
        (RenderRegion):

2012-08-09  Iain Merrick  <husky@chromium.org>

        [chromium] Enable kerning on Android
        https://bugs.webkit.org/show_bug.cgi?id=92737

        Reviewed by Adam Barth.

        This #ifdef was incorrectly copied from our forked WebKit repository
        while unforking our Android-specific changes. Kerning works without
        any known problems.

        Covered by existing tests (layout and instrumentation tests).

        * platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp:
        (WebCore::ComplexTextController::ComplexTextController):

2012-08-09  'Pavel Feldman'  <pfeldman@chromium.org>

        Web Inspector: follow up to r125174 - fix subtype use.

        Not reviewed, trivial fix.

        * inspector/InjectedScriptSource.js:
        (.):

2012-08-09  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: DocumentEventQueue memory instrumentation
        https://bugs.webkit.org/show_bug.cgi?id=93604

        Reviewed by Pavel Feldman.

        Provided DocumentEventQueue:: reportMemoryUsage implementation.

        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        * dom/DocumentEventQueue.cpp:
        (WebCore::DocumentEventQueue::reportMemoryUsage):
        (WebCore):
        * dom/DocumentEventQueue.h:
        (WebCore):
        * dom/Event.cpp:
        (WebCore::Event::reportMemoryUsage):
        (WebCore):
        * dom/Event.h:
        (WebCore):
        (Event):

2012-08-09  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: add codemirror library as an experiment
        https://bugs.webkit.org/show_bug.cgi?id=93620

        Reviewed by Vsevolod Vlasov.

        This change adds codemirror, deploys it, but does not include it into the inspector.html. Clients need to fetch it
        using XHR and eval into the inspector's context to use as a part of their experiments.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/cm/LICENSE: Added.
        * inspector/front-end/cm/codemirror.css: Added.
        (.CodeMirror):
        * inspector/front-end/cm/xml.js: Added.
        (CodeMirror.defineMode.):
        (CodeMirror.defineMode):

2012-08-09  Xan Lopez  <xlopez@igalia.com>

        1.9.6 drops symbols, breaking compatibility
        https://bugs.webkit.org/show_bug.cgi?id=93477

        Reviewed by Carlos Garcia Campos.

        Expose documentURI as writable again for the GObject DOM
        bindings. DOM4 makes it read-only, but we need to revert to the
        old state for compatibility reasons, just like Objective C.

        * dom/Document.idl: ditto.

2012-08-09  Mario Sanchez Prada  <msanchez@igalia.com>

        REGRESSION (r124997): Flaky crashes in two tests
        https://bugs.webkit.org/show_bug.cgi?id=93501

        Reviewed by Martin Robinson.

        Add missing null check to make sure we early return if the
        accessibility object does not have a valid parent exposed in the
        accessibility hierarchy.

        * accessibility/gtk/AXObjectCacheAtk.cpp:
        (WebCore::emitTextChanged): Add missing null check.

2012-08-09  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: generate preview for the objects dumped into the console upon logging.
        https://bugs.webkit.org/show_bug.cgi?id=35801

        Reviewed by Vsevolod Vlasov.

        As of today, dumping an object (array) into console will result in objects' properties being
        read upon console object expansion (i.e. lazily). This means that dumping the same object while
        mutating it will be hard to debug using the console.

        This change starts generating abbreviated previews for objects / arrays at the moment of their
        logging and passes this information along into the front-end. This only happens when the front-end
        is already opened, it only works for console.log(), not live console interaction.

        Covered by the existing console tests + collections test has been expanded to capture both: pre and post-

        * inspector/ConsoleMessage.cpp:
        (WebCore::ConsoleMessage::addToFrontend):
        * inspector/ConsoleMessage.h:
        (ConsoleMessage):
        * inspector/InjectedScript.cpp:
        (WebCore::InjectedScript::wrapObject):
        * inspector/InjectedScript.h:
        (InjectedScript):
        * inspector/InjectedScriptSource.js:
        (.):
        * inspector/Inspector.json:
        * inspector/InspectorConsoleAgent.cpp:
        (WebCore::InspectorConsoleAgent::enable):
        (WebCore::InspectorConsoleAgent::addConsoleMessage):
        * inspector/front-end/ConsoleMessage.js:
        (WebInspector.ConsoleMessageImpl.prototype._format):
        (WebInspector.ConsoleMessageImpl.prototype._formatParameter):
        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsObject):
        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsArrayOrObject):
        (WebInspector.ConsoleMessageImpl.prototype._appendObjectPreview):
        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsNode):
        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsArray):
        (WebInspector.ConsoleMessageImpl.prototype._printArray):
        (WebInspector.ConsoleMessageImpl.prototype._formatAsArrayEntry):
        (WebInspector.ConsoleMessageImpl.prototype._formatWithSubstitutionString):
        * inspector/front-end/DOMExtension.js:
        (Element.prototype.createTextChild):
        * inspector/front-end/ObjectPropertiesSection.js:
        (WebInspector.ObjectPropertiesSection):
        * inspector/front-end/PropertiesSection.js:
        * inspector/front-end/RemoteObject.js:
        (WebInspector.RemoteObject):
        (WebInspector.RemoteObject.fromPayload):
        (WebInspector.RemoteObject.prototype.get preview):
        * inspector/front-end/Section.js:
        * inspector/front-end/inspector.css:
        (.console-group-messages .section .header .title):
        (.section .console-formatted-node):
        (.console-object-preview):
        (.section .properties .name, .event-properties .name, .console-formatted-object .name):

2012-08-09  Keishi Hattori  <keishi@webkit.org>

        Page popups can show up at wrong locations
        https://bugs.webkit.org/show_bug.cgi?id=93556

        Reviewed by Kent Tamura.

        No new tests. Cannot test popup position.

        * html/shadow/CalendarPickerElement.cpp:
        (WebCore::CalendarPickerElement::contentSize):

2012-08-08  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: display progress bar while loading timeline data
        https://bugs.webkit.org/show_bug.cgi?id=92762

        Reviewed by Pavel Feldman.

        - display progress while loading timeline data;
        - disable status bar buttons while operation is in progress;
        - ignore save/load/record while operation is in progress;
        - disable context menu items while operation is in progress;
        - misc. compilation warning fixes;

        * inspector/front-end/ProgressBar.js:
        (WebInspector.CompositeProgress.prototype.createSubProgress):
        * inspector/front-end/TimelineModel.js:
        (WebInspector.TimelineModel.prototype._loadNextChunk):
        (WebInspector.TimelineModel.prototype.loadFromFile.parseAndImportData):
        (WebInspector.TimelineModel.prototype.loadFromFile.onLoad):
        (WebInspector.TimelineModel.prototype.loadFromFile.onError):
        (WebInspector.TimelineModel.prototype.loadFromFile.onProgress):
        (WebInspector.TimelineModel.prototype.loadFromFile):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel):
        (WebInspector.TimelinePanel.prototype.get statusBarItems):
        (WebInspector.TimelinePanel.prototype._createStatusBarItems):
        (WebInspector.TimelinePanel.prototype._setOperationInProgress):
        (WebInspector.TimelinePanel.prototype._contextMenu):
        (WebInspector.TimelinePanel.prototype._saveToFile):
        (WebInspector.TimelinePanel.prototype._loadFromFile):
        (WebInspector.TimelinePanel.prototype.get _toggleTimelineButtonClicked):
        (WebInspector.TimelinePanel.prototype.sidebarResized):
        * inspector/front-end/utilities.js: added Array.prototype.select(field) to map array of objects to array containing particular field of each object.

2012-08-09  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Floored and truncated rounded confused.
        https://bugs.webkit.org/show_bug.cgi?id=93475

        Reviewed by Levi Weintraub.

        Fix the common mistake of confusing truncating (round towards zero) and
        flooring (round down). They are only identical for positive numbers,
        not for negative numbers.

        This patch fixes instances of misimplemented or misused floor in the
        layout and geometric code. And also uses the new correct implementations
        to clean up the code for enclosingRect.

        * platform/FractionalLayoutUnit.h:
        (WebCore::FractionalLayoutUnit::fromFloatFloor):
        (FractionalLayoutUnit):
        (WebCore::FractionalLayoutUnit::ceil):
        (WebCore::FractionalLayoutUnit::floor):
        * platform/graphics/FloatPoint.h:
        (WebCore::FloatPoint::FloatPoint):
        (WebCore::roundedIntPoint):
        (WebCore::flooredIntPoint):
        (WebCore::ceiledIntPoint):
        (WebCore::flooredIntSize):
        * platform/graphics/FloatRect.cpp:
        (WebCore::enclosingIntRect):
        (WebCore::enclosedIntRect):
        * platform/graphics/FloatSize.h:
        (WebCore::roundedIntSize):
        (WebCore::flooredIntSize):
        (WebCore::flooredIntPoint):
        * platform/graphics/FractionalLayoutPoint.h:
        (WebCore::flooredIntPoint):
        (WebCore::flooredFractionalLayoutPoint):
        (WebCore::ceiledFractionalLayoutPoint):
        * platform/graphics/FractionalLayoutRect.cpp:
        (WebCore::enclosingIntRect):
        (WebCore::enclosingFractionalLayoutRect):
        * platform/graphics/FractionalLayoutSize.h:
        (WebCore::flooredIntSize):
        * platform/graphics/IntRect.cpp:
        (WebCore::IntRect::IntRect):
        * rendering/LayoutTypes.h:
        (WebCore::flooredLayoutPoint):
        (WebCore::floorToInt):
        (WebCore::isIntegerValue):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::convertToLayerCoords):

2012-08-07  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: use WebInspector.ProgressIndicator in AdvancedSearchController
        https://bugs.webkit.org/show_bug.cgi?id=93362

        Reviewed by Vsevolod Vlasov.

        - drop custom status bar used in AdvancedSearchController, use WebInspector.ProgressIndicator;
        - perform additional cancelation check after invoking searchResultCallback to account for stopSearch called from within callback;
        - fix compilation warnings in ProgressBar;

        * inspector/front-end/AdvancedSearchController.js:
        (WebInspector.SearchView):
        (WebInspector.SearchView.prototype.searchStarted):
        (WebInspector.SearchView.prototype.addSearchResult):
        (WebInspector.SearchView.prototype.searchFinished):
        (WebInspector.SearchView.prototype._onCancel):
        * inspector/front-end/ProgressBar.js:
        (WebInspector.CompositeProgress.prototype.createSubProgress):
        * inspector/front-end/ScriptsSearchScope.js:
        (WebInspector.ScriptsSearchScope.prototype.performSearch.searchCallbackWrapper):
        * inspector/front-end/inspector.css:
        (.progress-bar-container progress):
        (body.platform-mac .progress-bar-container progress):

2012-08-09  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: improve large array logging experience
        https://bugs.webkit.org/show_bug.cgi?id=93499

        Reviewed by Vsevolod Vlasov.

        Group elements in chunks of 100, not smaller. 

        * inspector/front-end/ObjectPropertiesSection.js:
        (WebInspector.FunctionScopeMainTreeElement):
        (WebInspector.FunctionScopeMainTreeElement.prototype.onpopulate):
        (WebInspector.ArrayGroupingTreeElement._populateRanges):

2012-08-09  MORITA Hajime  <morrita@google.com>

        DOMCharacterDataModified should not be fired inside shadows
        https://bugs.webkit.org/show_bug.cgi?id=93427

        Reviewed by Ryosuke Niwa.

        CharacterData::dispatchModifiedEvent() fires DOMCharacterDataModified event even if
        the node is in shadow. But it shouldn't. Check dispatchChildInsertionEvents() and
        dispatchChildRemovalEvents() to see how other MutationEvents are suppressed behind shadows.
        This change follows the same path to suppress DOMCharacterDataModified.

        Tests: fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html
               fast/forms/textarea-and-mutation-events-appending-text.html

        * dom/CharacterData.cpp:
        (WebCore::CharacterData::dispatchModifiedEvent):

2012-08-09  Eric Seidel  <eric@webkit.org>

        Use m_everHadLayout in RenderObject::checkForRepaintDuringLayout()
        https://bugs.webkit.org/show_bug.cgi?id=20885

        Reviewed by Dan Bernstein.

        Fix FIXME in checkForRepaintDuringLayout, making RenderObjects
        no longer paint on first layout, but instead require their
        parent containers to paint them.
        This appears to have fixed one minor SVG overpainting issue
        in svg/use-detach-expected.png.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::layoutBlock):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::checkForRepaintDuringLayout):
        * rendering/svg/SVGRenderSupport.cpp:
        (WebCore::SVGRenderSupport::layoutChildren):

2012-08-08  Arko Saha  <arko@motorola.com>

        Microdata: PropertyNodeList cache should be invalidated on id attribute change.
        https://bugs.webkit.org/show_bug.cgi?id=93485

        Reviewed by Ryosuke Niwa.

        Invalidate PropertyNodeList cache when id attribute of an element changed/modified.

        Test: fast/dom/MicroData/propertiescollection-on-changing-id-attr.html

        * dom/DynamicNodeList.cpp: Moved ownerNodeHasItemRefAttribute() method to DynamicNodeList.h
        (WebCore):
        * dom/DynamicNodeList.h:
        (WebCore):
        (WebCore::DynamicNodeListCacheBase::isRootedAtDocument): Return true if owner has itemref
        attribute specified with root type NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr.
        (WebCore::DynamicNodeListCacheBase::shouldInvalidateTypeOnAttributeChange): Return true if
        attrName is id attribute in case of InvalidateOnItemAttrChange.
        (WebCore::DynamicNodeListCacheBase::ownerNodeHasItemRefAttribute):

2012-08-09  Arko Saha  <arko@motorola.com>

        Microdata: HTMLPropertiesCollection does not contain all properties when item is not attached to the DOM tree.
        https://bugs.webkit.org/show_bug.cgi?id=93456

        Reviewed by Ryosuke Niwa.

        HTMLPropertiesCollection does not contain the item properties added through
        itemref attribute when item is not attached to the DOM tree. We need to
        find the root node of the item if its not attached in the document.

        It is also possible that itemref attribute of item refers to the root node.
        Made changes in getItemRefElements() method so that the traversal should
        start from the root node.

        Tests: fast/dom/MicroData/add-remove-property-to-item-which-is-not-attached-to-domtree.html
               fast/dom/MicroData/item-not-attached-to-domtree.html
               fast/dom/MicroData/itemref-pointing-to-root-node.html

        * dom/DynamicNodeList.cpp:
        (WebCore::DynamicNodeListCacheBase::rootNode):
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::getItemRefElements):

2012-08-09  Tim Horton  <timothy_horton@apple.com>

        Add optional debug logging for tiled scrolling
        https://bugs.webkit.org/show_bug.cgi?id=93305

        Reviewed by Simon Fraser.

        Add scrolling performance logging to ScrollingTreeNodeMac and WebTileLayer, which will log
        the amount of unpainted area exposed during scrolling and painting, respectively.

        The logging output looks like this:

            SCROLLING: Exposed tileless area. Time: 1344464850.154839 Unfilled Pixels: 1122008
            SCROLLING: Filled visible fresh tile. Time: 1344464850.575303 Unfilled Pixels: 1078272
            SCROLLING: Filled visible fresh tile. Time: 1344464850.676569 Unfilled Pixels: 823808
            SCROLLING: Filled visible fresh tile. Time: 1344464850.795877 Unfilled Pixels: 569344
            SCROLLING: Filled visible fresh tile. Time: 1344464850.846940 Unfilled Pixels: 524288
            SCROLLING: Filled visible fresh tile. Time: 1344464850.984113 Unfilled Pixels: 262144
            SCROLLING: Filled visible fresh tile. Time: 1344464851.027985 Unfilled Pixels: 0

        No new tests, as this is just debugging logging.

        * WebCore.exp.in:
        * page/FrameView.cpp:
        (WebCore::FrameView::setScrollingPerformanceLoggingEnabled):
        Added setScrollingPerformanceLoggingEnabled, passes flag into TiledBacking.

        * page/FrameView.h:
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        (WebCore::Settings::setScrollingPerformanceLoggingEnabled):
        Added setScrollingPerformanceLoggingEnabled, passes flag into FrameView.

        * page/Settings.h:
        (WebCore::Settings::scrollingPerformanceLoggingEnabled):
        * page/scrolling/ScrollingTree.cpp:
        (WebCore::ScrollingTree::ScrollingTree):
        (WebCore::ScrollingTree::setScrollingPerformanceLoggingEnabled):
        (WebCore::ScrollingTree::scrollingPeformanceLoggingEnabled):
        Added ScrollingPerformanceLoggingEnabled setter/getter; this is where it's accessed from ScrollingTreeNodeMac.

        * page/scrolling/ScrollingTree.h:
        * page/scrolling/mac/ScrollingTreeNodeMac.h:
        (ScrollingTreeNodeMac):
        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
        (WebCore::ScrollingTreeNodeMac::setScrollPosition):
        When updating scroll position, conditionally log the amount of unpainted area that was just exposed.

        (WebCore::ScrollingTreeNodeMac::logExposedTilelessArea):
        * platform/graphics/TiledBacking.h:
        (WebCore::TiledBacking::TiledBacking):
        (WebCore::TiledBacking::setScrollingPerformanceLoggingEnabled):
        (WebCore::TiledBacking::scrollingPerformanceLoggingEnabled):
        Added ScrollingPerformanceLoggingEnabled setter/getter; this is where it's accessed from WebTileLayer.

        * platform/graphics/ca/mac/TileCache.h:
        (WebCore::TileCache::visibleRect):
        * platform/graphics/ca/mac/TileCache.mm:
        (WebCore::TileCache::blankPixelCount):
        (WebCore::TileCache::blankPixelCountForTiles):
        Compute the exposed, unpainted area of the tile cache by iterating over the layers,
        checking if they've been painted, and subtracting painted layers from the total visible area.

        * platform/graphics/ca/mac/WebTileLayer.h:
        * platform/graphics/ca/mac/WebTileLayer.mm:
        (-[WebTileLayer drawInContext:]):
        (-[WebTileLayer repaintCount]):
        (-[WebTileLayer logFilledFreshTile]):
        When painting a WebTileLayer, conditionally log the amount of unpainted area remaining after painting said tile.

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::RenderLayerBacking):
        Plumb ScrollingPerformanceLoggingEnabled through to TiledBacking.

2012-08-08  Alpha Lam  <hclam@chromium.org>

        Remove image decoding in some BitmapImage metadata functions
        https://bugs.webkit.org/show_bug.cgi?id=93171

        Reviewed by Simon Fraser.

        These two metadata functions were decoding an entire frame:
        - frameOrientationAtIndex
        - frameHasAlphaAtIndex

        This change removes image decoding from these two methods. This is for
        preparation of having asynchronous image decoding, intending to reduce
        code location that trigger image decoding.

        frameOrientationAtIndex() doesn't require decoding a frame. This method
        is only implemented in CG port in ImageSourceCG.cpp which doesn't do
        image decoding.

        frameHasAlphaAtIndex() is used to optimize certain drawing operations
        and accelerated compositing. This change uses a heuristic for non-CG
        port to determine if an image has alpha. If an image is not yet
        decoded the function answers having alpha. Only if a frame is decoded
        and cached that the alpha state of the frame is returned. This is an
        admissible heuristic that postpone answering the question until a frame
        is decoded.

        Tested this change with a fully loaded image and partially loaded image
        with background color.

        Test: http/tests/images/jpg-img-partial-load.html

        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::frameHasAlphaAtIndex):
        (WebCore::BitmapImage::frameOrientationAtIndex):
        * platform/graphics/ImageSource.cpp:
        (WebCore::ImageSource::frameHasAlphaAtIndex):
        * platform/image-decoders/ImageDecoder.cpp:
        (WebCore::ImageDecoder::frameHasAlphaAtIndex):
        (WebCore):
        * platform/image-decoders/ImageDecoder.h:
        (ImageDecoder):

2012-08-08  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r125146.
        http://trac.webkit.org/changeset/125146
        https://bugs.webkit.org/show_bug.cgi?id=93578

        Would like to study fast/dom/Window/timer-null-script-
        execution-context.html behavior change (Requested by abarth on
        #webkit).

        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore):
        (WebCore::JSDOMWindowBase::crossDomainAccessErrorMessage):
        (WebCore::JSDOMWindowBase::allowsAccessFrom):
        * bindings/js/JSDOMWindowBase.h:
        (JSDOMWindowBase):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::namedItemGetter):
        (WebCore::JSDOMWindow::getOwnPropertySlot):
        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
        (WebCore::JSDOMWindow::put):
        (WebCore::JSDOMWindow::deleteProperty):
        (WebCore::JSDOMWindow::getPropertyNames):
        (WebCore::JSDOMWindow::getOwnPropertyNames):
        (WebCore::JSDOMWindow::defineOwnProperty):
        (WebCore::JSDOMWindow::setLocation):
        * bindings/js/JSDOMWindowCustom.h:
        (WebCore::JSDOMWindowBase::allowsAccessFrom):
        (WebCore):
        (WebCore::JSDOMWindowBase::allowsAccessFromNoErrorMessage):
        (WebCore::JSDOMWindowBase::allowsAccessFromPrivate):
        * bindings/js/JSInjectedScriptManager.cpp:
        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
        * bindings/objc/WebScriptObject.mm:
        (-[WebScriptObject _isSafeScript]):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateGetOwnPropertyDescriptorBody):
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::jsTestActiveDOMObjectExcitingAttr):
        (WebCore::jsTestActiveDOMObjectConstructor):
        (WebCore::jsTestActiveDOMObjectPrototypeFunctionExcitingFunction):

2012-08-05  Kinuko Yasuda  <kinuko@chromium.org>

        Unprefix window.webkitURL
        https://bugs.webkit.org/show_bug.cgi?id=93034

        Reviewed by Jian Li.

        Adding unprefixed window.URL as other browsers like FireFox and Opera 12 seem to have the API unprefixed.
        (This patch doesn't remove webkitURL yet as Safari and Chrome has exposed the URL for a while now.)

        Test: fast/dom/DOMURL/check-instanceof-domurl-functions.html

        * page/DOMWindow.cpp:
        * page/DOMWindow.h:
        (DOMWindow):
        * page/DOMWindow.idl:
        * workers/WorkerContext.idl:

2012-08-08  MORITA Hajime  <morrita@google.com>

        [SVG] load events shouldn't be fired during Node::insrtedInto()
        https://bugs.webkit.org/show_bug.cgi?id=92969

        Reviewed by Ryosuke Niwa.

        Event dispatches during insertedInto() allow event handlers to
        break DOM tree cosistency. This chagne makes them async for load
        events which are dispatched during insertedInto() call. This
        prevents event handlers from breaking tree consistency while the
        notification traversal.

        Test: svg/custom/loadevents-async.html

        * svg/SVGElement.cpp:
        (WebCore::SVGElement::sendSVGLoadEventIfPossibleAsynchronously): Added.
        (WebCore):
        (WebCore::SVGElement::svgLoadEventTimerFired): Added.
        (WebCore::SVGElement::svgLoadEventTimer):
        - Added a stub. Implemented in SVGScriptElement, SVGStopElement, SVGUseElement
          where the load event happens.
        * svg/SVGElement.h:
        (SVGElement):
        * svg/SVGExternalResourcesRequired.cpp:
        (WebCore::SVGExternalResourcesRequired::insertedIntoDocument):
        - Replaces event dispatch call with async version.
        * svg/SVGScriptElement.h:
        * svg/SVGStyleElement.h:
        * svg/SVGUseElement.h:

2012-08-08  Adam Barth  <abarth@webkit.org>

        Implement JSDOMWindow*::allowsAccessFrom* in terms of BindingSecurity
        https://bugs.webkit.org/show_bug.cgi?id=93407

        Reviewed by Eric Seidel.

        This patch removes allowsAccessFrom and implements the security checks
        in terms of shouldAllowAccessToFrame directly. There shouldn't be any
        change in behavior.

        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore):
        (WebCore::shouldAllowAccessFrom):
        * bindings/js/JSDOMWindowBase.h:
        (JSDOMWindowBase):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::namedItemGetter):
        (WebCore::JSDOMWindow::getOwnPropertySlot):
        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
        (WebCore::JSDOMWindow::put):
        (WebCore::JSDOMWindow::deleteProperty):
        (WebCore::JSDOMWindow::getPropertyNames):
        (WebCore::JSDOMWindow::getOwnPropertyNames):
        (WebCore::JSDOMWindow::defineOwnProperty):
        (WebCore::JSDOMWindow::setLocation):
        * bindings/js/JSDOMWindowCustom.h:
        * bindings/js/JSInjectedScriptManager.cpp:
        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
        * bindings/objc/WebScriptObject.mm:
        (-[WebScriptObject _isSafeScript]):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateGetOwnPropertyDescriptorBody):
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::jsTestActiveDOMObjectExcitingAttr):
        (WebCore::jsTestActiveDOMObjectConstructor):
        (WebCore::jsTestActiveDOMObjectPrototypeFunctionExcitingFunction):

2012-08-08  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r125143.
        http://trac.webkit.org/changeset/125143
        https://bugs.webkit.org/show_bug.cgi?id=93573

        Doesn't compile on Mac (Requested by tony^work on #webkit).

        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/BitmapImage.h:
        * platform/graphics/Image.h:
        * platform/graphics/ImageSource.h:
        (WebCore):
        * platform/graphics/NativeImagePtr.h: Removed.
        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:

2012-08-08  Huang Dongsung  <luxtella@company100.net>

        Extract the definition of NativeImagePtr from ImageSource.h into NativeImagePtr.h.
        https://bugs.webkit.org/show_bug.cgi?id=93466

        Reviewed by Adam Barth.

        Image.h includes ImageSource.h in order to know the definition of NativeImagePtr.
        But Image does not need to know the definition of ImageSource. So, this patch
        extracts the definition of NativeImagePtr from ImageSource.h into NativeImagePtr.h.

        This is a preparation for asynchronous image decoding. Async decoding
        will need a callback function, which sends a NativeImagePtr to clients, and the
        callback must know the definition of NativeImagePtr, not ImageSource.

        No new tests, behavior is unchanged.

        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/BitmapImage.h:
        * platform/graphics/Image.h:
        * platform/graphics/ImageSource.h:
        (WebCore):
        * platform/graphics/NativeImagePtr.h: Added.
        (WebCore):

2012-08-08  Shane Stephens  <shanestephens@google.com>

        Compile flag for CSS Hierarchies
        https://bugs.webkit.org/show_bug.cgi?id=92433

        Reviewed by Tony Chang.

        Note that this flag is disabled on all platforms for now.

        No new tests since there's no functional change.

        * Configurations/FeatureDefines.xcconfig:

2012-08-08  Kent Tamura  <tkent@chromium.org>

        [Chromium-mac] Switch to LocalizedNumberMac from LocalizedNumberICU
        https://bugs.webkit.org/show_bug.cgi?id=93432

        Reviewed by Hajime Morita.

        No new tests. Covered by fast/forms/number/number-lossless-localization.html,
        and WebKit/chromium/tests/LocaleMacTest.cpp.

        * WebCore.gyp/WebCore.gyp:
        Exclude locale-relatef files for ICU, and include files for Mac.

2012-08-08  Hayato Ito  <hayato@chromium.org>

        EventDispatcher::dispatchSimulatedClick should not reuse the same EventDispatcher instance.
        https://bugs.webkit.org/show_bug.cgi?id=93452

        Reviewed by Dimitri Glazkov.

        This is a follow up patch after r124975.  There is yet another
        place where the same EventDispatcher instance is reused across
        event dispatching.

        In addition to that, in order to simulate a real click, we must
        different dispatchers because we must recalculate event ancestors
        each time.  Current implementation wrongly freezes event ancestors
        at the first event dispatching.

        No new tests, no change in functionality.

        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::dispatchSimulatedClick):
        (WebCore::EventDispatcher::EventDispatcher):
        (WebCore::EventDispatcher::dispatchEvent):
        * dom/EventDispatcher.h:
        (EventDispatcher):

2012-08-08  Jae Hyun Park  <jae.park@company100.net>

        writeHelperGetString in V8HTMLDocument uses += to concatenate strings
        https://bugs.webkit.org/show_bug.cgi?id=93035

        Reviewed by Adam Barth.

        Use a StringBuilder instead of String concatenation because StringBuilder is generally faster.

        No new functionality, so no new tests.

        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::writeHelperGetString):

2012-08-08  Adrienne Walker  <enne@google.com>

        [chromium] Move scrollbar pointer into WebScrollbarThemePainter
        https://bugs.webkit.org/show_bug.cgi?id=93541

        Reviewed by James Robinson.

        Update clients of WebScrollbarThemePainter.

        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        (WebCore::createScrollbarLayer):
        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:

2012-08-08  Alexandru Chiculita  <achicu@adobe.com>

        [CSS Shaders] Invalid shaders should act as pass-through filters
        https://bugs.webkit.org/show_bug.cgi?id=93405

        Reviewed by Dean Jackson.

        If the shader fails to apply then clearShaderResult will just copy the result of the previous filter
        to the output of the current filter.

        Test: css3/filters/custom/invalid-custom-filter-shader.html

        * platform/graphics/filters/FECustomFilter.cpp:
        (WebCore::FECustomFilter::platformApplySoftware):
        (WebCore):
        (WebCore::FECustomFilter::clearShaderResult):
        (WebCore::FECustomFilter::applyShader):
        * platform/graphics/filters/FECustomFilter.h:
        (FECustomFilter):
        * rendering/style/StyleCustomFilterProgram.h: The test was exposing the fact that if the shaders were referencing the same
        file then StyleCustomFilterProgram will never complete the load. Having the same file for both the vertex and the fragment shader
        cannot really work, because the shaders would not compile anyway, thus triggering an invalid shader. 
        I'm fixing it part of this change because the current test actually exposes that on Safari Mac builds. See the note in the LayoutTest/ChangeLog.
        (WebCore::StyleCustomFilterProgram::notifyFinished):

2012-08-08  Adam Barth  <abarth@webkit.org>

        Rewire the same-origin checks for the JavaScriptCore bindings through BindingSecurity
        https://bugs.webkit.org/show_bug.cgi?id=93382

        Reviewed by Eric Seidel.

        This patch rewires the same-origin policy checks in the JavaScriptCore
        bindings to use the implementation in BindingSecurity.cpp, which is now
        shared by JavaScriptCore and V8. There are still a few places were we
        use the JSDOMWindowCustom-based code path, but I plan to change those
        in a follow up patch in the interest of keeping this patch as small as
        possible.

        This patch as two main benefits:

        1) We no longer need to maintain duplicate code in the JSC and the V8
           bindings for as delicate an area as the same-origin check.
           Previously, the two implementations accomplished the same task using
           a slightly different mechansim. After this patch, they use the same
           mechanism, which means we only need to convince ourselves that one
           implementation is correct.

        2) This patch will make it easier to remove DOMWindow::m_securityOrigin
           because there will be only one piece of code that needs to change.
           Prior to this patch, we would have had to change both
           implementations of the same-origin policy not to rely upon
           DOMWindow::m_securityOrigin.

        * bindings/js/BindingState.cpp:
        (WebCore::immediatelyReportUnsafeAccessTo):
        (WebCore):
        * bindings/js/BindingState.h:
        (WebCore):
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::shouldAllowAccessToNode):
        (WebCore::shouldAllowAccessToFrame):

2012-08-08  Brady Eidson  <beidson@apple.com>

        Google search query text reverts to original search query after multiple searches
        <rdar://problem/10800686> and https://bugs.webkit.org/show_bug.cgi?id=93544

        Reviewed by Darin Adler.

        For security sensitive fields we normally clear "autocomplete=off" form elements when
        restoring a page from the page cache.
        
        If the element is textual and has a defaultValue then "clearing" it actually restores 
        the default value.
        
        There's no scenario we can imagine where that makes sense so we should not reset the 
        value in such fields.

        Test: fast/forms/autocomplete-off-with-default-value-does-not-clear.html

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::parseAttribute): Update suspension callback registration as needed.
        (WebCore::HTMLInputElement::needsSuspensionCallback): Don't reset text fields with a non-empty default value.

2012-08-08  Raymond Toy  <rtoy@google.com>

        Creating "basic waveform" Oscillator nodes is not efficient
        https://bugs.webkit.org/show_bug.cgi?id=93194

        Reviewed by Chris Rogers.

        Cache the wavetables for the basic types so they don't have to be
        recomputed every time.

        Also fix a bug where oscillator type was always set to CUSTOM
        instead of the specified oscillator type.  Test added for this.

        Test: webaudio/oscillator-basic.html

        * Modules/webaudio/Oscillator.cpp:
        (WebCore):
        (WebCore::Oscillator::setType): Use cached wavetables; fix bug in
        setting the oscillator type.
        * Modules/webaudio/Oscillator.h: 
        (Oscillator): Define static variables to hold cached wavetables.

2012-08-08  Tom Sepez  <tsepez@chromium.org>

        Avoid ASSERT(m_workerContext->isSharedWorkerContext()) in WorkerScriptController::initScript()
        https://bugs.webkit.org/show_bug.cgi?id=93521

        Reviewed by Adam Barth.

        Changes WorkerContext and its subclasses so that we do not call functions that rely upon subclass
        virtual methods from the superclass constructor.

        Test: http/tests/security/contentSecurityPolicy/worker-set-timeout-blocked.html

        * workers/DedicatedWorkerContext.cpp:
        (WebCore):
        (WebCore::DedicatedWorkerContext::create):
        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
        * workers/DedicatedWorkerContext.h:
        (DedicatedWorkerContext):
        * workers/SharedWorkerContext.cpp:
        (WebCore):
        (WebCore::SharedWorkerContext::create):
        (WebCore::SharedWorkerContext::SharedWorkerContext):
        * workers/SharedWorkerContext.h:
        (SharedWorkerContext):
        * workers/WorkerContext.cpp:
        (WebCore::WorkerContext::WorkerContext):
        (WebCore::WorkerContext::applyContentSecurityPolicyFromString):
        (WebCore):
        * workers/WorkerContext.h:
        (WorkerContext):

2012-08-08  Thiago Marcos P. Santos  <thiago.santos@intel.com>

        CanvasRenderContext2D::setFont() should ignore inherited properties and default keyword value
        https://bugs.webkit.org/show_bug.cgi?id=93491

        Reviewed by Kenneth Rohde Christiansen.

        Treat "inherit" as an invalid value. Also ignore the "default"
        keyword that was previously treated as a font family. This second
        change was done in the property validation and will also affect the
        CSS font parsing, but it is probably harmless since font doesn't
        recognize the default keyword anyway.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseFontFamily):
        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::setFont):

2012-08-08  James Robinson  <jamesr@chromium.org>

        [chromium] Add missing OVERRIDE and virtual annotations in compositor
        https://bugs.webkit.org/show_bug.cgi?id=93438

        Reviewed by Adrienne Walker.

        As the title suggests.

        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h:
        (BitmapCanvasLayerTextureUpdater):
        * platform/graphics/chromium/ScrollbarLayerChromium.h:
        (ScrollbarLayerChromium):
        * platform/graphics/chromium/SolidColorLayerChromium.h:
        (SolidColorLayerChromium):
        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.h:
        * platform/graphics/chromium/cc/CCFrameRateController.h:
        (CCFrameRateController):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
        (CCScrollbarLayerImpl):

2012-08-08  Eric Penner  <epenner@google.com>

        [chromium] Refactor tile flags.
        https://bugs.webkit.org/show_bug.cgi?id=93059

        Reviewed by Adrienne Walker.

        This has become a general refactoring patch to make updateTiles easier
        to work with. The 'updated' flag had become convoluted and incorrect
        and the function had lots of special cases piled into it which
        makes for tangled depedancies that are hard to reason with.
 
        This refactors the updated flag into two flags ('validForFrame',
        and 'occluded') for the two purposes it is actually used for,
        simplifies the use of those flags.

        'validForFrame' is improved to work for all tiles that are not dirty
        before painting begins, rather than just the tiles that get touched via
        updateTiles().

        This refactors updateTiles() into several functions that more clearly
        illustrate all the depedancies that have accumulated in there. After
        doing that I managed to separate the occlusion pass from the painting
        passes, ecapsulating the difficult dependancies in one documented
        function 'markOcclusionsAndRequestTextures'.

        Now update tiles doesn't need the 'idle' flag, and returns didPaint
        as an out-param. The last remaining wierd output is m_failedPaint
        which is needed in place of m_skipsIdlePaint to prevent infinite 
        paints from being requested.

        As a last step I was going to merge LayerChromium::update() and
        LayerChromium::needsMoreUpdates() by having update() just return
        a boolean, but this proved to be a big change so I'm holding off
        on that. That would let us remove the m_failedPaint and get rid
        of needsIdlePaint() altogether.

        Tested by many existing tests.

        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (UpdatableTile):
        (WebCore::UpdatableTile::resetUpdateState):
        (WebCore::UpdatableTile::markForUpdate):
        (WebCore::UpdatableTile::UpdatableTile):
        (WebCore::TiledLayerChromium::TiledLayerChromium):
        (WebCore::TiledLayerChromium::pushPropertiesTo):
        (WebCore):
        (WebCore::TiledLayerChromium::updateTiles):
        (WebCore::TiledLayerChromium::markOcclusionsAndRequestTextures):
        (WebCore::TiledLayerChromium::haveTexturesForTiles):
        (WebCore::TiledLayerChromium::markTilesForUpdate):
        (WebCore::TiledLayerChromium::updateTileTextures):
        (WebCore::TiledLayerChromium::resetUpdateState):
        (WebCore::TiledLayerChromium::updateContentRect):
        (WebCore::TiledLayerChromium::needsIdlePaint):
        * platform/graphics/chromium/TiledLayerChromium.h:
        (TiledLayerChromium):

2012-08-08  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=93393
        Overflow regions sometimes repaint incorrectly after going into or 
        coming out of compositing mode
        -and corresponding-
        <rdar://problem/12006463>

        Reviewed by Simon Fraser.

        My first patch to fix this bug removed an if (parent()) check that is 
        needed to prevent a table crash seen in 
        fast/table/table-row-compositing-repaint-crash.html  
        The parent() check was actually added originally to prevent this same 
        crash. See http://trac.webkit.org/changeset/110456  
        This patch adds that check back, but really we should delay the 
        computation of repaint rects if layout has not happened yet.
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateBacking):

2012-08-08  Simon Fraser  <simon.fraser@apple.com>

        Avoid backing store on layers created for CoreAnimation plugins
        https://bugs.webkit.org/show_bug.cgi?id=93526
        <rdar://problem/12052828>

        Reviewed by Dean Jackson.

        We create a compositing layer for <embed> objects whose plug-in supports
        the CoreAnimation rendering model. When the embed's renderer is not styled,
        we can avoid allocating backing store for it.

        Test: compositing/plugins/no-backing-store.html

        * rendering/RenderLayerBacking.cpp:
        (WebCore::isCompositedPlugin):
        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):

2012-08-08  Erik Arvidsson  <arv@chromium.org>

        DOM4: classList should be defined on Element and not on HTMLElement
        https://bugs.webkit.org/show_bug.cgi?id=93015

        Reviewed by Adam Barth.

        DOM4 specs that Element should have the classList WebIDL attribute. This moves the
        attribute to the correct IDL file.

        Test: fast/dom/Element/class-list.html

        * dom/Element.idl:
        * html/HTMLElement.idl:

2012-08-08  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=92275
        Need a way to get a snapshot image that does not show the selection
        -and corresponding-
        <rdar://problem/11956802>

        Reviewed by Anders Carlsson.

        New function FrameView::paintContentsForSnapshot() has the option to 
        exclude selection from the snapshot.

        Export new function
        * WebCore.exp.in:

        Clear the selection from the RenderView when selection is to be excluded. Restore 
        all of this information via FrameSelection::updateAppearance() after calling 
        paintContents().
        * page/FrameView.cpp:
        (WebCore::FrameView::paintContentsForSnapshot):
        (WebCore):
        * page/FrameView.h:

2012-08-07  James Robinson  <jamesr@chromium.org>

        [chromium] Only use public Platform API in NonCompositedContentHost
        https://bugs.webkit.org/show_bug.cgi?id=93423

        Reviewed by Adrienne Walker.

        This renames the "NonCompositedContentHost" flag to "useLCDText", which is the primary purpose of the flag. We
        also use this flag to control whether we have border texels or not on the "root" layer, but I can't think of a
        clean name that encapsulates both behaviors.

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::LayerChromium):
        (WebCore::LayerChromium::setUseLCDText):
        (WebCore::LayerChromium::pushPropertiesTo):
        * platform/graphics/chromium/LayerChromium.h:
        (LayerChromium):
        (WebCore::LayerChromium::useLCDText):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::setUseLCDText):
        * platform/graphics/chromium/TiledLayerChromium.h:
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore::CCLayerImpl::setUseLCDText):
        (WebCore::CCLayerImpl::useLCDText):
        (CCLayerImpl):

2012-08-08  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=93393
        Overflow regions sometimes repaint incorrectly after going into or 
        coming out of compositing mode
        -and corresponding-
        <rdar://problem/12006463>

        Reviewed by Simon Fraser.

        New RenderLayer function computeRepaintRectsIncludingDescendants()
        * rendering/RenderLayer.cpp:
        (WebCore):
        (WebCore::RenderLayer::computeRepaintRectsIncludingDescendants):
        * rendering/RenderLayer.h:
        (RenderLayer):

        It is not sufficient to compute repaint rects just for the current 
        layer when compositing changes. They must be recomputed for all 
        descendant layers as well.
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateBacking):

2012-08-08  Alec Flett  <alecflett@chromium.org>

        IndexedDB: new enums and openCursor stub
        https://bugs.webkit.org/show_bug.cgi?id=93410

        Reviewed by Adam Barth.

        Introduce a new TaskType enum that will be used to prioritize
        internal tasks. This is preliminary staging for
        https://bugs.webkit.org/show_bug.cgi?id=91125.

        No new tests, coming in bug 91125.

        * Modules/indexeddb/IDBTransactionBackendInterface.h:

2012-08-08  Pavel Feldman  <pfeldman@chromium.org>

        REGRESSION(r125046): Breaks debug build (assertion in protocol type checks) (Requested by pfeldman on #webkit).
        https://bugs.webkit.org/show_bug.cgi?id=93505

        Not reviewed: roll out.

        * inspector/ConsoleMessage.cpp:
        (WebCore::ConsoleMessage::addToFrontend):
        * inspector/ConsoleMessage.h:
        (ConsoleMessage):
        * inspector/InjectedScript.cpp:
        (WebCore::InjectedScript::wrapObject):
        * inspector/InjectedScript.h:
        (InjectedScript):
        * inspector/InjectedScriptSource.js:
        (.):
        * inspector/InspectorConsoleAgent.cpp:
        (WebCore::InspectorConsoleAgent::enable):
        (WebCore::InspectorConsoleAgent::addConsoleMessage):
        * inspector/front-end/ConsoleMessage.js:
        (WebInspector.ConsoleMessageImpl.prototype._format):
        (WebInspector.ConsoleMessageImpl.prototype._formatParameter):
        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsObject):
        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsNode):
        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsArray):
        (WebInspector.ConsoleMessageImpl.prototype._printArray):
        (WebInspector.ConsoleMessageImpl.prototype._formatAsArrayEntry):
        (WebInspector.ConsoleMessageImpl.prototype._formatWithSubstitutionString):
        * inspector/front-end/DOMExtension.js:
        * inspector/front-end/ObjectPropertiesSection.js:
        (WebInspector.ObjectPropertiesSection):
        * inspector/front-end/PropertiesSection.js:
        * inspector/front-end/RemoteObject.js:
        (WebInspector.RemoteObject):
        (WebInspector.RemoteObject.fromPayload):
        * inspector/front-end/Section.js:
        * inspector/front-end/inspector.css:
        (.console-group-messages .section .header .title):
        (.section .properties .name, .event-properties .name):

2012-08-08  Adam Barth  <abarth@webkit.org>

        Crash when reloading a Chromium "platform" app
        https://bugs.webkit.org/show_bug.cgi?id=93497

        Reviewed by Eric Seidel.

        The framework for Chromium "platform" apps executes a big blob of
        script during the didCreateScriptContext callback. This blob of scripts
        interacts with a bunch of JavaScript objects and triggers a number of
        security checks.

        When reloading a frame, the didCreateScriptContext is called during
        Frame::setDocument (as a consequence of calling
        ScriptController::updateDocument). At that time, the SecurityOrigin
        object hasn't yet been copied over to the DOMWindow, and we crash
        trying to grab it.

        The long-term fix for this bug is to fix
        https://bugs.webkit.org/show_bug.cgi?id=75793, at which point there
        will no longer be a SecurityOrigin object on DOMWindow. In the
        meantime, however, we can fix this crash by null checking the
        DOMWindow's SecurityOrigin object.

        * bindings/generic/BindingSecurity.cpp:
        (WebCore::canAccessDocument):

2012-08-08  Dean Jackson  <dino@apple.com>

        Unreviewed build fix for Mac port after http://trac.webkit.org/changeset/125051

        Add CachedImageClient.h to project.

        * WebCore.xcodeproj/project.pbxproj:

2012-08-08  Antonio Gomes  <agomes@rim.com>

        [BlackBerry] Add boundsOrigin accessors to LayerOverride
        https://bugs.webkit.org/show_bug.cgi?id=93479
        PR #188677

        Reviewed by Yong Li.

        This is needed in order to allow us to directly set the boundsOrigin value
        to the LayerCompositingThread and avoid it to get overridden by the respective
        LayerWebKitThread's boundsOrigin value in the next commit.

        No new tests, since this is another preparation PR.

        * platform/graphics/blackberry/LayerCompositingThread.cpp:
        (WebCore::LayerCompositingThread::updateAnimations):
        * platform/graphics/blackberry/LayerCompositingThread.h:
        (WebCore::LayerOverride::isBoundsOriginSet):
        (WebCore::LayerOverride::boundsOrigin):
        (WebCore::LayerOverride::setBoundsOrigin):
        (LayerOverride):
        (WebCore::LayerOverride::LayerOverride):

2012-08-08  Antonio Gomes  <agomes@rim.com>

        [BlackBerry] Propagate GraphicsLayer::boundsOrigin down to the platform layers
        https://bugs.webkit.org/show_bug.cgi?id=93478
        PR #188657

        Reviewed by Yong Li.

        This property will be set from both WebKit and Compositing/UI
        threads in order to fast scroll block elements.

        No new tests, as it is a mid-step patch.

        * platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp:
        (WebCore::GraphicsLayerBlackBerry::setBoundsOrigin):
        (WebCore):
        (WebCore::GraphicsLayerBlackBerry::updateBoundsOrigin):
        * platform/graphics/blackberry/GraphicsLayerBlackBerry.h:
        (GraphicsLayerBlackBerry):
        * platform/graphics/blackberry/LayerCompositingThread.h:
        (WebCore::LayerCompositingThread::setBoundsOrigin):
        * platform/graphics/blackberry/LayerData.h:
        (WebCore::LayerData::boundsOrigin):
        (LayerData):
        * platform/graphics/blackberry/LayerRenderer.cpp:
        (WebCore::LayerRenderer::updateLayersRecursive):
        * platform/graphics/blackberry/LayerWebKitThread.h:
        (WebCore::LayerWebKitThread::setBoundsOrigin):
        (LayerWebKitThread):

2012-08-08  Nate Chapin  <japhet@chromium.org>

        [chromium] Upstream android's FlingAnimator
        https://bugs.webkit.org/show_bug.cgi?id=92900

        Reviewed by James Robinson.

        No new tests yet, will be added once this code is called.

        * WebCore.gypi:
        * platform/chromium/support/PlatformGestureCurveFactory.cpp: Added.
        (WebKit):
        (WebKit::PlatformGestureCurveFactory::get):
        (WebKit::PlatformGestureCurveFactory::createCurve):
        (WebKit::PlatformGestureCurveFactory::setWebFlingAnimatorForTest):
        * platform/chromium/support/PlatformGestureCurveFactory.h: Added.
        (WebKit):
        (PlatformGestureCurveFactory):
        * platform/chromium/support/WebFlingAnimatorToGestureCurveAdapter.h: Added.
        (WebKit):
        (WebFlingAnimatorToGestureCurveAdapter):
        (WebKit::WebFlingAnimatorToGestureCurveAdapter::create):
        (WebKit::WebFlingAnimatorToGestureCurveAdapter::WebFlingAnimatorToGestureCurveAdapter):

2012-08-08  Anna Cavender  <annacc@chromium.org>

        Update HTMLMediaElement to the new OO MediaSource API.
        https://bugs.webkit.org/show_bug.cgi?id=91775

        Reviewed by Eric Carlson.

        This patch rips out the old-style MediaSource API and allows a
        MediaSource object to be attached to HTMLMediaElement.
        http://dvcs.w3.org/hg/html-media/raw-file/tip/media-source/media-source.html

        Tests: updates to http/tests/media/media-source/*
               http/tests/media/media-source/video-media-source-add-and-remove-buffers.html
               http/tests/media/media-source/video-media-source-objects.html

        * html/HTMLMediaElement.cpp:
        (WebCore):
        (WebCore::HTMLMediaElement::HTMLMediaElement): Remove old style API resources.
        (WebCore::HTMLMediaElement::parseAttribute): Remove old style event attribute.
        (WebCore::HTMLMediaElement::prepareForLoad): Set source state to "closed".
        (WebCore::HTMLMediaElement::loadResource): Get MediaSource object from blob registry
            look up and, if found, set it's MediaPlayer pointer to the current MediaPlayer.
        (WebCore::HTMLMediaElement::noneSupported): Set source state to "closed".
        (WebCore::HTMLMediaElement::mediaEngineError): Set source state to "closed".
        (WebCore::HTMLMediaElement::mediaPlayerSourceOpened): Set source state to "open".
        (WebCore::HTMLMediaElement::mediaPlayerSourceURL): Change to new blob URL.
        (WebCore::HTMLMediaElement::seek): Check if source state is "closed".
        (WebCore::HTMLMediaElement::setSourceState): Helper function so that we don't have to
            keep checking for m_mediaSource.
        (WebCore::HTMLMediaElement::userCancelledLoad): Set source state to "closed".
        (WebCore::HTMLMediaElement::createMediaPlayer): If the current MediaPlayer is re-
             created, notify the MediaSource and reset its MediaPlayer.

        * html/HTMLMediaElement.h: Remove old style API code and add a MediaSource object.
        (HTMLMediaElement):
        * html/HTMLMediaElement.idl: Remove old style API.

2012-08-08  Dean Jackson  <dino@apple.com>

        Unreviewed build fix for Mac port after http://trac.webkit.org/changeset/125051

        * platform/mac/ClipboardMac.mm:

2012-08-08  Xan Lopez  <xlopez@igalia.com>

        Evolution, empathy no longer build with webkint 1.9.6:  webkit_dom_html_element_set_class_name is gone
        https://bugs.webkit.org/show_bug.cgi?id=93384

        Reviewed by Adam Barth.

        Provide custom backwards compatibility wrappers for HTMLElement
        className accessors, since the attribute was moved to Element. The
        previous fix attempted to define the attribute twice (once in each
        class), but this is wrong, just provide again the old accessors
        making them forward to the new methods.

        * bindings/gobject/WebKitDOMCustom.cpp:
        (webkit_dom_html_element_get_class_name): provide again
        get_class_name for backwards compatibility.
        (webkit_dom_html_element_set_class_name): provide again
        set_class_name for backwards compatibility.
        * bindings/gobject/WebKitDOMCustom.h: ditto.
        * html/HTMLElement.idl: remove the className attribute
        definition. Since it's already present in Element this will break
        our bindings.

2012-08-07  Ojan Vafai  <ojan@chromium.org>

        percentage height/width values in quirks mode are incorrectly resolved in flexbox children
        https://bugs.webkit.org/show_bug.cgi?id=81809

        Reviewed by Tony Chang.

        When computing percentage logical heights we need to use the RenderBox helper methods
        to make sure we handle all the edge cases correctly (e.g. walk up the containing block
        ancestor chain in quirks mode until we find a definite size).

        For widths, the containing block always has a definite size, so all we need to do
        is call computeContentBoxLogicalWidth(valueForLength(...)), although I'm not sure
        this does the right thing for the intrinsic sizing keywords.

        Tests: css3/flexbox/box-sizing-min-max-sizes.html
               css3/flexbox/percentage-sizes-quirks.html
               css3/flexbox/percentage-sizes.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeLogicalClientHeight):
        (WebCore):
        * rendering/RenderBox.h:
        (RenderBox):
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::computeMainAxisSizeForChild):
        (WebCore::RenderFlexibleBox::preferredMainAxisContentExtentForChild):
        (WebCore::RenderFlexibleBox::adjustChildSizeForMinAndMax):
        * rendering/RenderFlexibleBox.h:

2012-08-08  Andrew Scherkus  <scherkus@chromium.org>

        Fire suspend event whenever network state is set to NETWORK_IDLE.
        https://bugs.webkit.org/show_bug.cgi?id=93052

        Reviewed by Eric Carlson.

        There was a regression in the Chromium port (http://crbug.com/139511) that revealed we didn't
        have a layout test for suspend events. Upon further investigation it appeared we also had a bug
        where we didn't fire the suspend event when a media engine reported they had completely loaded
        the media.

        Covered by new test http/tests/media/video-load-suspend.html.

        * html/HTMLMediaElement.cpp: Move firing of suspend event to changeNetworkStateFromLoadingToIdle
        (WebCore::HTMLMediaElement::setNetworkState):
        (WebCore::HTMLMediaElement::changeNetworkStateFromLoadingToIdle):

2012-08-08  Tom Sepez  <tsepez@chromium.org>

        Video element image loader must persist after element detach.  
        https://bugs.webkit.org/show_bug.cgi?id=90801

        Reviewed by Eric Carlson.

        We rely on the OwnPtr in the element to cleanup the loader.     

        Test: fast/dom/beforeload/remove-video-poster-in-beforeload-listener.html

        * html/HTMLVideoElement.cpp:
        (WebCore):
        * html/HTMLVideoElement.h:
        (HTMLVideoElement):

2012-08-08  Nikhil Bhargava  <nbhargava@google.com>

        Improve RenderObject.h compile time - split CachedImage and CachedImageClient
        https://bugs.webkit.org/show_bug.cgi?id=93400

        Reviewed by Eric Seidel.

        Splits loader/cache/CachedImage.h into two files. The remaining changes are to repair existing #includes

        No new tests. No changes to existing functions/functionality.

        * css/CSSCrossfadeValue.h:
        * loader/ImageLoader.h:
        * loader/cache/CachedImage.cpp:
        * loader/cache/CachedImage.h:
        (WebCore):
        * loader/cache/CachedImageClient.h: Added.
        (WebCore):
        (CachedImageClient):
        (WebCore::CachedImageClient::~CachedImageClient):
        (WebCore::CachedImageClient::expectedType):
        (WebCore::CachedImageClient::resourceClientType):
        (WebCore::CachedImageClient::imageChanged):
        (WebCore::CachedImageClient::willRenderImage):
        * platform/chromium/ClipboardChromium.h:
        * rendering/RenderObject.h:
        (WebCore):
        * rendering/style/StyleCachedImage.cpp:
        * rendering/style/StyleCachedImage.h:
        (WebCore):
        * rendering/style/StyleCachedImageSet.h:
        * svg/graphics/SVGImage.cpp:

2012-08-08  Dan Bernstein  <mitz@apple.com>

        REGRESSION (r123171): <svg> element with intrinsic size and max-width gets sized incorrectly
        https://bugs.webkit.org/show_bug.cgi?id=93388

        Reviewed by Beth Dakin.

        Test: svg/css/max-width-3.html

        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::computeAspectRatioInformationForRenderBox): Added code to set
        m_intrinsicSize in the no-contentRenderer branch of this function so that the calls to
        RenderBox::computeReplacedLogical{Height,Width} in the end use the right intrinsic size.
        This is similar to what the contentRenderer branch of this function already does.

2012-08-08  Keishi Hattori  <keishi@webkit.org>

        Make slider tick mark snapping threshold configurable for each platform
        https://bugs.webkit.org/show_bug.cgi?id=93429

        Reviewed by Kent Tamura.

        This makes the slider tick mark snapping threshold configurable for each platform.
        And we increase the threshold for the Chromium port.

        No new tests. Covered by range-snap-to-datalist.html.

        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::setPositionFromPoint):
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::sliderTickSnappingThreshold):
        (WebCore):
        * rendering/RenderTheme.h:
        (RenderTheme):
        (WebCore::RenderTheme::sliderTickSnappingThreshold): Returns the threshold distance to the tick mark for snapping to occur.
        * rendering/RenderThemeChromiumCommon.cpp:
        (WebCore::RenderThemeChromiumCommon::sliderTickSnappingThreshold):
        (WebCore):
        * rendering/RenderThemeChromiumCommon.h:
        (RenderThemeChromiumCommon):
        * rendering/RenderThemeChromiumMac.h:
        * rendering/RenderThemeChromiumMac.mm:
        (WebCore):
        (WebCore::RenderThemeChromiumMac::sliderTickSnappingThreshold):
        * rendering/RenderThemeChromiumSkia.cpp:
        (WebCore):
        (WebCore::RenderThemeChromiumSkia::sliderTickSnappingThreshold):
        * rendering/RenderThemeChromiumSkia.h:

2012-08-08  Mike West  <mkwst@chromium.org>

        Until CSP fully supports paths, we should log a warning if we encounter a source with a path.
        https://bugs.webkit.org/show_bug.cgi?id=93468

        Reviewed by Adam Barth.

        CSP 1.0 ignores path components of sources in directives' source lists.
        'script-src http://example.com/path/to/directory' is treated exactly the
        same as 'script-src http://example.com'. It's likely that this behavior
        will change in CSP 1.1, which could break with developers' expectations.
        This patch adds a warning when a path is encountered, alerting
        developers to the fact that their current source is interpreted
        differently than they might expect.

        See http://crbug.com/128493 for additional context and discussion.

        Tests for this change are covered by updating the existing Content
        Security Policy tests to include the new console warnings.

        * page/ContentSecurityPolicy.cpp:
        (CSPSourceList):
        (WebCore::CSPSourceList::CSPSourceList):
            Passing the directive name down into CSPSourceList so that we can
            generate informative error messages.
        (WebCore::CSPSourceList::parse):
            Create a 'path' string, pass it into 'parseSource', and use it after
            parsing each source to determine whether a warning should be sent.
        (WebCore::CSPSourceList::parseSource):
            Adding a 'path' argument so that we can see whether or not a
            specific source should generate a warning.
        (WebCore::CSPDirective::CSPDirective):
            Passing the directive name down into CSPSourceList so that we can
            generate informative error messages.
        (WebCore::ContentSecurityPolicy::reportIgnoredPathComponent):
            Generate the new warning message.
        (WebCore):
        * page/ContentSecurityPolicy.h:

2012-08-08  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: generate preview for the objects dumped into the console upon logging.
        https://bugs.webkit.org/show_bug.cgi?id=35801

        Reviewed by Vsevolod Vlasov.

        As of today, dumping an object (array) into console will result in objects' properties being
        read upon console object expansion (i.e. lazily). This means that dumping the same object while
        mutating it will be hard to debug using the console.

        This change starts generating abbreviated previews for objects / arrays at the moment of their
        logging and passes this information along into the front-end. This only happens when the front-end
        is already opened, it only works for console.log(), not live console interaction.

        Covered by the existing console tests + collections test has been expanded to capture both: pre and post-
        front-end opening scenarios.

        * inspector/ConsoleMessage.cpp:
        (WebCore::ConsoleMessage::addToFrontend):
        * inspector/ConsoleMessage.h:
        (ConsoleMessage):
        * inspector/InjectedScript.cpp:
        (WebCore::InjectedScript::wrapObject):
        * inspector/InjectedScript.h:
        (InjectedScript):
        * inspector/InjectedScriptSource.js:
        (.):
        * inspector/Inspector.json:
        * inspector/InspectorConsoleAgent.cpp:
        (WebCore::InspectorConsoleAgent::enable):
        (WebCore::InspectorConsoleAgent::addConsoleMessage):
        * inspector/front-end/ConsoleMessage.js:
        (WebInspector.ConsoleMessageImpl.prototype._format):
        (WebInspector.ConsoleMessageImpl.prototype._formatParameter):
        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsObject):
        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsArrayOrObject):
        (WebInspector.ConsoleMessageImpl.prototype._appendObjectPreview):
        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsNode):
        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsArray):
        (WebInspector.ConsoleMessageImpl.prototype._printArray):
        (WebInspector.ConsoleMessageImpl.prototype._formatAsArrayEntry):
        (WebInspector.ConsoleMessageImpl.prototype._formatWithSubstitutionString):
        * inspector/front-end/DOMExtension.js:
        (Element.prototype.createTextChild):
        * inspector/front-end/ObjectPropertiesSection.js:
        (WebInspector.ObjectPropertiesSection):
        * inspector/front-end/PropertiesSection.js:
        * inspector/front-end/RemoteObject.js:
        (WebInspector.RemoteObject):
        (WebInspector.RemoteObject.fromPayload):
        (WebInspector.RemoteObject.prototype.get previewProperties):
        * inspector/front-end/Section.js:
        * inspector/front-end/inspector.css:
        (.console-group-messages .section .header .title):
        (.section .console-formatted-node):
        (.console-object-preview):
        (.section .properties .name, .event-properties .name, .console-formatted-object .name):

2012-07-31  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] media/media-continues-playing-after-replace-source.html fails
        https://bugs.webkit.org/show_bug.cgi?id=86310

        Reviewed by Eric Carlson.

        Reset the player's network and ready states, this allows the media
        player client to potentially emit a timeupdate event while the new
        location is being loaded. States are synchronized again after the
        pipeline pre-rolled.

        No new tests but fixes
        media/media-continues-playing-after-replace-source.html

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::load):

2012-08-08  Alexandru Chiculita  <achicu@adobe.com>

        [Chromium] Skia assert triggered by custom filter unmultiplied results
        https://bugs.webkit.org/show_bug.cgi?id=92758

        Reviewed by Dean Jackson.

        The FECustomFilter (which renders the CSS Shaders) used premultiplied colors for both input and ouput.
        The problem with that is that some shaders do not pre-multiply the values and the reality is that
        we cannot trust the shader to do that. The easy way would be to use only unpremultiplied colors and do the
        computation in C++ code. This will be changed when the mix blending is implemented to do that in the shader itself. 

        No new tests, just updated existing tests to take unpremultiplied colors instead.

        * platform/graphics/filters/FECustomFilter.cpp:
        (WebCore::FECustomFilter::platformApplySoftware):

2012-08-08  Philippe Normand  <pnormand@igalia.com>

        Unreviewed, build fix after r125041.

        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
        (StreamingClient::didReceiveResponse): Fix arguments order of the
        notifyGstTagsOnPad() call.

2012-08-08  Vineet Chaudhary  <rgf748@motorola.com>

        Remove All Custom binding code for TypedArray.
        https://bugs.webkit.org/show_bug.cgi?id=93371

        Reviewed by Kentaro Hara.

        Removing Custom bindings completely with help of [TypedArray] attribute.

        Tests: TestTypedArray.idl
        There should not be any behavioral change and all tests should pass.

        * GNUmakefile.list.am: Removed Custom files.
        * Target.pri: Ditto.
        * UseJSC.cmake: Ditto.
        * UseV8.cmake: Ditto.
        * WebCore.gypi: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * bindings/js/JSBindingsAllInOne.cpp: Ditto.
        * bindings/js/JSFloat32ArrayCustom.cpp: Removed.
        * bindings/js/JSFloat64ArrayCustom.cpp: Removed.
        * bindings/js/JSInt16ArrayCustom.cpp: Removed.
        * bindings/js/JSInt32ArrayCustom.cpp: Removed.
        * bindings/js/JSInt8ArrayCustom.cpp: Removed.
        * bindings/js/JSUint16ArrayCustom.cpp: Removed.
        * bindings/js/JSUint32ArrayCustom.cpp: Removed.
        * bindings/js/JSUint8ArrayCustom.cpp: Removed.
        * bindings/js/JSUint8ClampedArrayCustom.cpp: Removed.
        * bindings/scripts/CodeGeneratorCPP.pm:
        (GenerateHeader): Skip implementaion for TypedArray.
        (GenerateImplementation): Skip implementaion for TypedArray.
        * bindings/scripts/CodeGeneratorGObject.pm:
        (GenerateFunction): Skip implementaion for TypedArray.
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation): Generates binding for set() call.
        (GenerateConstructorDefinition): ConstructorTemplate implementation for TypedArray.
        * bindings/scripts/CodeGeneratorObjC.pm:
        (GenerateHeader): Skip implementaion for TypedArray.
        (GenerateImplementation): Skip implementaion for TypedArray.
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateFunctionCallback): Generates binding for setCallback().
        (GenerateTypedArrayConstructorCallback): Generates binding for constructorCallback().
        (GenerateImplementation):
        * bindings/scripts/IDLAttributes.txt: Support ConstructorTemplate for TypedArray as well.
        * bindings/scripts/test/JS/JSFloat64Array.cpp: Binding tests results.
        (WebCore::toJS):
        (WebCore::JSFloat64Array::indexSetter):
        (WebCore::JSFloat64ArrayConstructor::getConstructData):
        (WebCore::jsFloat64ArrayPrototypeFunctionFoo):
        (WebCore::jsFloat64ArrayPrototypeFunctionSet):
        * bindings/scripts/test/JS/JSFloat64Array.h: Binding tests results.
        * bindings/scripts/test/TestTypedArray.idl: Binding tests.
        * bindings/scripts/test/V8/V8Float64Array.cpp: Binding tests results.
        (WebCore::Float64ArrayV8Internal::setCallback):
        (Float64ArrayV8Internal):
        (WebCore):
        (WebCore::V8Float64Array::constructorCallback):
        (WebCore::ConfigureV8Float64ArrayTemplate):
        * bindings/v8/custom/V8Float32ArrayCustom.cpp: Removed.
        * bindings/v8/custom/V8Float64ArrayCustom.cpp: Removed.
        * bindings/v8/custom/V8Int16ArrayCustom.cpp: Removed.
        * bindings/v8/custom/V8Int32ArrayCustom.cpp: Removed.
        * bindings/v8/custom/V8Int8ArrayCustom.cpp: Removed.
        * bindings/v8/custom/V8Uint16ArrayCustom.cpp: Removed.
        * bindings/v8/custom/V8Uint32ArrayCustom.cpp: Removed.
        * bindings/v8/custom/V8Uint8ArrayCustom.cpp: Removed.
        * bindings/v8/custom/V8Uint8ClampedArrayCustom.cpp: Removed.
        * html/canvas/Float32Array.idl: Using [ConstructorTemplate = TypedArray] instead of custom implementaion.
        * html/canvas/Float64Array.idl: Ditto.
        * html/canvas/Int16Array.idl: Ditto.
        * html/canvas/Int32Array.idl: Ditto.
        * html/canvas/Int8Array.idl: Ditto.
        * html/canvas/Uint16Array.idl: Ditto.
        * html/canvas/Uint32Array.idl: Ditto.
        * html/canvas/Uint8Array.idl: Ditto.
        * html/canvas/Uint8ClampedArray.idl: Ditto.

2012-08-08  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] 0.11 build broken (again)
        https://bugs.webkit.org/show_bug.cgi?id=93474

        Reviewed by Martin Robinson.

        Adapt the GStreamer media player backend to the latest GStreamer
        0.11 API changes.

        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
        (WTF::adoptGRef):
        * platform/graphics/gstreamer/GStreamerVersioning.cpp:
        (gstObjectIsFloating):
        * platform/graphics/gstreamer/GStreamerVersioning.h:
        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
        (StreamingClient::didReceiveResponse):

2012-08-08  Loïc Yhuel  <loic.yhuel@softathome.com>

        [Qt] Compile errors with OpenGLES2
        https://bugs.webkit.org/show_bug.cgi?id=93206

        Reviewed by Noam Rosenthal.

        Fix build with OpenGLES2 on Linux desktop

        * platform/graphics/OpenGLESShims.h: removed unused define conflicting with gl2ext.h from ANGLE

2012-08-08  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: store last evaluation result in $_
        https://bugs.webkit.org/show_bug.cgi?id=93377

        Reviewed by Vsevolod Vlasov.

        All "console" evaluations end up in that variable on command line API.

        Test: inspector/console/console-last-result.html

        * inspector/InjectedScriptSource.js:
        (.):

2012-08-08  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] Port internal findMethodIndex method matcher to use JSC C API
        https://bugs.webkit.org/show_bug.cgi?id=93463

        Reviewed by Kenneth Rohde Christiansen.

        Based on patch by No'am Rosenthal.

        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::setException):
        (Bindings):
        (JSC::Bindings::findMethodIndex): Fixed also coding style while at it.
        (JSC::Bindings::QtRuntimeMetaMethod::call): Use new findMethodIndex. The
        created JSValueRefs should not need GC protection because we only support
        up to 10 method arguments and thus they will live on the stack storage
        of the vector.
        * bridge/qt/qt_runtime.h:
        (Bindings):

2012-08-08  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: move setTouchEventEmulationEnabled from DOMAgent to PageAgent
        https://bugs.webkit.org/show_bug.cgi?id=93437

        Reviewed by Pavel Feldman.

        * inspector/Inspector.json:
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::clearFrontend):
        (WebCore::InspectorDOMAgent::restore):
        * inspector/InspectorDOMAgent.h:
        (InspectorDOMAgent):
        * inspector/InspectorPageAgent.cpp:
        (PageAgentState):
        (WebCore::InspectorPageAgent::clearFrontend):
        (WebCore::InspectorPageAgent::restore):
        (WebCore):
        (WebCore::InspectorPageAgent::updateTouchEventEmulationInPage):
        (WebCore::InspectorPageAgent::setTouchEmulationEnabled):
        * inspector/InspectorPageAgent.h:
        * inspector/front-end/DOMAgent.js:
        (WebInspector.DOMAgent.prototype._emulateTouchEventsChanged):

2012-08-08  Alexis Menard  <alexis.menard@openbossa.org>

        Unreviewed build fix for Qt on Linux.

        * platform/qt/GamepadsQt.cpp:

2012-08-08  KwangYong Choi  <ky0.choi@samsung.com>

        [EFL] Support DataList for <input type="range">
        https://bugs.webkit.org/show_bug.cgi?id=92634

        Reviewed by Kenneth Rohde Christiansen.

        DataList theme for EFL is implemented. DataList feature of
        <input type="range"> is supported.

        Test: fast/forms/datalist/input-list.html

        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::paintSliderTrack):
        (WebCore::RenderThemeEfl::sliderTickSize):
        (WebCore::RenderThemeEfl::sliderTickOffsetFromTrackCenter):
        (WebCore::RenderThemeEfl::supportsDataListUI):
        (WebCore):
        * platform/efl/RenderThemeEfl.h:
        (RenderThemeEfl):

2012-08-08  Sergey Rogulenko  <rogulenko@google.com>

        Web Inspector: renaming DOMNodeHighlighter to InspectorOverlay
        https://bugs.webkit.org/show_bug.cgi?id=93253

        Reviewed by Pavel Feldman.

        Renaming DOMNodeHighlighter to InspectorOverlay where necessary.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * inspector/InspectorAllInOne.cpp:
        * inspector/InspectorController.cpp:
        * inspector/InspectorDOMAgent.cpp:
        * inspector/InspectorDOMAgent.h:
        * inspector/InspectorOverlay.cpp: Renamed from Source/WebCore/inspector/DOMNodeHighlighter.cpp.
        (WebCore::InspectorOverlay::InspectorOverlay):
        (WebCore):
        (WebCore::InspectorOverlay::paint):
        (WebCore::InspectorOverlay::drawOutline):
        (WebCore::InspectorOverlay::getHighlight):
        (WebCore::InspectorOverlay::setPausedInDebuggerMessage):
        (WebCore::InspectorOverlay::hideHighlight):
        (WebCore::InspectorOverlay::highlightNode):
        (WebCore::InspectorOverlay::highlightRect):
        (WebCore::InspectorOverlay::highlightedNode):
        (WebCore::InspectorOverlay::update):
        (WebCore::InspectorOverlay::drawNodeHighlight):
        (WebCore::InspectorOverlay::drawRectHighlight):
        (WebCore::InspectorOverlay::drawPausedInDebugger):
        * inspector/InspectorOverlay.h: Renamed from Source/WebCore/inspector/DOMNodeHighlighter.h.
        (WebCore):
        (HighlightConfig):
        (WebCore::Highlight::setColors):
        (Highlight):
        (InspectorOverlay):
        (WebCore::InspectorOverlay::create):
        * inspector/InspectorPageAgent.cpp:
        * inspector/PageDebuggerAgent.cpp:
        * page/GestureTapHighlighter.h:
        * testing/Internals.cpp:

2012-08-08  Chris Guan  <chris.guan@torchmobile.com.cn>

        [Blackberry] missing a Multipart header when m_multipartResponse is null
        https://bugs.webkit.org/show_bug.cgi?id=93440

        Reviewed by George Staikos.

        when m_multipartResponse is null, we just created new one but not called 
        setHTTPHeaderField. So we missed this received multipart Header. We should 
        call setHTTPHeaderField for each reveived header.

        No new tests, because those current multipart test cases (http/tests/multipart/*) 
        are enough.

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::handleNotifyMultipartHeaderReceived):

2012-08-08  Mike West  <mkwst@chromium.org>

        Refactor console logging out of CSPDirectiveList into ContentSecurityPolicy
        https://bugs.webkit.org/show_bug.cgi?id=93205

        Reviewed by Adam Barth.

        We currently pass a protected resource's ScriptExecutionContext down
        into CSPDirectiveList in order to log errors, grab the SecurityOrigin,
        resolve relative URLs, and one or two other bits. This implementation
        requires us to maintain state inside of low-level objects that shouldn't
        really know about the ScriptExecutionContext, and makes logging errors
        difficult, as CSPDirectiveList is the only piece of the puzzle that can
        interact with the console.

        This patch removes the dependence on ScriptExecutionContext, replacing
        it with a pointer to the ContentSecurityPolicy object itself. The low-
        level objects like CSPDirectiveList now make requests to the policy
        object, which understands how to resolve them. This gives a cleaner
        separation between the CSP implementation and the rest of WebCore, and
        opens the door for future patches that teach the remaining low-level
        objects about the policy in which they're contained in order to improve
        error logging.

        This should be a purely internal refactoring of the location from which
        warnings are logged to the console. No new tests have been added; the
        behavior should be covered by the existing CSP tests.

        * page/ContentSecurityPolicy.cpp:
        (CSPSourceList):
        (WebCore::CSPSourceList::CSPSourceList):
            Pass the policy object into CSPSourceList, rather than a pointer to
            ScriptExecutionContext.
        (WebCore::CSPSourceList::parse):
        (WebCore::CSPSourceList::addSourceSelf):
            Read the SecurityOrigin from the policy object, rather than from the
            ScriptExecutionContext.
        (WebCore::CSPDirective::CSPDirective):
            Pass the policy object into CSPDirective, rather than a pointer to
            ScriptExecutionContext. Use it to read the protected resource's
            URL.
        (CSPDirectiveList):
        (WebCore::CSPDirectiveList::CSPDirectiveList):
            Pass the policy object into CSPSourceList, rather than a pointer to
            ScriptExecutionContext.
        (WebCore::CSPDirectiveList::create):
            Move the enforcement of eval restrictions out of CSPDirectiveList,
            and into ContentSecurityPolicy::ContentSecurityPolicy.
        (WebCore::CSPDirectiveList::reportViolation):
            Move most of the logic out of this method, and into
            ContentSecurityPolicy::reportViolation.
        (WebCore::CSPDirectiveList::parseDirective):
            Use the policy object for logging.
        (WebCore::CSPDirectiveList::parseReportURI):
            Use the policy object for logging, and URL completion.
        (WebCore::CSPDirectiveList::parseScriptNonce):
            Use the policy object for logging.
        (WebCore::CSPDirectiveList::setCSPDirective):
            Use the policy object for logging.
        (WebCore::CSPDirectiveList::applySandboxPolicy):
            Use the policy object for logging, and move enforcement to
            ContentSecurityPolicy::enforceSandboxFlags.
        (WebCore::CSPDirectiveList::addDirective):
            Use the policy object for logging.
        (WebCore::ContentSecurityPolicy::didReceiveHeader):
            Pass the policy object to CSPDirectiveList, and disable eval if
            necessary after parsing the policy.
        (WebCore::ContentSecurityPolicy::securityOrigin):
        (WebCore):
        (WebCore::ContentSecurityPolicy::url):
        (WebCore::ContentSecurityPolicy::completeURL):
        (WebCore::ContentSecurityPolicy::enforceSandboxFlags):
            Move the enforcement of the sandbox directive out of
            CSPDirectiveList and into the policy object.
        (WebCore::ContentSecurityPolicy::reportViolation):
        (WebCore::ContentSecurityPolicy::reportUnrecognizedDirective):
        (WebCore::ContentSecurityPolicy::reportDuplicateDirective):
        (WebCore::ContentSecurityPolicy::reportInvalidNonce):
            Move CSPDirectiveList::logXXX out to the policy object. The
            directive list is now responsible for reporting errors and
            violations; the policy decides what to do with them.
        (WebCore::ContentSecurityPolicy::logToConsole):
            Wrap the call to addConsoleMessage to make it simpler for the
            various ContentSecurityPolicy::reportXXX methods.
        * page/ContentSecurityPolicy.h:
        (WebCore):

2012-08-08  Kentaro Hara  <haraken@chromium.org>

        [V8] Rename V8Helpers to V8BindingHelpers
        https://bugs.webkit.org/show_bug.cgi?id=93318

        Reviewed by Eric Seidel.

        For naming consistency, a file including binding utility methods
        should be prefixed by "V8Binding". In a follow-up patch, I'll move
        methods from V8Binding to V8BindingHelpers.

        In addition this patch makes V8Binding.h include V8BindingHelpers.h,
        and removes #include V8BindingHelpers.h from binding files.

        No tests. No change in behavior.

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/v8/NPV8Object.cpp:
        * bindings/v8/V8BindingHelpers.cpp: Renamed from Source/WebCore/bindings/v8/V8Helpers.cpp.
        (WebCore):
        (WebCore::toV8Context):
        (WebCore::toV8Proxy):
        * bindings/v8/V8BindingHelpers.h: Renamed from Source/WebCore/bindings/v8/V8Helpers.h.
        (WebCore):
        * bindings/v8/V8NPObject.cpp:

2012-08-08  Kentaro Hara  <haraken@chromium.org>

        'class WrapperTypeInfo' should be 'struct WrapperTypeInfo'

        Unreviewed. Build fix for r125015.

        * bindings/v8/V8BindingPerIsolateData.h:
        (WebCore):

2012-08-08  Matt Arsenault  <arsenm2@gmail.com>

        Crash when inspecting an element with border-image
        https://bugs.webkit.org/show_bug.cgi?id=93380

        Reviewed by Tim Horton.

        The second value in the CSSPair should be the same as the first if
        we are in a shorthand and the next value is not a
        border-image-repeat keyword.

        Test: fast/css/parse-border-image-repeat-null-crash.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseBorderImageRepeat):

2012-08-08  Kentaro Hara  <haraken@chromium.org>

        [V8] Factor out V8BindingPerIsolateData from V8Binding to a separate file
        https://bugs.webkit.org/show_bug.cgi?id=93333

        Reviewed by Adam Barth.

        This patch moves V8BindingPerIsolateData to V8BindingPerIsolateData.{h,cpp}.

        To avoid circular #include dependency, I used OwnPtrs for m_stringCache,
        m_integerCache, m_hiddenPropertyName and m_gcEventData.

        No tests. No change in behavior.

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/v8/ScriptGCEvent.cpp:
        (WebCore::isolateGCEventData):
        (WebCore::ScriptGCEvent::addEventListener):
        (WebCore::ScriptGCEvent::removeEventListener):
        (WebCore::ScriptGCEvent::gcPrologueCallback):
        (WebCore::ScriptGCEvent::gcEpilogueCallback):
        * bindings/v8/V8Binding.cpp:
        * bindings/v8/V8Binding.h:
        (GCEventData):
        (WebCore):
        * bindings/v8/V8BindingPerIsolateData.cpp: Added.
        (WebCore):
        (WebCore::V8BindingPerIsolateData::V8BindingPerIsolateData):
        (WebCore::V8BindingPerIsolateData::~V8BindingPerIsolateData):
        (WebCore::V8BindingPerIsolateData::create):
        (WebCore::V8BindingPerIsolateData::ensureInitialized):
        (WebCore::V8BindingPerIsolateData::dispose):
        (WebCore::V8BindingPerIsolateData::reportMemoryUsage):
        * bindings/v8/V8BindingPerIsolateData.h: Added.
        (WebCore):
        (V8BindingPerIsolateData):
        (WebCore::V8BindingPerIsolateData::current):
        (WebCore::V8BindingPerIsolateData::rawTemplateMap):
        (WebCore::V8BindingPerIsolateData::templateMap):
        (WebCore::V8BindingPerIsolateData::toStringName):
        (WebCore::V8BindingPerIsolateData::toStringTemplate):
        (WebCore::V8BindingPerIsolateData::lazyEventListenerToStringTemplate):
        (WebCore::V8BindingPerIsolateData::stringCache):
        (WebCore::V8BindingPerIsolateData::integerCache):
        (WebCore::V8BindingPerIsolateData::allStores):
        (WebCore::V8BindingPerIsolateData::hiddenPropertyName):
        (WebCore::V8BindingPerIsolateData::auxiliaryContext):
        (WebCore::V8BindingPerIsolateData::registerDOMDataStore):
        (WebCore::V8BindingPerIsolateData::unregisterDOMDataStore):
        (WebCore::V8BindingPerIsolateData::domDataStore):
        (WebCore::V8BindingPerIsolateData::setDOMDataStore):
        (WebCore::V8BindingPerIsolateData::recursionLevel):
        (WebCore::V8BindingPerIsolateData::incrementRecursionLevel):
        (WebCore::V8BindingPerIsolateData::decrementRecursionLevel):
        (WebCore::V8BindingPerIsolateData::globalHandleMap):
        (WebCore::V8BindingPerIsolateData::internalScriptRecursionLevel):
        (WebCore::V8BindingPerIsolateData::incrementInternalScriptRecursionLevel):
        (WebCore::V8BindingPerIsolateData::decrementInternalScriptRecursionLevel):
        (WebCore::V8BindingPerIsolateData::gcEventData):
        (WebCore::V8BindingPerIsolateData::setShouldCollectGarbageSoon):
        (WebCore::V8BindingPerIsolateData::clearShouldCollectGarbageSoon):
        (WebCore::V8BindingPerIsolateData::shouldCollectGarbageSoon):

2012-08-08  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: show whitespace nodes if they are the only tag's children.
        https://bugs.webkit.org/show_bug.cgi?id=93441

        Reviewed by Vsevolod Vlasov.

        Pass whitespace node info into the front-end when it is the only element's child.

        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):

2012-08-08  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to ArrayValue and Dictionary
        https://bugs.webkit.org/show_bug.cgi?id=93315

        Reviewed by Adam Barth.

        This patch passes Isolate to ArrayValue and Dictionary.

        Rationale 1: We want to replace V8Proxy::throwError(ExceptionCode)
        with setDOMException(ExceptionCode, Isolate*). For the replacement,
        we need to pass Isolate to V8Utilities::extractTransferables().
        To pass Isolate to V8Utilities::extractTransferables(), ( ...omitted... ),
        we need to pass Isolate to ArrayValue and Dictionary.

        Rationale 2: JSC already passes ExecState to ArrayValue and Dictionary.

        Tests: storage/indexeddb/*
               fast/files/*

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateEventConstructorCallback):
        (JSValueToNative):
        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
        (WebCore::V8TestEventConstructor::constructorCallback):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::optionsObjectCallback):
        * bindings/v8/ArrayValue.cpp:
        (WebCore::ArrayValue::operator=):
        (WebCore::ArrayValue::get):
        * bindings/v8/ArrayValue.h:
        (WebCore::ArrayValue::ArrayValue):
        (ArrayValue):
        * bindings/v8/Dictionary.cpp:
        (WebCore::Dictionary::Dictionary):
        (WebCore::Dictionary::operator=):
        (WebCore::Dictionary::get):
        * bindings/v8/Dictionary.h:
        (Dictionary):
        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::V8Blob::constructorCallback):
        * bindings/v8/custom/V8IntentConstructor.cpp:
        (WebCore::V8Intent::constructorCallback):

2012-08-08  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: cached images memory instrumentation regression after r124744
        https://bugs.webkit.org/show_bug.cgi?id=93366

        Reviewed by Vsevolod Vlasov.

        CachedImage memory usage data no includes size of both encoded and
        decoded data.

        Test: inspector/profiler/memory-instrumentation-cached-images.html

        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::reportMemoryUsage):

2012-08-08  Kentaro Hara  <haraken@chromium.org>

        Optimize Element::hasAttribute() by replacing String with AtomicString
        https://bugs.webkit.org/show_bug.cgi?id=90273

        Reviewed by Adam Barth.

        Based on the observation described in this ChangeLog
        (http://trac.webkit.org/changeset/121439), this patch optimizes the
        performance of Element::hasAttribute() by replacing String with AtomicString.

        Performance test: https://bugs.webkit.org/attachment.cgi?id=150144

        hasAttribute (Chromium/Linux):
        329.60ms => 259.00ms

        hasAttributeNS (Chromium/Linux):
        549.60ms => 435.80ms

        * dom/Element.cpp:
        (WebCore::Element::hasAttribute):
        (WebCore::Element::hasAttributeNS):
        * dom/Element.h:
        (Element):

2012-08-08  Kentaro Hara  <haraken@chromium.org>

        Optimize Element::removeAttribute() by replacing String with AtomicString
        https://bugs.webkit.org/show_bug.cgi?id=90265

        Reviewed by Adam Barth.

        Based on the observation described in this ChangeLog
        (http://trac.webkit.org/changeset/121439), this patch optimizes
        Element::removeAttribute() by replacing String with AtomicString.

        Performance test: https://bugs.webkit.org/attachment.cgi?id=150140

        removeAttribute (Chromium/Linux):
        334.20ms => 240.60ms

        removeAttributeNS (Chromium/Linux):
        552.80ms => 421.60ms

        * dom/Element.cpp:
        (WebCore::Element::removeAttribute):
        (WebCore::Element::removeAttributeNS):
        * dom/Element.h:
        (Element):

2012-08-08  Shinya Kawanaka  <shinyak@chromium.org>

        Remove Element::ensureShadowRoot
        https://bugs.webkit.org/show_bug.cgi?id=77608

        Reviewed by Ryosuke Niwa.

        Since Element::ensureShadowRoot is not used anymore, we can remove this safely.

        No new tests, no change in behavior.

        * WebCore.order:
        * dom/Element.cpp:
        * dom/Element.h:
        (Element):

2012-08-08  Kentaro Hara  <haraken@chromium.org>

        Remove an unused member variable.

        Unreviewed, build fix for r124990.

        * dom/ContainerNode.h:
        (WebCore::ChildNodesLazySnapshot::ChildNodesLazySnapshot):
        (ChildNodesLazySnapshot):

2012-08-07  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: TabbedPane should use floating point width values for measuring.
        https://bugs.webkit.org/show_bug.cgi?id=93349

        Reviewed by Pavel Feldman.

        TabbedPane now uses getBoundingClientRect().width instead of offsetWidth for more precise calculation.

        * inspector/front-end/TabbedPane.js:
        (WebInspector.TabbedPane.prototype._totalWidth):
        (WebInspector.TabbedPane.prototype._updateTabsDropDown):
        (WebInspector.TabbedPane.prototype._measureDropDownButton):
        (WebInspector.TabbedPane.prototype._updateWidths):
        (WebInspector.TabbedPaneTab.prototype._measure):

2012-08-08  Douglas Stockwell  <dstockwell@chromium.org>

        'highlight' should not be parsed for a composite operation
        https://bugs.webkit.org/show_bug.cgi?id=92615

        Reviewed by Ryosuke Niwa.

        r88144 removed support for highlight as a composite operation but did
        not update the parser.

        Test: fast/backgrounds/composite-highlight-is-invalid.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseFillProperty):

2012-08-08  Takashi Sakamoto  <tasak@google.com>

        showNodePath should show the age of ShadowRoot
        https://bugs.webkit.org/show_bug.cgi?id=93347

        Reviewed by Ryosuke Niwa.

        No new tests, because this patch is for fixing a bug of a method for
        debugging. If NDEBUG is defined, the method is not compiled.

        * dom/Node.cpp:
        (WebCore::Node::showNodePathForThis):
        Fixed the bug to obtain the oldest shadow root from a shadow root.
        oldestShadowRootFor only works for an element node, not for a shadow root.

2012-08-07  Kent Tamura  <tkent@chromium.org>

        Remove fractionDigits argument of WebCore::convertToLocalizedNumber()
        https://bugs.webkit.org/show_bug.cgi?id=93435

        Reviewed by Kentaro Hara.

        Remove the fractionDigits argument of convertToLocalizedNumber because
        we don't use it any more. Also, we can remove
        parseToDoubleForNumberTypeWithDecimalPlaces() functions, which are used
        to obtain the fractionDigits argument.

        No new tests because of no behavior changes.

        * platform/text/LocalizedNumber.h:
        (WebCore): Remove the fractionDigits argument of convertToLocalizedNumber.
        * platform/text/LocalizedNumberICU.cpp:
        (WebCore::convertToLocalizedNumber): ditto.
        * platform/text/LocalizedNumberNone.cpp:
        (WebCore::convertToLocalizedNumber): ditto.
        * platform/text/mac/LocalizedNumberMac.mm:
        (WebCore::convertToLocalizedNumber): ditto.
        * platform/text/win/LocalizedNumberWin.cpp:
        (WebCore::convertToLocalizedNumber): ditto.

        * html/NumberInputType.cpp:
        (WebCore::NumberInputType::localizeValue):
        Remove the code to make the decimalPlace value.
        * html/parser/HTMLParserIdioms.cpp:
        Remove parseToDoubleForNumberTypeWithDecimalPlaces.
        * html/parser/HTMLParserIdioms.h: ditto.

2012-08-08  Mario Sanchez Prada  <msanchez@igalia.com>

        REGRESSION(r65062): out of bound access in TextIterator (5 editing tests) on GTK
        https://bugs.webkit.org/show_bug.cgi?id=63611

        Reviewed by Ryosuke Niwa.

        Ensure document's layout is up-to-date before using TextIterator
        to properly calculate the offset for a text change when emitting
        accessibility related signals in GTK.

        * accessibility/gtk/AXObjectCacheAtk.cpp:
        (WebCore::AXObjectCache::nodeTextChangePlatformNotification): Call
        to document->updateLayout() before using TextIterator.

2012-08-07  Hayato Ito  <hayato@chromium.org>

        Unreviewed build fix after http://trac.webkit.org/changeset/124975

        Remove assertion introduced in r124975.

        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::EventDispatcher):
        (WebCore::EventDispatcher::dispatchEvent):
        * dom/EventDispatcher.h:
        (EventDispatcher):

2012-08-07  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124969.
        http://trac.webkit.org/changeset/124969
        https://bugs.webkit.org/show_bug.cgi?id=93436

        Causes assertion failure in RenderQueue (Requested by toyoshim
        on #webkit).

        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::removeChildNode):
        (WebCore::RenderObjectChildList::appendChildNode):
        (WebCore::RenderObjectChildList::insertChildNode):
        * rendering/RenderQuote.cpp:
        (WebCore::adjustDepth):
        (WebCore::RenderQuote::RenderQuote):
        (WebCore::RenderQuote::~RenderQuote):
        (WebCore::RenderQuote::willBeDestroyed):
        (WebCore::RenderQuote::renderName):
        (WebCore):
        (WebCore::RenderQuote::placeQuote):
        (WebCore::RenderQuote::originalText):
        (WebCore::RenderQuote::computePreferredLogicalWidths):
        (WebCore::RenderQuote::rendererSubtreeAttached):
        (WebCore::RenderQuote::rendererRemovedFromTree):
        (WebCore::RenderQuote::styleDidChange):
        * rendering/RenderQuote.h:
        (RenderQuote):
        (WebCore::RenderQuote::isQuote):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::RenderView):
        * rendering/RenderView.h:
        (WebCore):
        (RenderView):
        (WebCore::RenderView::addRenderQuote):
        (WebCore::RenderView::removeRenderQuote):
        (WebCore::RenderView::hasRenderQuotes):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::diff):

2012-08-07  Kentaro Hara  <haraken@chromium.org>

        Optimize ChildNode{Insertion,Removal}Notifier::notify() by lazily taking a snapshot of child nodes
        https://bugs.webkit.org/show_bug.cgi?id=92965

        Reviewed by Adam Barth.

        This patch improves performance of Dromaeo/dom-modify by 8.2% in both Chromium and Safari.

        [Mac/Safari]     4590.33 runs/s  =>  4965.79 runs/s  (+8.18%)
        [Chromium/Linux] 3970.63 runs/s  =>  4299.65 runs/s  (+8.29%)

        notifyDescendantRemovedFromDocument() cannot iterate child nodes in this way:

        void notifyDescendantRemovedFromDocument(Node* node) {
            for (Node* child = node->firstChild(); child; child = child->nextSibling()) {
                ...;
                notifyNodeRemovedFromDocument(child);
            }
        }

        This is because notifyNodeRemovedFromDocument(child) might dispatch events
        and the events might change child trees. To avoid security issues, the current
        code takes a snapshot of child nodes before starting the iteration.

        void notifyDescendantRemovedFromDocument(Node* node) {
            NodeVector children;
            getChildNodes(node, children); // Take a snapshot.
            for (int i = 0; i < children.size(); i++) {
                ...;
                notifyNodeRemovedFromDocument(children[i]);
            }
        }

        Based on the observation that in almost all cases events won't be dispatched
        from inside notifyNodeRemovedFromDocument(), this patch implements
        a "lazy" snapshot. The snapshot is taken at the point where
        EventDispatcher::dispatchEvent() is invoked. The snapshot is not taken unless
        any event is dispatched.

        No tests. Confirm that all existing tests pass.
        Actually, at present there is (should be) no case where an event is
        dispatched from inside notifyNodeRemovedFromDocument(). Even DOMNodeInserted
        and DOMNodeRemoved events are not dispatched. Originally the snapshot was
        implemented "just in case" to protect the code from future attacks.
        I manually confirmed that the lazy snapshot works correctly by inserting
        takeChildNodesSnapshot() to notifyDescendantRemovedFromDocument()
        in a random manner.

        * dom/ContainerNode.cpp:
        (WebCore):
        * dom/ContainerNode.h:
        (ChildNodesLazySnapshot):
        (WebCore::ChildNodesLazySnapshot::ChildNodesLazySnapshot):
        (WebCore::ChildNodesLazySnapshot::~ChildNodesLazySnapshot):
        (WebCore::ChildNodesLazySnapshot::nextNode):
        (WebCore::ChildNodesLazySnapshot::takeSnapshot):
        (WebCore::ChildNodesLazySnapshot::nextSnapshot):
        (WebCore::ChildNodesLazySnapshot::hasSnapshot):
        (WebCore::ChildNodesLazySnapshot::takeChildNodesLazySnapshot):
        (WebCore):
        * dom/ContainerNodeAlgorithms.cpp:
        (WebCore::ChildNodeInsertionNotifier::notifyDescendantInsertedIntoDocument):
        (WebCore::ChildNodeRemovalNotifier::notifyDescendantRemovedFromDocument):
        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::dispatchEvent):

2012-08-07  Ojan Vafai  <ojan@chromium.org>

        percentage margins + flex incorrectly overflows the flexbox
        https://bugs.webkit.org/show_bug.cgi?id=93411

        Reviewed by Tony Chang.

        Percent margins should always be computed with respect to the containing
        block's width, not it's height. We were getting this wrong in column flows.

        Test: css3/flexbox/percent-margins.html

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::computeMarginValue):
        (WebCore):
        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes):
        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
        * rendering/RenderFlexibleBox.h:

2012-08-07  Kentaro Hara  <haraken@chromium.org>

        [V8] Replace throwError(ExceptionCode, Isolate*) with setDOMException(ExceptionCode, Isolate*) in v8/* and v8/custom/*
        https://bugs.webkit.org/show_bug.cgi?id=93226

        Reviewed by Eric Seidel.

        Now throwError(ExceptionCode, Isolate*) is equivalent to
        setDOMException(ExceptionCode, Isolate*). We can replace the former with
        the latter. After this replacement, the rule becomes simple and sane:
        "Use throwError() for throwing JavaScript errors, use setDOMException()
        for throwing DOM exceptions".

        No tests. No change in behavior.

        * bindings/v8/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::transferArrayBuffers):
        (WebCore::SerializedScriptValue::SerializedScriptValue):
        * bindings/v8/custom/V8AudioContextCustom.cpp:
        (WebCore::V8AudioContext::constructorCallback):
        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
        (WebCore::V8CSSStyleDeclaration::namedPropertySetter):
        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        (WebCore::V8DOMStringMap::namedPropertySetter):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::handlePostMessageCallback):
        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
        (WebCore::handlePostMessageCallback):
        * bindings/v8/custom/V8DirectoryEntryCustom.cpp:
        (WebCore::V8DirectoryEntry::getDirectoryCallback):
        (WebCore::V8DirectoryEntry::getFileCallback):
        * bindings/v8/custom/V8DocumentCustom.cpp:
        (WebCore::V8Document::evaluateCallback):
        * bindings/v8/custom/V8HistoryCustom.cpp:
        (WebCore::V8History::pushStateCallback):
        (WebCore::V8History::replaceStateCallback):
        * bindings/v8/custom/V8IntentConstructor.cpp:
        (WebCore::V8Intent::constructorCallback):
        * bindings/v8/custom/V8MessagePortCustom.cpp:
        (WebCore::handlePostMessageCallback):
        * bindings/v8/custom/V8MutationObserverCustom.cpp:
        (WebCore::V8MutationObserver::constructorCallback):
        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
        (WebCore::V8NotificationCenter::createHTMLNotificationCallback):
        (WebCore::V8NotificationCenter::createNotificationCallback):
        (WebCore::V8NotificationCenter::requestPermissionCallback):
        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
        (WebCore::V8SQLTransaction::executeSqlCallback):
        * bindings/v8/custom/V8SQLTransactionSyncCustom.cpp:
        (WebCore::V8SQLTransactionSync::executeSqlCallback):
        * bindings/v8/custom/V8StorageCustom.cpp:
        (WebCore::storageSetter):
        * bindings/v8/custom/V8WebSocketCustom.cpp:
        (WebCore::V8WebSocket::constructorCallback):
        (WebCore::V8WebSocket::sendCallback):
        * bindings/v8/custom/V8WorkerContextCustom.cpp:
        (WebCore::V8WorkerContext::importScriptsCallback):
        * bindings/v8/custom/V8WorkerCustom.cpp:
        (WebCore::handlePostMessageCallback):
        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
        (WebCore::V8XMLHttpRequest::responseTextAccessorGetter):
        (WebCore::V8XMLHttpRequest::openCallback):
        (WebCore::V8XMLHttpRequest::sendCallback):

2012-08-07  Kentaro Hara  <haraken@chromium.org>

        [V8] Replace v8::Handle<v8::Value>() in custom bindings with v8Undefined()
        https://bugs.webkit.org/show_bug.cgi?id=93215

        Reviewed by Eric Seidel.

        We should use v8Undefined() everywhere in V8 bindings.

        No tests. No change in behavior.

        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
        (WebCore::V8CSSStyleDeclaration::namedPropertyGetter):
        (WebCore::V8CSSStyleDeclaration::namedPropertySetter):
        * bindings/v8/custom/V8ConsoleCustom.cpp:
        (WebCore::V8Console::traceCallback):
        (WebCore::V8Console::assertCallback):
        (WebCore::V8Console::profileCallback):
        (WebCore::V8Console::profileEndCallback):
        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        (WebCore::V8DOMStringMap::namedPropertyGetter):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::V8DOMWindow::indexedPropertyGetter):
        (WebCore::V8DOMWindow::namedPropertyGetter):
        * bindings/v8/custom/V8DataViewCustom.cpp:
        (WebCore::V8DataView::setInt8Callback):
        (WebCore::V8DataView::setUint8Callback):
        * bindings/v8/custom/V8DeviceMotionEventCustom.cpp:
        (WebCore::V8DeviceMotionEvent::initDeviceMotionEventCallback):
        * bindings/v8/custom/V8DeviceOrientationEventCustom.cpp:
        (WebCore::V8DeviceOrientationEvent::initDeviceOrientationEventCallback):
        * bindings/v8/custom/V8DirectoryEntryCustom.cpp:
        (WebCore::V8DirectoryEntry::getDirectoryCallback):
        (WebCore::V8DirectoryEntry::getFileCallback):
        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
        (WebCore::getNamedItems):
        (WebCore::V8HTMLAllCollection::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
        (WebCore::getNamedItems):
        (WebCore::V8HTMLCollection::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::V8HTMLDocument::GetNamedProperty):
        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
        (WebCore::V8HTMLFormElement::indexedPropertyGetter):
        (WebCore::V8HTMLFormElement::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
        (WebCore::V8HTMLFrameSetElement::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
        (WebCore::V8HTMLOptionsCollection::indexedPropertyGetter):
        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
        (WebCore::npObjectNamedGetter):
        (WebCore::npObjectNamedSetter):
        (WebCore::npObjectIndexedGetter):
        (WebCore::npObjectIndexedSetter):
        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
        (WebCore::V8HTMLSelectElement::indexedPropertyGetter):
        * bindings/v8/custom/V8LocationCustom.cpp:
        (WebCore::V8Location::reloadAccessorGetter):
        (WebCore::V8Location::replaceAccessorGetter):
        (WebCore::V8Location::assignAccessorGetter):
        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
        (WebCore::V8NamedNodeMap::indexedPropertyGetter):
        (WebCore::V8NamedNodeMap::namedPropertyGetter):
        * bindings/v8/custom/V8NodeListCustom.cpp:
        (WebCore::V8NodeList::namedPropertyGetter):
        * bindings/v8/custom/V8SVGLengthCustom.cpp:
        (WebCore::V8SVGLength::convertToSpecifiedUnitsCallback):
        * bindings/v8/custom/V8StorageCustom.cpp:
        (WebCore::storageGetter):
        (WebCore::V8Storage::namedPropertyGetter):
        (WebCore::storageSetter):
        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
        (WebCore::V8StyleSheetList::namedPropertyGetter):

2012-08-07  Kentaro Hara  <haraken@chromium.org>

        [V8] Replace v8::Handle<v8::Value>() in bindings/v8/* with v8Undefined()
        https://bugs.webkit.org/show_bug.cgi?id=93211

        Reviewed by Eric Seidel.

        We should use v8Undefined() everywhere in V8 bindings.
        Replacing v8::Local<v8::Value>() etc with v8Undefined() can cause build
        errors due to type conversion mismatch. I'll do the replacement in follow-up
        patches.

        No tests. No change in behavior.

        * bindings/v8/IDBBindingUtilities.cpp:
        (WebCore):
        * bindings/v8/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::pauseOnExceptionsState):
        (WebCore::ScriptDebugServer::handleV8DebugEvent):
        * bindings/v8/SerializedScriptValue.cpp:
        * bindings/v8/V8Binding.cpp:
        (WebCore::batchConfigureCallbacks):
        * bindings/v8/V8Collection.h:
        (WebCore::getV8Object):
        (WebCore::collectionNamedPropertyGetter):
        * bindings/v8/V8DOMWrapper.cpp:
        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
        * bindings/v8/V8NPObject.cpp:
        (WebCore::npObjectGetProperty):
        (WebCore::npObjectSetProperty):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::setDOMException):
        (WebCore::V8Proxy::throwError):
        * bindings/v8/WorkerScriptDebugServer.cpp:
        (WebCore::WorkerScriptDebugServer::addListener):

2012-08-07  Joe Mason  <jmason@rim.com>

        Fix regression in credential storage when using Negotiate auth
        https://bugs.webkit.org/show_bug.cgi?id=93386

        Reviewed by George Staikos.

        r124205 regressed credential storage and lookup.  It added code to update the scheme used in
        credential storage if the scheme chosen by the network stack is different from that requested by
        webkit (currently this is only used when webkit requests Negotiate auth, but the Negotiate
        infrastructure isn't set up correctly, so the network stack falls back to another auth type, usually
        NTLM).  But the credentials are saved when a "success" status is received, and the scheme in the
        credentials is not updated until notifyAuthReceived is called to report the actual auth scheme used.
        The result is that the credentials are stored with the wrong auth scheme and can never be retreived.

        Fixed by delaying the credential save until notifyAuthReceived.

        RIM PR 166514
        Internally reviewed by George Staikos

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::handleNotifyStatusReceived): Stop storing credentials here.
        (WebCore::NetworkJob::notifyAuthReceived): Store credentials here instead.

2012-08-07  Kent Tamura  <tkent@chromium.org>

        [Mac] Do not reformat numbers in <input type=number>
        https://bugs.webkit.org/show_bug.cgi?id=93236

        Reviewed by Hajime Morita.

        We had bugs such as stripping leading zeros, dropping lower digits of
        large numbers because we parse a user-input string to a double value,
        and generate a string from the double value.

        In order to avoid such reformatting, we use
        platform/text/NumberLocalizer, which maps ASCII digits to the
        corresponding localized digits.

        Test: fast/forms/number/number-lossless-localization.html

        * WebCore.xcodeproj/project.pbxproj:
        Add the following files:
         - platform/text/NumberLocalizer.cpp
         - platform/text/NumberLocalizer.h
         - platform/mac/LocaleMac.h
         - platform/mac/LocaleMac.mm
        * platform/text/mac/LocaleMac.h:
        (LocaleMac): Inherit NumberLocalizer, and declare
        initializeNumberLocalizerData() for it.
        Add m_didInitializeNumberData flag.
        * platform/text/mac/LocaleMac.mm:
        (WebCore::LocaleMac::LocaleMac): Initialize m_didInitializeNumberData
        (WebCore::LocaleMac::initializeNumberLocalizerData):
        Added. Prepare data for number localization, and call
        NumberLocalizer::setNumberLocalizerData().
        A tricky part is to format 9876543210 for m_locale. It seems OSX doesn't
        have API to get localized digits.
        * platform/text/mac/LocalizedNumberMac.mm:
        Remove many lines, and calls the corresponding functions of LocaleMac.
        (WebCore::convertToLocalizedNumber):
        (WebCore::convertFromLocalizedNumber):
        (WebCore::localizedDecimalSeparator):

2012-08-07  Kentaro Hara  <haraken@chromium.org>

        [V8] Move V8BindingMacros.h from bindings/v8/custom/ to bindings/v8/
        https://bugs.webkit.org/show_bug.cgi?id=93254

        Reviewed by Eric Seidel.

        V8BindingMacros.h should exist in bindings/v8/.
        This patch also moves related enums from V8Binding.h to V8BindingMacros.h.

        No tests. No change in behavior.

        * WebCore.gypi:
        * bindings/v8/V8BindingMacros.h: Renamed from Source/WebCore/bindings/v8/custom/V8BindingMacros.h.
        (WebCore):

2012-08-07  Kentaro Hara  <haraken@chromium.org>

        [V8] StringCache::m_lastStringImpl and StringCache::m_lastV8String should be in sync
        https://bugs.webkit.org/show_bug.cgi?id=93065

        Reviewed by Eric Seidel.

        StringCache::m_lastStringImpl caches a StringImpl that was accessed most
        recently. StringCache::m_lastV8String caches Persistent<String> corresponding
        to the StringImpl. Hence m_lastStringImpl and m_lastV8String should be in sync.

        However, StringCache::remove() breaks the sync. StringCache::remove() clears
        m_lastStringImpl but does not clear m_lastV8String. As far as I analyze the code,
        this won't cause any problem, but we should fix it just in case.

        No tests. No change in behavior.

        * bindings/v8/V8Binding.cpp:
        (WebCore::StringCache::remove):

2012-08-07  Hayato Ito  <hayato@chromium.org>

        Don't re-use the same EventDispatcher instance to dispatch events.
        https://bugs.webkit.org/show_bug.cgi?id=93322

        Reviewed by Dimitri Glazkov.

        It is potentially dangerous to call
        EventDispatcher::dispatchEvent(PassRefPtr<Event>) twice for the
        same EventDispatcher instance.  Some member functions in
        EventDispatcher assume that dispatchEvent(PassRefPtr<Event>) is
        never called more than once in its life cycle.

        For example, EventDispatcher::ensureEventAncestor never
        recalculates ancestors of node even when
        dispatchEvent(PassRefPtr<Event)) is called again with a different
        event parameter.

        A 'dblclick' event violates this rule. A 'dblclick' dispatching
        reuses the same dispatcher instance.  So stop re-using the same
        dispatcher and add ASSERT to make sure dispatchEvent() is never
        called more than once.

        No new tests, no change in functionality.

        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::EventDispatcher):
        (WebCore::EventDispatcher::dispatchEvent):
        * dom/EventDispatcher.h:
        (EventDispatcher):
        * dom/MouseEvent.cpp:
        (WebCore::MouseEventDispatchMediator::dispatchEvent):

2012-08-07  Joshua Bell  <jsbell@chromium.org>

        Layout Test storage/indexeddb/intversion-omit-parameter.html is flaky
        https://bugs.webkit.org/show_bug.cgi?id=92952

        Reviewed by Tony Chang.

        Account for events being propagated from the back-end to front-end after
        front-end context is stopped (i.e. document is being destroyed). The IDBRequest
        lifecycle was tightened up in http://trac.webkit.org/changeset/123275 with more
        asserts but the stopped state wasn't accounted for.

        Test: [chromium] webkit_unit_tests --gtest_filter='IDBRequestTest.EventsAfterStopping'

        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::abort):
        (WebCore::IDBRequest::onError):
        (WebCore::IDBRequest::onSuccess):
        (WebCore::IDBRequest::onSuccessWithContinuation):

2012-08-07  Kentaro Hara  <haraken@chromium.org>

        Optimize Element::getAttributeNode() by replacing String with AtomicString
        https://bugs.webkit.org/show_bug.cgi?id=90274

        Reviewed by Adam Barth.

        Based on the observation described in this ChangeLog
        (http://trac.webkit.org/changeset/121439), this patch optimizes
        the performance of Element::getAttributeNode() by replacing String
        with AtomicString.

        Performance test: https://bugs.webkit.org/attachment.cgi?id=150147

        getAttributeNode (Chromium/Linux):
        375.20ms => 310.80ms

        getAttributeNodeNS (Chromium/Linux):
        684.40ms => 539.00ms

        * dom/Element.cpp:
        (WebCore::Element::getAttributeNode):
        (WebCore::Element::getAttributeNodeNS):
        * dom/Element.h:
        (Element):

2012-08-07  Michelangelo De Simone  <michelangelo@webkit.org>

        CSSParser::parseTransform() refactor to accept valueList as argument
        https://bugs.webkit.org/show_bug.cgi?id=93295

        Reviewed by Darin Adler.

        CSS::parseTranform() is now accepting the related CSSParserValueList as
        argument. This change will be used by the code to parse the 3d-transforms
        within the custom() function, see bug #71443.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseTransform):
        * css/CSSParser.h:

2012-08-07  Elliott Sprehn  <esprehn@gmail.com>

        Reimplement RenderQuote placement algorithm
        https://bugs.webkit.org/show_bug.cgi?id=93056

        Reviewed by Eric Seidel.

        Greatly simplify the code that maintains the linked list of RenderQuotes. Now RenderQuote
        is placed into the linked list in computePreferredLogicalWidths on first access and is
        detached when destroyed (or explicitly removed).

        The new algorithm doesn't require walking up the tree of renderers when there are no
        RenderQuotes in the tree yet, and also removes the need to walk over every subtree
        when inserting in rendererSubtreeAttached.

        No new tests because this patch doesn't change any behavior.

        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::removeChildNode): Call detachQuote when removing from a child list.
        (WebCore::RenderObjectChildList::appendChildNode):
        (WebCore::RenderObjectChildList::insertChildNode):
        * rendering/RenderQuote.cpp:
        (WebCore::RenderQuote::RenderQuote):
        (WebCore::RenderQuote::~RenderQuote):
        (WebCore::RenderQuote::willBeDestroyed): Call detachQuote to ensure all destroyed quotes are detached.
        (WebCore::RenderQuote::originalText):
        (WebCore::RenderQuote::computePreferredLogicalWidths): Attach quote before computing the width.
        (WebCore):
        (WebCore::RenderQuote::attachQuote): Puts the RenderQuote in the linked list of quotes and computes the depth.
        (WebCore::RenderQuote::detachQuote): Removes the quote from the linked list.
        (WebCore::RenderQuote::updateDepth):
        * rendering/RenderQuote.h:
        (RenderQuote):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::diff): Return StyleDifferenceLayout if quotes change and remove check in styleDidChange in RenderQuote.
        * rendering/RenderView.cpp:
        (WebCore::RenderView::RenderView):
        * rendering/RenderView.h:
        (WebCore):
        (WebCore::RenderView::setRenderQuoteHead):
        (WebCore::RenderView::renderQuoteHead): Stores the first quote in the document.
        (RenderView):

2012-08-07  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove a bunch of Persistent::New()s on setJSWrapperForXXXObject()
        https://bugs.webkit.org/show_bug.cgi?id=93342

        Reviewed by Adam Barth.

        There are a lot of custom bindings like this:

            V8DOMWrapper::setJSWrapperForDOMObject(impl.release(), v8::Persistent<v8::Object>::New(args.Holder()));

        Manually written Persistent::New() is error-prone. We can remove the
        Persistent::New() by allocating the Persistent handle inside
        setJSWrapperForDOMObject().

        A new setJSWrapperForDOMObject() receives a wrapper object, allocates
        the Persistent handle of the wrapper object, and return the Persistent handle.

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateConstructorCallback):
        (GenerateEventConstructorCallback):
        (GenerateNamedConstructorCallback):
        (GenerateToV8Converters):
        * bindings/scripts/test/V8/V8Float64Array.cpp:
        (WebCore::V8Float64Array::wrapSlow):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        (WebCore::V8TestActiveDOMObject::wrapSlow):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
        (WebCore::V8TestCustomNamedGetter::wrapSlow):
        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
        (WebCore::V8TestEventConstructor::constructorCallback):
        (WebCore::V8TestEventConstructor::wrapSlow):
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        (WebCore::V8TestEventTarget::wrapSlow):
        * bindings/scripts/test/V8/V8TestException.cpp:
        (WebCore::V8TestException::wrapSlow):
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore::V8TestInterface::constructorCallback):
        (WebCore::V8TestInterface::wrapSlow):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
        (WebCore::V8TestMediaQueryListListener::wrapSlow):
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        (WebCore::V8TestNamedConstructorConstructorCallback):
        (WebCore::V8TestNamedConstructor::wrapSlow):
        * bindings/scripts/test/V8/V8TestNode.cpp:
        (WebCore::V8TestNode::constructorCallback):
        (WebCore::V8TestNode::wrapSlow):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::V8TestObj::constructorCallback):
        (WebCore::V8TestObj::wrapSlow):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore::V8TestSerializedScriptValueInterface::constructorCallback):
        (WebCore::V8TestSerializedScriptValueInterface::wrapSlow):
        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::V8DOMWindowShell::installDOMWindow):
        * bindings/v8/V8DOMWrapper.cpp:
        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
        (WebCore::V8DOMWrapper::setJSWrapperForActiveDOMNode):
        * bindings/v8/V8DOMWrapper.h:
        (V8DOMWrapper):
        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
        (WebCore::V8DOMWrapper::setJSWrapperForActiveDOMObject):
        * bindings/v8/WorkerContextExecutionProxy.cpp:
        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
        * bindings/v8/custom/V8ArrayBufferCustom.cpp:
        (WebCore::V8ArrayBuffer::constructorCallback):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore::wrapArrayBufferView):
        (WebCore::constructWebGLArray):
        * bindings/v8/custom/V8DOMFormDataCustom.cpp:
        (WebCore::V8DOMFormData::constructorCallback):
        * bindings/v8/custom/V8DataViewCustom.cpp:
        (WebCore::V8DataView::constructorCallback):
        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
        (WebCore::v8HTMLImageElementConstructorCallback):
        * bindings/v8/custom/V8IntentConstructor.cpp:
        (WebCore::V8Intent::constructorCallback):
        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
        (WebCore::V8MessageChannel::constructorCallback):
        * bindings/v8/custom/V8MutationObserverCustom.cpp:
        (WebCore::V8MutationObserver::constructorCallback):
        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
        (WebCore::V8WebKitPoint::constructorCallback):
        * bindings/v8/custom/V8WebSocketCustom.cpp:
        (WebCore::V8WebSocket::constructorCallback):
        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
        (WebCore::V8XMLHttpRequest::constructorCallback):

2012-08-07  Erik Arvidsson  <arv@chromium.org>

        Evolution, empathy no longer build with webkint 1.9.6:  webkit_dom_html_element_set_class_name is gone
        https://bugs.webkit.org/show_bug.cgi?id=93384

        Reviewed by Adam Barth.

        The GObject bindings do not do inheritance so when className was moved from HTMLElement to Element,
        webkit_dom_html_element_set_class_name was no longer defined. This patch re-adds the binding for the
        GObject bindings to HTMLElement.

        No new tests.

        * html/HTMLElement.idl:

2012-08-07  Dirk Pranke  <dpranke@chromium.org>

        fix chromium win build after r124945
        https://bugs.webkit.org/show_bug.cgi?id=93421

        Unreviewed, build fix.

        Two Efl files were removed in r124945 but we forgot to remove
        them from WebCore.gypi.

        * WebCore.gypi:

2012-08-07  Dean Jackson  <dino@apple.com>

        Unreviewed build fix for Mac port after http://trac.webkit.org/changeset/124954

        * html/HTMLPlugInElement.cpp:
        (WebCore::HTMLPlugInElement::isKeyboardFocusable):

2012-08-07  Kentaro Hara  <haraken@chromium.org>

        [V8] Move setIsolatedWorldSecurityOrigin() from V8Proxy to ScriptController
        https://bugs.webkit.org/show_bug.cgi?id=93334

        Reviewed by Adam Barth.

        The goal is to move factor out V8Proxy methods to ScriptController.
        As a starting point, this patch moves setIsolatedWorldSecurityOrigin().

        isolatedWorlds() and isolatedWorldSecurityOrigins() are temporary methods.
        They will be soon removed after moving all related methods
        and m_isolatedWorlds and m_isolatedWorldSecurityOrigins.

        No tests. No change in behavior.

        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::setIsolatedWorldSecurityOrigin):
        * bindings/v8/V8Proxy.cpp:
        * bindings/v8/V8Proxy.h:
        (WebCore):
        (V8Proxy):
        (WebCore::V8Proxy::isolatedWorlds):
        (WebCore::V8Proxy::isolatedWorldSecurityOrigins):

2012-08-07  Yoshifumi Inoue  <yosin@chromium.org>

        translateZ(0) shifts file name in file input
        https://bugs.webkit.org/show_bug.cgi?id=69248

        Reviewed by Simon Fraser.

        This patch changes to use relative y-coordinate rather than absolute
        y-coordinate for baseline of text of input type "file" what we've already
        done for file icon y-coordinate.

        Test: file-appearance-transform-no-effects.html

        * rendering/RenderFileUploadControl.cpp:
        (WebCore::RenderFileUploadControl::paintObject): Changed to use paintOffset
        instead of absoluteBoundingBoxRectIgnoringTransforms().

2012-08-07  Kentaro Hara  <haraken@chromium.org>

        [V8] Replace throwError(ExceptionCode, Isolate*) with
        setDOMException(ExceptionCode, Isolate*) in CodeGeneratorV8.pm
        https://bugs.webkit.org/show_bug.cgi?id=93223

        Reviewed by Adam Barth.

        Now throwError(ExceptionCode, Isolate*) is equivalent to
        setDOMException(ExceptionCode, Isolate*). We can replace the former
        with the latter. After this replacement, the rule becomes simple
        and sane: "Use throwError() for throwing JavaScript errors, use
        setDOMException() for throwing DOM exceptions".

        Test: bindings/scripts/test/TestObj.idl

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateParametersCheck):
        (GenerateConstructorCallback):
        (GenerateNamedConstructorCallback):
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore::V8TestInterface::constructorCallback):
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        (WebCore::V8TestNamedConstructorConstructorCallback):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::methodWithCallbackArgCallback):
        (WebCore::TestObjV8Internal::methodWithNonCallbackArgAndCallbackArgCallback):
        (WebCore::TestObjV8Internal::methodWithCallbackAndOptionalArgCallback):
        (WebCore::TestObjV8Internal::overloadedMethod5Callback):
        (WebCore::V8TestObj::constructorCallback):

2012-08-07  Fady Samuel  <fsamuel@chromium.org>

        Allow plugins to decide whether they are keyboard focusable
        https://bugs.webkit.org/show_bug.cgi?id=88958

        Reviewed by Anders Carlsson.

        * dom/Node.h:
        (WebCore::Node::isPluginElement):
        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::renderWidgetForJSBindings):
        * html/HTMLEmbedElement.h:
        (HTMLEmbedElement):
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
        * html/HTMLObjectElement.h:
        (HTMLObjectElement):
        * html/HTMLPlugInElement.cpp:
        (WebCore::HTMLPlugInElement::pluginWidget):
        (WebCore::HTMLPlugInElement::isKeyboardFocusable):
        (WebCore):
        (WebCore::HTMLPlugInElement::isPluginElement):
        * html/HTMLPlugInElement.h:
        (HTMLPlugInElement):
        * page/FocusController.cpp:
        (WebCore::FocusController::advanceFocusInDocumentOrder):
        * plugins/PluginViewBase.h:
        (WebCore::PluginViewBase::supportsKeyboardFocus):

2012-08-07  Anna Cavender  <annacc@chromium.org>

        Create a MediaSource object.
        https://bugs.webkit.org/show_bug.cgi?id=91773

        Reviewed by Eric Carlson.

        MediaSource object is needed in order to implement the new
        object-oriented MediaSource API:
        http://dvcs.w3.org/hg/html-media/raw-file/tip/media-source/media-source.html

        No new tests - will be able to test after landing:
        https://bugs.webkit.org/show_bug.cgi?id=91775

        Adding new files to build files:
        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:

        New MediaSource object:
        * Modules/mediasource/MediaSource.cpp: Added.
        * Modules/mediasource/MediaSource.h: Added.
        * Modules/mediasource/MediaSource.idl: Added.

        Create a registry for the blob storage and lookup:
        * Modules/mediasource/MediaSourceRegistry.cpp: Added.
        * Modules/mediasource/MediaSourceRegistry.h: Added.

        Connect SourceBuffer to MediaSource:
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::SourceBuffer):
        (WebCore::SourceBuffer::buffered): Forward call to MediaSource.
        (WebCore::SourceBuffer::append): Ditto.
        (WebCore::SourceBuffer::abort): Ditto.
        * Modules/mediasource/SourceBuffer.h:
        (WebCore::SourceBuffer::create): Add a MediaSource to the constructor.
        (WebCore::SourceBuffer::clear): Clear the MediaSource.
        (SourceBuffer):
        * Modules/mediasource/SourceBufferList.cpp: include SourceBuffer.h
        * Modules/mediasource/SourceBufferList.h:

        Make MediaSource an EventTarget:
        * dom/EventTarget.h:
        (WebCore):
        * dom/EventTargetFactory.in:

        Enable creation of MediaSource object URL from JavaScript:
        * html/DOMURL.cpp:
        (WebCore):
        (WebCore::DOMURL::createObjectURL):
        (WebCore::DOMURL::revokeObjectURL):
        * html/DOMURL.h:
        (WebCore):
        (DOMURL):
        * html/DOMURL.idl:
        * html/PublicURLManager.h: create a new sourceURLs list for storing
            reigstered MediaSource URLS.
        (WebCore::PublicURLManager::contextDestroyed): make sure everything is
            removed from the sourceURLs list upon destruction.
        (PublicURLManager):
        (WebCore::PublicURLManager::sourceURLs): getter for the sourceURLs list.

        New MediaSource constructor:
        * page/DOMWindow.idl:

2012-08-07  Kentaro Hara  <haraken@chromium.org>

        [V8] Implement V8Proxy::registerExtensionIfNeeded() and remove redundant methods
        https://bugs.webkit.org/show_bug.cgi?id=93209

        Reviewed by Adam Barth.

        By implementing V8Proxy::registerExtensionIfNeeded(), we can remove
        registeredExtensionWithV8() and registerExtension().

        No tests. No change in behavior.

        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::V8DOMWindowShell::createNewContext):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::registerExtensionIfNeeded):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):

2012-08-07  Ryuan Choi  <ryuan.choi@samsung.com>

        [EFL] Remove PlatformTouchEventEfl and PlatformTouchPointEfl
        https://bugs.webkit.org/show_bug.cgi?id=93270

        Reviewed by Eric Seidel.

        PlatformTouchEventEfl and PlatformTouchPointEfl initialize PlatformTouchEvent
        directly from Ewk_TouchEvent which is WebKit1/Efl API and they can not be
        shared with WebKit2/Efl.

        In order to remove this WebKit dependency from WebCore, this patch removes Efl
        specific codes from PlatformTouchXXX and adds the classes which convert
        Ewk_Touch_XXX to PlatformTouchXXX.

        No new tests. Just a refactoring.

        * PlatformEfl.cmake: Removed PlatformTouchEventEfl.cpp and PlatformTouchPointEfl.cpp
        * platform/PlatformTouchEvent.h: Removed Efl specific codes.
        (PlatformTouchEvent):
        * platform/PlatformTouchPoint.h: Ditto.
        (PlatformTouchPoint):
        * platform/efl/PlatformTouchEventEfl.cpp: Removed.
        * platform/efl/PlatformTouchPointEfl.cpp: Removed.

2012-08-07  James Robinson  <jamesr@chromium.org>

        [chromium] Avoid dependending on implicit WebString -> String conversion in compositor
        https://bugs.webkit.org/show_bug.cgi?id=93408

        Reviewed by Adrienne Walker.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::initialize):
        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
        (WebCore::CCResourceProvider::initialize):

2012-08-07  Kentaro Hara  <haraken@chromium.org>

        [V8] Factor out V8Binding methods that configures DOM attributes and methods
        https://bugs.webkit.org/show_bug.cgi?id=93239

        Reviewed by Adam Barth.

        V8Binding is messy. This patch factors out V8Binding methods that configures
        DOM attributes and methods into another file. This patch just moves the methods
        from V8Binding.{h,cpp} to V8ConfigureDOMAttributesAndMethods.{h,cpp}.

        No tests. No change in behavior.

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/v8/V8Binding.cpp:
        * bindings/v8/V8Binding.h:
        (WebCore):
        * bindings/v8/V8ConfigureDOMAttributesAndMethods.cpp: Added.
        (WebCore):
        (WebCore::batchConfigureAttributes):
        (WebCore::batchConfigureConstants):
        (WebCore::batchConfigureCallbacks):
        (WebCore::configureTemplate):
        * bindings/v8/V8ConfigureDOMAttributesAndMethods.h: Added.
        (WebCore):
        (BatchedAttribute):
        (WebCore::configureAttribute):
        (BatchedConstant):
        (BatchedCallback):

2012-08-07  Kentaro Hara  <haraken@chromium.org>

        [V8] Replace all V8 undefined values in the rest of custom bindings with v8Undefined()
        https://bugs.webkit.org/show_bug.cgi?id=93220

        Reviewed by Eric Seidel.

        We should use v8Undefined() everywhere in V8 bindings.
        This patch replaces all V8 undefined values in the rest of custom bindings
        with v8Undefined().

        No tests. No change in behavior.

        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        (WebCore::V8DOMStringMap::namedPropertyQuery): Simple refactoring not related to
        this patch. Since other bindings are using 0 instead of v8::None, we should use 0 here too.
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ScriptProfileCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ScriptProfileNodeCustom.cpp:
        (WebCore::toV8):

2012-08-07  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove #include V8BindingMacros.h
        https://bugs.webkit.org/show_bug.cgi?id=93312

        Reviewed by Eric Seidel.

        We are factoring out V8Binding methods to separate files.
        After the refactoring, V8Binding.h will include binding related
        header files (e.g. V8BindingMacros.h, V8BindingHelper.h, etc), so that
        custom V8 binding files just need to include V8Binding.h only.

        We can remove '#include V8BindingMacros.h' from V8 binding files.

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrSetter):
        (GenerateParametersCheck):
        (GenerateEventConstructorCallback):
        (ConvertToV8Parameter):
        * bindings/scripts/test/V8/V8Float64Array.cpp:
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        * bindings/scripts/test/V8/V8TestObj.cpp:
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        * bindings/v8/ScriptController.cpp:
        * bindings/v8/custom/V8BlobCustom.cpp:
        * bindings/v8/custom/V8ConsoleCustom.cpp:
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        * bindings/v8/custom/V8DataViewCustom.cpp:
        * bindings/v8/custom/V8DeviceMotionEventCustom.cpp:
        * bindings/v8/custom/V8DeviceOrientationEventCustom.cpp:
        * bindings/v8/custom/V8DirectoryEntryCustom.cpp:
        * bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp:
        * bindings/v8/custom/V8IntentConstructor.cpp:
        * bindings/v8/custom/V8MutationObserverCustom.cpp:
        * bindings/v8/custom/V8PerformanceCustom.cpp:
        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
        * bindings/v8/custom/V8SQLTransactionSyncCustom.cpp:
        * bindings/v8/custom/V8SVGLengthCustom.cpp:
        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
        * bindings/v8/custom/V8WebKitAnimationCustom.cpp:
        * bindings/v8/custom/V8WorkerContextCustom.cpp:

2012-08-07  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove #include Frame.h from V8Binding.h
        https://bugs.webkit.org/show_bug.cgi?id=93326

        Reviewed by Adam Barth.

        We want to remove unnecessary #include in V8Binding.h
        to avoid circular include dependency.

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateDomainSafeFunctionGetter):
        (GenerateNormalAttrGetter):
        (GenerateReplaceableAttrSetter):
        (GenerateFunctionCallback):
        (GenerateNamedConstructorCallback):
        (GenerateToV8Converters):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        * bindings/scripts/test/V8/V8TestNode.cpp:
        * bindings/v8/ScheduledAction.cpp:
        * bindings/v8/V8Binding.h:
        * bindings/v8/V8DOMWrapper.cpp:
        * bindings/v8/custom/V8DocumentCustom.cpp:
        * bindings/v8/custom/V8SVGDocumentCustom.cpp:
        * testing/v8/WebCoreTestSupport.cpp:

2012-08-07  Kentaro Hara  <haraken@chromium.org>

        [V8] Factor out V8Binding classes that manage V8 value's cache
        https://bugs.webkit.org/show_bug.cgi?id=93343

        Reviewed by Adam Barth.

        We are factoring out V8Binding methods to separate files.
        This patch moves V8Binding classes that manage V8 value's cache
        to V8ValueCache.{h,cpp}.

        No tests. No change in behavior.

        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/v8/V8Binding.cpp:
        * bindings/v8/V8Binding.h:
        (WebCore):
        * bindings/v8/V8ValueCache.cpp: Added.
        (WebCore):
        (WebCore::makeExternalString):
        (WebCore::cachedStringCallback):
        (WebCore::StringCache::remove):
        (WebCore::StringCache::v8ExternalStringSlow):
        (WebCore::IntegerCache::createSmallIntegers):
        (WebCore::IntegerCache::~IntegerCache):
        * bindings/v8/V8ValueCache.h: Added.
        (WebCore):
        (StringCache):
        (WebCore::StringCache::StringCache):
        (WebCore::StringCache::v8ExternalString):
        (WebCore::StringCache::clearOnGC):
        (WebCoreStringResource):
        (WebCore::WebCoreStringResource::WebCoreStringResource):
        (WebCore::WebCoreStringResource::~WebCoreStringResource):
        (WebCore::WebCoreStringResource::data):
        (WebCore::WebCoreStringResource::length):
        (WebCore::WebCoreStringResource::webcoreString):
        (WebCore::WebCoreStringResource::atomicString):
        (WebCore::WebCoreStringResource::visitStrings): This method is used by inspector
        and thus is not performance-critical. To avoid circular #include dependency,
        I moved the implementation to cpp.
        (WebCore::WebCoreStringResource::toStringResource):
        (IntegerCache):
        (WebCore::IntegerCache::IntegerCache):
        (WebCore::IntegerCache::v8Integer):
        (WebCore::IntegerCache::v8UnsignedInteger):

2012-08-07  James Robinson  <jamesr@chromium.org>

        [chromium] Switch PlatformLayer typedef to Platform API type for PLATFORM(CHROMIUM)
        https://bugs.webkit.org/show_bug.cgi?id=93335

        Reviewed by Adrienne Walker.

        This converts the PlatformLayer typedef to WebKit::WebLayer (part of the chromium Platform API) for the
        Chromium port. This involves some odd const_cast<>s in places since cross-platform interfaces assume that
        PlatformLayer is a potentially heavy implementation class, but WebLayer is a thin smart pointer type.

        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        (WebCore::createScrollbarLayer):
        (WebCore::ScrollingCoordinator::setScrollLayer):
        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
        (WebCore::ScrollingCoordinator::setLayerIsContainerForFixedPositionLayers):
        (WebCore::ScrollingCoordinator::setLayerIsFixedToContainerLayer):
        * platform/graphics/PlatformLayer.h:
        (WebKit):
        (WebCore):
        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
        (WebCore::Canvas2DLayerBridge::layer):
        * platform/graphics/chromium/Canvas2DLayerBridge.h:
        (Canvas2DLayerBridge):
        * platform/graphics/chromium/DrawingBufferChromium.cpp:
        (WebCore::DrawingBufferPrivate::layer):
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::removeFromParent):
        (WebCore::GraphicsLayerChromium::setDrawsContent):
        (WebCore::GraphicsLayerChromium::setContentsVisible):
        (WebCore::GraphicsLayerChromium::setMaskLayer):
        (WebCore::GraphicsLayerChromium::setContentsToCanvas):
        (WebCore::GraphicsLayerChromium::setContentsToMedia):
        (WebCore::GraphicsLayerChromium::primaryLayer):
        (WebCore::GraphicsLayerChromium::platformLayer):
        (WebCore::GraphicsLayerChromium::updateChildList):
        * platform/graphics/chromium/GraphicsLayerChromium.h:
        (GraphicsLayerChromium):

2012-08-07  James Robinson  <jamesr@chromium.org>

        [chromium] Use WebCompositor interface in Platform API instead of CCProxy to query threaded compositor status
        https://bugs.webkit.org/show_bug.cgi?id=93398

        Reviewed by Adam Barth.

        Converts non-compositor code that cares about threaded compositing status over to query WebCompositor instead of
        CCProxy.

        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        * platform/chromium/support/WebCompositorImpl.cpp:
        (WebKit):
        (WebKit::WebCompositor::threadingEnabled):
        (WebKit::WebCompositor::onCompositorThread):
        (WebKit::WebCompositorImpl::threadingEnabled):
        * platform/chromium/support/WebCompositorImpl.h:
        (WebCompositorImpl):
        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
        (WebCore::Canvas2DLayerBridge::Canvas2DLayerBridge):
        * platform/graphics/chromium/DrawingBufferChromium.cpp:
        (WebCore::DrawingBuffer::DrawingBuffer):

2012-08-07  Anders Carlsson  <andersca@apple.com>

        Knob slot animation is flipped
        https://bugs.webkit.org/show_bug.cgi?id=93396

        Reviewed by Beth Dakin.

        When painting the scrollbar knob slot, use rectForPart: since it correctly takes the expansion transition state into account.

        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::scrollbarPainterPaint):

2012-08-07  Adrienne Walker  <enne@google.com>

        50% fixed position coverage slow scroll heuristic is incorrect when invalidations aren't clipped
        https://bugs.webkit.org/show_bug.cgi?id=92011

        Reviewed by Simon Fraser.

        The heuristic in scrollContentsFastPath to slow scroll by invalidating
        the entire frame if fixed position elements cover 50% of the frame
        takes away the ability of ports to make their own decisions about how
        to best handle invalidations. Therefore, remove this heuristic.

        * page/FrameView.cpp:
        (WebCore::FrameView::scrollContentsFastPath):

2012-08-07  Konrad Piascik  <kpiascik@rim.com>

        [BlackBerry] Change how devicePixelRatio is set.
        https://bugs.webkit.org/show_bug.cgi?id=93385

        Reviewed by Antonio Gomes.

        Update the theme to adjust to a constant devicePixelRatio.

        Not testable.

        * platform/blackberry/RenderThemeBlackBerry.cpp:
        (WebCore::determineFullScreenMultiplier):

2012-08-07  James Robinson  <jamesr@chromium.org>

        [chromium] Move WebCompositor interface into Platform API
        https://bugs.webkit.org/show_bug.cgi?id=93391

        Reviewed by Adam Barth.

        Moves the support files for WebCompositor into WebCore/platform/support/. CCThreadImpl is a helper class used
        only by WebCompositorImpl.

        Refactor/renaming only, so no new tests.

        * WebCore.gypi:
        * platform/chromium/support/CCThreadImpl.cpp: Renamed from Source/WebKit/chromium/src/CCThreadImpl.cpp.
        (WebKit):
        (GetThreadIDTask):
        (WebKit::GetThreadIDTask::GetThreadIDTask):
        (WebKit::GetThreadIDTask::~GetThreadIDTask):
        (WebKit::GetThreadIDTask::run):
        (CCThreadTaskAdapter):
        (WebKit::CCThreadTaskAdapter::CCThreadTaskAdapter):
        (WebKit::CCThreadTaskAdapter::~CCThreadTaskAdapter):
        (WebKit::CCThreadTaskAdapter::run):
        (WebKit::CCThreadImpl::create):
        (WebKit::CCThreadImpl::~CCThreadImpl):
        (WebKit::CCThreadImpl::postTask):
        (WebKit::CCThreadImpl::postDelayedTask):
        (WebKit::CCThreadImpl::threadID):
        (WebKit::CCThreadImpl::CCThreadImpl):
        * platform/chromium/support/CCThreadImpl.h: Renamed from Source/WebKit/chromium/src/CCThreadImpl.h.
        (WebKit):
        (CCThreadImpl):
        * platform/chromium/support/WebCompositorImpl.cpp: Renamed from Source/WebKit/chromium/src/WebCompositorImpl.cpp.
        (WebKit):
        (WebKit::WebCompositor::initialize):
        (WebKit::WebCompositor::shutdown):
        (WebKit::WebCompositor::setPerTilePaintingEnabled):
        (WebKit::WebCompositor::setPartialSwapEnabled):
        (WebKit::WebCompositor::setAcceleratedAnimationEnabled):
        (WebKit::WebCompositorImpl::initialize):
        (WebKit::WebCompositorImpl::initialized):
        (WebKit::WebCompositorImpl::shutdown):
        * platform/chromium/support/WebCompositorImpl.h: Renamed from Source/WebKit/chromium/src/WebCompositorImpl.h.
        (WebCore):
        (WebKit):
        (WebCompositorImpl):

2012-08-07  Abhishek Arya  <inferno@chromium.org>

        Crash in ContainerNode::cloneChildNodes.
        https://bugs.webkit.org/show_bug.cgi?id=93378

        Reviewed by Levi Weintraub.

        Re-enabling the editing delete button controller in cloneChildNode was causing style changes,
        thereby causing load events to fire. The load event can blow our nodes from underneath. This causes
        crashes when we are nested inside cloneChildNodes. The patch just skips the delete button controller's
        container element from being cloned and removes the hacky enable/disable logic. 

        Test: fast/dom/clone-node-load-event-crash.html

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::cloneChildNodes):

2012-08-07  No'am Rosenthal  <noam.rosenthal@nokia.com>

        GraphicsLayerAnimation shouldn't use HashMap<String>
        https://bugs.webkit.org/show_bug.cgi?id=93284

        Reviewed by Kenneth Rohde Christiansen.

        Use a vector containing all the animations instead of a map of String to Vector.
        The HashMap contains very few elements, which makes it inefficient relatively to a vector.
        This has been shown to be a bottleneck in valgrind.

        Covered by existing animation tests.

        * platform/graphics/GraphicsLayerAnimation.cpp:
        (WebCore::GraphicsLayerAnimation::GraphicsLayerAnimation):
        (WebCore::GraphicsLayerAnimations::hasActiveAnimationsOfType):
        (WebCore::GraphicsLayerAnimations::hasRunningAnimations):
        (WebCore::GraphicsLayerAnimations::add):
        (WebCore::GraphicsLayerAnimations::pause):
        (WebCore::GraphicsLayerAnimations::remove):
        (WebCore::GraphicsLayerAnimations::apply):
        * platform/graphics/GraphicsLayerAnimation.h:
        (GraphicsLayerAnimation):
        (WebCore::GraphicsLayerAnimation::name):
        (GraphicsLayerAnimations):
        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
        (WebCore::GraphicsLayerTextureMapper::addAnimation):

2012-08-07  Marcelo Lira  <marcelo.lira@openbossa.org>

        [Qt] Add support for the Gamepad API
        https://bugs.webkit.org/show_bug.cgi?id=90637

        Reviewed by Alexis Menard.

        Adds support for Gamepad API on the Qt port.

        The implementation of this class relies on the Linux
        kernel joystick API.

        Gamepad devices are recognized through the GamepadsQt
        class, which uses the udev library to watch for connection,
        disconnection and other gamepad related events.

        Tests for this feature already exist.

        * DerivedSources.pri:
        * Target.pri:
        * WebCore.pri:
        * platform/qt/GamepadsQt.cpp: Added.
        (WebCore):
        (GamepadDeviceLinuxQt):
        (WebCore::GamepadDeviceLinuxQt::create):
        (WebCore::GamepadDeviceLinuxQt::GamepadDeviceLinuxQt):
        (WebCore::GamepadDeviceLinuxQt::~GamepadDeviceLinuxQt):
        (WebCore::GamepadDeviceLinuxQt::readCallback):
        (GamepadsQt):
        (WebCore::GamepadsQt::GamepadsQt):
        (WebCore::GamepadsQt::~GamepadsQt):
        (WebCore::GamepadsQt::isGamepadDevice):
        (WebCore::GamepadsQt::onGamePadChange):
        (WebCore::GamepadsQt::registerDevice):
        (WebCore::GamepadsQt::unregisterDevice):
        (WebCore::GamepadsQt::updateGamepadList):
        (WebCore::sampleGamepads):

2012-08-07  Mike Reed  <reed@google.com>

        reimplement fastMod w/o (soon to be) private skia macros
        https://bugs.webkit.org/show_bug.cgi?id=93370

        Reviewed by Adrienne Walker.

        fastMod() reimplemented (same functionality) to stop using soon-to-be private macros in
        SkMath.h. The new version is functionally identical.

        No new tests -- existing layouttests exercise GraphicsContext::strokeArc(), the only caller

        * platform/graphics/skia/GraphicsContextSkia.cpp:

2012-08-07  Brian Anderson  <brianderson@chromium.org>

        Add CCDelayBasedTimeSource::setTimebaseAndInterval
        https://bugs.webkit.org/show_bug.cgi?id=92825

        Reviewed by James Robinson.

        Allows CCDelayBaseTimeSource to have it's timebase and interval updated
        on the fly.  Accounts for double ticking due to jitter or resetting the
        timer multiple times quickly.

        CCDelayBasedTimeSourceTest updated with two tests for proper handling
        of jittery timebase/interval source and immediate handling of
        significant timebase/interval changes.

        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp:
        (WebCore::CCDelayBasedTimeSource::CCDelayBasedTimeSource):
        (WebCore::CCDelayBasedTimeSource::nextTickTime):
        (WebCore):
        (WebCore::CCDelayBasedTimeSource::onTimerFired):
        (WebCore::CCDelayBasedTimeSource::setTimebaseAndInterval):
        (WebCore::CCDelayBasedTimeSource::postNextTickTask):
        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.h:

2012-07-23  Alexandru Chiculita  <achicu@adobe.com>

        [CSS Shaders] Reuse precompiled shaders across elements
        https://bugs.webkit.org/show_bug.cgi?id=88427

        Reviewed by Dean Jackson.

        Added CustomFilterProgramInfo as a link between the CustomFilterProgram and the CustomFilterCompiledProgram.
        CustomFilterGlobalContext now acts as a cache for the compiled shaders. Note that only the shaders displayed on the page
        are cached, making it useful in animations or when more elements share the same shader filter.

        For CSS Shaders we need two files, vertex and fragment shaders, so that's why we have a CustomFilterProgram. 
        CustomFilterProgram is the platform object, so StyleCustomFilterProgram implements it and is referenced from the RenderStyle.

        StyleCustomFilterProgram is also the one that actually keeps references to the CachedShaders and has all the loading logic.
        The only problem is that there might be multiple StyleCustomFilterProgram with the same set of CachedShaders.
        That's why in this patch I've added CustomFilterProgramInfo as a simple class to be used as a key in a hash map.

        For now CustomFilterProgramInfo should act similar to a pair<String, String>. There's only one exception: one of the strings
        is allowed to be null. A null string is the placeholder for the default shader.

        Note that alpha compositing and blending will be added to the CustomFilterProgramInfo after the mix() 
        function parsing will land in https://bugs.webkit.org/show_bug.cgi?id=90101 .

        Test: css3/filters/custom/custom-filter-shader-reuse.html

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/filters/CustomFilterCompiledProgram.cpp:
        (WebCore::CustomFilterCompiledProgram::CustomFilterCompiledProgram):
        (WebCore::CustomFilterCompiledProgram::getDefaultShaderString): Returns the default shader based on the type.
        (WebCore):
        (WebCore::CustomFilterCompiledProgram::compileShader): Added check for isNull and used the default shader in that case.
        (WebCore::CustomFilterCompiledProgram::~CustomFilterCompiledProgram): Added call to CustomFilterGlobalContext::removeCompiledProgram.
        * platform/graphics/filters/CustomFilterCompiledProgram.h:
        (WebCore::CustomFilterCompiledProgram::detachFromGlobalContext): Called from ~CustomFilterGlobalContext, so that it doesn't call into a deleted object later when ~CustomFilterCompiledProgram is called. It should only happen when CustomFilterGlobalContext dies before the 
        CustomFilterCompiledPrograms that it caches.
        (WebCore):
        * platform/graphics/filters/CustomFilterGlobalContext.cpp:
        (WebCore::CustomFilterGlobalContext::~CustomFilterGlobalContext):
        (WebCore::CustomFilterGlobalContext::getCompiledProgram): Gets or creates a compiled shader for a specific CustomFilterProgramInfo.
        (WebCore):
        (WebCore::CustomFilterGlobalContext::removeCompiledProgram): Called by ~CustomFilterCompiledProgram.
        * platform/graphics/filters/CustomFilterGlobalContext.h:
        (WebCore):
        (CustomFilterGlobalContext):
        * platform/graphics/filters/CustomFilterProgram.cpp:
        (WebCore::CustomFilterProgram::programInfo):
        * platform/graphics/filters/CustomFilterProgram.h:
        (WebCore):
        * platform/graphics/filters/CustomFilterProgramInfo.cpp: Added.
        (WebCore):
        (WebCore::hashPossiblyNullString): We need to allow null strings in the hash, so this is a helper to check for isNull 
        before asking for the hash.
        (WebCore::CustomFilterProgramInfo::CustomFilterProgramInfo):
        (WebCore::CustomFilterProgramInfo::isEmptyValue):
        (WebCore::CustomFilterProgramInfo::isHashTableDeletedValue):
        (WebCore::CustomFilterProgramInfo::hash):
        (WebCore::CustomFilterProgramInfo::operator==):
        * platform/graphics/filters/CustomFilterProgramInfo.h: Added.
        (WebCore):
        (CustomFilterProgramInfo):
        (WebCore::CustomFilterProgramInfo::vertexShaderString):
        (WebCore::CustomFilterProgramInfo::fragmentShaderString):
        (WebCore::CustomFilterProgramInfoHash::hash):
        (WebCore::CustomFilterProgramInfoHash::equal):
        (CustomFilterProgramInfoHash): Structures needed to make this a key in the hash map.
        (CustomFilterProgramInfoHashTraits):
        (WebCore::CustomFilterProgramInfoHashTraits::isEmptyValue): I've used the deleted strings value to mark a deleted
        CustomFilterProgramInfo object. Those are not safe to compare to deleted, so there's a need to set safeToCompareToEmptyOrDeleted to false, meaning that there's a need to manually check for empty values.
        (WTF):
        * platform/graphics/filters/FECustomFilter.cpp:
        (WebCore::FECustomFilter::initializeContext): Moved to using the cached shader instead.

2012-08-07  Florin Malita  <fmalita@chromium.org>

        [Chromium] Unreviewed build fix after r124879.

        * WebCore.gypi: Remove deleted file references.

2012-08-07  George Staikos  <staikos@webkit.org>

        [BlackBerry] We should fail the HTTP auth silently for non-main loads
        in the non-viewer process.
        https://bugs.webkit.org/show_bug.cgi?id=93230

        Reviewed by Rob Buis.

        No way to test this in WebKit.

        * platform/network/blackberry/NetworkJob.cpp: Add early return.
        (WebCore::NetworkJob::sendRequestWithCredentials):

2012-08-07  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Typing backslash in Console traverses the panel history when using German keyboard layout
        https://bugs.webkit.org/show_bug.cgi?id=93357

        Reviewed by Vsevolod Vlasov.

        For some reason, in the German keyboard layout keyIdentifier for '\' is the same as that for '['
        in the ordinary English-US layout.
        Remove a too-safe-side check and never switch panels on key combinations that result in "keypress" events.

        * inspector/front-end/InspectorView.js:
        (WebInspector.InspectorView):
        (WebInspector.InspectorView.prototype._keyPress):

2012-08-07  Robin Cao  <robin.cao@torchmobile.com.cn>

        [BlackBerry] GL scissor test is accidentally turned off
        https://bugs.webkit.org/show_bug.cgi?id=93360
        PR #161020

        Reviewed by Antonio Gomes.

        The GL scissor test is accidentally turned off inside drawTextures().
        This is wrong and should be removed.

        * platform/graphics/blackberry/LayerCompositingThread.cpp:
        (WebCore::LayerCompositingThread::drawTextures):

2012-08-07  Abhishek Arya  <inferno@chromium.org>

        Crash in InlineFlowBox::deleteLine.
        https://bugs.webkit.org/show_bug.cgi?id=88795

        Reviewed by Tony Chang.

        When we move the fullscreen object from its parent to RenderFullScreen, we forgot to clear the
        line box tree underneath the object's containing block and mark it for layout. Before the patch,
        the containing block never got laid out and maintained references to removed line boxes (since the
        object moved under RenderFullScreen did get laid out and its lineboxes replaced with new ones).

        Test: fullscreen/full-screen-line-boxes-crash.html

        * rendering/RenderFullScreen.cpp:
        (RenderFullScreen::wrapRenderer):

2012-08-07  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Do not disable network tracking while profiling cpu.
        https://bugs.webkit.org/show_bug.cgi?id=93359

        Reviewed by Yury Semikhatsky.

        Removed network tracking enabling/disabling machinery.

        * inspector/front-end/CPUProfileView.js:
        (WebInspector.CPUProfileType.prototype.buttonClicked):
        * inspector/front-end/NetworkManager.js:
        (WebInspector.NetworkManager.get this):
        (WebInspector.NetworkManager.get NetworkAgent):
        (WebInspector.NetworkManager):
        * inspector/front-end/ResourceTreeModel.js:
        (WebInspector.ResourceTreeModel):

2012-08-07  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: make the MemoryClassInfo class a not-template
        https://bugs.webkit.org/show_bug.cgi?id=93265

        Reviewed by Yury Semikhatsky.

        * bindings/js/ScriptWrappable.h:
        (WebCore::ScriptWrappable::reportMemoryUsage):
        * bindings/v8/DOMDataStore.cpp:
        (WebCore::DOMDataStore::reportMemoryUsage):
        * bindings/v8/IntrusiveDOMWrapperMap.h:
        (WebCore::ChunkedTable::reportMemoryUsage):
        * bindings/v8/ScriptWrappable.h:
        (WebCore::ScriptWrappable::reportMemoryUsage):
        * bindings/v8/V8Binding.cpp:
        (WebCore::V8BindingPerIsolateData::reportMemoryUsage):
        (WebCore::StringCache::reportMemoryUsage):
        * bindings/v8/V8DOMMap.h:
        * css/CSSAspectRatioValue.cpp:
        (WebCore::CSSAspectRatioValue::reportDescendantMemoryUsage):
        * css/CSSBorderImageSliceValue.cpp:
        (WebCore::CSSBorderImageSliceValue::reportDescendantMemoryUsage):
        * css/CSSCalculationValue.cpp:
        (WebCore::CSSCalcValue::reportDescendantMemoryUsage):
        * css/CSSCanvasValue.cpp:
        (WebCore::CSSCanvasValue::reportDescendantMemoryUsage):
        * css/CSSCharsetRule.cpp:
        (WebCore::CSSCharsetRule::reportDescendantMemoryUsage):
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::reportMemoryUsage):
        * css/CSSCrossfadeValue.cpp:
        (WebCore::CSSCrossfadeValue::reportDescendantMemoryUsage):
        * css/CSSCursorImageValue.cpp:
        (WebCore::CSSCursorImageValue::reportDescendantMemoryUsage):
        * css/CSSFontFaceRule.cpp:
        (WebCore::CSSFontFaceRule::reportDescendantMemoryUsage):
        * css/CSSFontFaceSrcValue.cpp:
        (WebCore::CSSFontFaceSrcValue::reportDescendantMemoryUsage):
        * css/CSSFunctionValue.cpp:
        (WebCore::CSSFunctionValue::reportDescendantMemoryUsage):
        * css/CSSGradientValue.cpp:
        (WebCore::CSSGradientColorStop::reportMemoryUsage):
        (WebCore::CSSGradientValue::reportBaseClassMemoryUsage):
        (WebCore::CSSLinearGradientValue::reportDescendantMemoryUsage):
        (WebCore::CSSRadialGradientValue::reportDescendantMemoryUsage):
        * css/CSSImageGeneratorValue.cpp:
        (WebCore::CSSImageGeneratorValue::reportBaseClassMemoryUsage):
        * css/CSSImageSetValue.cpp:
        (WebCore::CSSImageSetValue::reportDescendantMemoryUsage):
        (WebCore::CSSImageSetValue::ImageWithScale::reportMemoryUsage):
        * css/CSSImageValue.cpp:
        (WebCore::CSSImageValue::reportDescendantMemoryUsage):
        * css/CSSImportRule.cpp:
        (WebCore::CSSImportRule::reportDescendantMemoryUsage):
        * css/CSSInheritedValue.cpp:
        (WebCore::CSSInheritedValue::reportDescendantMemoryUsage):
        * css/CSSInitialValue.cpp:
        (WebCore::CSSInitialValue::reportDescendantMemoryUsage):
        * css/CSSLineBoxContainValue.cpp:
        (WebCore::CSSLineBoxContainValue::reportDescendantMemoryUsage):
        * css/CSSMediaRule.cpp:
        (WebCore::CSSMediaRule::reportDescendantMemoryUsage):
        * css/CSSPageRule.cpp:
        (WebCore::CSSPageRule::reportDescendantMemoryUsage):
        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::reportDescendantMemoryUsage):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::reportMemoryUsage):
        * css/CSSReflectValue.cpp:
        (WebCore::CSSReflectValue::reportDescendantMemoryUsage):
        * css/CSSRule.cpp:
        (WebCore::CSSRule::reportBaseClassMemoryUsage):
        * css/CSSRuleList.cpp:
        (WebCore::StaticCSSRuleList::reportMemoryUsage):
        * css/CSSRuleList.h:
        * css/CSSSelectorList.cpp:
        (WebCore::CSSSelectorList::reportMemoryUsage):
        * css/CSSStyleRule.cpp:
        (WebCore::CSSStyleRule::reportDescendantMemoryUsage):
        * css/CSSStyleSheet.cpp:
        (WebCore::CSSStyleSheet::reportMemoryUsage):
        * css/CSSTimingFunctionValue.cpp:
        (WebCore::CSSLinearTimingFunctionValue::reportDescendantMemoryUsage):
        (WebCore::CSSCubicBezierTimingFunctionValue::reportDescendantMemoryUsage):
        (WebCore::CSSStepsTimingFunctionValue::reportDescendantMemoryUsage):
        * css/CSSUnicodeRangeValue.cpp:
        (WebCore::CSSUnicodeRangeValue::reportDescendantMemoryUsage):
        * css/CSSUnknownRule.h:
        (WebCore::CSSUnknownRule::reportDescendantMemoryUsage):
        * css/CSSValue.cpp:
        (WebCore::TextCloneCSSValue::reportDescendantMemoryUsage):
        * css/CSSValueList.cpp:
        (WebCore::CSSValueList::reportDescendantMemoryUsage):
        * css/CSSVariableValue.h:
        (WebCore::CSSVariableValue::reportDescendantMemoryUsage):
        * css/FontFeatureValue.cpp:
        (WebCore::FontFeatureValue::reportDescendantMemoryUsage):
        * css/FontValue.cpp:
        (WebCore::FontValue::reportDescendantMemoryUsage):
        * css/MediaList.cpp:
        (WebCore::MediaQuerySet::reportMemoryUsage):
        (WebCore::MediaList::reportMemoryUsage):
        * css/MediaQuery.cpp:
        (WebCore::MediaQuery::reportMemoryUsage):
        * css/MediaQueryExp.cpp:
        (WebCore::MediaQueryExp::reportMemoryUsage):
        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::reportMemoryUsage):
        (WebCore::StyleRuleCSSStyleDeclaration::reportMemoryUsage):
        (WebCore::InlineCSSStyleDeclaration::reportMemoryUsage):
        * css/ShadowValue.cpp:
        (WebCore::ShadowValue::reportDescendantMemoryUsage):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::reportMemoryUsage):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::Features::reportMemoryUsage):
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleRule.cpp:
        (WebCore::StyleRuleBase::reportMemoryUsage):
        (WebCore::StyleRule::reportDescendantMemoryUsage):
        (WebCore::StyleRulePage::reportDescendantMemoryUsage):
        (WebCore::StyleRuleFontFace::reportDescendantMemoryUsage):
        (WebCore::StyleRuleBlock::reportDescendantMemoryUsage):
        (WebCore::StyleRuleMedia::reportDescendantMemoryUsage):
        (WebCore::StyleRuleRegion::reportDescendantMemoryUsage):
        * css/StyleRuleImport.cpp:
        (WebCore::StyleRuleImport::reportDescendantMemoryUsage):
        * css/StyleSheetContents.cpp:
        (WebCore::StyleSheetContents::reportMemoryUsage):
        * css/WebKitCSSFilterValue.cpp:
        (WebCore::WebKitCSSFilterValue::reportDescendantMemoryUsage):
        * css/WebKitCSSKeyframeRule.cpp:
        (WebCore::StyleKeyframe::reportMemoryUsage):
        (WebCore::WebKitCSSKeyframeRule::reportDescendantMemoryUsage):
        * css/WebKitCSSKeyframesRule.cpp:
        (WebCore::StyleRuleKeyframes::reportDescendantMemoryUsage):
        (WebCore::WebKitCSSKeyframesRule::reportDescendantMemoryUsage):
        * css/WebKitCSSMixFunctionValue.cpp:
        (WebCore::WebKitCSSMixFunctionValue::reportDescendantMemoryUsage):
        * css/WebKitCSSRegionRule.cpp:
        (WebCore::WebKitCSSRegionRule::reportDescendantMemoryUsage):
        * css/WebKitCSSSVGDocumentValue.cpp:
        (WebCore::WebKitCSSSVGDocumentValue::reportDescendantMemoryUsage):
        * css/WebKitCSSShaderValue.cpp:
        (WebCore::WebKitCSSShaderValue::reportDescendantMemoryUsage):
        * css/WebKitCSSTransformValue.cpp:
        (WebCore::WebKitCSSTransformValue::reportDescendantMemoryUsage):
        * dom/CharacterData.cpp:
        (WebCore::CharacterData::reportMemoryUsage):
        * dom/ContainerNode.h:
        (WebCore::ContainerNode::reportMemoryUsage):
        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        * dom/Element.h:
        (WebCore::Element::reportMemoryUsage):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::reportMemoryUsage):
        * dom/MemoryInstrumentation.h:
        (MemoryInstrumentation):
        (MemoryObjectInfo):
        (WebCore::MemoryObjectInfo::reportObjectInfo):
        (MemoryClassInfo):
        (WebCore::MemoryClassInfo::MemoryClassInfo):
        * dom/Node.cpp:
        (WebCore::Node::reportMemoryUsage):
        * dom/QualifiedName.h:
        (WebCore::QualifiedName::QualifiedNameImpl::reportMemoryUsage):
        (WebCore::QualifiedName::reportMemoryUsage):
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::reportMemoryUsage):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::reportMemoryUsage):
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::reportMemoryUsage):
        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::reportMemoryUsage):
        * loader/cache/CachedFont.cpp:
        (WebCore::CachedFont::reportMemoryUsage):
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::reportMemoryUsage):
        * loader/cache/CachedRawResource.cpp:
        (WebCore::CachedRawResource::reportMemoryUsage):
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::reportMemoryUsage):
        * loader/cache/CachedResourceHandle.cpp:
        (WebCore::CachedResourceHandleBase::reportMemoryUsage):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::reportMemoryUsage):
        * loader/cache/CachedSVGDocument.cpp:
        (WebCore::CachedSVGDocument::reportMemoryUsage):
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::reportMemoryUsage):
        * loader/cache/CachedShader.cpp:
        (WebCore::CachedShader::reportMemoryUsage):
        * loader/cache/CachedXSLStyleSheet.cpp:
        (WebCore::CachedXSLStyleSheet::reportMemoryUsage):
        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::reportMemoryUsage):
        * page/Frame.cpp:
        (WebCore::Frame::reportMemoryUsage):
        * platform/SharedBuffer.cpp:
        (WebCore::SharedBuffer::reportMemoryUsage):
        * platform/TreeShared.h:
        (WebCore::TreeShared::reportMemoryUsage):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::reportMemoryUsage):
        * rendering/style/StyleRareInheritedData.cpp:
        (WebCore::StyleRareInheritedData::reportMemoryUsage):
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::reportMemoryUsage):
        * svg/SVGColor.cpp:
        (WebCore::SVGColor::reportDescendantMemoryUsage):
        * svg/SVGPaint.cpp:
        (WebCore::SVGPaint::reportDescendantMemoryUsage):

2012-08-02  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] Remove Qt 4 specific code paths
        https://bugs.webkit.org/show_bug.cgi?id=88161

        Reviewed by Kenneth Rohde Christiansen.

        * Target.pri:
        * WebCore.pri:
        * bridge/qt/qt_class.cpp:
        (JSC::Bindings::QtClass::fallbackObject):
        * bridge/qt/qt_instance.cpp:
        (JSC::Bindings::QtInstance::getPropertyNames):
        (JSC::Bindings::QtInstance::stringValue):
        (JSC::Bindings::QtField::setValueToInstance):
        * bridge/qt/qt_runtime.h:
        (QtConnectionObject):
        * bridge/qt/qt_runtime_qt4.cpp: Removed.
        * editing/qt/SmartReplaceQt.cpp: Removed.
        * page/qt/EventHandlerQt.cpp:
        (WebCore::EventHandler::tabsToAllFormControls):
        * platform/graphics/GraphicsContext3D.h:
        * platform/graphics/OpenGLShims.cpp:
        (WebCore::getProcAddress):
        * platform/graphics/OpenGLShims.h:
        * platform/graphics/gstreamer/PlatformVideoWindowPrivate.h:
        * platform/graphics/gstreamer/PlatformVideoWindowQt.cpp:
        (FullScreenVideoWindow::FullScreenVideoWindow):
        (FullScreenVideoWindow::keyPressEvent):
        (FullScreenVideoWindow::event):
        (FullScreenVideoWindow::showFullScreen):
        (PlatformVideoWindow::PlatformVideoWindow):
        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        (WebCore::GraphicsContext3DPrivate::blitMultisampleFramebufferAndRestoreContext):
        (WebCore::GraphicsContext3DPrivate::makeCurrentIfNeeded):
        * platform/graphics/qt/GraphicsContextQt.cpp:
        (WebCore::GraphicsContext::releaseWindowsContext):
        * platform/graphics/qt/ImageQt.cpp:
        (WebCore::BitmapImage::create):
        * platform/graphics/qt/SimpleFontDataQt.cpp:
        (WebCore::SimpleFontData::platformInit):
        * platform/graphics/texmap/TextureMapper.h:
        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGLData::SharedGLData::getCurrentGLContext):
        * platform/qt/DeviceMotionProviderQt.h:
        * platform/qt/DeviceOrientationProviderQt.h:
        * platform/qt/KURLQt.cpp:
        (WebCore::KURL::operator QUrl):
        * platform/qt/PlatformScreenQt.cpp:
        (WebCore::screenDepth):
        (WebCore::screenDepthPerComponent):
        (WebCore::screenIsMonochrome):
        (WebCore::screenRect):
        (WebCore::screenAvailableRect):
        * platform/qt/QWebPageClient.h:
        (QWebPageClient):
        * platform/qt/RenderThemeQt.cpp:
        * platform/text/qt/TextBreakIteratorQt.cpp: Removed.
        * plugins/qt/PluginContainerQt.cpp: Removed.
        * plugins/qt/PluginContainerQt.h: Removed.
        * plugins/qt/PluginPackageQt.cpp:
        (WebCore::PluginPackage::isPluginBlacklisted):
        * plugins/qt/PluginViewQt.cpp:
        (WebCore::PluginView::setFocus):
        (WebCore::PluginView::paintUsingXPixmap):
        (WebCore::setSharedXEventFields):
        (WebCore::PluginView::setNPWindowIfNeeded):
        (WebCore::PluginView::setParentVisible):
        (WebCore::PluginView::platformGetValue):
        (WebCore::PluginView::invalidateRect):
        (WebCore::getVisualAndColormap):
        (WebCore::PluginView::platformStart):
        * plugins/win/PluginViewWin.cpp:
        (windowHandleForPageClient):

2012-08-06  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: implement reusable progress bar
        https://bugs.webkit.org/show_bug.cgi?id=93267

        - Generic progress bar implementation to be used
            by various long-running operations in inspector.

        Test: inspector/progress-bar.html

        Reviewed by Pavel Feldman.

        * WebCore.gypi: Added ProgressBar.js
        * WebCore.vcproj/WebCore.vcproj: ditto.
        * inspector/compile-front-end.py: ditto.
        * inspector/front-end/AdvancedSearchController.js: renamed style for stop button.
        (WebInspector.SearchView):
        * inspector/front-end/ProgressBar.js: Added.
        (WebInspector.Progress): Interface for both ProgressIndicator and SubProgress.
        (WebInspector.Progress.prototype.setTotalWork):
        (WebInspector.Progress.prototype.setTitle):
        (WebInspector.Progress.prototype.setWorked):
        (WebInspector.Progress.prototype.done):
        (WebInspector.Progress.prototype.isCanceled):
        (WebInspector.ProgressIndicator): A UI control that implements Progress.
        (WebInspector.ProgressIndicator.prototype.show):
        (WebInspector.ProgressIndicator.prototype.hide):
        (WebInspector.ProgressIndicator.prototype.done):
        (WebInspector.ProgressIndicator.prototype._cancel):
        (WebInspector.ProgressIndicator.prototype.isCanceled):
        (WebInspector.ProgressIndicator.prototype.setTitle):
        (WebInspector.ProgressIndicator.prototype.setTotalWork):
        (WebInspector.ProgressIndicator.prototype.setWorked):
        (WebInspector.CompositeProgress): A progress bar that is composed of several SubProgress bars and uses a Progress to display total progress of all tasks.
        (WebInspector.CompositeProgress.prototype._childDone):
        (WebInspector.CompositeProgress.prototype.createSubProgress):
        (WebInspector.CompositeProgress.prototype._update):
        (WebInspector.SubProgress): A child of CompositeProgress, implements Progress interface.
        (WebInspector.SubProgress.prototype.isCanceled):
        (WebInspector.SubProgress.prototype.setTitle):
        (WebInspector.SubProgress.prototype.done):
        (WebInspector.SubProgress.prototype.setTotalWork):
        (WebInspector.SubProgress.prototype.setWorked):
        * inspector/front-end/WebKit.qrc: Added ProgressBar.js
        * inspector/front-end/inspector.css:
        (.progress-bar-stop-button-item):
        (.progress-bar-stop-button .glyph):
        (.progress-bar-container):
        (.progress-bar-container span):
        (.progress-bar-container progress):
        (.progress-bar-container button.status-bar-item):
        * inspector/front-end/inspector.html:

2012-08-07  Peter Rybin  <peter.rybin@gmail.com>

        Web Inspector: display function scope in UI
        https://bugs.webkit.org/show_bug.cgi?id=90631

        Reviewed by Yury Semikhatsky.

        Two new tree element types added: function scope group node and scope node.
        Scope node is only used to represent closure and catch scopes. Scopes that
        have a real object beneath are represented as a property node.
        A method that reads properties from RemoteObject and populate tree element
        is factored out from RemoteObjectTreeElement for reuse.

        * inspector/front-end/ObjectPropertiesSection.js:
        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
        (WebInspector.ObjectPropertyTreeElement.Populate.callback):
        (WebInspector.ObjectPropertyTreeElement.Populate):
        (WebInspector.FunctionScopeMainTreeElement):
        (WebInspector.FunctionScopeMainTreeElement.prototype.onpopulate.didGetDetails):
        (WebInspector.FunctionScopeMainTreeElement.prototype.onpopulate):
        (WebInspector.FunctionScopeMainTreeElement.prototype.onattach):
        (WebInspector.FunctionScopeMainTreeElement.prototype.update):
        (WebInspector.ScopeTreeElement):
        (WebInspector.ScopeTreeElement.prototype.onpopulate):
        (WebInspector.ScopeTreeElement.prototype.onattach):
        (WebInspector.ScopeTreeElement.prototype.update):
        * inspector/front-end/RemoteObject.js:
        (WebInspector.RemoteObjectProperty.fromScopeValue):


2012-08-07  Vineet Chaudhary  <rgf748@motorola.com>

        [V8] Remove custom toV8() calls for TypedArray.
        https://bugs.webkit.org/show_bug.cgi?id=93248

        Reviewed by Kentaro Hara.

        With the support of [TypedArray] we can remove the custom calls toV8().
        TypedArray spec : http://www.khronos.org/registry/typedarray/specs/latest/#7

        Tests: TestTypedArray.idl
        Tests under below folders should pass as this does not cause any behavioral changes.
               fast/canvas/webgl
               compositing/webgl

        * bindings/js/JSInt8ArrayCustom.cpp:
        * bindings/js/JSUint8ArrayCustom.cpp:
        * bindings/js/JSUint8ClampedArrayCustom.cpp:
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateImplementation): Modified Generator code to generate bindings for toV8().
        (IsWrapperType):
        (GetTypeNameOfExternalTypedArray): Method to get view type of TypedArray.
        * bindings/scripts/test/V8/V8Float64Array.cpp: Tests results.
        (WebCore::toV8):
        * bindings/v8/custom/V8Float32ArrayCustom.cpp: Removed custom call toV8().
        * bindings/v8/custom/V8Float64ArrayCustom.cpp: Ditto.
        * bindings/v8/custom/V8Int16ArrayCustom.cpp: Ditto.
        * bindings/v8/custom/V8Int32ArrayCustom.cpp: Ditto.
        * bindings/v8/custom/V8Int8ArrayCustom.cpp: Ditto.
        * bindings/v8/custom/V8Uint16ArrayCustom.cpp: Ditto.
        * bindings/v8/custom/V8Uint32ArrayCustom.cpp: Ditto.
        * bindings/v8/custom/V8Uint8ArrayCustom.cpp: Ditto.
        * bindings/v8/custom/V8Uint8ClampedArrayCustom.cpp: Ditto.
        * html/canvas/Int8Array.idl: Using TypedArray.
        * html/canvas/Uint8Array.idl: Ditto.
        * html/canvas/Uint8ClampedArray.idl: Ditto.

2012-08-07  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: [regression r121673] restore link between the command and the result.
        https://bugs.webkit.org/show_bug.cgi?id=93280

        Reviewed by Vsevolod Vlasov.

        Passing lost parameter along.

        Test: inspector/console/console-originating-command.html

        * inspector/front-end/ConsoleView.js:
        (WebInspector.ConsoleView.prototype.runScript.runCallback):
        (WebInspector.ConsoleView.prototype.runScript):
        (WebInspector.ConsoleView.prototype._printResult):

2012-08-07  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>

        CUSTOM_SCHEME_HANDLER flag should depend on REGISTER_PROTOCOL_HANDLER
        https://bugs.webkit.org/show_bug.cgi?id=93081

        Reviewed by Adam Barth.

        CUSTOM_SCHEME_HANDLER #if guards are enclosed in the REGISTER_PROTOCOL_HANDLER guards.
        The whole NavigatorRegisterProtocolHandler interface is conditional on REGISTER_PROTOCOL_HANDLER
        CUSTOM_SCHEME_HANDLER-specific methods only are conditional on CUSTOM_SCHEME_HANDLER.

        No new tests. No new functionality is added.

        * Modules/protocolhandler/NavigatorRegisterProtocolHandler.cpp:
        (WebCore::NavigatorRegisterProtocolHandler::registerProtocolHandler):
        * Modules/protocolhandler/NavigatorRegisterProtocolHandler.h:
        (NavigatorRegisterProtocolHandler):
        * Modules/protocolhandler/NavigatorRegisterProtocolHandler.idl:
        * Modules/protocolhandler/RegisterProtocolHandlerClient.h:

2012-08-07  Xingnan Wang  <xingnan.wang@intel.com>

        IndexedDB: Size the Vector in encodeInt/encodeVarInt/encodeString
        https://bugs.webkit.org/show_bug.cgi?id=91813

        Reviewed by Kentaro Hara.

        To avoid memory re-allocation in Vector, init the capability or size of Vector in encodeInt(), encodeVarInt(),
        encodeBool(), encodeIDBKey() etc.

        No new tests - Low level functions covered by existing layout tests and also covered by Chromium
        webkit_unit_tests IDBLevelIDBCodingTest.* which validates the sizes of buffers returned by encodeVarInt.

        * Modules/indexeddb/IDBLevelDBCoding.cpp:
        (WebCore::IDBLevelDBCoding::encodeInt):
        (WebCore::IDBLevelDBCoding::encodeVarInt):
        (WebCore::IDBLevelDBCoding::encodeString):

2012-08-06  Arko Saha  <arko@motorola.com>

        Microdata: itemType[index] must be undefined for out-of-range index.
        https://bugs.webkit.org/show_bug.cgi?id=92988

        Reviewed by Kentaro Hara.

        Made changes in IndexedGetter property so that it returns undefined
        for out-of-range index.
        Spec: http://www.w3.org/TR/WebIDL/#idl-indexed-properties
        Firefox and Opera's behavior is consistent with the spec. Both returns
        undefined for out-of-range index.

        Also renamed the function name collectionStringOrNullIndexedPropertyGetter and
        setCollectionStringOrNullIndexedGetter to collectionStringOrUndefinedIndexedPropertyGetter
        and setCollectionStringOrUndefinedIndexedGetter respectively.

        Test: fast/dom/MicroData/domsettabletokenlist-attributes-out-of-range-index.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateImplementationIndexer):
        * bindings/v8/V8Collection.h:
        (WebCore::collectionStringOrUndefinedIndexedPropertyGetter):
        (WebCore::setCollectionStringOrUndefinedIndexedGetter):

2012-08-06  David Grogan  <dgrogan@chromium.org>

        IndexedDB: Make leveldb store integer versions and migrate old schemas
        https://bugs.webkit.org/show_bug.cgi?id=92883

        Reviewed by Tony Chang.

        Our first schema change. If an existing DB doesn't have integer
        versions, this will add one to all object stores in the origin.

        No new tests - chrome test for the migration forthcoming. Will involve
        starting with a leveldb directory from an old build of chrome, opening
        it up with the migration code in place, and checking the new database.
        http://codereview.chromium.org/10826159/

        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
        (WebCore::putVarInt):
        (WebCore):
        (WebCore::setUpMetadata):
        Uses the ASSERT-but-still-handle-corruption pattern recently discussed
        in https://bugs.webkit.org/show_bug.cgi?id=92725#c13.

        (WebCore::IDBLevelDBBackingStore::open):
        (WebCore::IDBLevelDBBackingStore::getIDBDatabaseMetaData):
        Because we can't store negative numbers, store 0 instead of -1.

        (WebCore::IDBLevelDBBackingStore::createIDBDatabaseMetaData):
        (WebCore::IDBLevelDBBackingStore::updateIDBDatabaseIntVersion):
        * Modules/indexeddb/IDBLevelDBCoding.h:
        * Modules/indexeddb/IDBMetadata.h:

2012-08-06  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124780.
        http://trac.webkit.org/changeset/124780
        https://bugs.webkit.org/show_bug.cgi?id=93340

        We don't want an incomplete feature set for the chromium
        branch cut. (Requested by annacc on #webkit).

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * Modules/mediasource/MediaSource.cpp: Removed.
        * Modules/mediasource/MediaSource.h: Removed.
        * Modules/mediasource/MediaSource.idl: Removed.
        * Modules/mediasource/MediaSourceRegistry.cpp: Removed.
        * Modules/mediasource/MediaSourceRegistry.h: Removed.
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::SourceBuffer):
        (WebCore::SourceBuffer::buffered):
        (WebCore::SourceBuffer::append):
        (WebCore::SourceBuffer::abort):
        * Modules/mediasource/SourceBuffer.h:
        (WebCore::SourceBuffer::create):
        (WebCore::SourceBuffer::clear):
        (SourceBuffer):
        * Modules/mediasource/SourceBufferList.cpp:
        * Modules/mediasource/SourceBufferList.h:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/EventTarget.h:
        (WebCore):
        * dom/EventTargetFactory.in:
        * html/DOMURL.cpp:
        * html/DOMURL.h:
        (WebCore):
        (DOMURL):
        * html/DOMURL.idl:
        * page/DOMWindow.idl:

2012-08-06  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124798.
        http://trac.webkit.org/changeset/124798
        https://bugs.webkit.org/show_bug.cgi?id=93337

        We don't want an incomplete feature set for the chromium
        branch cut. (Requested by annacc on #webkit).

        * html/DOMURL.cpp:
        (WebCore::DOMURL::createObjectURL):
        * html/PublicURLManager.h:
        (WebCore::PublicURLManager::contextDestroyed):
        (PublicURLManager):

2012-08-06  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124848.
        http://trac.webkit.org/changeset/124848
        https://bugs.webkit.org/show_bug.cgi?id=93336

        Caused 3 tests to crash on chromium Linux32/Mac10.6/Linux
        (Requested by toyoshim on #webkit).

        * html/HTMLMediaElement.cpp:
        (WebCore):
        (WebCore::HTMLMediaElement::HTMLMediaElement):
        (WebCore::HTMLMediaElement::parseAttribute):
        (WebCore::HTMLMediaElement::prepareForLoad):
        (WebCore::HTMLMediaElement::loadResource):
        (WebCore::HTMLMediaElement::noneSupported):
        (WebCore::HTMLMediaElement::mediaEngineError):
        (WebCore::HTMLMediaElement::mediaPlayerSourceOpened):
        (WebCore::HTMLMediaElement::isValidSourceId):
        (WebCore::HTMLMediaElement::seek):
        (WebCore::HTMLMediaElement::webkitSourceAddId):
        (WebCore::HTMLMediaElement::webkitSourceRemoveId):
        (WebCore::HTMLMediaElement::webkitSourceBuffered):
        (WebCore::HTMLMediaElement::webkitSourceAppend):
        (WebCore::HTMLMediaElement::webkitSourceAbort):
        (WebCore::HTMLMediaElement::webkitSourceEndOfStream):
        (WebCore::HTMLMediaElement::webkitSourceState):
        (WebCore::HTMLMediaElement::setSourceState):
        (WebCore::HTMLMediaElement::userCancelledLoad):
        (WebCore::HTMLMediaElement::createMediaPlayer):
        * html/HTMLMediaElement.h:
        (HTMLMediaElement):
        * html/HTMLMediaElement.idl:

2012-08-06  Anna Cavender  <annacc@chromium.org>

        Update HTMLMediaElement to the new OO MediaSource API.
        https://bugs.webkit.org/show_bug.cgi?id=91775

        Reviewed by Eric Carlson.

        This patch rips out the old-style MediaSource API and allows a
        MediaSource object to be attached to HTMLMediaElement.
        http://dvcs.w3.org/hg/html-media/raw-file/tip/media-source/media-source.html

        Test: http/tests/media/media-source/video-media-source-add-and-remove-buffers.html

        Tests: updates to http/tests/media/media-source/*

        * html/HTMLMediaElement.cpp:
        (WebCore):
        (WebCore::HTMLMediaElement::HTMLMediaElement): Remove old style API resources.
        (WebCore::HTMLMediaElement::parseAttribute): Remove old style event attributes.
        (WebCore::HTMLMediaElement::prepareForLoad): Set source state to "closed".
        (WebCore::HTMLMediaElement::loadResource): Get MediaSource object from blob registry
            look up and, if found, set it's MediaPlayer pointer to the current MediaPlayer.
        (WebCore::HTMLMediaElement::noneSupported): Set source state to "closed".
        (WebCore::HTMLMediaElement::mediaEngineError): Set source state to "closed".
        (WebCore::HTMLMediaElement::mediaPlayerSourceOpened): Set source state to "open".
        (WebCore::HTMLMediaElement::mediaPlayerSourceURL): Change to new blob URL.
        (WebCore::HTMLMediaElement::seek): Check if source state is "closed".
        (WebCore::HTMLMediaElement::setSourceState): Helper function so that we don't have to
            keep checking for m_mediaSource.
        (WebCore::HTMLMediaElement::userCancelledLoad): Set source state to "closed".
        (WebCore::HTMLMediaElement::createMediaPlayer): If the current MediaPlayer is re-
            created, notify the MediaSource and reset its MediaPlayer.

        * html/HTMLMediaElement.h: Remove old style API code and add a MediaSource object.
        (HTMLMediaElement):
        * html/HTMLMediaElement.idl: Remove old style API.

2012-08-06  Adam Barth  <abarth@webkit.org>

        BindingSecurity::shouldAllowAccessToFrame shouldn't use a raw boolean parameter
        https://bugs.webkit.org/show_bug.cgi?id=93323

        Reviewed by Eric Seidel.

        As requested by Eric. This patch also renames the function to match its
        counterpart in the JavaScriptCore bindings.

        * bindings/generic/BindingSecurity.cpp:
        (WebCore::canAccessDocument):
        (WebCore::BindingSecurity::shouldAllowAccessToFrame):
        (WebCore::BindingSecurity::shouldAllowAccessToNode):
        (WebCore::BindingSecurity::allowSettingFrameSrcToJavascriptUrl):
        * bindings/generic/BindingSecurity.h:
        (BindingSecurity):
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateDomainSafeFunctionGetter):
        (GenerateReplaceableAttrSetter):
        (GenerateFunctionCallback):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        (WebCore::TestActiveDOMObjectV8Internal::excitingFunctionCallback):
        (WebCore::TestActiveDOMObjectV8Internal::postMessageAttrGetter):
        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::canAccessFromCurrentOrigin):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::WindowSetTimeoutImpl):
        (WebCore::V8DOMWindow::eventAccessorGetter):
        (WebCore::V8DOMWindow::eventAccessorSetter):
        (WebCore::V8DOMWindow::openerAccessorSetter):
        (WebCore::V8DOMWindow::addEventListenerCallback):
        (WebCore::V8DOMWindow::removeEventListenerCallback):
        (WebCore::V8DOMWindow::showModalDialogCallback):
        (WebCore::V8DOMWindow::openCallback):
        (WebCore::V8DOMWindow::namedSecurityCheck):
        (WebCore::V8DOMWindow::indexedSecurityCheck):
        * bindings/v8/custom/V8HistoryCustom.cpp:
        (WebCore::V8History::indexedSecurityCheck):
        (WebCore::V8History::namedSecurityCheck):
        * bindings/v8/custom/V8InjectedScriptManager.cpp:
        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
        * bindings/v8/custom/V8LocationCustom.cpp:
        (WebCore::V8Location::reloadAccessorGetter):
        (WebCore::V8Location::replaceAccessorGetter):
        (WebCore::V8Location::assignAccessorGetter):
        (WebCore::V8Location::toStringCallback):
        (WebCore::V8Location::indexedSecurityCheck):
        (WebCore::V8Location::namedSecurityCheck):

2012-08-06  Yuta Kitamura  <yutak@chromium.org>

        WebSocket.send() should accept ArrayBufferView
        https://bugs.webkit.org/show_bug.cgi?id=90877

        Reviewed by Kent Tamura.

        Accept ArrayBufferView as an argument of WebSocket.send() to comply with recent change
        in specification: <http://html5.org/tools/web-apps-tracker?from=7084&to=7085>.

        Once WebSocket.send(ArrayBuffer) was removed from the specification, but added back
        in <http://html5.org/tools/web-apps-tracker?from=7202&to=7203>. Thus the functionality
        of send(ArrayBuffer) is kept as-is.

        Tests: http/tests/websocket/tests/hybi/send-arraybufferview.html
               http/tests/websocket/tests/hybi/workers/send-arraybufferview.html

        * Modules/websockets/ThreadableWebSocketChannel.h:
        Change the signature of send() to receive offset and length so the clients can send
        subrange of an ArrayBuffer.
        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::send):
        WebSocket.send(ArrayBufferView) is added, which puts the sub region of the given
        ArrayBuffer into the outgoing frame queue.
        * Modules/websockets/WebSocket.h:
        * Modules/websockets/WebSocket.idl:
        * Modules/websockets/WebSocketChannel.cpp:
        (WebCore::WebSocketChannel::send):
        * Modules/websockets/WebSocketChannel.h:
        (WebSocketChannel):
        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
        (WebCore::WorkerThreadableWebSocketChannel::send):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::send):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::send):
        Send only necessary part of data to the main thread.
        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
        (WorkerThreadableWebSocketChannel):
        (Bridge):
        * bindings/js/JSWebSocketCustom.cpp:
        (WebCore::JSWebSocket::send): Accept ArrayBufferView in send().
        * bindings/v8/custom/V8WebSocketCustom.cpp:
        (WebCore::V8WebSocket::sendCallback): Ditto.

2012-08-06  James Robinson  <jamesr@chromium.org>

        [chromium] Add gyp variable to control which compositor target is depended on
        https://bugs.webkit.org/show_bug.cgi?id=93165

        Reviewed by Adam Barth.

        This adds a use_libcc_for_compositor gyp variable to control whether webcore_platform links in the compositor
        code from the webcore_chromium_compositor target or from cc from the chromium repo.

        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:

2012-08-06  Shinya Kawanaka  <shinyak@chromium.org>

        Crash in GenericEventQueue::timerFired since the owner of GenericEventQueue is deleted during dispatching events.
        https://bugs.webkit.org/show_bug.cgi?id=92946

        Reviewed by Eric Carlson.

        In GenericEventQueue::timerFired(), the owner of GenericEventQueue might be deleted.
        We have to protect the owner of GenericEventQueue during dispatching events.

        Test: media/event-queue-crash.html

        * dom/GenericEventQueue.cpp:
        (WebCore::GenericEventQueue::timerFired): Added a protection.

2012-08-06  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Remove IDBRequest::finishCursor() and plumbing
        https://bugs.webkit.org/show_bug.cgi?id=93274

        Reviewed by Tony Chang.

        Delete an unused flag and code for setting it, rendered obsolete in r123275.

        No new tests - no functional changes.

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::close):
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::IDBRequest):
        * Modules/indexeddb/IDBRequest.h:
        (IDBRequest):

2012-08-06  James Robinson  <jamesr@chromium.org>

        [chromium] Remove lingering unwrap<>() calls in GraphicsLayerChromium.cpp
        https://bugs.webkit.org/show_bug.cgi?id=93319

        Reviewed by Adrienne Walker.

        Gets rid of all (but one) of the remaining unwrap<LayerChromium>() calls in GraphicsLayer chromium to avoid
        punching through the WebLayer API.  Covered by many layout tests, mostly in compositing/

        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::willBeDestroyed):
        (WebCore::GraphicsLayerChromium::setName):
        (WebCore::GraphicsLayerChromium::updateNames):
        (WebCore::GraphicsLayerChromium::setMaskLayer):
        (WebCore::GraphicsLayerChromium::setReplicatedByLayer):
        (WebCore::GraphicsLayerChromium::setContentsToImage):
        (WebCore::GraphicsLayerChromium::setContentsToCanvas):
        (WebCore::GraphicsLayerChromium::setContentsToMedia):
        (WebCore::GraphicsLayerChromium::updateChildList):
        (WebCore::GraphicsLayerChromium::setupContentsLayer):
        * platform/graphics/chromium/GraphicsLayerChromium.h:
        (GraphicsLayerChromium):

2012-08-06  Adrienne Walker  <enne@google.com>

        [chromium] Convert WebScrollbarThemeGeometry from a concrete class to an interface
        https://bugs.webkit.org/show_bug.cgi?id=93308

        Reviewed by James Robinson.

        Convert WebScrollbarThemeGeometry to be an interface. Create a new
        WebScrollbarThemeGeometryNative implementation to wrap a native theme
        pointer.

        Update ScrollbarLayerChromium/CCScrollbarLayerImpl to use a pointer to
        this interface rather than a concrete member variable. Because both
        layer types need to access the theme during painting or compositing
        and either layer could go away at any time, the theme is cloned during
        commit rather than dealing with refcounting across threads or having
        one layer type be the sole owner.

        * WebCore.gypi:
        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        (WebCore::createScrollbarLayer):
        * platform/chromium/support/WebScrollbarThemeGeometryNative.cpp: Renamed from Source/WebKit/chromium/src/WebScrollbarThemeGeometry.cpp.
        (WebKit):
        (WebKit::WebScrollbarThemeGeometryNative::create):
        (WebKit::WebScrollbarThemeGeometryNative::WebScrollbarThemeGeometryNative):
        (WebKit::WebScrollbarThemeGeometryNative::clone):
        (WebKit::WebScrollbarThemeGeometryNative::thumbPosition):
        (WebKit::WebScrollbarThemeGeometryNative::thumbLength):
        (WebKit::WebScrollbarThemeGeometryNative::trackPosition):
        (WebKit::WebScrollbarThemeGeometryNative::trackLength):
        (WebKit::WebScrollbarThemeGeometryNative::hasButtons):
        (WebKit::WebScrollbarThemeGeometryNative::hasThumb):
        (WebKit::WebScrollbarThemeGeometryNative::trackRect):
        (WebKit::WebScrollbarThemeGeometryNative::thumbRect):
        (WebKit::WebScrollbarThemeGeometryNative::minimumThumbLength):
        (WebKit::WebScrollbarThemeGeometryNative::scrollbarThickness):
        (WebKit::WebScrollbarThemeGeometryNative::backButtonStartRect):
        (WebKit::WebScrollbarThemeGeometryNative::backButtonEndRect):
        (WebKit::WebScrollbarThemeGeometryNative::forwardButtonStartRect):
        (WebKit::WebScrollbarThemeGeometryNative::forwardButtonEndRect):
        (WebKit::WebScrollbarThemeGeometryNative::constrainTrackRectToTrackPieces):
        (WebKit::WebScrollbarThemeGeometryNative::splitTrack):
        * platform/chromium/support/WebScrollbarThemeGeometryNative.h: Added.
        (WebKit):
        (WebScrollbarThemeGeometryNative):
        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        (WebCore::ScrollbarLayerChromium::create):
        (WebCore::ScrollbarLayerChromium::ScrollbarLayerChromium):
        (WebCore::ScrollbarLayerChromium::pushPropertiesTo):
        (WebCore::ScrollbarBackgroundPainter::create):
        (WebCore::ScrollbarBackgroundPainter::ScrollbarBackgroundPainter):
        (ScrollbarBackgroundPainter):
        (WebCore::ScrollbarThumbPainter::create):
        (WebCore::ScrollbarThumbPainter::ScrollbarThumbPainter):
        (ScrollbarThumbPainter):
        (WebCore::ScrollbarLayerChromium::createTextureUpdaterIfNeeded):
        (WebCore::ScrollbarLayerChromium::setTexturePriorities):
        (WebCore::ScrollbarLayerChromium::update):
        * platform/graphics/chromium/ScrollbarLayerChromium.h:
        (ScrollbarLayerChromium):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
        (WebCore::CCScrollbarLayerImpl::setScrollbarGeometry):
        (WebCore::CCScrollbarLayerImpl::setScrollbarData):
        (WebCore::CCScrollbarLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
        (WebCore::CCScrollbarLayerImpl::scrollbarGeometry):
        (CCScrollbarLayerImpl):

2012-08-06  Adam Barth  <abarth@webkit.org>

        JSC should use BindingState to determine the activeDOMWindow
        https://bugs.webkit.org/show_bug.cgi?id=93307

        Reviewed by Eric Seidel.

        This patch moves activeDOMWindow from JSDOMBindings.cpp to
        BindingState.cpp. This is a first step towards sharing the core
        security logic in the bindings between JavaScriptCore and V8. Once the
        logic is shared, we will be able to refactor the logic to avoid the
        need for DOMWindow::m_securityOrigin.

        This patch doesn't actually share any code (yet). It just sets the
        stage by creating BindingState as a typedef of ExecState and adding the
        appropriate files to the build systems.

        This patch also renames activeWindow and firstWindow in the V8 bindings
        to activeDOMWindow and firstDOMWindow to match the names in the
        JavaScriptCore bindings.

        * GNUmakefile.list.am:
        * Target.pri:
        * UseJSC.cmake:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/generic/BindingSecurity.cpp:
        (WebCore::canAccessDocument):
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSDOMBinding.cpp:
        (WebCore):
        * bindings/js/JSDOMBinding.h:
        (WebCore):
        * bindings/v8/BindingState.cpp:
        (WebCore::activeDOMWindow):
        (WebCore::firstDOMWindow):
        * bindings/v8/BindingState.h:
        (WebCore):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::V8DOMWindow::locationAccessorSetter):
        (WebCore::handlePostMessageCallback):
        (WebCore::V8DOMWindow::showModalDialogCallback):
        (WebCore::V8DOMWindow::openCallback):
        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
        (WebCore::V8Document::locationAccessorSetter):
        * bindings/v8/custom/V8LocationCustom.cpp:
        (WebCore::V8Location::hashAccessorSetter):
        (WebCore::V8Location::hostAccessorSetter):
        (WebCore::V8Location::hostnameAccessorSetter):
        (WebCore::V8Location::hrefAccessorSetter):
        (WebCore::V8Location::pathnameAccessorSetter):
        (WebCore::V8Location::portAccessorSetter):
        (WebCore::V8Location::protocolAccessorSetter):
        (WebCore::V8Location::searchAccessorSetter):
        (WebCore::V8Location::reloadCallback):
        (WebCore::V8Location::replaceCallback):
        (WebCore::V8Location::assignCallback):

2012-08-05  Kent Tamura  <tkent@chromium.org>

        [Chromium-Mac] Use the default locale only if the browser locale matches to it
        https://bugs.webkit.org/show_bug.cgi?id=93227

        Reviewed by Hajime Morita.

        For a calendar picker, we have used month names and day-of-week names
        obtained from the OS default locale. However, the year-month format and
        [Today] [Clear] labels are decided with the browser locale. It made
        calendar pickers with mixed languages.

        To make calendar pickers with a single language, we use the OS default
        locale only if the browser locale matches to it.

        No new tests. Behavior for locale setting is not testable in WebKit.

        * platform/text/mac/LocaleMac.mm:
        (WebCore::languageFromLocale):
        A helper for determineLocale. This returns the language part of the
        specified locale identifier.
        (WebCore::determineLocale):
        If the browser language matches to the language of the current NSLocale,
        returns the current NSLocale. Otherwise, returns a NSLocale with the
        browser language.
        Note that [NSLolca localeIdentifier] returns a string in
        <language>_<country> format though defaultLanguage() in Chromium returns
        a string in <language>-<country> format.
        (WebCore::LocaleMac::currentLocale):
        Use determineLocale.

2012-08-06  Luke Macpherson   <macpherson@chromium.org>

        Handle variables in CSSParser::parseValidPrimitive(), preventing null return value.
        https://bugs.webkit.org/show_bug.cgi?id=93235

        Reviewed by Tony Chang.

        By returning null here (and failing to handle the variable) the current code would cause null pointer dereferences in StyleResolver at several points.
        Instead we create a primitive value for the variable reference and return it.

        Test: fast/css/variables/invalid-font-reference.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValidPrimitive):

2012-08-06  David Reveman  <reveman@chromium.org>

        [Chromium] Rename CCTextureUpdater to CCTextureUpdateQueue.
        https://bugs.webkit.org/show_bug.cgi?id=93293

        Reviewed by Adrienne Walker.

        No new tests.

        * WebCore.gypi:
        * platform/graphics/chromium/ContentLayerChromium.cpp:
        (WebCore::ContentLayerChromium::update):
        * platform/graphics/chromium/ContentLayerChromium.h:
        (ContentLayerChromium):
        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.cpp:
        (WebCore::HeadsUpDisplayLayerChromium::update):
        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.h:
        (HeadsUpDisplayLayerChromium):
        * platform/graphics/chromium/ImageLayerChromium.cpp:
        (WebCore::ImageLayerChromium::update):
        * platform/graphics/chromium/ImageLayerChromium.h:
        (ImageLayerChromium):
        * platform/graphics/chromium/LayerChromium.h:
        (WebCore):
        (WebCore::LayerChromium::update):
        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        (WebCore::ScrollbarLayerChromium::updatePart):
        (WebCore::ScrollbarLayerChromium::update):
        * platform/graphics/chromium/ScrollbarLayerChromium.h:
        (WebCore):
        (ScrollbarLayerChromium):
        * platform/graphics/chromium/TextureLayerChromium.cpp:
        (WebCore::TextureLayerChromium::update):
        * platform/graphics/chromium/TextureLayerChromium.h:
        (TextureLayerChromiumClient):
        (TextureLayerChromium):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::updateTiles):
        (WebCore::TiledLayerChromium::updateContentRect):
        * platform/graphics/chromium/TiledLayerChromium.h:
        (TiledLayerChromium):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::updateLayers):
        (WebCore::CCLayerTreeHost::paintMasksForRenderSurface):
        (WebCore::CCLayerTreeHost::paintLayerContents):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore):
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::doCommit):
        (WebCore::CCSingleThreadProxy::commitAndComposite):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        * platform/graphics/chromium/cc/CCTextureUpdateController.cpp:
        (WebCore::CCTextureUpdateController::updateTextures):
        (WebCore::CCTextureUpdateController::CCTextureUpdateController):
        (WebCore::CCTextureUpdateController::hasMoreUpdates):
        (WebCore::CCTextureUpdateController::updateMoreTextures):
        * platform/graphics/chromium/cc/CCTextureUpdateController.h:
        (WebCore::CCTextureUpdateController::create):
        (CCTextureUpdateController):
        * platform/graphics/chromium/cc/CCTextureUpdateQueue.cpp: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.cpp.
        (WebCore):
        (WebCore::CCTextureUpdateQueue::CCTextureUpdateQueue):
        (WebCore::CCTextureUpdateQueue::~CCTextureUpdateQueue):
        (WebCore::CCTextureUpdateQueue::appendFullUpload):
        (WebCore::CCTextureUpdateQueue::appendPartialUpload):
        (WebCore::CCTextureUpdateQueue::appendCopy):
        (WebCore::CCTextureUpdateQueue::takeFirstFullUpload):
        (WebCore::CCTextureUpdateQueue::takeFirstPartialUpload):
        (WebCore::CCTextureUpdateQueue::takeFirstCopy):
        (WebCore::CCTextureUpdateQueue::hasMoreUpdates):
        * platform/graphics/chromium/cc/CCTextureUpdateQueue.h: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.h.
        (WebCore):
        (CCTextureUpdateQueue):
        (WebCore::CCTextureUpdateQueue::fullUploadSize):
        (WebCore::CCTextureUpdateQueue::partialUploadSize):
        (WebCore::CCTextureUpdateQueue::copySize):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::beginFrame):
        (WebCore::CCThreadProxy::beginFrameCompleteOnImplThread):
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (WebCore):
        (CCThreadProxy):

2012-08-06  Anders Carlsson  <andersca@apple.com>

        Clear out the TileCache backpointer for all tile layers when the tile cache is destroyed
        https://bugs.webkit.org/show_bug.cgi?id=93317
        <rdar://problem/11566543>

        Reviewed by Dean Jackson.

        It seems that in some rare cases, the tile cache layer can be destroyed in the same transaction as tile layers
        are being asked to paint. Make sure to null out the TileCache back pointer for all layers in the TileCache destructor.

        * platform/graphics/ca/mac/TileCache.mm:
        (WebCore::TileCache::~TileCache):

2012-08-06  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124816.
        http://trac.webkit.org/changeset/124816
        https://bugs.webkit.org/show_bug.cgi?id=93311

        made some tests crash (Requested by noamr on #webkit).

        * platform/graphics/GraphicsLayerAnimation.cpp:
        (WebCore::GraphicsLayerAnimation::GraphicsLayerAnimation):
        (WebCore::GraphicsLayerAnimations::hasActiveAnimationsOfType):
        (WebCore::GraphicsLayerAnimations::hasRunningAnimations):
        (WebCore::GraphicsLayerAnimations::add):
        (WebCore::GraphicsLayerAnimations::pause):
        (WebCore::GraphicsLayerAnimations::apply):
        * platform/graphics/GraphicsLayerAnimation.h:
        (GraphicsLayerAnimation):
        (GraphicsLayerAnimations):
        (WebCore::GraphicsLayerAnimations::remove):
        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
        (WebCore::GraphicsLayerTextureMapper::addAnimation):

2012-08-06  Max Vujovic  <mvujovic@adobe.com>

        [CSS Shaders] Parse mix function
        https://bugs.webkit.org/show_bug.cgi?id=90101

        Reviewed by Dirk Schulze.

        Parse the mix function syntax for CSS Shaders as defined in the Filter Effects spec:
        https://dvcs.w3.org/hg/FXTF/raw-file/tip/filters/index.html#FilterFunction

        The fragment shader argument of the custom filter function can now be a mix function with
        the following syntax:
        mix(<uri> [ <blend-mode> || <alpha-compositing> ]?)

        For example:
        -webkit-filter: custom(url(shader.vert) mix(url(shader.frag multiply source-over))

        The Filter Effects spec references the Compositing and Blending spec, which defines the
        supported blend modes and alpha compositing modes.

        Blend modes:
        https://dvcs.w3.org/hg/FXTF/rawfile/tip/compositing/index.html#blend-mode

        This patch adds all of the blend modes in the spec.

        Alpha compositing modes:
        https://dvcs.w3.org/hg/FXTF/rawfile/tip/compositing/index.html#alpha-compositing

        This patch does not add any new CSS values for alpha compositing. Currently, we parse the
        values that are the same between the spec and the -webkit-background-composite property,
        including:
            clear
            copy
            source-over
            source-in
            source-out
            source-atop
            destination-over
            destination-in
            destination-out
            destination-atop
            xor

        In the future, we may need to add the following CSS values for alpha compositing:
            lighter
            destination

        This is currently under discussion on the www-style mailing list:
        http://lists.w3.org/Archives/Public/www-style/2012Aug/0123.html

        No new test files. Add test cases in:
            css3/filters/script-tests/custom-filter-property-computed-style.js:
            css3/filters/script-tests/custom-filter-property-parsing-invalid.js:
            css3/filters/script-tests/custom-filter-property-parsing.js:

        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::valueForFilter):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::isBlendMode):
        (WebCore):
        (WebCore::CSSParser::isCompositeOperator):
        (WebCore::CSSParser::parseMixFunction):
        (WebCore::CSSParser::parseCustomFilter):
        * css/CSSParser.h:
        (WebCore):
        * css/CSSParserValues.h:
        (WebCore::CSSParserValueList::currentIndex):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore):
        (WebCore::CSSPrimitiveValue::operator BlendMode):
        * css/CSSValue.cpp:
        (WebCore::CSSValue::reportMemoryUsage):
        (WebCore::CSSValue::cssText):
        (WebCore::CSSValue::destroy):
        (WebCore::CSSValue::cloneForCSSOM):
        * css/CSSValue.h:
        (WebCore::CSSValue::isWebKitCSSMixFunctionValue):
        (CSSValue):
        * css/CSSValueKeywords.in:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/WebKitCSSMixFunctionValue.cpp: Added.
        (WebCore):
        (WebCore::WebKitCSSMixFunctionValue::WebKitCSSMixFunctionValue):
        (WebCore::WebKitCSSMixFunctionValue::customCssText):
        (WebCore::WebKitCSSMixFunctionValue::cloneForCSSOM):
        (WebCore::WebKitCSSMixFunctionValue::reportDescendantMemoryUsage):
        * css/WebKitCSSMixFunctionValue.h: Added.
        (WebCore):
        (WebKitCSSMixFunctionValue):
        (WebCore::WebKitCSSMixFunctionValue::create):
        * platform/graphics/GraphicsTypes.h:
        * platform/graphics/filters/CustomFilterProgram.cpp:
        (WebCore::CustomFilterProgram::CustomFilterProgram):
        * platform/graphics/filters/CustomFilterProgram.h:
        (WebCore::CustomFilterProgramMixSettings::CustomFilterProgramMixSettings):
        (CustomFilterProgramMixSettings):
        (WebCore):
        * rendering/style/StyleCustomFilterProgram.h:
        (WebCore::StyleCustomFilterProgram::create):
        (WebCore::StyleCustomFilterProgram::StyleCustomFilterProgram):

2012-08-06  No'am Rosenthal  <noam.rosenthal@nokia.com>

        GraphicsLayerAnimation shouldn't use HashMap<String>
        https://bugs.webkit.org/show_bug.cgi?id=93284

        Reviewed by Kenneth Rohde Christiansen.

        Use a vector containing all the animations instead of a map of String to Vector.
        The HashMap contains very few elements, which makes it inefficient relatively to a vector.
        This has been shown to be a bottleneck in valgrind.

        Covered by existing animation tests.

        * platform/graphics/GraphicsLayerAnimation.cpp:
        (WebCore::GraphicsLayerAnimation::GraphicsLayerAnimation):
        (WebCore::GraphicsLayerAnimations::hasActiveAnimationsOfType):
        (WebCore::GraphicsLayerAnimations::hasRunningAnimations):
        (WebCore::GraphicsLayerAnimations::add):
        (WebCore::GraphicsLayerAnimations::pause):
        (WebCore::GraphicsLayerAnimations::remove):
        (WebCore::GraphicsLayerAnimations::apply):
        * platform/graphics/GraphicsLayerAnimation.h:
        (GraphicsLayerAnimation):
        (WebCore::GraphicsLayerAnimation::name):
        (GraphicsLayerAnimations):
        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
        (WebCore::GraphicsLayerTextureMapper::addAnimation):

2012-08-06  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=93199
        REGRESSION (r124489): Crash in FrameView::scrollContentsFastPath when 
        scrolling Facebook and Google image search
        -and corresponding-
        <rdar://problem/12035066>

        Reviewed by Anders Carlsson.

        As the comment in setShouldUpdateScrollLayerPositionOnMainThread() 
        indicates, the goal of adding a call to 
        updateMainFrameScrollPositionAndScrollLayerPosition() within that 
        function was just to make sure the layer position was up-to-date 
        since that is what is not kept up to date when scrolling is happening 
        on the scrolling thread. So I'm fixing this crash by having that code 
        ONLY update the layer position instead of also updating the scroll 
        position, since it was updating the scroll position that led to this 
        crash.

        New function updateMainFrameScrollLayerPosition() will update JUST 
        the layer position.
        * page/scrolling/ScrollingCoordinator.h:
        (ScrollingCoordinator):        
        * page/scrolling/ScrollingCoordinator.cpp:
        (WebCore::ScrollingCoordinator::updateMainFrameScrollLayerPosition):

        Update just the layer position here instead of the layer position and 
        the scroll position.
        (WebCore)::
(WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):

2012-08-06  Anna Cavender  <annacc@chromium.org>

        MediaSource should use it's own list of source URLs
        https://bugs.webkit.org/show_bug.cgi?id=93285

        Reviewed by Eric Carlson.

        r124780 added MediaSource objects to PublicURLManager's streamURLs list,
        piggy-backing on MEDIA_STREAM.  This patch creates a sourceURLs list so
        that MediaSource can stand on its own.

        Test: builds on Andriod even when MEDIA_STREAM is disabled.

        * html/DOMURL.cpp:
        (WebCore::DOMURL::createObjectURL):
        * html/PublicURLManager.h:
        (WebCore::PublicURLManager::contextDestroyed):
        (PublicURLManager):
        (WebCore::PublicURLManager::sourceURLs):

2012-08-06  Nico Weber  <thakis@chromium.org>

        [chromium/mac] Unbreak debug builds with the 10.7 SDK
        https://bugs.webkit.org/show_bug.cgi?id=93202

        Reviewed by James Robinson.

        FMGetATSFontRefFromFont() is not available with the 10.7 SDK
        when targetting 10.6. Don't delete this code completely yet,
        it's still used with the 10.6 SDK when targetting 10.6 (which
        chromium's build bots use).

        * platform/graphics/mac/SimpleFontDataMac.mm:
        (WebCore):

2012-07-31  Ojan Vafai  <ojan@chromium.org>

        need tests to ensure flexboxes play nicely with box-sizing
        https://bugs.webkit.org/show_bug.cgi?id=70771

        Reviewed by Tony Chang.

        Anytime we grab the width/height off of the RenderStyle, we need to adjust
        it for box-sizing. Fortunately, we only do this two places in RenderFlexibleBox.
        Also, delete crossAxisLength since it's unused.

        Test: css3/flexbox/box-sizing.html

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::preferredMainAxisContentExtentForChild):
        * rendering/RenderFlexibleBox.h:

2012-08-06  John J. Barton  <johnjbarton@chromium.org>

        Web Inspector: WebInspector.linkifyStringAsFragment gives wrong typeof lineNumber
        https://bugs.webkit.org/show_bug.cgi?id=93019

        Reviewed by Pavel Feldman.

        Add test for WebInspector.linkifyStringAsFragment()

        * inspector/front-end/ResourceUtils.js:
        (WebInspector.linkifyStringAsFragmentWithCustomLinkifier):

2012-08-06  David Reveman  <reveman@chromium.org>

        [Chromium] Refactor CCTextureUpdater into CCTextureUpdater and CCTextureUpdateController.
        https://bugs.webkit.org/show_bug.cgi?id=92596

        Reviewed by Adrienne Walker.

        The CCTextureUpdater interface is used by the main thread to queue
        texture updates. The CCTextureUpdateController constructor takes a
        CCTextureUpdater and contains the logic required to perform texture
        uploads and texture copies. This class is only used by the impl thread.

        No new tests.

        * WebCore.gypi:
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        (WebCore::ScrollbarLayerChromium::updatePart):
        * platform/graphics/chromium/TextureCopier.cpp:
        (WebCore::AcceleratedTextureCopier::copyTexture):
        * platform/graphics/chromium/TextureCopier.h:
        (Parameters):
        (TextureCopier):
        (AcceleratedTextureCopier):
        * platform/graphics/chromium/TextureUploader.h:
        (Parameters):
        (TextureUploader):
        * platform/graphics/chromium/ThrottledTextureUploader.cpp:
        (WebCore::ThrottledTextureUploader::uploadTexture):
        * platform/graphics/chromium/ThrottledTextureUploader.h:
        (ThrottledTextureUploader):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::updateTiles):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::doCommit):
        * platform/graphics/chromium/cc/CCTextureUpdateController.cpp: Added.
        (WebCore):
        (WebCore::CCTextureUpdateController::maxPartialTextureUpdates):
        (WebCore::CCTextureUpdateController::updateTextures):
        (WebCore::CCTextureUpdateController::CCTextureUpdateController):
        (WebCore::CCTextureUpdateController::~CCTextureUpdateController):
        (WebCore::CCTextureUpdateController::hasMoreUpdates):
        (WebCore::CCTextureUpdateController::updateMoreTextures):
        (WebCore::CCTextureUpdateController::updateMoreTexturesSize):
        * platform/graphics/chromium/cc/CCTextureUpdateController.h: Copied from Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.h.
        (WebCore):
        (CCTextureUpdateController):
        (WebCore::CCTextureUpdateController::create):
        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:
        (WebCore::CCTextureUpdater::appendFullUpload):
        (WebCore::CCTextureUpdater::appendPartialUpload):
        (WebCore::CCTextureUpdater::appendCopy):
        (WebCore::CCTextureUpdater::takeFirstFullUpload):
        (WebCore::CCTextureUpdater::takeFirstPartialUpload):
        (WebCore::CCTextureUpdater::takeFirstCopy):
        (WebCore::CCTextureUpdater::hasMoreUpdates):
        * platform/graphics/chromium/cc/CCTextureUpdater.h:
        (CCTextureUpdater):
        (WebCore::CCTextureUpdater::fullUploadSize):
        (WebCore::CCTextureUpdater::partialUploadSize):
        (WebCore::CCTextureUpdater::copySize):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::scheduledActionBeginFrame):
        (WebCore::CCThreadProxy::beginFrame):
        (WebCore::CCThreadProxy::beginFrameCompleteOnImplThread):
        (WebCore::CCThreadProxy::hasMoreResourceUpdates):
        (WebCore::CCThreadProxy::scheduledActionUpdateMoreResources):
        (WebCore::CCThreadProxy::scheduledActionCommit):
        (WebCore::CCThreadProxy::maxPartialTextureUpdates):
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (WebCore):
        (WebCore::CCThreadProxy::BeginFrameAndCommitState::BeginFrameAndCommitState):
        (BeginFrameAndCommitState):
        (CCThreadProxy):

2012-08-06  Douglas Stockwell  <dstockwell@chromium.org>

        Crash in WebCore::RenderListItem::updateMarkerLocation
        https://bugs.webkit.org/show_bug.cgi?id=90476

        Reviewed by Abhishek Arya.

        In some cases an anonymous block is destroyed when its last child is
        removed. RenderListItem did not expect this and has it's own logic for
        cleaning up such blocks when the list marker is removed. Detect this
        case in RenderBlock::removeChild to defer to the logic in RenderListItem::updateListMarker.

        Test: fast/lists/list-marker-remove-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removeChild):

2012-08-06  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Non-preserves-3d requires explicit flattening of screen-space transform.
        https://bugs.webkit.org/show_bug.cgi?id=85808

        Reviewed by Adrienne Walker.

        When computing the screen-space transforms, z values were not
        being flattened when they should be. This caused incorrect
        clipping due to occlusion tracking that relied on the screen-space
        transform. The fix is to flatten the screen-space transform just
        like the "sublayerMatrix" is flattened, when the layer does not
        preserve-3d.

        In addition to making the simple fix, it was convenient to make a
        helper function for the flattening code.

        Additional unit test added to exercise that flattening code:
          CCLayerTreeHostCommonTest.verifyTransformsForFlatteningLayer

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateDrawTransformsInternal):
        * platform/graphics/chromium/cc/CCMathUtil.cpp:
        (WebCore::CCMathUtil::flattenTransformTo2d):
        (WebCore):
        * platform/graphics/chromium/cc/CCMathUtil.h:
        (CCMathUtil):

2012-08-06  Anna Cavender  <annacc@chromium.org>

        Create a MediaSource object.
        https://bugs.webkit.org/show_bug.cgi?id=91773

        Reviewed by Eric Carlson.

        MediaSource object is needed in order to implement the new
        object-oriented MediaSource API:
        http://dvcs.w3.org/hg/html-media/raw-file/tip/media-source/media-source.html

        No new tests - will be able to test after landing:
        https://bugs.webkit.org/show_bug.cgi?id=91775
 
        Adding new files to build files:
        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:

        New MediaSource object:
        * Modules/mediasource/MediaSource.cpp: Added.
        * Modules/mediasource/MediaSource.h: Added.
        * Modules/mediasource/MediaSource.idl: Added.

        Create a registry for the blob storage and lookup:
        * Modules/mediasource/MediaSourceRegistry.cpp: Added.
        * Modules/mediasource/MediaSourceRegistry.h: Added.

        Connect SourceBuffer to MediaSource:
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::SourceBuffer):
        (WebCore::SourceBuffer::buffered): Forward call to MediaSource.
        (WebCore::SourceBuffer::append): Ditto.
        (WebCore::SourceBuffer::abort): Ditto.
        * Modules/mediasource/SourceBuffer.h:
        (WebCore::SourceBuffer::create): Add a MediaSource to the constructor.
        (WebCore::SourceBuffer::clear): Clear the MediaSource.
        (SourceBuffer):
        * Modules/mediasource/SourceBufferList.cpp: include SourceBuffer.h
        * Modules/mediasource/SourceBufferList.h:
 
        Make MediaSource an EventTarget:
        * dom/EventTarget.h:
        (WebCore):
        * dom/EventTargetFactory.in:

        Enable creation of MediaSource object URL from JavaScript:
        * html/DOMURL.cpp:
        (WebCore):
        (WebCore::DOMURL::createObjectURL):
        * html/DOMURL.h:
        (WebCore):
        (DOMURL):
        * html/DOMURL.idl:

        New MediaSource constructor:
        * page/DOMWindow.idl:

2012-08-06  Andreas Kling  <kling@webkit.org>

        Simplify CSSOM style declaration's grabbing at internals.
        <http://webkit.org/b/93261>

        Reviewed by Antti Koivisto.

        It was already the case that StylePropertySets exposed in CSSOM were guaranteed mutable,
        so remove the mechanism to convert immutable backing objects to mutable ones.

        Made ensureCSSStyleDeclaration() non-const to prevent callers that may have an
        immutable StylePropertySet from wrapping a CSSOM object around it.

        * css/PropertySetCSSStyleDeclaration.h:
        (PropertySetCSSStyleDeclaration):
        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::length):
        (WebCore::PropertySetCSSStyleDeclaration::item):
        (WebCore::PropertySetCSSStyleDeclaration::cssText):
        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValue):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValue):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyPriority):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyShorthand):
        (WebCore::PropertySetCSSStyleDeclaration::isPropertyImplicit):
        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValueInternal):
        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
        (WebCore::PropertySetCSSStyleDeclaration::copy):
        (WebCore::PropertySetCSSStyleDeclaration::makeMutable):
        (WebCore::PropertySetCSSStyleDeclaration::cssPropertyMatches):

            Remove indirection and access StylePropertySet member directly.

        * css/StylePropertySet.h:
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::ensureCSSStyleDeclaration):
        (WebCore::StylePropertySet::ensureInlineCSSStyleDeclaration):

            Made these two non-const. CSSOM wrappers should only ever be constructed around
            mutable StylePropertySets.
            Also added ASSERT(isMutable()).

        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::buildObjectForAttributesStyle):

            Cast away the constness of StyledElement::attributeStyle(). It's not pretty,
            but these objects are guaranteed mutable, and there's an assertion to protect
            us in ensureCSSStyleDeclaration() if something changes in the future.

2012-08-06  Andrei Poenaru  <poenaru@adobe.com>

        Web Inspector: Protocol: Add "namedFlowCreated" and "namedFlowRemoved" events
        https://bugs.webkit.org/show_bug.cgi?id=92739

        Reviewed by Pavel Feldman.

        Implemented "namedFlowCreated" and "namedFlowRemoved" events.

        Modified test: inspector/styles/protocol-css-regions-commands.html.

        * dom/WebKitNamedFlowCollection.cpp:
        (WebCore::WebKitNamedFlowCollection::ensureFlowWithName):
        (WebCore::WebKitNamedFlowCollection::discardNamedFlow):
        * inspector/Inspector.json:
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::reset):
        (WebCore::InspectorCSSAgent::didCreateNamedFlow):
        (WebCore):
        (WebCore::InspectorCSSAgent::didRemoveNamedFlow):
        (WebCore::InspectorCSSAgent::getNamedFlowCollection):
        * inspector/InspectorCSSAgent.h:
        (InspectorCSSAgent):
        * inspector/InspectorInstrumentation.cpp:
        (WebCore):
        (WebCore::InspectorInstrumentation::didCreateNamedFlowImpl):
        (WebCore::InspectorInstrumentation::didRemoveNamedFlowImpl):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        (WebCore::InspectorInstrumentation::didCreateNamedFlow):
        (WebCore):
        (WebCore::InspectorInstrumentation::didRemoveNamedFlow):
        * inspector/front-end/CSSStyleModel.js:
        (WebInspector.CSSStyleModel.prototype._namedFlowCreated.callback):
        (WebInspector.CSSStyleModel.prototype._namedFlowCreated):
        (WebInspector.CSSStyleModel.prototype._namedFlowRemoved.callback):
        (WebInspector.CSSStyleModel.prototype._namedFlowRemoved):
        (WebInspector.CSSDispatcher.prototype.styleSheetChanged):
        (WebInspector.CSSDispatcher.prototype.namedFlowCreated):
        (WebInspector.CSSDispatcher.prototype.namedFlowRemoved):

2012-08-06  Abhishek Arya  <inferno@chromium.org>

        Crash in FrameLoader::stopAllLoaders.
        https://bugs.webkit.org/show_bug.cgi?id=90805

        Reviewed by Nate Chapin.

        Calling m_provisionalDocumentLoader->stopLoading() can blow away the frame
        from underneath. Protect it with a RefPtr.

        No new tests. We don't have a reliable testcase to reproduce this. However,
        the crash and free stack from ClusterFuzz point clearly at the bug.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::stopAllLoaders):

2012-08-06  Hironori Bono  <hbono@chromium.org>

        Rolling out my r123067 and r123572
        https://bugs.webkit.org/show_bug.cgi?id=93234

        Reviewed by Ryosuke Niwa.

        This change manually rolls out my r123067 and r123572 (except layout tests)
        because it renders RTL text to a wrong place when an RTL element shows a
        vertical scrollbar at its left side.

        No new tests because this change rolls out my changes.

        * dom/Element.cpp:
        (WebCore::Element::clientLeft):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::addOverflowFromPositionedObjects):
        (WebCore::RenderBlock::determineLogicalLeftPositionForChild):
        (WebCore::RenderBlock::paintObject):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::topLeftLocationOffset):

2012-08-06  Andrei Bucur  <abucur@adobe.com>

        [CSS Regions] Add the NamedFlow.getRegions() API
        https://bugs.webkit.org/show_bug.cgi?id=93240

        Reviewed by Andreas Kling.

        This patch adds the NamedFlow.getRegions() API call as specified by http://www.w3.org/TR/2012/WD-css3-regions-20120503/#dom-named-flow .
        For now, WebKit supports only one type of regions, Element. The Region interface will be introduced when other interfaces will be capable
        of becoming regions.

        New test: fast/regions/webkit-named-flow-get-regions.html

        * dom/WebKitNamedFlow.cpp:
        (WebCore::WebKitNamedFlow::getRegionsByContent): Add a check not to include the pseudo-elements that are regions; those don't have a node attached.
        (WebCore::WebKitNamedFlow::getRegions):
        (WebCore):
        * dom/WebKitNamedFlow.h:
        (WebKitNamedFlow):
        * dom/WebKitNamedFlow.idl:

2012-08-06  Andrei Bucur  <abucur@adobe.com>

        [CSS Regions] Rename regionOverflow to regionOverset
        https://bugs.webkit.org/show_bug.cgi?id=93256

        Reviewed by Andreas Kling.

        Link to spec: http://www.w3.org/TR/2012/WD-css3-regions-20120503/#dom-region-regionoverset
        The regionOverflow property has been renamed to regionOverset in the latest working draft. This patch applies the change both externally and
        internally in the code.

        Tests: No new tests because this is not a functional change.

        * dom/Element.cpp:
        (WebCore::Element::renderRegion): Convenience method to access the renderer for a region element.
        (WebCore):
        (WebCore::Element::webkitRegionOverset):
        * dom/Element.h:
        (WebCore):
        * dom/Element.idl:
        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::paintIntoRegion):
        (WebCore::RenderFlowThread::hitTestRegion):
        (WebCore::RenderFlowThread::repaintRectangleInRegions):
        (WebCore::RenderFlowThread::computeOverflowStateForRegions):
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::regionOversetRect):
        * rendering/RenderRegion.h:
        (RenderRegion):

2012-08-06  Sergey Rogulenko  <rogulenko@google.com>

        Web Inspector: a tiny refactoring of Highlighter in InspectorDOMAgent
        https://bugs.webkit.org/show_bug.cgi?id=93257

        Reviewed by Pavel Feldman.

        Moving error string setting inside highlightConfigFromInspectorObject.

        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::setSearchingForNode):
        (WebCore::InspectorDOMAgent::highlightConfigFromInspectorObject):
        (WebCore::InspectorDOMAgent::highlightNode):
        * inspector/InspectorDOMAgent.h:
        (InspectorDOMAgent):

2012-08-03  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add memory instrumentation for CSSValue and its descendants
        https://bugs.webkit.org/show_bug.cgi?id=93130

        Reviewed by Pavel Feldman.

        Added memory footprint reporting routine to CSSValue and its descendants.

        Memory reporing for CSSValue is organized in a following way:
        - CSSValue implements reportMemoryUsage method that switches by the value
          type and calls reportDescendantMemoryUsage on the concrete type
        - There may be some intermediate classes in the inheritance chain between
          CSSValue and the leaf class implementing reportDescendantMemoryUsage. Those
          intermediate classes implement reportBaseClassMemoryUsage method that can
          be called from a descendant to collect memory information for the base class
          members. Having reportDescendantMemoryUsage only on the leaf classes prevents
          us from accidentally adding the intermediate classes to the switch block
          in the CSSValue::reportMemoryUsage.

        * css/CSSAspectRatioValue.cpp:
        (WebCore::CSSAspectRatioValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSAspectRatioValue.h:
        (CSSAspectRatioValue):
        * css/CSSBorderImageSliceValue.cpp:
        (WebCore::CSSBorderImageSliceValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSBorderImageSliceValue.h:
        (CSSBorderImageSliceValue):
        * css/CSSCalculationValue.cpp:
        (WebCore):
        (WebCore::CSSCalcValue::reportDescendantMemoryUsage):
        (CSSCalcPrimitiveValue):
        * css/CSSCalculationValue.h:
        (CSSCalcExpressionNode):
        (CSSCalcValue):
        * css/CSSCanvasValue.cpp:
        (WebCore::CSSCanvasValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSCanvasValue.h:
        (CSSCanvasValue):
        * css/CSSCrossfadeValue.cpp:
        (WebCore::CSSCrossfadeValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSCrossfadeValue.h:
        (CSSCrossfadeValue):
        * css/CSSCursorImageValue.cpp:
        (WebCore::CSSCursorImageValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSCursorImageValue.h:
        (CSSCursorImageValue):
        * css/CSSFontFaceSrcValue.cpp:
        (WebCore::CSSFontFaceSrcValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSFontFaceSrcValue.h:
        (CSSFontFaceSrcValue):
        * css/CSSFunctionValue.cpp:
        (WebCore::CSSFunctionValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSFunctionValue.h:
        (CSSFunctionValue):
        * css/CSSGradientValue.cpp:
        (WebCore::CSSGradientColorStop::reportMemoryUsage):
        (WebCore):
        (WebCore::CSSGradientValue::reportBaseClassMemoryUsage):
        (WebCore::CSSLinearGradientValue::reportDescendantMemoryUsage):
        (WebCore::CSSRadialGradientValue::reportDescendantMemoryUsage):
        * css/CSSGradientValue.h:
        (CSSGradientColorStop):
        (CSSGradientValue):
        (CSSLinearGradientValue):
        (CSSRadialGradientValue):
        * css/CSSImageGeneratorValue.cpp:
        (WebCore::CSSImageGeneratorValue::reportBaseClassMemoryUsage):
        (WebCore):
        * css/CSSImageGeneratorValue.h:
        (CSSImageGeneratorValue):
        * css/CSSImageSetValue.cpp:
        (WebCore::CSSImageSetValue::reportDescendantMemoryUsage):
        (WebCore):
        (WebCore::CSSImageSetValue::ImageWithScale::reportMemoryUsage):
        * css/CSSImageSetValue.h:
        (ImageWithScale):
        (CSSImageSetValue):
        * css/CSSImageValue.cpp:
        (WebCore::CSSImageValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSImageValue.h:
        (CSSImageValue):
        * css/CSSInheritedValue.cpp:
        (WebCore::CSSInheritedValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSInheritedValue.h:
        (CSSInheritedValue):
        * css/CSSInitialValue.cpp:
        (WebCore::CSSInitialValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSInitialValue.h:
        (CSSInitialValue):
        * css/CSSLineBoxContainValue.cpp:
        (WebCore::CSSLineBoxContainValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSLineBoxContainValue.h:
        (CSSLineBoxContainValue):
        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSPrimitiveValue.h:
        (CSSPrimitiveValue):
        * css/CSSReflectValue.cpp:
        (WebCore::CSSReflectValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSReflectValue.h:
        (CSSReflectValue):
        * css/CSSTimingFunctionValue.cpp:
        (WebCore::CSSLinearTimingFunctionValue::reportDescendantMemoryUsage):
        (WebCore):
        (WebCore::CSSCubicBezierTimingFunctionValue::reportDescendantMemoryUsage):
        (WebCore::CSSStepsTimingFunctionValue::reportDescendantMemoryUsage):
        * css/CSSTimingFunctionValue.h:
        (CSSLinearTimingFunctionValue):
        (CSSCubicBezierTimingFunctionValue):
        (CSSStepsTimingFunctionValue):
        * css/CSSUnicodeRangeValue.cpp:
        (WebCore::CSSUnicodeRangeValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSUnicodeRangeValue.h:
        (CSSUnicodeRangeValue):
        * css/CSSValue.cpp:
        (WebCore::TextCloneCSSValue::reportDescendantMemoryUsage):
        (TextCloneCSSValue):
        (WebCore::CSSValue::reportMemoryUsage):
        (WebCore):
        * css/CSSValue.h:
        (WebCore):
        (CSSValue):
        * css/CSSValueList.cpp:
        (WebCore::CSSValueList::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSValueList.h:
        (CSSValueList):
        * css/CSSVariableValue.h:
        (WebCore::CSSVariableValue::reportDescendantMemoryUsage):
        (CSSVariableValue):
        * css/FontFeatureValue.cpp:
        (WebCore::FontFeatureValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/FontFeatureValue.h:
        (FontFeatureValue):
        * css/FontValue.cpp:
        (WebCore::FontValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/FontValue.h:
        (FontValue):
        * css/MediaQueryExp.cpp:
        (WebCore::MediaQueryExp::reportMemoryUsage):
        * css/ShadowValue.cpp:
        (WebCore::ShadowValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/ShadowValue.h:
        (ShadowValue):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/WebKitCSSFilterValue.cpp:
        (WebCore::WebKitCSSFilterValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/WebKitCSSFilterValue.h:
        (WebKitCSSFilterValue):
        * css/WebKitCSSSVGDocumentValue.cpp:
        (WebCore::WebKitCSSSVGDocumentValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/WebKitCSSSVGDocumentValue.h:
        (WebKitCSSSVGDocumentValue):
        * css/WebKitCSSShaderValue.cpp:
        (WebCore::WebKitCSSShaderValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/WebKitCSSShaderValue.h:
        (WebKitCSSShaderValue):
        * css/WebKitCSSTransformValue.cpp:
        (WebCore::WebKitCSSTransformValue::reportDescendantMemoryUsage):
        (WebCore):
        * css/WebKitCSSTransformValue.h:
        (WebKitCSSTransformValue):
        * dom/MemoryInstrumentation.cpp:
        (WebCore::MemoryInstrumentation::addString):
        (WebCore):
        * dom/MemoryInstrumentation.h:
        (MemoryInstrumentation):
        (WebCore::MemoryClassInfo::addHashCountedSet):
        (WebCore::MemoryClassInfo::addMember):
        * svg/SVGColor.cpp:
        (WebCore::SVGColor::reportDescendantMemoryUsage):
        (WebCore):
        * svg/SVGColor.h:
        (SVGColor):
        * svg/SVGPaint.cpp:
        (WebCore::SVGPaint::reportDescendantMemoryUsage):
        (WebCore):
        * svg/SVGPaint.h:
        (SVGPaint):

2012-08-06  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: rename WorkerAgent.setWorkerInspectionEnabled to WorkerAgent.enable and make it return error
        https://bugs.webkit.org/show_bug.cgi?id=92545

        Reviewed by Pavel Feldman.

        - Replaced WorkerAgent.setWorkerInspectionEnabled with WorkerAgent.enable/disable
        - Replaced Preferences.exposeWorkersInspection with InspectorFrontendHost.canInspectWorkers()
          that tells if inspector front-end on the given platform can launch dedicated worker
          front-end.

        * inspector/Inspector.json:
        * inspector/InspectorFrontendClient.h:
        (InspectorFrontendClient):
        * inspector/InspectorFrontendClientLocal.h:
        (WebCore::InspectorFrontendClientLocal::canInspectWorkers):
        * inspector/InspectorFrontendHost.cpp:
        (WebCore::InspectorFrontendHost::canInspectWorkers):
        (WebCore):
        * inspector/InspectorFrontendHost.h:
        (InspectorFrontendHost):
        * inspector/InspectorFrontendHost.idl:
        * inspector/InspectorWorkerAgent.cpp:
        (WebCore::InspectorWorkerAgent::enable):
        (WebCore):
        (WebCore::InspectorWorkerAgent::disable):
        * inspector/InspectorWorkerAgent.h:
        (InspectorWorkerAgent):
        * inspector/front-end/InspectorFrontendHostStub.js:
        (.WebInspector.InspectorFrontendHostStub.prototype.setZoomFactor):
        (.WebInspector.InspectorFrontendHostStub.prototype.canInspectWorkers):
        * inspector/front-end/ScriptsPanel.js:
        * inspector/front-end/Settings.js:

2012-08-06  Mario Sanchez Prada  <msanchez@igalia.com>

        [WK2][GTK] Improvements for the new spell-checking API
        https://bugs.webkit.org/show_bug.cgi?id=93262

        Reviewed by Carlos Garcia Campos.

        Provide a way to ask TextCheckerEnchant helper class for the list
        of languages currently available for the spell checking feature.

        * platform/text/gtk/TextCheckerEnchant.cpp:
        (enchantDictDescribeCallback): Renamed from
        getAvailableDictionariesCallback, for consistency.
        (TextCheckerEnchant::updateSpellCheckingLanguages): Updated usage
        of getAvailableDictionariesCallback to enchantDictDescribeCallback.
        (TextCheckerEnchant::getSpellCheckingLanguages): New. Will build
        and return a String with a comma-separated list of languages
        currently in use by the spell checking feature.
        * platform/text/gtk/TextCheckerEnchant.h:
        (TextCheckerEnchant): Added new function getSpellCheckingLanguages.

2012-08-06  Andreas Kling  <kling@webkit.org>

        Pass presentational attribute StylePropertySets by const pointer where possible.
        <http://webkit.org/b/93187>

        Reviewed by Antti Koivisto.

        Minor cleanup to enforce (at compile time) the fact that no methods that have the
        side-effect of incurring immutable-to-mutable-StylePropertySet conversion.

        This was already covered by assertions, we're just making it stricter and adding
        some documentational flavor.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::addElementStyleProperties):
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleResolver.h:
        (StyleResolver):
        * dom/ElementAttributeData.h:
        (WebCore::ElementAttributeData::attributeStyle):
        * dom/StyledElement.h:
        (WebCore::StyledElement::additionalAttributeStyle):
        (StyledElement):
        (WebCore::StyledElement::attributeStyle):
        * html/HTMLTableCellElement.cpp:
        (WebCore::HTMLTableCellElement::additionalAttributeStyle):
        * html/HTMLTableCellElement.h:
        (HTMLTableCellElement):
        * html/HTMLTableColElement.cpp:
        (WebCore::HTMLTableColElement::additionalAttributeStyle):
        * html/HTMLTableColElement.h:
        (HTMLTableColElement):
        * html/HTMLTableElement.cpp:
        (WebCore::HTMLTableElement::additionalAttributeStyle):
        (WebCore::HTMLTableElement::additionalCellStyle):
        (WebCore::HTMLTableElement::additionalGroupStyle):
        * html/HTMLTableElement.h:
        (HTMLTableElement):
        * html/HTMLTableSectionElement.cpp:
        (WebCore::HTMLTableSectionElement::additionalAttributeStyle):
        * html/HTMLTableSectionElement.h:
        (HTMLTableSectionElement):
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::buildObjectForAttributesStyle):

2012-08-06  Kihong Kwon  <kihong.kwon@samsung.com>

        Add DeviceProximityEvent interface
        https://bugs.webkit.org/show_bug.cgi?id=92942

        Reviewed by Kentaro Hara.

        Spec : http://www.w3.org/TR/proximity/#idl-def-DeviceProximityEvent

        Add DeviceProximityEvent interface of Proximity Events.
        And add onwebkitdeviceproximity event handler to the DOMWindow.

        Tests: fast/dom/Proximity/check-event-deviceproximity.html
               fast/dom/Proximity/create-event-deviceproximity.html
               fast/events/constructors/device-proximity-event-constructor.html

        * CMakeLists.txt:
        * Modules/proximity/DeviceProximityEvent.cpp: Added.
        (WebCore):
        (WebCore::DeviceProximityEvent::DeviceProximityEvent):
        * Modules/proximity/DeviceProximityEvent.h: Added.
        (WebCore):
        (WebCore::DeviceProximityEventInit::DeviceProximityEventInit):
        (DeviceProximityEventInit):
        (DeviceProximityEvent):
        (WebCore::DeviceProximityEvent::~DeviceProximityEvent):
        (WebCore::DeviceProximityEvent::create):
        (WebCore::DeviceProximityEvent::value):
        (WebCore::DeviceProximityEvent::min):
        (WebCore::DeviceProximityEvent::max):
        (WebCore::DeviceProximityEvent::interfaceName):
        * Modules/proximity/DeviceProximityEvent.idl: Added.
        * dom/EventNames.h:
        (WebCore):
        * dom/EventNames.in:
        * page/DOMWindow.h:
        (DOMWindow):
        * page/DOMWindow.idl:

2012-08-06  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix make distcheck.

        * GNUmakefile.list.am: Remove unexistent header file.

2012-08-06  Vineet Chaudhary  <rgf748@motorola.com>

        [JSC] Remove custom JSBindings for constructArrayBufferView()
        https://bugs.webkit.org/show_bug.cgi?id=93097

        Reviewed by Kentaro Hara.

        Currently TypedArray files have the custom implementation of constructArrayBufferView().
        We can can remove these modifying CodeGeneratorJS.pm

        Tests: TestTypedArray.idl

        * bindings/js/JSFloat32ArrayCustom.cpp: Removed custom call constructArrayBufferView().
        * bindings/js/JSFloat64ArrayCustom.cpp: Ditto.
        * bindings/js/JSInt16ArrayCustom.cpp: Ditto.
        * bindings/js/JSInt32ArrayCustom.cpp: Ditto.
        * bindings/js/JSUint16ArrayCustom.cpp: Ditto.
        * bindings/js/JSUint32ArrayCustom.cpp: Ditto.
        * bindings/scripts/CodeGeneratorJS.pm: Modified Generator code to generate bindings for
        constructArrayBufferView()
        (GenerateConstructorDefinition):
        * bindings/scripts/IDLAttributes.txt: Added [TypedArray] attribute.
        * bindings/scripts/test/JS/JSFloat64Array.cpp: Tests result.
        (WebCore::JSFloat64ArrayConstructor::getConstructData):
        (WebCore::JSFloat64ArrayConstructor::constructJSFloat64Array):
        * bindings/scripts/test/TestTypedArray.idl: Test.
        * html/canvas/Float32Array.idl: Using [TypedArray].
        * html/canvas/Float64Array.idl: Ditto.
        * html/canvas/Int16Array.idl: Ditto.
        * html/canvas/Int32Array.idl: Ditto.
        * html/canvas/Uint16Array.idl: Ditto.
        * html/canvas/Uint32Array.idl: Ditto.

2012-08-06  Shinya Kawanaka  <shinyak@chromium.org>

        AuthorShadowDOM for progress element
        https://bugs.webkit.org/show_bug.cgi?id=91969

        Reviewed by Hajime Morita.

        We add support for AuthorShadowDOM for progress element.

        According to the Shadow DOM spec, a progress element should behave like having a UserAgentShadowRoot and
        an element in UserAgentShadowRoot draws a real 'progress' bar. In this patch, we change the inner structure
        of a progress element so that we can distribute an element having RenderProgress to AuthorShadowDOM.

        Before this patch, a progress element has the following inner structure.

            <progress>--UserAgentShadowRoot -- -- -- -- -- -- -- -- -- -- AuthorShadowRoot
                               |
                               +-- ProgressBarElement
                               |
                               +-- ProgressValueElement

        After this patch, a progress element will have the following inner structure.

            <progress>--UserAgentShadowRoot -- -- -- -- -- -- -- -- -- -- AuthorShadowRoot
                               |
                               +-- ProgressInnerElement
                                           |
                                           +-- ProgressBarElement
                                           |
                                           +-- ProgressValueElement


        Tests: fast/dom/shadow/shadowdom-for-progress-dynamic.html
               fast/dom/shadow/shadowdom-for-progress-multiple.html
               fast/dom/shadow/shadowdom-for-progress-with-style.html
               fast/dom/shadow/shadowdom-for-progress-without-appearance.html
               fast/dom/shadow/shadowdom-for-progress-without-shadow-element.html
               fast/dom/shadow/shadowdom-for-progress.html

        * css/html.css:
        (progress::-webkit-progress-inner-element):
        * html/HTMLProgressElement.cpp:
        (WebCore::HTMLProgressElement::HTMLProgressElement):
        (WebCore::HTMLProgressElement::createRenderer):
        (WebCore::HTMLProgressElement::renderProgress): Returns RenderProgress gotten from UserAgentShadowDOM.
        (WebCore):
        (WebCore::HTMLProgressElement::willAddAuthorShadowRoot):
        (WebCore::HTMLProgressElement::didElementStateChange):
        (WebCore::HTMLProgressElement::createShadowSubtree): Creates a new Shadow DOM structure.
        * html/HTMLProgressElement.h:
        (WebCore):
        (WebCore::HTMLProgressElement::hasAuthorShadowRoot):
        (HTMLProgressElement):
        (WebCore::isHTMLProgressElement):
        (WebCore::toHTMLProgressElement):
        * html/shadow/ProgressShadowElement.cpp:
        (WebCore::ProgressShadowElement::ProgressShadowElement):
        (WebCore::ProgressShadowElement::progressElement):
        (WebCore::ProgressInnerElement::ProgressInnerElement): We introduce a new element having RenderProgress
        so that we can distribute an element having RenderProgress to AuthorShadowDOM.
        (WebCore):
        (WebCore::ProgressInnerElement::create):
        (WebCore::ProgressInnerElement::shadowPseudoId):
        (WebCore::ProgressInnerElement::createRenderer):
        (WebCore::ProgressInnerElement::rendererIsNeeded):
        * html/shadow/ProgressShadowElement.h:
        (ProgressShadowElement):
        (WebCore):
        (ProgressInnerElement):
        * rendering/RenderProgress.cpp:
        (WebCore::RenderProgress::RenderProgress):
        (WebCore::RenderProgress::progressElement):
        * rendering/RenderProgress.h:
        (RenderProgress):

2012-08-06  Keishi Hattori  <keishi@webkit.org>

        Remove minimum window size for PagePopup
        https://bugs.webkit.org/show_bug.cgi?id=93100

        Reviewed by Kent Tamura.

        DOMWindow had a minimum size of 100x100 pixels. We need to remove that limit for PagePopup window.

        No new tests. Covered in platform/chromium/fast/forms/color/color-suggestion-picker-{one,two}-row-appearance.html.

        * Resources/colorSuggestionPicker.css:
        (.color-swatch-container):
        * page/ChromeClient.h:
        (WebCore::ChromeClient::minimumWindowSize):
        (ChromeClient):
        * page/DOMWindow.cpp:
        (WebCore):
        (WebCore::DOMWindow::adjustWindowRect): Asks Chrome::minimumWindowSize for minimum window size.
        * page/DOMWindow.h:
        (DOMWindow):

2012-08-06  Arko Saha  <arko@motorola.com>

        Microdata: document.getItems() must treat no token as no parameter.
        https://bugs.webkit.org/show_bug.cgi?id=93071

        Reviewed by Ryosuke Niwa.

        document.getItems() must return all top-level microdata items in the
        document when no tokens specified in the argument.
        Spec: http://www.whatwg.org/specs/web-apps/current-work/multipage/microdata.html#dom-document-getitems

        Test: fast/dom/MicroData/getitems-empty-string-as-arg.html

        * dom/Document.cpp:
        (WebCore::Document::getItems): Create an empty string identifier when typeNames is null string
        to map such request in the cache.
        * dom/MicroDataItemList.cpp:
        (WebCore::MicroDataItemList::undefinedItemType): Changed undefinedItemType() to empty string.
        (WebCore::MicroDataItemList::nodeMatches): Return true if m_typeNames contains no token.

2012-08-06  Sergey Rogulenko  <rogulenko@google.com>

        Web Inspector: extracting HighlightInfo from HighlightData in DOMNodeHighlighter
        https://bugs.webkit.org/show_bug.cgi?id=91632

        Reviewed by Pavel Feldman.

        Extracted struct HighlightInfo from struct HighlightData in DOMNodeHighlighter.
        Now InspectorOverlay receives node or rect to highlight together with highlightInfo.

        * inspector/DOMNodeHighlighter.cpp:
        (WebCore::InspectorOverlay::paint):
        (WebCore::InspectorOverlay::getHighlight):
        (WebCore::InspectorOverlay::hideHighlight):
        (WebCore::InspectorOverlay::highlightNode):
        (WebCore::InspectorOverlay::highlightRect):
        (WebCore::InspectorOverlay::highlightedNode):
        (WebCore::InspectorOverlay::update):
        (WebCore::InspectorOverlay::drawNodeHighlight):
        (WebCore):
        (WebCore::InspectorOverlay::drawRectHighlight):
        (WebCore::InspectorOverlay::drawPausedInDebugger):
        * inspector/DOMNodeHighlighter.h:
        (HighlightConfig):
        (WebCore::Highlight::setColors):
        (Highlight):
        (InspectorOverlay):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::clearFrontend):
        (WebCore::InspectorDOMAgent::inspect):
        (WebCore::InspectorDOMAgent::mouseDidMoveOverElement):
        (WebCore::InspectorDOMAgent::setSearchingForNode):
        (WebCore::InspectorDOMAgent::highlightConfigFromInspectorObject):
        (WebCore::InspectorDOMAgent::setInspectModeEnabled):
        (WebCore::InspectorDOMAgent::highlightRect):
        (WebCore::InspectorDOMAgent::highlightNode):
        (WebCore::InspectorDOMAgent::highlightFrame):
        * inspector/InspectorDOMAgent.h:
        (WebCore):
        (InspectorDOMAgent):

2012-08-06  Ilya Tikhonovsky  <loislo@chromium.org>

        Unreviewed: Web Inspector: single line test fix for r124744.

        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::reportMemoryUsage):

2012-08-06  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124739.
        http://trac.webkit.org/changeset/124739
        https://bugs.webkit.org/show_bug.cgi?id=93241

        newly added test crash on chromium linux debug (Requested by
        toyoshim on #webkit).

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removeChild):

2012-08-06  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Fix layoutMod in fractional layout units.
        https://bugs.webkit.org/show_bug.cgi?id=92374

        Reviewed by Levi Weintraub.

        The modulo operation is upgraded from only being performed in integer to 
        being performed in fractionalLayoutUnits, so that it returns an accurate
        remainder for fractionalLayoutUnit division.

        An alternative modulo operation is added and used to find the remainder
        after division with natural integer results, for instance, the remainding
        height after pagination.

        No new functionality. No new tests.

        * platform/FractionalLayoutUnit.h:
        (WebCore::intMod):
        (WebCore::operator%):
        * rendering/LayoutTypes.h:
        (WebCore::layoutMod):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::pageRemainingLogicalHeightForOffset):
        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::regionRemainingLogicalHeightForLine):

2012-08-06  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: native memory instrumentation: cover MemoryCache with MemoryInstrumentation
        https://bugs.webkit.org/show_bug.cgi?id=91734

        Reviewed by Yury Semikhatsky.

        Old version of native memory instrumentation doesn't mark the memory cache objects as visited.
        As a result MI could count the same objects multiple times.
        The new version just traverses through MemoryCache the same way as through DOM.
        Also not all the cached resource types were counted.

        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        * dom/MemoryInstrumentation.h:
        * inspector/InspectorMemoryAgent.cpp:
        (MemoryBlockName):
        (WebCore):
        (WebCore::collectDomTreeInfo):
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::reportMemoryUsage):
        (WebCore):
        * loader/cache/CachedCSSStyleSheet.h:
        (WebCore):
        (CachedCSSStyleSheet):
        * loader/cache/CachedFont.cpp:
        (WebCore::CachedFont::reportMemoryUsage):
        (WebCore):
        * loader/cache/CachedFont.h:
        (CachedFont):
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::reportMemoryUsage):
        (WebCore):
        * loader/cache/CachedImage.h:
        (CachedImage):
        * loader/cache/CachedRawResource.cpp:
        (WebCore::CachedRawResource::reportMemoryUsage):
        (WebCore):
        * loader/cache/CachedRawResource.h:
        (WebCore):
        (CachedRawResource):
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::reportMemoryUsage):
        (WebCore):
        * loader/cache/CachedResource.h:
        (WebCore):
        (CachedResource):
        * loader/cache/CachedResourceHandle.cpp:
        (WebCore::CachedResourceHandleBase::reportMemoryUsage):
        (WebCore):
        * loader/cache/CachedResourceHandle.h:
        (WebCore):
        (CachedResourceHandleBase):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore):
        (WebCore::CachedResourceLoader::reportMemoryUsage):
        * loader/cache/CachedResourceLoader.h:
        (WebCore):
        (CachedResourceLoader):
        * loader/cache/CachedSVGDocument.cpp:
        (WebCore::CachedSVGDocument::reportMemoryUsage):
        (WebCore):
        * loader/cache/CachedSVGDocument.h:
        (CachedSVGDocument):
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::reportMemoryUsage):
        (WebCore):
        * loader/cache/CachedScript.h:
        (WebCore):
        (CachedScript):
        * loader/cache/CachedShader.cpp:
        (WebCore::CachedShader::reportMemoryUsage):
        (WebCore):
        * loader/cache/CachedShader.h:
        (WebCore):
        (CachedShader):
        * loader/cache/CachedXSLStyleSheet.cpp:
        (WebCore::CachedXSLStyleSheet::reportMemoryUsage):
        (WebCore):
        * loader/cache/CachedXSLStyleSheet.h:
        (WebCore):
        (CachedXSLStyleSheet):
        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::reportMemoryUsage):
        (WebCore):
        * loader/cache/MemoryCache.h:
        (WebCore):
        (MemoryCache):
        * platform/PurgeableBuffer.h:
        (WebCore):
        (PurgeableBuffer):

2012-08-06  Douglas Stockwell  <dstockwell@chromium.org>

        Crash in WebCore::RenderListItem::updateMarkerLocation
        https://bugs.webkit.org/show_bug.cgi?id=90476

        Reviewed by Abhishek Arya.

        In some cases an anonymous block is destroyed when its last child is
        removed. RenderListItem did not expect this and has it's own logic for
        cleaning up such blocks when the list marker is removed. Detect this
        case in RenderBlock::removeChild to defer to the logic in RenderListItem::updateListMarker.

        Test: fast/lists/list-marker-remove-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removeChild):

2012-08-06  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: NMI: replace addString with addMember overload function.
        https://bugs.webkit.org/show_bug.cgi?id=93201

        Reviewed by Yury Semikhatsky.

        It is impossible to implement nice instrumentation for template containers
        content when we have different function names for different types.

        Drive by: fix the most annoing warning in Element.h detected by our clang plugin.

        * css/CSSCharsetRule.cpp:
        (WebCore::CSSCharsetRule::reportDescendantMemoryUsage):
        * css/CSSStyleSheet.cpp:
        (WebCore::CSSStyleSheet::reportMemoryUsage):
        * css/MediaQuery.cpp:
        (WebCore::MediaQuery::reportMemoryUsage):
        * css/MediaQueryExp.cpp:
        (WebCore::MediaQueryExp::reportMemoryUsage):
        * css/StyleRuleImport.cpp:
        (WebCore::StyleRuleImport::reportDescendantMemoryUsage):
        * css/StyleSheetContents.cpp:
        (WebCore::StyleSheetContents::reportMemoryUsage):
        * css/WebKitCSSKeyframeRule.cpp:
        (WebCore::StyleKeyframe::reportMemoryUsage):
        * css/WebKitCSSKeyframesRule.cpp:
        (WebCore::StyleRuleKeyframes::reportDescendantMemoryUsage):
        * dom/CharacterData.cpp:
        (WebCore::CharacterData::reportMemoryUsage):
        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        * dom/Element.h:
        (WebCore::Element::reportMemoryUsage):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::reportMemoryUsage):
        * dom/MemoryInstrumentation.cpp:
        (WebCore::MemoryInstrumentation::addObject):
        * dom/MemoryInstrumentation.h:
        (MemoryInstrumentation):
        (WebCore::MemoryClassInfo::addMember):
        * dom/QualifiedName.h:
        (WebCore::QualifiedName::QualifiedNameImpl::reportMemoryUsage):
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::reportMemoryUsage):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::reportMemoryUsage):
        * rendering/style/StyleRareInheritedData.cpp:
        (WebCore::StyleRareInheritedData::reportMemoryUsage):
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::reportMemoryUsage):

2012-08-05  Kent Tamura  <tkent@chromium.org>

        [Chromium-win] Use system locale for number representation
        https://bugs.webkit.org/show_bug.cgi?id=93085

        Reviewed by Hajime Morita.

        We have used LocaleICU for number localization (presentation of <input
        type=number>) even on Windows. This patch introduces number localization
        feature with Windows API to LocaleWin, and we stop using LocaleICU on
        Windows.

        Tests: Add new test cases to WebKit/chromium/tests/LocaleWinTest.cpp.

        * WebCore.gyp/WebCore.gyp:
        - Stop using LocaleICU.{cpp,h} and LocalizedNumberICU.cpp.
        - Add LocalizedNumberWin.cpp.
        * platform/text/LocaleWin.cpp:
        (WebCore::LocaleWin::LocaleWin):
         - Initialize m_didInitializeNumberData.
         - Use getLocaleInfo() to obtain LOCALE_IFIRSTDAYOFWEEK.
        (WebCore::LocaleWin::getLocaleInfo):
        Added. A helper to obtain integer locale value.
        (WebCore::LocaleWin::initializeNumberLocalizerData):
        Added. Prepare data for number localization, and pass it to NumberLocalizer.
        * platform/text/LocaleWin.h:
        (LocaleWin): Inherit NumberLocalizer, and declare some new members.
        * platform/text/win/LocalizedNumberWin.cpp: Added.
        (WebCore::convertToLocalizedNumber):
        Forward to the corresponding function of LocaleWin.
        (WebCore::convertFromLocalizedNumber): ditto.
        (WebCore::localizedDecimalSeparator): ditto.

2012-08-05  Philip Rogers  <pdr@google.com>

        Fix assertion during detach of SVG wrappers without baseVal
        https://bugs.webkit.org/show_bug.cgi?id=93063

        Reviewed by Nikolas Zimmermann.

        r131583 introduced a change where SVGAnimatedListPropertyTearOff required
        a baseVal to be set before detaching wrappers. This caused an assertion
        to be hit if no baseVal was set.
        This patch changes this behavior so that wrappers are detached even if
        no baseVal is set.

        Test: svg/animations/dynamic-modify-transform-without-baseval.html

        * svg/properties/SVGAnimatedListPropertyTearOff.h:
        (WebCore::SVGAnimatedListPropertyTearOff::detachListWrappers):
        * svg/properties/SVGListProperty.h:
        (WebCore::SVGListProperty::detachListWrappersAndResize): Extracted this static method for detaching wrappers without needing an SVGListProperty.
        (SVGListProperty):
        (WebCore::SVGListProperty::detachListWrappers):

2012-08-05  Kihong Kwon  <kihong.kwon@samsung.com>

        Remove DeviceMotionEvent.h and DeviceOrientationEvent.h from Document.cpp
        https://bugs.webkit.org/show_bug.cgi?id=93224

        Reviewed by Kentaro Hara.

        Need to remove DeviceMotionEvent.h and DeviceOrientationEvent.h from Document.cpp.
        They are not used anymore in that file.

        No new tests. No change in behavior.

        * dom/Document.cpp:

2012-08-05  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        [CMAKE] Move media source files from #ifdef ENABLE(MEDIA_SOURCE) to existing file list
        https://bugs.webkit.org/show_bug.cgi?id=93219

        Reviewed by Hajime Morita.

        r122688 removed duplicating #ifdef guards from CMakeLists.txt. But, ENABLE_MEDIA_SOURCE is added to
        CMakeList using duplicating #ifdef again.

        No new tests. No change in behavior.

        * CMakeLists.txt:

2012-08-05  Peter Wang  <peter.wang@torchmobile.com.cn>

        Web Inspector: [JSC] implement setting breakpoints by line:column
        https://bugs.webkit.org/show_bug.cgi?id=53003

        Reviewed by Geoffrey Garen.

        Since JSC can provide column info now, ScriptDebugServer can use it to support "Pretty Print"
        debug mode. The related interfaces derived from JSC::Debugger was added a parameter. 

        No new tests for this patch.

        * bindings/js/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::setBreakpoint):
        (WebCore::ScriptDebugServer::removeBreakpoint):
        (WebCore):
        (WebCore::ScriptDebugServer::updateCurrentStatementPosition):
        (WebCore::ScriptDebugServer::hasBreakpoint):
        (WebCore::ScriptDebugServer::createCallFrameAndPauseIfNeeded):
        (WebCore::ScriptDebugServer::updateCallFrameAndPauseIfNeeded):
        (WebCore::ScriptDebugServer::callEvent):
        (WebCore::ScriptDebugServer::atStatement):
        (WebCore::ScriptDebugServer::returnEvent):
        (WebCore::ScriptDebugServer::exception):
        (WebCore::ScriptDebugServer::willExecuteProgram):
        (WebCore::ScriptDebugServer::didExecuteProgram):
        (WebCore::ScriptDebugServer::didReachBreakpoint):
        * bindings/js/ScriptDebugServer.h:
        (ScriptDebugServer):

2012-08-05  Luke Macpherson   <macpherson@chromium.org>

        Fix null pointer dereference when CSSParser::sinkFloatingValueList() returns null and is passed to storeVariableDeclaration().
        https://bugs.webkit.org/show_bug.cgi?id=92461

        Reviewed by Eric Seidel.

        Invalid variable lists could cause CSSGrammar.y to pass null as value to storeVariableDeclaration, so we now check for null.

        Test: fast/css/variables/invalid-value-list-crash.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::storeVariableDeclaration):

2012-08-03  Kent Tamura  <tkent@chromium.org>

        [Chromium-win] Use the default locale only if the browser locale matches to it
        https://bugs.webkit.org/show_bug.cgi?id=93083

        Reviewed by Hajime Morita.

        For a calendar picker, we have used month names and day-of-week names
        obtained from the OS default locale. However, the year-month format and
        [Today] [Clear] labels are decided with the browser locale. It made
        calendar pickers with mixed languages.

        To make calendar pickers with a single language, we use the OS default
        locale only if the browser locale matches to it.
        This patch changes the behavior for Windows Vista or later. No change
        for Windows XP because of API support limitation.

        No new tests.  Behavior for locale setting is not testable in WebKit.

        * platform/text/LocaleWin.cpp:
        (determineCurrentLCID):
        Added. If the system has no LocaleNameToLCID API, just returns
        LOCALE_USER_DEFAULT. Otherwise, if the system locale matches to the
        browser locale, it returns LOCALE_USER_DEFAULT, otherwise it returns the
        LCID for the browser locale.
        (WebCore::LocaleWin::currentLocale): Uses determineCurrentLCID().

2012-08-05  Antti Koivisto  <antti@apple.com>

        Don't reuse cached stylesheet with failed or canceled resource loads
        https://bugs.webkit.org/show_bug.cgi?id=93203

        Reviewed by Simon Fraser.

        1) Go to apple.com
        2) Reload repeatedly

        Eventually you can get into state where some images don't load.
        
        The problem is that a cached stylesheet may end up pointing to image resources that have been canceled (by the reload).
        If this happens they stay in the canceled state even when the stylesheet is applied to a new document.
        
        Fix by checking if all loads are complete (or pending) when restoring a cached stylesheet. The sheet is only used
        if there are no failed or canceled loads. There are potential more sophisticated fixes but this is simple and safe.
        Walking the sheet is fast and since it is only done on cache restore the cost is minimal.

        No regression test yet though the new code does get exercised by the existing tests.

        * css/CSSCrossfadeValue.cpp:
        (WebCore::CSSCrossfadeValue::hasFailedOrCanceledSubresources):
        (WebCore):
        * css/CSSCrossfadeValue.h:
        (CSSCrossfadeValue):
        * css/CSSFontFaceSrcValue.cpp:
        (WebCore::CSSFontFaceSrcValue::hasFailedOrCanceledSubresources):
        (WebCore):
        * css/CSSFontFaceSrcValue.h:
        (CSSFontFaceSrcValue):
        * css/CSSImageSetValue.cpp:
        (WebCore::CSSImageSetValue::hasFailedOrCanceledSubresources):
        (WebCore):
        * css/CSSImageSetValue.h:
        (CSSImageSetValue):
        * css/CSSImageValue.cpp:
        (WebCore::CSSImageValue::hasFailedOrCanceledSubresources):
        (WebCore):
        * css/CSSImageValue.h:
        (CSSImageValue):
        * css/CSSValue.cpp:
        (WebCore::CSSValue::hasFailedOrCanceledSubresources):
        (WebCore):
        * css/CSSValue.h:
        (CSSValue):
        * css/CSSValueList.cpp:
        (WebCore::CSSValueList::hasFailedOrCanceledSubresources):
        (WebCore):
        * css/CSSValueList.h:
        (CSSValueList):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::hasFailedOrCanceledSubresources):
        (WebCore):
        * css/StylePropertySet.h:
        (StylePropertySet):
        * css/StyleSheetContents.cpp:
        (WebCore::childRulesHaveFailedOrCanceledSubresources):
        (WebCore):
        (WebCore::StyleSheetContents::hasFailedOrCanceledSubresources):
        * css/StyleSheetContents.h:
        (StyleSheetContents):
        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::restoreParsedStyleSheet):
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::loadFailedOrCanceled):

2012-08-05  Kentaro Hara  <haraken@chromium.org>

        [V8] Move V8Proxy methods that set DOM attributes/callbacks to V8Binding
        https://bugs.webkit.org/show_bug.cgi?id=93103

        Reviewed by Adam Barth.

        To remove V8Proxy, we can move V8Proxy methods that set DOM
        attributes/callbacks to V8Binding.

        No tests. No change in behavior.

        * bindings/v8/V8Binding.cpp:
        (WebCore::batchConfigureAttributes):
        (WebCore):
        (WebCore::batchConfigureCallbacks):
        (WebCore::batchConfigureConstants):
        * bindings/v8/V8Binding.h:
        (BatchedAttribute):
        (WebCore):
        (WebCore::configureAttribute):
        (BatchedConstant):
        (BatchedCallback):
        * bindings/v8/V8Proxy.cpp:
        * bindings/v8/V8Proxy.h:
        (WebCore):

2012-08-05  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove V8Proxy::registerExtensionWithV8()
        https://bugs.webkit.org/show_bug.cgi?id=93115

        Reviewed by Adam Barth.

        V8Proxy::registerExtensionWithV8() is used by V8Proxy::registerExtension()
        only. We can remove the redundant method.

        In a follow-up patch, I will implement V8Proxy::registerExtentionIfNeeded()
        and remove registerExtensionWithV8() and registerExtension().

        No tests. No change in behavior.

        * bindings/v8/V8Proxy.cpp:
        (WebCore::staticExtensionsList): Just moved to near related methods.
        (WebCore):
        (WebCore::V8Proxy::extensions):
        (WebCore::V8Proxy::registerExtension):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):

2012-08-05  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove unused enum and typedefs in V8Proxy
        https://bugs.webkit.org/show_bug.cgi?id=93105

        Reviewed by Adam Barth.

        In preparation for removing V8Proxy, we can remove unused enum
        and typedefs in V8Proxy.

        No tests. No change in behavior.

        * bindings/v8/V8Proxy.cpp:
        * bindings/v8/V8Proxy.h:
        (WebCore::throwError):

2012-08-04  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/11875795> REGRESSION (tiled drawing): Page’s scroll bars flash with each character you type in a textarea (affects Wikipedia and YouTube)
        https://bugs.webkit.org/show_bug.cgi?id=91348

        Reviewed by Andy Estes.

        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::scrollPositionChanged): Changed to call notifyContentAreaScrolled()
        only if the scroll position after the change differs from what it was before the change.
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::scrollPosition): Added an override of this ScrollableArea function.
        * rendering/RenderListBox.h:

2012-08-04  Ami Fischman  <fischman@chromium.org>

        HTMLMediaElement may fire the seeked event before currentTime reaches the seek time
        https://bugs.webkit.org/show_bug.cgi?id=92881

        Reviewed by Eric Carlson.

        Testing provided by media/video-seek-past-end-paused.html, hopefully demonstrating lack of redness on all ports/bots this time.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): don't finishSeek() until the media player is no longer seeking.

2012-08-04  Dan Bernstein  <mitz@apple.com>

        Tried to fix the Qt Windows build after r124654.

        * platform/graphics/SimpleFontData.cpp:
        (WebCore::SimpleFontData::glyphForCharacter): Enclosed this function in
        #if !(PLATFORM(QT) && !HAVE(QRAWFONT)).

2012-08-04  Mike West  <mkwst@chromium.org>

        Refactor SubframeLoader::requestPlugin/loadPlugin for clarity.
        https://bugs.webkit.org/show_bug.cgi?id=93138

        Reviewed by Adam Barth.

        SubframeLoader::requestPlugin and SubframeLoader::loadPlugin both do a
        variety of checks to determine whether or not a specific resource ought
        to instantiate a plugin in a specific context. r124636[1] moved one of
        those checks, but there doesn't seem to be a clear way to determine
        which checks should be performed where.

        This patch refactors the checks out of those two methods for clarity,
        moving them all into a new method: SubframeLoader::pluginIsLoadable.
        That method requires the resource URL and MIME type, as well as the
        `object` or `embed` element that owns this bit of rendering. The URL
        and type are used directly to determine availability, while the element
        is currently used only to create a renderer on which
        setPluginUnavailabilityReason can be called if the plugin is blocked by
        Content Security Policy.

        This patch introduces no new tests, as it shouldn't change the code's
        behavior: it should be a straightforward refactoring without web-visible
        side-effects.

        [1]: http://trac.webkit.org/changeset/124636

        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::pluginIsLoadable):
            A new method that extracts the various 'Should we allow this plugin
            in this context?' checks from requestPlugin and loadPlugin into ine
            location, rather than spreading them across both.
        (WebCore):
        (WebCore::SubframeLoader::requestPlugin):
        (WebCore::SubframeLoader::loadPlugin):
        * loader/SubframeLoader.h:
        (SubframeLoader):

2012-08-04  John J. Barton  <johnjbarton@chromium.org>

        Web Inspector: filteredItemSelectionDialog.css has wrong selector for highlights
        https://bugs.webkit.org/show_bug.cgi?id=93168

        Reviewed by Pavel Feldman.

        Selector required span to be a child, but highlights are themselves span. Used descendent selector.
        No new tests: I'll make one next week, to go with bug 93166

        * inspector/front-end/filteredItemSelectionDialog.css:
        (.js-outline-dialog > .container > div.item span.highlight):

2012-08-03  Robert Hogan  <robert@webkit.org>

        CSS 2.1 failure: overflow-applies-to-001 fails
        https://bugs.webkit.org/show_bug.cgi?id=93148

        Reviewed by Eric Seidel.

        Overflow no longer applies to table-rows or table-row-groups, it only applies
        to block containers: http://www.w3.org/TR/CSS21/visufx.html#overflow

        Tests:  css2.1/20110323/overflow-applies-to-001.htm
                css2.1/20110323/overflow-applies-to-002.htm
                css2.1/20110323/overflow-applies-to-003.htm
                css2.1/20110323/overflow-applies-to-004.htm
                css2.1/20110323/overflow-applies-to-005.htm
                css2.1/20110323/overflow-applies-to-006.htm
                css2.1/20110323/overflow-applies-to-007.htm
                css2.1/20110323/overflow-applies-to-008.htm
                css2.1/20110323/overflow-applies-to-009.htm
                css2.1/20110323/overflow-applies-to-010.htm
                css2.1/20110323/overflow-applies-to-012.htm
                css2.1/20110323/overflow-applies-to-013.htm
                css2.1/20110323/overflow-applies-to-014.htm
                css2.1/20110323/overflow-applies-to-015.htm

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::updateBoxModelInfoFromStyle):

2012-08-04  Adam Barth  <abarth@webkit.org>

        BindingSecurity::shouldAllowAccessToNode shouldn't detour through Frame to find the node's document
        https://bugs.webkit.org/show_bug.cgi?id=93140

        Reviewed by Eric Seidel.

        Previously, shouldAllowAccessToNode took a detour through the Frame to
        find the Document associated with a given Node. That's crazy! Nodes
        already know their documents. This patch removes the detour.

        It's theoretically possible that this patch changes behavior in the
        case where the Frame is 0, but I couldn't find any situations in which
        we call this function on nodes in inactive documents because the
        typical way you find a node worth checking security on is via
        a JavaScript window object.

        * bindings/generic/BindingSecurity.cpp:
        (WebCore::canAccessDocument):
        (WebCore::BindingSecurity::shouldAllowAccessToNode):
        (WebCore::BindingSecurity::allowSettingFrameSrcToJavascriptUrl):

2012-08-04  Adam Barth  <abarth@webkit.org>

        [V8] Re-wire "target" half of the same-origin security check through Document rather than DOMWindow
        https://bugs.webkit.org/show_bug.cgi?id=93079

        Reviewed by Eric Seidel.

        Before this patch, we were traversing from Nodes to Frames to
        DOMWindows to SecurityOrigins when determing the "target" of an
        operation for the same-origin policy security check. Rather than
        detouring through DOMWindow, these security checks should operate in
        terms of ScriptExecutionContexts (aka Documents) because that's the
        canonical place we store SecurityOrigin objects.

        A future patch will re-wire the "active" part of the security check to
        use ScriptExecutionContexts as well and we'll be able to remove the
        extra copy of SecurityOrigin that we keep in DOMWindow.

        * bindings/generic/BindingSecurity.cpp:
        (WebCore::canAccessDocument):
        (WebCore::BindingSecurity::canAccessFrame):
        (WebCore::BindingSecurity::shouldAllowAccessToNode):
        * bindings/v8/BindingState.cpp:
        (WebCore::immediatelyReportUnsafeAccessTo):
        * bindings/v8/BindingState.h:
        (WebCore):
        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::reportUnsafeJavaScriptAccess):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::reportUnsafeAccessTo):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):

2012-08-03  Adam Barth  <abarth@webkit.org>

        Disabling eval changes the timing of DidCreateScriptContext
        https://bugs.webkit.org/show_bug.cgi?id=92189

        Reviewed by Eric Seidel.

        When we implemented Content-Security-Policy, we added the ability to
        disable eval in the JavaScript engine. However, when we process the
        Content-Security-Policy header, we might not have initialized the
        script context for the given frame.

        Previously, we would initialize the context, but that generates a
        DidCreateScriptContext callback to the embedder earlier in the Document's
        lifetime that before. A natural thing to do in this callback is to run
        script to customize the script context, but Document isn't fully
        initialized yet, which leads to odd bugs and general confusion.

        In this patch, we delay actually disabling eval until we would have
        created the scripting context previously. From the perspective of the
        web platform, this has the same behavior. The only difference is that
        now the DidCreateScriptContext notification occurs at the same time
        regardless of whether Content-Security-Policy disables eval.

        I tried to write a test for this change, but it was unclear to me how
        to write a good test. I tried writing a Chromium WebKit unit test to no
        avail. The good news is that this patch will be covered by the
        PlatformAppBrowserTest.Iframes test in Chromium once
        https://bugs.webkit.org/show_bug.cgi?id=93079 lands. That's not the
        best way to test this change, but it might be sufficient.

        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::initScript):
        (WebCore::ScriptController::disableEval):
        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::enableEval):
        (WebCore::ScriptController::disableEval):
        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::V8DOMWindowShell::initContextIfNeeded):

2012-08-03  James Robinson  <jamesr@chromium.org>

        [chromium] Stop relying on implicit WebFoo <-> WebCore conversion operators in compositor
        https://bugs.webkit.org/show_bug.cgi?id=93169

        Reviewed by Adrienne Walker.

        This removes the compositor's reliance on implicit conversion operators from Web* types to WebKit-internal
        types, specifically WebRect <-> WebCore::IntRect and WebString <-> WTF::String.

        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
        (WebCore::CanvasLayerTextureUpdater::paintContents):
        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::getFramebufferPixels):
        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        (WebCore::ScrollbarLayerChromium::setTexturePriorities):
        (WebCore::ScrollbarLayerChromium::update):
        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
        (WebCore::CCFontAtlas::drawOneLineOfTextInternal):
        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
        (WebCore::CCHeadsUpDisplayLayerImpl::drawFPSCounter):
        (WebCore::CCHeadsUpDisplayLayerImpl::drawDebugRects):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
        (WebCore::toUVRect):
        (WebCore::CCScrollbarLayerImpl::appendQuads):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::size):

2012-08-03  Michael Nordman  <michaeln@google.com>

        [Chromium] Cross-thread-copy a couple more recently added ResourceResponse data members, apparently
        these got missed when they were added. And fix a bug with how the m_remoteIPAddress
        data member is handled, an isolatedCopy() is needed for thread safety.
        https://bugs.webkit.org/show_bug.cgi?id=93158

        Reviewed by David Levin.

        No new tests, minor cleanup.

        * platform/network/chromium/ResourceResponse.cpp:
        (WebCore::ResourceResponse::doPlatformCopyData): make deep copies
        (WebCore::ResourceResponse::doPlatformAdopt): take ownership of them
        * platform/network/chromium/ResourceResponse.h:
        (ResourceResponse):
        (CrossThreadResourceResponseData):

2012-08-03  Florin Malita  <fmalita@chromium.org>

        [SVG] Tref target event listener cleanup
        https://bugs.webkit.org/show_bug.cgi?id=93004

        Reviewed by Abhishek Arya.

        Currently SVGTRefElement allocates event listeners dynamically as it attaches to its
        targets. Synchronizing the lifetime of the target listener vs. the tref element is
        error prone, as various events can stack and trigger nested handlers.

        In order to reduce complexity and address a couple of outstanding issues, this patch
        changes the way event listeners are allocated: only one target listener is created
        for the lifetime of the SVGTRefElement, and gets reused if the target element changes.

        Test: svg/custom/tref-nested-events-crash.svg

        * dom/EventListener.h:
        Added new <tref> target event listener type.
        * svg/SVGTRefElement.cpp:
        (WebCore):
        (WebCore::SVGTRefTargetEventListener::create):
        (WebCore::SVGTRefTargetEventListener::cast):
        (SVGTRefTargetEventListener):
        (WebCore::SVGTRefTargetEventListener::isAttached):
        (WebCore::SVGTRefTargetEventListener::SVGTRefTargetEventListener):
        (WebCore::SVGTRefTargetEventListener::attach):
        (WebCore::SVGTRefTargetEventListener::detach):
        (WebCore::SVGTRefTargetEventListener::operator==):
        (WebCore::SVGTRefTargetEventListener::handleEvent):
        No need to check m_trefElement anymore - the listener is allocated for the whole element
        lifetime, detached when the element is removed and deallocated when the element is
        destroyed.
        (WebCore::SVGTRefElement::SVGTRefElement):
        Allocate one target listener per element, at construction time.
        (WebCore::SVGTRefElement::~SVGTRefElement):
        Detach the listener if necessary.
        (WebCore::SVGTRefElement::detachTarget):
        Check whether the element is still in document after updating the text (may have been
        removed by event handlers).
        (WebCore::SVGTRefElement::buildPendingResource):
        Attach the event listener before updating the text content to avoid racing with event
        handlers (which can remove the element).
        (WebCore::SVGTRefElement::removedFrom):
        * svg/SVGTRefElement.h:
        (WebCore):
        (SVGTRefElement):

2012-08-03  Michael Saboff  <msaboff@apple.com>

        Convert HTML parser to handle 8-bit resources without converting to UChar*
        https://bugs.webkit.org/show_bug.cgi?id=90321

        Reviewed by Adam Barth.

        No new tests, no new functionality therefore covered by existing tests.

        Changed the parsing of HTML to handle 8-bit strings without converting the 
        whole string to 16-bits.  Primary change was to use the appropriate 
        character pointer type (LChar* or UChar*) depending on the source string.
        This access is abstracted in SegmentedSubstring by getCurrentChar{8,16} and
        incrementAndGetCurrentChar{8,16} methods.  In SegmentedString, the advance()
        and advanceAndUpdateLineNumber() methods have been refactored into a
        state machine managed pair of function pointers.  The possible functions
        have not only the 8 and 16 bitness factored out, they also have the 
        "exclude line numbers" logic factored out for advanceAndUpdateLineNumber().
        This change also has improvements over http://trac.webkit.org/changeset/123679.
        The most prominent change was to inline the 8 bit paths for both advance()
        and advanceAndUpdateLineNumber().
        This provides a net speed-up even with the 8/16 bit testing.
        Other changes involve using String methods to access and compare with the
        source data.

        * html/FTPDirectoryDocument.cpp:
        (WebCore::FTPDirectoryDocumentParser::append): Changed to use currentChar()
        instead of SegmentedString '*' operator.
        * html/parser/HTMLEntityParser.cpp: Changed to use currentChar() instead of
        SegmentedString '*' operator.
        * html/parser/HTMLParserIdioms.cpp:
        (WebCore::stripLeadingAndTrailingHTMLSpaces): Added 8-bit fast path.
        * html/parser/HTMLSourceTracker.cpp:
        (WebCore::HTMLSourceTracker::sourceForToken): Changed to use currentChar() instead of
        SegmentedString '*' operator.
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::script): Updated to use new String::dataSize() method.
        * platform/text/SegmentedString.cpp:
        (WebCore::SegmentedString::SegmentedString):
        (WebCore::SegmentedString::operator=):
        (WebCore::SegmentedString::clear):
        (WebCore::SegmentedString::append):
        (WebCore::SegmentedString::prepend):
        (WebCore::SegmentedString::advanceSubstring):
        (WebCore::SegmentedString::advance):
        (WebCore::SegmentedString::advance8): Fast path advance function for 8 bit data.
        (WebCore::SegmentedString::advance16): Fast path advance function for 16 bit data.
        (WebCore::SegmentedString::advanceAndUpdateLineNumber8): Fast path
        advanceAndUpdateLineNumber for 8 bit data when we need to update the line number.
        (WebCore::SegmentedString::advanceAndUpdateLineNumber16): Fast path
        advanceAndUpdateLineNumber for 16 bit data when we need to update the line number.
        (WebCore::SegmentedString::advanceSlowCase): Slow case advance function for both
        8 and 16 bit advance.
        (WebCore::SegmentedString::advanceAndUpdateLineNumberSlowCase): Slow case
        advanceAndUpdateLineNumber function for both 8 and 16 bit data.
        (WebCore::SegmentedString::advanceEmpty): Advance function when input has been exhausted.
        (WebCore::SegmentedString::updateSlowCaseFunctionPointers): Set advance function
        pointers to slow case functions.
        * platform/text/SegmentedString.h:
        (WebCore::SegmentedSubstring::SegmentedSubstring):
        (WebCore::SegmentedSubstring::clear):
        (SegmentedSubstring):
        (WebCore::SegmentedSubstring::is8Bit): New getter.
        (WebCore::SegmentedSubstring::appendTo):
        (WebCore::SegmentedSubstring::getCurrentChar8): New getter for the 8 bit case.
        (WebCore::SegmentedSubstring::getCurrentChar16): New getter for the 16 bit case.
        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar8): New wrapper functions
        that pre-increments the 8 bit pointer and returns the next character.
        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar16): New wrapper functions
        that pre-increments the 16 bit pointer and returns the next character.
        (WebCore::SegmentedSubstring::currentSubString):
        (WebCore::SegmentedSubstring::getCurrentChar):
        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar):
        (WebCore::SegmentedString::SegmentedString):
        (WebCore::SegmentedString::push):
        (WebCore::SegmentedString::isEmpty):
        (WebCore::SegmentedString::lookAhead):
        (WebCore::SegmentedString::lookAheadIgnoringCase):
        (WebCore::SegmentedString::advance): Wrapper that contains 8 bit fast path
        or calls via member function point to approriate advance() flavor.
        (WebCore::SegmentedString::advanceAndUpdateLineNumber): Wrapper that
        contains 8 bit fast path or calls via member function point to approriate
        advance() flavor.
        (WebCore::SegmentedString::advanceAndASSERT):
        (WebCore::SegmentedString::advanceAndASSERTIgnoringCase):
        (WebCore::SegmentedString::advancePastNonNewline):
        (WebCore::SegmentedString::advancePastNewlineAndUpdateLineNumber):
        (WebCore::SegmentedString::currentChar):
        (WebCore::SegmentedString::decrementAndCheckLength): Decrement substring length and
        change to slow case functions when only one character left.
        (WebCore::SegmentedString::updateAdvanceFunctionPointers): Select appropriate
        advance functions based on current substring.
        (WebCore::SegmentedString::lookAheadInline): Changed to use String::startsWith().
        (WebCore::SegmentedString::lookAheadSlowCase):
        * xml/parser/CharacterReferenceParserInlineMethods.h:
        (WebCore::consumeCharacterReference): Changed to use currentChar() instead of
        SegmentedString '*' operator.
        * xml/parser/MarkupTokenizerBase.h:
        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::nextInputCharacter):
        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::peek): Changed to use
        currentChar() instead of SegmentedString '*' operator.
        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::advance):

2012-08-03  Arnaud Renevier  <a.renevier@sisa.samsung.com>

        Update TypedArrays to throw RangeError or similar instead of INDEX_SIZE_ERR
        https://bugs.webkit.org/show_bug.cgi?id=45118

        Reviewed by Kenneth Russell.

        Update TypedArrays to raise JavaScript RangeError instead of dom
        INDEX_SIZE_ERR exceptions. Also, update TypedArrays to raise TypeError
        instead of JavaScript SyntaxError or dom exceptions SYNTAX_ERR when
        calling set method with invalid arguments.

        Specification does not define the type of exceptions to raise, but
        other browsers raise JavaScript errors, so those changes will improve
        compatibility.

        New Test: fast/canvas/webgl/array-set-invalid-arguments.html

        Updated Tests expectations:
            fast/canvas/webgl/array-set-out-of-bounds.html
            fast/canvas/webgl/data-view-crash.html
            fast/canvas/webgl/data-view-test.html

        * bindings/js/JSArrayBufferViewHelper.h:
        (WebCore):
        (WebCore::setWebGLArrayWithTypedArrayArgument):
        (WebCore::setWebGLArrayHelper):
        (WebCore::constructArrayBufferViewWithTypedArrayArgument):
        (WebCore::constructArrayBufferViewWithArrayBufferArgument):
        (WebCore::constructArrayBufferView):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore):
        (WebCore::constructWebGLArrayWithArrayBufferArgument):
        (WebCore::setWebGLArrayHelper):

2012-08-03  Dave Tu  <dtu@chromium.org>

        [chromium] Fix Renderer4.CompositorThreadImplDrawDelay histogram.
        https://bugs.webkit.org/show_bug.cgi?id=93159

        Reviewed by Adrienne Walker.

        The histogram is using the frame number instead of the frame time by mistake.

        * platform/graphics/chromium/cc/CCFrameRateCounter.cpp:
        (WebCore::CCFrameRateCounter::markBeginningOfFrame):

2012-08-03  David Grogan  <dgrogan@chromium.org>

        IndexedDB: Core upgradeneeded logic
        https://bugs.webkit.org/show_bug.cgi?id=92558

        Reviewed by Ojan Vafai.

        This is the backend webkit logic needed for integer versions. The rest
        is in https://bugs.webkit.org/show_bug.cgi?id=89505.

        I tried to make use of the existing processPendingCalls and added two
        more queues, pendingOpenWithVersionCalls and
        pendingSecondHalfOpenWithVersionCalls. The "second half" refers to
        how there are two events that need to be fired in response to an
        open-with-version call. The "second half" queue holds the open
        requests that should immediately follow the caller's upgradeneeded
        handler.

        No new tests, there are so many they are in their own patch:
        https://bugs.webkit.org/show_bug.cgi?id=92560

        Though this patch doesn't change any expected behavior anyway, lack of
        regressions is what we're hoping for here.

        * Modules/indexeddb/IDBBackingStore.h:
        (IDBBackingStore):
        * Modules/indexeddb/IDBCallbacks.h:
        (WebCore::IDBCallbacks::onBlocked):
        (WebCore::IDBCallbacks::onUpgradeNeeded):
        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (IDBDatabaseBackendImpl::PendingOpenCall):
        (IDBDatabaseBackendImpl::PendingOpenWithVersionCall):
        (WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::create):
        (WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::callbacks):
        (WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::version):
        (WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::PendingOpenWithVersionCall):
        (WebCore):
        (WebCore::IDBDatabaseBackendImpl::IDBDatabaseBackendImpl):
        (WebCore::IDBDatabaseBackendImpl::openInternal):
        (WebCore::IDBDatabaseBackendImpl::metadata):
        (WebCore::IDBDatabaseBackendImpl::setVersion):
        (WebCore::IDBDatabaseBackendImpl::setIntVersionInternal):
        (WebCore::IDBDatabaseBackendImpl::transactionFinished):
        (WebCore::IDBDatabaseBackendImpl::transactionFinishedAndEventsFired):
        When an upgradeneeded event is fired in response to an
        open-with-version call, the version change transaction must receive its
        complete event before processPendingCalls fires a success event at
        IDBOpenDBRequest. In the future this should probably be changed
        instead to transactionFinishedAndAbortFired and
        transactionFinishedAndCompleteFired so that we'll know to fire a
        success or error event at IDBOpenDBRequest. Currently, instead of
        firing error when there's an abort, we don't fire anything.

        (WebCore::IDBDatabaseBackendImpl::processPendingCalls):
        Now that this is called after a connection is opened, we unfortunately
        lose the invariant that there is only one existing connection when this
        is called, but nothing inside this function actually relied on that.
        Additionally, the secondHalfOpen calls only ever need to be serviced
        in one place: right after a version change transaction completes, so
        it could be moved out of here.

        (WebCore::IDBDatabaseBackendImpl::registerFrontendCallbacks):
        Now that setVersion and deleteDatabase calls are queued up behind
        secondHalfOpen calls, we have to service those queues when
        secondHalfOpen calls complete, which is here.  So call
        processPendingCalls().

        (WebCore::IDBDatabaseBackendImpl::runIntVersionChangeTransaction):
        (WebCore::IDBDatabaseBackendImpl::openConnectionWithVersion):
        (WebCore::IDBDatabaseBackendImpl::deleteDatabase):
        (WebCore::IDBDatabaseBackendImpl::close):
        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
        (IDBDatabaseBackendImpl):
        * Modules/indexeddb/IDBDatabaseCallbacks.h:
        (WebCore::IDBDatabaseCallbacks::onVersionChange):
        * Modules/indexeddb/IDBFactoryBackendImpl.cpp:
        (WebCore::IDBFactoryBackendImpl::open):
        This is refactored some so that the call to openConection{WithVersion}
        happens once, at the end.

        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
        (WebCore::IDBLevelDBBackingStore::getIDBDatabaseMetaData):
        (WebCore::IDBLevelDBBackingStore::createIDBDatabaseMetaData):
        (WebCore::IDBLevelDBBackingStore::updateIDBDatabaseIntVersion):
        (WebCore):
        (WebCore::IDBLevelDBBackingStore::deleteDatabase):
        * Modules/indexeddb/IDBLevelDBBackingStore.h:
        (IDBLevelDBBackingStore):
        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
        (WebCore::IDBTransactionBackendImpl::commit):
        See above comments about transactionFinishedAndEventsFired. I tried
        moving the call to transactionFinished after the events were fired but
        that failed some asserts. But changing those asserts is still an
        alternative to splitting up transactionFinished as is done here.

2012-08-03  Rick Byers  <rbyers@chromium.org>

        Double tap gesture should send dblclick event
        https://bugs.webkit.org/show_bug.cgi?id=92412

        Reviewed by Adam Barth.

        Propagate the tap count from PlatformGestureEvent in the derived mouse
        events.

        Also fixes a crash with unexpected GestureDoubleTap events by just
        supressing them early.  They will probably be removed soon anyway.

        Test: fast/events/touch/gesture/gesture-dblclick.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleGestureEvent):
        (WebCore::EventHandler::handleGestureTap):

2012-08-03  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124668.
        http://trac.webkit.org/changeset/124668
        https://bugs.webkit.org/show_bug.cgi?id=93167

        Broke Mac build (Requested by kbr_google on #webkit).

        * bindings/js/JSArrayBufferViewHelper.h:
        (WebCore::setWebGLArrayWithTypedArrayArgument):
        (WebCore::setWebGLArrayHelper):
        (WebCore::constructArrayBufferViewWithTypedArrayArgument):
        (WebCore::constructArrayBufferViewWithArrayBufferArgument):
        (WebCore::constructArrayBufferView):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore::constructWebGLArrayWithArrayBufferArgument):
        (WebCore):
        (WebCore::constructWebGLArray):
        (WebCore::setWebGLArrayHelper):

2012-08-03  Julien Chaffraix  <jchaffraix@webkit.org>

        Implement computePreferredLogicalWidths on RenderGrid
        https://bugs.webkit.org/show_bug.cgi?id=92908

        Reviewed by Ojan Vafai.

        This functions implements a primitive computePreferredLogicalWidths
        so that we properly handle vertical writing modes.

        Covered by fast/css-grid-layout/place-cell-by-index.html.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::computePreferredLogicalWidths):
        * rendering/RenderGrid.h:
        Added computePreferredLogicalWidths.

2012-08-03  Arnaud Renevier  <a.renevier@sisa.samsung.com>

        Update TypedArrays to throw RangeError or similar instead of INDEX_SIZE_ERR
        https://bugs.webkit.org/show_bug.cgi?id=45118

        Reviewed by Kenneth Russell.

        Update TypedArrays to raise JavaScript RangeError instead of dom
        INDEX_SIZE_ERR exceptions. Also, update TypedArrays to raise TypeError
        instead of JavaScript SyntaxError or dom exceptions SYNTAX_ERR when
        calling set method with invalid arguments.

        Specification does not define the type of exceptions to raise, but
        other browsers raise JavaScript errors, so those changes will improve
        compatibility.

        New Test: fast/canvas/webgl/array-set-invalid-arguments.html

        Updated Tests expectations:
            fast/canvas/webgl/array-set-out-of-bounds.html
            fast/canvas/webgl/data-view-crash.html
            fast/canvas/webgl/data-view-test.html

        * bindings/js/JSArrayBufferViewHelper.h:
        (WebCore):
        (WebCore::setWebGLArrayWithTypedArrayArgument):
        (WebCore::setWebGLArrayHelper):
        (WebCore::constructArrayBufferViewWithTypedArrayArgument):
        (WebCore::constructArrayBufferViewWithArrayBufferArgument):
        (WebCore::constructArrayBufferView):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore):
        (WebCore::constructWebGLArrayWithArrayBufferArgument):
        (WebCore::setWebGLArrayHelper):

2012-08-03  Levi Weintraub  <leviw@chromium.org>

        Switch mapLocalToContainer to use a flag instead of boolean parameters
        https://bugs.webkit.org/show_bug.cgi?id=92927

        Reviewed by Dirk Schulze.

        Changing mapLocalToContainer to use a uint flag to set the mode of operation. This removes
        simplifies the contract, removes boolean arguments and paves the way for an additional mode
        for sub-pixel layout support. See https://bugs.webkit.org/show_bug.cgi?id=89238 for the
        sub-pixel use case. Other than the new MapLocalToContainerMode enum and MapLocalToContainerFlags
        typedef, this change is purely mechanical.

        No new tests as this doesn't change current behavior.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::selectionGapRectsForRepaint):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::mapLocalToContainer):
        * rendering/RenderBox.h:
        (RenderBox):
        * rendering/RenderGeometryMap.cpp:
        (WebCore::RenderGeometryMap::mapToAbsolute):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::mapLocalToContainer):
        * rendering/RenderInline.h:
        (RenderInline):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::localToAbsolute):
        (WebCore::RenderObject::mapLocalToContainer):
        (WebCore::RenderObject::localToContainerQuad):
        (WebCore::RenderObject::localToContainerPoint):
        * rendering/RenderObject.h:
        (RenderObject): Adding the MapLocalToContainerMode enum and MapLocalToContainerFlags unsigned
        int, and removing the old ApplyContainerFlipOrNot enum.
        * rendering/RenderView.cpp:
        (WebCore::RenderView::mapLocalToContainer):
        * rendering/RenderView.h:
        (RenderView):
        * rendering/svg/RenderSVGForeignObject.cpp:
        (WebCore::RenderSVGForeignObject::mapLocalToContainer):
        * rendering/svg/RenderSVGForeignObject.h:
        (RenderSVGForeignObject):
        * rendering/svg/RenderSVGInline.cpp:
        (WebCore::RenderSVGInline::mapLocalToContainer):
        * rendering/svg/RenderSVGInline.h:
        (RenderSVGInline):
        * rendering/svg/RenderSVGModelObject.cpp:
        (WebCore::RenderSVGModelObject::mapLocalToContainer):
        * rendering/svg/RenderSVGModelObject.h:
        (RenderSVGModelObject):
        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::mapLocalToContainer):
        * rendering/svg/RenderSVGRoot.h:
        (RenderSVGRoot):
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::mapLocalToContainer):
        * rendering/svg/RenderSVGText.h:
        (RenderSVGText):
        * rendering/svg/SVGRenderSupport.cpp:
        (WebCore::SVGRenderSupport::mapLocalToContainer):

2012-08-03  Emil A Eklund  <eae@chromium.org>

        Remove dependency on LayoutTypes.h from transformation code
        https://bugs.webkit.org/show_bug.cgi?id=93037

        Reviewed by Levi Weintraub.

        TransformationMatrix and HitTestingTransformState includes LayoutTypes.h
        which is in rendering. This is a layering violation.
        Remove this dependency as it is no longer needed.

        No new tests, no change in functionality.

        * rendering/LayoutTypes.h:
        Remove clampToLayoutUnit
        
        * platform/FractionalLayoutUnit.h:
        (WebCore::FractionalLayoutUnit::clamp):
        Add FractionalLayoutUnit::clamp method that clamps a double to a FractionalLayoutUnit.
        * platform/graphics/transforms/TransformationMatrix.cpp:
        (WebCore::clampEdgeValue):
        (WebCore::TransformationMatrix::clampedBoundsOfProjectedQuad):
        Use clamp/max/min from FractionalLayoutUnit instead of going through LayoutUnit abstraction.
        * platform/graphics/transforms/TransformationMatrix.h:
        * rendering/HitTestingTransformState.cpp:
        * rendering/HitTestingTransformState.h:
        Replace use of LayoutRect with FractionalLayoutRect as LayoutRect maps to FractionalLayoutRect on all platforms.

2012-08-03  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/12005188> REGRESSION (Safari 5.1 - 6): Cannot correctly display Traditional Mongolian Script
        https://bugs.webkit.org/show_bug.cgi?id=92864

        Reviewed by Sam Weinig.

        Test: platform/mac/fast/text/combining-character-sequence-vertical.html

        * platform/graphics/SimpleFontData.cpp:
        (WebCore::SimpleFontData::glyphForCharacter): Added this helper function.
        * platform/graphics/SimpleFontData.h:
        (SimpleFontData): Declared glyphDataForCharacter.
        * platform/graphics/mac/FontComplexTextMac.cpp:
        (WebCore::Font::fontDataForCombiningCharacterSequence): Added logic to use the appropriate
        variant of each font in the fallback list, which mimcs the equivalent logic in
        glyphDataAndPageForCharacter().

2012-08-03  Kenneth Russell  <kbr@google.com>

        [Chromium] Web Inspector: Win Dbg tests timing out (r123556 or r123560?)
        https://bugs.webkit.org/show_bug.cgi?id=92570

        Reviewed by Pavel Feldman.

        Try restricting the use of the GC hint for canvas contexts to only
        WebGL contexts, where it is most needed, to see whether this
        clears up the timeouts.

        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
        (WebCore::V8HTMLCanvasElement::getContextCallback):

2012-08-02  Jeffrey Pfau  <jpfau@apple.com>

        Add API for enabling blanket third-party data blocking
        https://bugs.webkit.org/show_bug.cgi?id=93022

        Reviewed by Anders Carlsson.

        Added API for enabling third-party storage blocking.

        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (WebCore::Settings::setThirdPartyStorageBlockingEnabled):
        (WebCore::Settings::thirdPartyStorageBlockingEnabled):
        (Settings):

2012-08-03  Anna Cavender  <annacc@chromium.org>

        Negative timestamps for TextTrackCues should not be allowed.
        https://bugs.webkit.org/show_bug.cgi?id=92939

        Reviewed by Eric Carlson.

        Make sure cues added in JavaScript are not allowed negative timestamps.
        Attempting to add a cue with a negative timestamp is not successful
        and setting a timestamp to a negative value has no effect.

        Test: media/track/track-cue-negative-timestamp.html

        * html/track/TextTrack.cpp:
        (WebCore::TextTrack::addCue): If the cue's startTime or endTime is 
            negative, do not add the cue.
        * html/track/TextTrackCue.cpp:
        (WebCore::TextTrackCue::setStartTime): Ignore negative values.
        (WebCore::TextTrackCue::setEndTime): Ignore negative values.
        * html/track/TextTrackCueList.cpp:
        (WebCore::TextTrackCueList::add): Add ASSERTs to check startTime and
            endTime are positive.

2012-08-03  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124594.
        http://trac.webkit.org/changeset/124594
        https://bugs.webkit.org/show_bug.cgi?id=93152

        Broke PlatformAppBrowserTest.Iframes browser_test on Chromium
        bots (Requested by dimich on #webkit).

        * bindings/generic/BindingSecurity.cpp:
        (WebCore::canAccess):
        (WebCore::BindingSecurity::canAccessFrame):
        (WebCore::BindingSecurity::shouldAllowAccessToNode):
        * bindings/v8/BindingState.cpp:
        (WebCore::immediatelyReportUnsafeAccessTo):
        * bindings/v8/BindingState.h:
        (WebCore):
        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::reportUnsafeJavaScriptAccess):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::reportUnsafeAccessTo):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):

2012-08-03  Terry Anderson  <tdanderson@chromium.org>

        Apply target fuzzing when sending a context menu event
        https://bugs.webkit.org/show_bug.cgi?id=92914

        Reviewed by Antonio Gomes.

        If TOUCH_ADJUSTMENT is enabled, use bestClickableNodeForTouchPoint to possibly
        adjust the location of a context menu event. This change uses the same set of
        candidates for touch adjustment as is used for a GestureTap event (which
        admittedly is a simplifying assumption).

        Test: touchadjustment/touch-links-longpress.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleGestureTap):
        Some code moved to the new function adjustGesturePosition.
        (WebCore):
        (WebCore::EventHandler::adjustGesturePosition):
        Added this function to avoid repeated code in handleGestureTap and
        sendContextMenuEventForGesture.
        (WebCore::EventHandler::sendContextMenuEventForGesture):
        Try to adjust the location of |mouseEvent| to correspond to the most
        probable gesture target. If no such target exists, the location of
        |mouseEvent| is unchanged.
        * page/EventHandler.h:
        (EventHandler):

2012-08-03  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124475 and r124496.
        http://trac.webkit.org/changeset/124475
        http://trac.webkit.org/changeset/124496
        https://bugs.webkit.org/show_bug.cgi?id=93151

        Causing assertion failures in table-section-node-at-point-
        crash.html (Requested by inferno-sec on #webkit).

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::paint):

2012-08-03  Jan Keromnes  <janx@linux.com>

        Web Inspector: Create and interface for TextEditor
        https://bugs.webkit.org/show_bug.cgi?id=93126

        Reviewed by Pavel Feldman.

        For more extensibility, TextEditor needs to be an interface that other
        classes can implement, e.g. the new class DefaultTextEditor.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame):
        * inspector/front-end/TextEditor.js:
        (WebInspector.TextEditor):
        (WebInspector.TextEditor.prototype.set mimeType):
        (WebInspector.TextEditor.prototype.setReadOnly):
        (WebInspector.TextEditor.prototype.readOnly):
        (WebInspector.TextEditor.prototype.defaultFocusedElement):
        (WebInspector.TextEditor.prototype.revealLine):
        (WebInspector.TextEditor.prototype.addDecoration):
        (WebInspector.TextEditor.prototype.removeDecoration):
        (WebInspector.TextEditor.prototype.markAndRevealRange):
        (WebInspector.TextEditor.prototype.highlightLine):
        (WebInspector.TextEditor.prototype.clearLineHighlight):
        (WebInspector.TextEditor.prototype.freeCachedElements):
        (WebInspector.TextEditor.prototype.elementsToRestoreScrollPositionsFor):
        (WebInspector.TextEditor.prototype.inheritScrollPositions):
        (WebInspector.TextEditor.prototype.beginUpdates):
        (WebInspector.TextEditor.prototype.endUpdates):
        (WebInspector.TextEditor.prototype.onResize):
        (WebInspector.TextEditor.prototype._textChanged):
        (WebInspector.TextEditor.prototype.editRange):
        (WebInspector.TextEditor.prototype.scrollToLine):
        (WebInspector.TextEditor.prototype.selection):
        (WebInspector.TextEditor.prototype.lastSelection):
        (WebInspector.TextEditor.prototype.setSelection):
        (WebInspector.TextEditor.prototype.setText):
        (WebInspector.TextEditor.prototype.text):
        (WebInspector.TextEditor.prototype.range):
        (WebInspector.TextEditor.prototype.line):
        (WebInspector.TextEditor.prototype.get linesCount):
        (WebInspector.TextEditor.prototype.setAttribute):
        (WebInspector.TextEditor.prototype.getAttribute):
        (WebInspector.TextEditor.prototype.removeAttribute):
        (WebInspector.TextEditor.prototype.wasShown):
        (WebInspector.TextEditor.prototype._handleFocused):
        (WebInspector.TextEditor.prototype.willHide):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:

2012-08-03  Mike West  <mkwst@chromium.org>

        Blocking a plugin via CSP should result in one (and only one) console message.
        https://bugs.webkit.org/show_bug.cgi?id=92649

        Reviewed by Adam Barth.

        Currently, blocking a plugin via Content Security Policy results in some
        leakage of console log messages between tests. I'm unclear as to the
        root cause, but the symptoms exhibited include
        `SubframeLoader::requestPlugin` being called multiple times for a single
        element, which in turn causes multiple console logs to be sent. These
        messages tend to appear in the subsequent test, making the
        `http/test/security/contentSecurityPolicy/object-src-*` set of tests
        flakey indeed.

        This patch addresses the issue by marking elements' plugins as
        unavailable when they're blocked by CSP. No new tests have been added:
        this patch should simply make the current tests actually pass.

        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::requestPlugin):
            We check the CSP status in `SubframeLoader::loadPlugin`, which is
            called at the end of this function. Checking CSP status in both
            locations is redundant.
        (WebCore::SubframeLoader::loadPlugin):
            If the plugin is blocked by CSP, tell the element's embedded object
            renderer that the plugin is unavailable.
        * platform/LocalizedStrings.cpp:
        (WebCore::blockedPluginByContentSecurityPolicyText):
        (WebCore):
        * platform/LocalizedStrings.h:
        (WebCore):
        * platform/blackberry/LocalizedStringsBlackBerry.cpp:
        (WebCore::blockedPluginByContentSecurityPolicyText):
        (WebCore):
        * platform/efl/LocalizedStringsEfl.cpp:
        (WebCore::blockedPluginByContentSecurityPolicyText):
        (WebCore):
        * platform/gtk/LocalizedStringsGtk.cpp:
        (WebCore::blockedPluginByContentSecurityPolicyText):
        (WebCore):
        * platform/qt/LocalizedStringsQt.cpp:
        (WebCore::blockedPluginByContentSecurityPolicyText):
        (WebCore):
        * rendering/RenderEmbeddedObject.cpp:
        (WebCore::unavailablePluginReplacementText):
        * rendering/RenderEmbeddedObject.h:
            Return appropriate text when the plugin is blocked by CSP.

2012-08-03  Kentaro Hara  <haraken@chromium.org>

        [V8] Add an IsExecutionTerminating() check to setDOMException()
        https://bugs.webkit.org/show_bug.cgi?id=93101

        Reviewed by Adam Barth.

        In preparation for moving exception related code from V8Proxy to V8Binding,
        I am going to remove throwError(ExceptionCode, v8::Isolate*) from V8Proxy.
        throwError(ExceptionCode, v8::Isolate*) will be replaced with
        setDOMException(ExceptionCode, v8::Isolate*). By this refactoring,
        the way to throw JavaScript errors and DOM exceptions becomes simple:
        "Throw JavaScript errors by throwError(). Throw DOM exceptions by setDOMException()".
        (Currently some DOM exceptions are being thrown by throwError().)

        To keep the current behavior of throwError(ExceptionCode, v8::Isolate*),
        before the replacement, we need to insert the IsExecutionTerminating()
        check to setDOMException(). This will add an extra check to the current
        setDOMException(), but I don't think it's a problem.

        No tests. No change in behavior.

        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::setDOMException):

2012-08-03  Sadrul Habib Chowdhury  <sadrul@chromium.org>

        Avoid dispatching gesture events of unknown types
        https://bugs.webkit.org/show_bug.cgi?id=93060

        Reviewed by Adam Barth.

        WebCore gesture events do not always correspond 1-to-1 to the Platform gesture events. So
        avoid dispatching the unknown gesture events to nodes.

        * dom/GestureEvent.cpp:
        (WebCore::GestureEvent::create):
        * dom/Node.cpp:
        (WebCore::Node::dispatchGestureEvent):

2012-08-03  Stephen Chenney  <schenney@chromium.org>

        Crash when a clip path referencing a clip path changes documents
        https://bugs.webkit.org/show_bug.cgi?id=93023

        Reviewed by Dirk Schulze.

        The SVGClipPathElement is set to not need pending resource handling,
        when in fact it can have pending resources. The result is a crash when
        the element is moved to a new document (which deletes all resources
        and leaves them pending) and then immediately deleted (which asserts
        that there are no pending resources). There is code to remove pending
        resources upon deletion and removal from the DOM, but it was not
        executing for clips because of the aforementioned code claiming that
        clips don't require such handling.

        The assertion that there be no pending resources is necessary to
        prevent caches of pending resources from trying to access the deleted
        element.

        This change removes the check for needsPendingResourceHandling in
        SVGStyledElement upon deletion and removal from the DOM. Pending resources
        will always be checked in such cases to ensure we do not introduce
        security issues.

        Test: svg/custom/clip-path-document-change-assert.html

        * svg/SVGStyledElement.cpp:
        (WebCore::SVGStyledElement::~SVGStyledElement): Removed needsPendingResourceHandling in the conditional to clean up resources.
        (WebCore::SVGStyledElement::removedFrom): Removed needsPendingResourceHandling in the conditional to clean up resources.

2012-08-03  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove unused methods in V8Proxy
        https://bugs.webkit.org/show_bug.cgi?id=93106

        Reviewed by Adam Barth.

        In preparation for removing V8Proxy, we can remove unused methods in V8Proxy.

        No tests. No change in behavior.

        * bindings/v8/V8Proxy.h:
        (V8Proxy):

2012-08-03  Kentaro Hara  <haraken@chromium.org>

        [V8] Implement v8Undefined()
        https://bugs.webkit.org/show_bug.cgi?id=93093

        Reviewed by Adam Barth.

        There are a couple of equivalent ways to create an undefined value,
        e.g. v8::Undefined(), v8::Undefined(isolate), v8::Handle<v8::Value>(), etc.
        We should implement v8Undefined() and use it everywhere.

        In this bug, we implement v8Undefined() and use it in CodeGeneratorV8.pm.
        We can implement v8Undefined() like this:

            v8::Handle<v8::Value> v8Undefined() { v8::Handle<v8::Value>(); }

        This is based on the following performance results:

        // 14.5 ns
        v8::Handle<v8::Value> xxxAttrGetter(..., info) {
            return v8::Undefined();
        }

        // 8.24 ns (This cannot be used where isolate can be 0.)
        v8::Handle<v8::Value> xxxAttrGetter(..., info) {
            return v8::Undefined(info.GetIsolate());
        }

        // 8.54 ns
        v8::Handle<v8::Value> xxxAttrGetter(..., info) {
            v8::Isolate* isolate = info.GetIsolate();
            return isolate ? v8::Handle<v8::Value>(v8::Undefined(isolate)) : v8::Handle<v8::Value>();
        }

        // 8.52 ns
        v8::Handle<v8::Value> xxxAttrGetter(..., info) {
            return v8::Handle<v8::Value>();
        }

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateConstructorGetter):
        (GenerateNormalAttrGetter):
        (GenerateNewFunctionTemplate):
        (GenerateEventListenerCallback):
        (GenerateFunctionCallback):
        (GenerateCallWith):
        (GenerateParametersCheck):
        (GenerateEventConstructorCallback):
        (GenerateNonStandardFunction):
        (GenerateImplementation):
        (NativeToJSValue):
        * bindings/scripts/test/V8/V8Float64Array.cpp:
        (WebCore::ConfigureV8Float64ArrayTemplate):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        (WebCore::TestActiveDOMObjectV8Internal::excitingFunctionCallback):
        (WebCore::TestActiveDOMObjectV8Internal::postMessageCallback):
        (WebCore::TestActiveDOMObjectV8Internal::postMessageAttrGetter):
        (WebCore::ConfigureV8TestActiveDOMObjectTemplate):
        (WebCore::V8TestActiveDOMObject::wrapSlow):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
        (WebCore::TestCustomNamedGetterV8Internal::anotherFunctionCallback):
        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
        (WebCore::V8TestEventConstructor::constructorCallback):
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        (WebCore::TestEventTargetV8Internal::addEventListenerCallback):
        (WebCore::TestEventTargetV8Internal::removeEventListenerCallback):
        (WebCore::ConfigureV8TestEventTargetTemplate):
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore::TestInterfaceV8Internal::supplementalMethod1Callback):
        (WebCore::TestInterfaceV8Internal::supplementalMethod2Callback):
        (WebCore::TestInterfaceV8Internal::supplementalMethod4Callback):
        (WebCore::ConfigureV8TestInterfaceTemplate):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
        (WebCore::TestMediaQueryListListenerV8Internal::methodCallback):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::readOnlyTestObjAttrAttrGetter):
        (WebCore::TestObjV8Internal::withScriptStateAttributeAttrGetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAttributeAttrGetter):
        (WebCore::TestObjV8Internal::withScriptStateAttributeRaisesAttrGetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAttributeRaisesAttrGetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateAttributeAttrGetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateAttributeRaisesAttrGetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateWithSpacesAttributeAttrGetter):
        (WebCore::TestObjV8Internal::withScriptArgumentsAndCallStackAttributeAttrGetter):
        (WebCore::TestObjV8Internal::withScriptArgumentsAndCallStackAttributeAttrSetter):
        (WebCore::TestObjV8Internal::cachedAttribute1AttrGetter):
        (WebCore::TestObjV8Internal::cachedAttribute2AttrGetter):
        (WebCore::TestObjV8Internal::TestObjConstructorGetter):
        (WebCore::TestObjV8Internal::voidMethodCallback):
        (WebCore::TestObjV8Internal::voidMethodWithArgsCallback):
        (WebCore::TestObjV8Internal::methodWithSequenceArgCallback):
        (WebCore::TestObjV8Internal::serializedValueCallback):
        (WebCore::TestObjV8Internal::idbKeyCallback):
        (WebCore::TestObjV8Internal::optionsObjectCallback):
        (WebCore::TestObjV8Internal::methodWithExceptionCallback):
        (WebCore::TestObjV8Internal::addEventListenerCallback):
        (WebCore::TestObjV8Internal::removeEventListenerCallback):
        (WebCore::TestObjV8Internal::withScriptStateVoidCallback):
        (WebCore::TestObjV8Internal::withScriptStateVoidExceptionCallback):
        (WebCore::TestObjV8Internal::withScriptExecutionContextCallback):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateCallback):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateObjExceptionCallback):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateWithSpacesCallback):
        (WebCore::TestObjV8Internal::withScriptArgumentsAndCallStackCallback):
        (WebCore::TestObjV8Internal::methodWithOptionalArgCallback):
        (WebCore::TestObjV8Internal::methodWithNonOptionalArgAndOptionalArgCallback):
        (WebCore::TestObjV8Internal::methodWithNonOptionalArgAndTwoOptionalArgsCallback):
        (WebCore::TestObjV8Internal::methodWithOptionalStringCallback):
        (WebCore::TestObjV8Internal::methodWithOptionalStringIsUndefinedCallback):
        (WebCore::TestObjV8Internal::methodWithOptionalStringIsNullStringCallback):
        (WebCore::TestObjV8Internal::methodWithCallbackArgCallback):
        (WebCore::TestObjV8Internal::methodWithNonCallbackArgAndCallbackArgCallback):
        (WebCore::TestObjV8Internal::methodWithCallbackAndOptionalArgCallback):
        (WebCore::TestObjV8Internal::conditionalMethod2Callback):
        (WebCore::TestObjV8Internal::conditionalMethod3Callback):
        (WebCore::TestObjV8Internal::overloadedMethod1Callback):
        (WebCore::TestObjV8Internal::overloadedMethod2Callback):
        (WebCore::TestObjV8Internal::overloadedMethod3Callback):
        (WebCore::TestObjV8Internal::overloadedMethod4Callback):
        (WebCore::TestObjV8Internal::overloadedMethod5Callback):
        (WebCore::TestObjV8Internal::overloadedMethod6Callback):
        (WebCore::TestObjV8Internal::overloadedMethod7Callback):
        (WebCore::TestObjV8Internal::overloadedMethod8Callback):
        (WebCore::TestObjV8Internal::overloadedMethod9Callback):
        (WebCore::TestObjV8Internal::overloadedMethod10Callback):
        (WebCore::TestObjV8Internal::classMethodCallback):
        (WebCore::TestObjV8Internal::overloadedMethod11Callback):
        (WebCore::TestObjV8Internal::overloadedMethod12Callback):
        (WebCore::TestObjV8Internal::classMethodWithClampCallback):
        (WebCore::TestObjV8Internal::enabledAtRuntimeMethod1Callback):
        (WebCore::TestObjV8Internal::enabledAtRuntimeMethod2Callback):
        (WebCore::TestObjV8Internal::enabledPerContextMethod1Callback):
        (WebCore::TestObjV8Internal::enabledPerContextMethod2Callback):
        (WebCore::TestObjV8Internal::convert1Callback):
        (WebCore::TestObjV8Internal::convert2Callback):
        (WebCore::TestObjV8Internal::convert3Callback):
        (WebCore::TestObjV8Internal::convert4Callback):
        (WebCore::TestObjV8Internal::convert5Callback):
        (WebCore::TestObjV8Internal::orangeCallback):
        (WebCore::ConfigureV8TestObjTemplate):
        (WebCore::V8TestObj::installPerContextProperties):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::acceptTransferListCallback):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::multiTransferListCallback):
        (WebCore::V8TestSerializedScriptValueInterface::constructorCallback):
        * bindings/v8/V8Binding.h:
        (WebCore::v8Undefined):
        (WebCore):

2012-08-03  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove v8StringToWebCoreString()
        https://bugs.webkit.org/show_bug.cgi?id=93087

        Reviewed by Adam Barth.

        There should be only one API that converts V8 String
        to WebCore String. v8ValueToWebCoreString() does it.
        We can remove v8StringToWebCoreString().

        No tests. No change in behavior.

        * bindings/v8/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::setBreakpoint):
        * bindings/v8/V8Binding.cpp:
        (WebCore::v8ValueToWebCoreString):
        * bindings/v8/V8Binding.h:
        (WebCore):

2012-07-20  Jon Lee  <jonlee@apple.com>

        Crash in Notification when setting a non-object as an event listener (91881)
        https://bugs.webkit.org/show_bug.cgi?id=91881
        <rdar://problem/11923341>

        Reviewed by Oliver Hunt.

        Check to make sure that the value being retrieved is an object. This is similar
        to the isObject() check done in the bindings code.

        Test: fast/notifications/notifications-event-listener-crash.html

        * bindings/js/Dictionary.h:
        (WebCore::Dictionary::getEventListener):

2012-08-03  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove v8StringToAtomicWebCoreString()
        https://bugs.webkit.org/show_bug.cgi?id=93086

        Reviewed by Dimitri Glazkov.

        There should be only one API that converts V8 String to
        AtomicString. v8ValueToAtomicWebCoreString() does it.
        We can remove v8StringToAtomicWebCoreString().

        No tests. No change in behavior.

        * bindings/v8/V8Binding.cpp:
        (WebCore::v8ValueToAtomicWebCoreString):
        * bindings/v8/V8Binding.h:
        (WebCore):
        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::getter):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::V8DOMWindow::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
        (WebCore::V8HTMLAllCollection::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
        (WebCore::V8HTMLCollection::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
        (WebCore::V8HTMLFormElement::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
        (WebCore::V8HTMLFrameSetElement::namedPropertyGetter):

2012-08-03  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: eliminate visitBaseClass method from NMI. It introduces unnecessary complexity.
        https://bugs.webkit.org/show_bug.cgi?id=93129

        Reviewed by Yury Semikhatsky.

        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::StyleRuleCSSStyleDeclaration::reportMemoryUsage):
        (WebCore::InlineCSSStyleDeclaration::reportMemoryUsage):
        * dom/CharacterData.cpp:
        (WebCore::CharacterData::reportMemoryUsage):
        * dom/ContainerNode.h:
        (WebCore::ContainerNode::reportMemoryUsage):
        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        * dom/Element.h:
        (WebCore::Element::reportMemoryUsage):
        * dom/MemoryInstrumentation.h:
        * dom/Node.cpp:
        (WebCore::Node::reportMemoryUsage):

2012-08-03  Alexandre Elias  <aelias@google.com>

        [chromium] Move ubercomp quads back into CC
        https://bugs.webkit.org/show_bug.cgi?id=93062

        Reviewed by James Robinson.

        Because GTFO is almost done, we can move back the quad types
        to CC and pickle them there.  This patch moves everything back
        to where it was before and changes types like WebRect to IntRect.

        As a bonus, I also added CCRenderPassDrawQuad and CCYUVVideoDrawQuad
        (which had been left in the CC files) to CCDrawQuad::size(), so now
        every quad type is ready for serialization.

        No new tests (no-op refactoring).

        * WebCore.gypi:
        * platform/chromium/support/WebCompositorStreamVideoQuad.cpp: Removed.
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawQuad):
        * platform/graphics/chromium/cc/CCCheckerboardDrawQuad.cpp: Copied from Source/WebCore/platform/graphics/chromium/cc/CCQuadSink.h.
        (WebCore):
        (WebCore::CCCheckerboardDrawQuad::create):
        (WebCore::CCCheckerboardDrawQuad::CCCheckerboardDrawQuad):
        (WebCore::CCCheckerboardDrawQuad::materialCast):
        * platform/graphics/chromium/cc/CCCheckerboardDrawQuad.h:
        (WebCore):
        (CCCheckerboardDrawQuad):
        * platform/graphics/chromium/cc/CCDebugBorderDrawQuad.cpp: Renamed from Source/WebCore/platform/chromium/support/WebCompositorDebugBorderQuad.cpp.
        (WebCore):
        (WebCore::CCDebugBorderDrawQuad::create):
        (WebCore::CCDebugBorderDrawQuad::CCDebugBorderDrawQuad):
        (WebCore::CCDebugBorderDrawQuad::materialCast):
        * platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h:
        (WebCore):
        (CCDebugBorderDrawQuad):
        (WebCore::CCDebugBorderDrawQuad::color):
        (WebCore::CCDebugBorderDrawQuad::width):
        * platform/graphics/chromium/cc/CCDrawQuad.cpp: Renamed from Source/WebCore/platform/chromium/support/WebCompositorQuad.cpp.
        (WebCore):
        (WebCore::CCDrawQuad::CCDrawQuad):
        (WebCore::CCDrawQuad::opaqueRect):
        (WebCore::CCDrawQuad::setQuadVisibleRect):
        (WebCore::CCDrawQuad::size):
        (WebCore::CCDrawQuad::setSharedQuadState):
        * platform/graphics/chromium/cc/CCDrawQuad.h:
        (WebCore):
        (CCDrawQuad):
        (WebCore::CCDrawQuad::quadRect):
        (WebCore::CCDrawQuad::quadTransform):
        (WebCore::CCDrawQuad::visibleContentRect):
        (WebCore::CCDrawQuad::scissorRect):
        (WebCore::CCDrawQuad::opacity):
        (WebCore::CCDrawQuad::needsBlending):
        (WebCore::CCDrawQuad::isLayerAxisAlignedIntRect):
        (WebCore::CCDrawQuad::quadVisibleRect):
        (WebCore::CCDrawQuad::isDebugQuad):
        (WebCore::CCDrawQuad::material):
        (WebCore::CCDrawQuad::sharedQuadState):
        (WebCore::CCDrawQuad::sharedQuadStateId):
        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
        (WebCore::CCHeadsUpDisplayLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.cpp: Renamed from Source/WebCore/platform/chromium/support/WebCompositorIOSurfaceQuad.cpp.
        (WebCore):
        (WebCore::CCIOSurfaceDrawQuad::create):
        (WebCore::CCIOSurfaceDrawQuad::CCIOSurfaceDrawQuad):
        (WebCore::CCIOSurfaceDrawQuad::materialCast):
        * platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.h:
        (WebCore):
        (CCIOSurfaceDrawQuad):
        (WebCore::CCIOSurfaceDrawQuad::ioSurfaceSize):
        (WebCore::CCIOSurfaceDrawQuad::ioSurfaceTextureId):
        (WebCore::CCIOSurfaceDrawQuad::orientation):
        * platform/graphics/chromium/cc/CCQuadCuller.h:
        (CCQuadCuller):
        * platform/graphics/chromium/cc/CCQuadSink.h:
        (WebCore):
        (CCQuadSink):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
        (WebCore::CCRenderPassDrawQuad::create):
        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
        (WebCore::CCRenderPassDrawQuad::materialCast):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
        (CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCSharedQuadState.cpp: Renamed from Source/WebCore/platform/chromium/support/WebCompositorSharedQuadState.cpp.
        (WebCore):
        (WebCore::CCSharedQuadState::CCSharedQuadState):
        (WebCore::CCSharedQuadState::create):
        (WebCore::CCSharedQuadState::isLayerAxisAlignedIntRect):
        * platform/graphics/chromium/cc/CCSharedQuadState.h:
        (WebCore):
        (CCSharedQuadState):
        * platform/graphics/chromium/cc/CCSolidColorDrawQuad.cpp: Renamed from Source/WebCore/platform/chromium/support/WebCompositorSolidColorQuad.cpp.
        (WebCore):
        (WebCore::CCSolidColorDrawQuad::create):
        (WebCore::CCSolidColorDrawQuad::CCSolidColorDrawQuad):
        (WebCore::CCSolidColorDrawQuad::materialCast):
        * platform/graphics/chromium/cc/CCSolidColorDrawQuad.h:
        (WebCore):
        (CCSolidColorDrawQuad):
        (WebCore::CCSolidColorDrawQuad::color):
        * platform/graphics/chromium/cc/CCStreamVideoDrawQuad.cpp: Renamed from Source/WebCore/platform/chromium/support/WebCompositorCheckerboardQuad.cpp.
        (WebCore):
        (WebCore::CCStreamVideoDrawQuad::create):
        (WebCore::CCStreamVideoDrawQuad::CCStreamVideoDrawQuad):
        (WebCore::CCStreamVideoDrawQuad::materialCast):
        * platform/graphics/chromium/cc/CCStreamVideoDrawQuad.h:
        (WebCore):
        (CCStreamVideoDrawQuad):
        (WebCore::CCStreamVideoDrawQuad::textureId):
        (WebCore::CCStreamVideoDrawQuad::matrix):
        * platform/graphics/chromium/cc/CCTextureDrawQuad.cpp: Renamed from Source/WebCore/platform/chromium/support/WebCompositorTextureQuad.cpp.
        (WebCore):
        (WebCore::CCTextureDrawQuad::create):
        (WebCore::CCTextureDrawQuad::CCTextureDrawQuad):
        (WebCore::CCTextureDrawQuad::setNeedsBlending):
        (WebCore::CCTextureDrawQuad::materialCast):
        * platform/graphics/chromium/cc/CCTextureDrawQuad.h:
        (WebCore):
        (CCTextureDrawQuad):
        (WebCore::CCTextureDrawQuad::uvRect):
        (WebCore::CCTextureDrawQuad::resourceId):
        (WebCore::CCTextureDrawQuad::premultipliedAlpha):
        (WebCore::CCTextureDrawQuad::flipped):
        * platform/graphics/chromium/cc/CCTileDrawQuad.cpp: Renamed from Source/WebCore/platform/chromium/support/WebCompositorTileQuad.cpp.
        (WebCore):
        (WebCore::CCTileDrawQuad::create):
        (WebCore::CCTileDrawQuad::CCTileDrawQuad):
        (WebCore::CCTileDrawQuad::materialCast):
        * platform/graphics/chromium/cc/CCTileDrawQuad.h:
        (WebCore):
        (CCTileDrawQuad):
        (WebCore::CCTileDrawQuad::resourceId):
        (WebCore::CCTileDrawQuad::textureOffset):
        (WebCore::CCTileDrawQuad::textureSize):
        (WebCore::CCTileDrawQuad::textureFilter):
        (WebCore::CCTileDrawQuad::swizzleContents):
        (WebCore::CCTileDrawQuad::leftEdgeAA):
        (WebCore::CCTileDrawQuad::topEdgeAA):
        (WebCore::CCTileDrawQuad::rightEdgeAA):
        (WebCore::CCTileDrawQuad::bottomEdgeAA):
        (WebCore::CCTileDrawQuad::isAntialiased):
        * platform/graphics/chromium/cc/CCYUVVideoDrawQuad.cpp:
        (WebCore::CCYUVVideoDrawQuad::create):
        (WebCore::CCYUVVideoDrawQuad::CCYUVVideoDrawQuad):
        (WebCore::CCYUVVideoDrawQuad::materialCast):
        * platform/graphics/chromium/cc/CCYUVVideoDrawQuad.h:
        (CCYUVVideoDrawQuad):

2012-08-03  Alexander Pavlov  <apavlov@chromium.org>

        Unreviewed, restore Web Inspector JS frontend compilability after r124484 (fix JSDoc annotations).

        * inspector/front-end/Settings.js:
        * inspector/front-end/SettingsScreen.js:
        * inspector/front-end/UserAgentSupport.js:
        (WebInspector.UserAgentSupport.DeviceOrientation):

2012-08-03  Philippe Normand  <pnormand@igalia.com>

        Unreviewed, rolling out r124614.
        http://trac.webkit.org/changeset/124614
        https://bugs.webkit.org/show_bug.cgi?id=91727

        gstreamer core .po files mess up the build again

        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
        (WTF::adoptGRef):
        * platform/graphics/gstreamer/GStreamerVersioning.cpp:
        (setGstElementClassMetadata):
        * platform/graphics/gstreamer/GStreamerVersioning.h:
        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
        (StreamingClient::didReceiveResponse):

2012-08-03  Benjamin Poulain  <bpoulain@apple.com>

        Initialize the Event Names' string from read only memory
        https://bugs.webkit.org/show_bug.cgi?id=92435

        Reviewed by Anders Carlsson.

        Similarily to r123689, we can initialize the event names' string from memory without copying the data.
        This saves us memory and initialization time.

        * dom/EventNames.cpp:
        (WebCore):

2012-08-03  Philippe Normand  <pnormand@igalia.com>

        [GTK][jhbuild] Switch to GStreamer 0.11 build
        https://bugs.webkit.org/show_bug.cgi?id=91727

        Reviewed by Gustavo Noronha Silva.

        Add a new function to encapsulate the GStreamer API removal of
        GST_OBJECT_IS_FLOATING in the upcoming 1.0 release. Use of this
        macro can now be replaced by calling the g_object_is_floating
        function.

        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
        (WTF::adoptGRef):
        * platform/graphics/gstreamer/GStreamerVersioning.cpp:
        (gstObjectIsFloating):
        * platform/graphics/gstreamer/GStreamerVersioning.h:

2012-08-03  George Staikos  <staikos@webkit.org>

        [BlackBerry] Add a null check for media implementation to fix a crash.
        https://bugs.webkit.org/show_bug.cgi?id=93107

        Reviewed by Rob Buis.

        Fixes media/video-size.html.

        * platform/blackberry/RenderThemeBlackBerry.cpp:
        (WebCore::RenderThemeBlackBerry::paintMediaSliderTrack): Add null check.

2012-08-03  Yury Semikhatsky  <yurys@chromium.org>

        Unreviewed. Fixed WinCE compilation after r124589.

        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::StyleRuleCSSStyleDeclaration::reportMemoryUsage):
        (WebCore::InlineCSSStyleDeclaration::reportMemoryUsage):

2012-08-03  Keishi Hattori  <keishi@webkit.org>

        Add keyboard support for color suggestion popup
        https://bugs.webkit.org/show_bug.cgi?id=93069

        Reviewed by Kent Tamura.

        This adds support for keyboard inside the color suggestion popup.
        Tab or arrow keys to move around. Return or space to select the color.
        Escape closes the popup.

        No new tests. Covered in platform/chromium/fast/forms/color/color-suggestion-picker-appearance.html.

        * Resources/colorSuggestionPicker.css:
        (.color-swatch):
        (.color-swatch:focus):
        * Resources/colorSuggestionPicker.js:
        (ColorPicker):
        (ColorPicker.prototype._layout):
        (ColorPicker.prototype.selectColorAtIndex): Selects color at index.
        (ColorPicker.prototype._handleMouseMove): Set focus to the swatch under the mouse cursor.
        (ColorPicker.prototype._handleKeyDown): Move focused element on arrow keys.
        (ColorPicker.prototype._handleMouseDown): Prevents blur on click.

2012-08-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>

        Add missing include to build on Mac OS 10.8

        Reviewed by Ossy.

        * platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp:

2012-08-03  Adam Barth  <abarth@webkit.org>

        [V8] Re-wire "target" half of the same-origin security check through Document rather than DOMWindow
        https://bugs.webkit.org/show_bug.cgi?id=93079

        Reviewed by Eric Seidel.

        Before this patch, we were traversing from Nodes to Frames to
        DOMWindows to SecurityOrigins when determing the "target" of an
        operation for the same-origin policy security check. Rather than
        detouring through DOMWindow, these security checks should operate in
        terms of ScriptExecutionContexts (aka Documents) because that's the
        canonical place we store SecurityOrigin objects.

        A future patch will re-wire the "active" part of the security check to
        use ScriptExecutionContexts as well and we'll be able to remove the
        extra copy of SecurityOrigin that we keep in DOMWindow.

        * bindings/generic/BindingSecurity.cpp:
        (WebCore::canAccessDocument):
        (WebCore::BindingSecurity::canAccessFrame):
        (WebCore::BindingSecurity::shouldAllowAccessToNode):
        * bindings/v8/BindingState.cpp:
        (WebCore::immediatelyReportUnsafeAccessTo):
        * bindings/v8/BindingState.h:
        (WebCore):
        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::reportUnsafeJavaScriptAccess):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::reportUnsafeAccessTo):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):

2012-08-03  Keishi Hattori  <keishi@webkit.org>

        ColorSuggestionPicker popup's height doesn't get smaller than 100 px
        https://bugs.webkit.org/show_bug.cgi?id=92945

        Reviewed by Kent Tamura.

        A window cannot be resized to be smaller than 100x100 pixels so this
        adjust the color suggestion popup UI to look better when there are only
        a few suggestions.

        Tests: platform/chromium/fast/forms/color/color-suggestion-picker-one-row-appearance.html
               platform/chromium/fast/forms/color/color-suggestion-picker-two-row-appearance.html

        * Resources/colorSuggestionPicker.css:
        (.color-swatch-container): Vertically center the swatches.

2012-08-03  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Remove InspectorCSSAgent from InstrumentingAgents on clearFrontend()
        https://bugs.webkit.org/show_bug.cgi?id=93082

        Reviewed by Yury Semikhatsky.

        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::InspectorCSSAgent):
        (WebCore::InspectorCSSAgent::~InspectorCSSAgent):
        (WebCore::InspectorCSSAgent::setFrontend):
        (WebCore::InspectorCSSAgent::clearFrontend):

2012-08-03  Eugene Klyuchnikov  <eustas.big@gmail.com>

        Web Inspector: Profiles: extract save to file / load from code
        https://bugs.webkit.org/show_bug.cgi?id=92348

        Reviewed by Yury Semikhatsky.

        Motivation: extract reusable code for timeline load/save.
        FileUtils.js will contain common code. Not all code moved to FileUtils
        to make review easier. This code will be moved in next patch.

        Core abstractions: OutputStream and OutputStreamDelegate.

        OutputStream is interface that is used to transfer entity divded
        to chunks. Transfer process is explicitly initialized (startTransfer)
        and finalized (finishTrnsfer).

        OutputStreamDelegate is interface to receive notifications about
        transfer process: onTransferStarted, onChunkTransferred, onTransferFinished.

        ChunkedFileReader: utility class that loads file by chunks of specified
        size and notifies given delegate. OutputStream is supplied as a
        parameter of method "start".

        ChunkedFileWriter: implementation of OutputStream that saves data
        to file specified by file name and notifies given delegate.

        * WebCore.gypi: Added 'FileUtils.js'.
        * WebCore.vcproj/WebCore.vcproj: Added 'FileUtils.js'.
        * inspector/compile-front-end.py: Added 'FileUtils.js'.
        * inspector/front-end/FileUtils.js: Added.
        (WebInspector.OutputStreamDelegate): Added.
        (WebInspector.ChunkedFileReader): Added.
        (WebInspector.createFileSelectorElement): Added utility method to construct
        hidden input element to select file.
        * inspector/front-end/HeapSnapshotLoader.js: Adopted new API.
        * inspector/front-end/HeapSnapshotProxy.js: Adopted new API.
        * inspector/front-end/HeapSnapshotView.js: Adopted new API.
        (WebInspector.HeapSnapshotLoadFromFileDelegate):
        Extracted from existing code.
        (WebInspector.ChunkedFileWriter): Renamed and refactored.
        (WebInspector.HeapSnapshotSaveToFileDelegate):
        Extracted from existing code.
        * inspector/front-end/ProfilesPanel.js: Adopted new API.

2012-08-03  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Incorrect blob url href when inspecting
        https://bugs.webkit.org/show_bug.cgi?id=93076

        Reviewed by Vsevolod Vlasov.

        Special-cased the "blob" scheme to return the original URL intact on completion.

        * inspector/front-end/ResourceUtils.js:
        (WebInspector.completeURL):

2012-08-03  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add CSSRule memory instrumentation
        https://bugs.webkit.org/show_bug.cgi?id=92962

        Reviewed by Pavel Feldman.

        Added memory footprint reporting method to CSSRule and its descendants.

        * css/CSSCharsetRule.cpp:
        (WebCore::CSSCharsetRule::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSCharsetRule.h:
        (CSSCharsetRule):
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::reportMemoryUsage):
        (WebCore):
        * css/CSSComputedStyleDeclaration.h:
        (CSSComputedStyleDeclaration):
        * css/CSSFontFaceRule.cpp:
        (WebCore::CSSFontFaceRule::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSFontFaceRule.h:
        (CSSFontFaceRule):
        * css/CSSImportRule.cpp:
        (WebCore::CSSImportRule::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSImportRule.h:
        (CSSImportRule):
        * css/CSSMediaRule.cpp:
        (WebCore::CSSMediaRule::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSMediaRule.h:
        (CSSMediaRule):
        * css/CSSPageRule.cpp:
        (WebCore::CSSPageRule::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSPageRule.h:
        (CSSPageRule):
        * css/CSSRule.cpp:
        (WebCore::CSSRule::reportMemoryUsage): we manually implement polymorphic
        call here to avoid adding vtable pointer to all CSSRule objects. Descendants
        are expected to report their memory via reportDescendantMemoryUsage. The name
        is intentionally different from reportMemoryUsage to avoid accidential infitite
        recursion: if the descendants overrode non-virtual CSSRule::reportMemoryUsage,
        it would be easy to add a new descendant type to the switch in
        CSSRule::reportMemoryUsage without providing proper override for reportMemoryUsage
        and CSSRule::reportMemoryUsage would end up calling itself.
        (WebCore):
        (WebCore::CSSRule::reportBaseClassMemoryUsage): again we cannot use
        MemoryClassInfo::visitBaseClass like we do for virtual methods because it would
        lead to a recursive call of CSSRule::reportMemoryUsage. This is why we use
        reportBaseClassMemoryUsage to allow descendants to report objects referenced
        from their base class.
        * css/CSSRule.h:
        (WebCore):
        (CSSRule):
        * css/CSSRuleList.cpp:
        (WebCore::StaticCSSRuleList::reportMemoryUsage):
        (WebCore):
        * css/CSSRuleList.h:
        (WebCore):
        (CSSRuleList):
        (StaticCSSRuleList):
        (LiveCSSRuleList):
        * css/CSSStyleDeclaration.h:
        (WebCore):
        (CSSStyleDeclaration):
        * css/CSSStyleRule.cpp:
        (WebCore::CSSStyleRule::reportDescendantMemoryUsage):
        (WebCore):
        * css/CSSStyleRule.h:
        (CSSStyleRule):
        * css/CSSStyleSheet.cpp:
        (StyleSheetCSSRuleList):
        (WebCore::CSSStyleSheet::reportMemoryUsage):
        * css/CSSUnknownRule.h:
        (CSSUnknownRule):
        (WebCore::CSSUnknownRule::reportDescendantMemoryUsage):
        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::reportMemoryUsage):
        (WebCore):
        (WebCore::StyleRuleCSSStyleDeclaration::reportMemoryUsage):
        (WebCore::InlineCSSStyleDeclaration::reportMemoryUsage):
        * css/PropertySetCSSStyleDeclaration.h:
        (PropertySetCSSStyleDeclaration):
        (StyleRuleCSSStyleDeclaration):
        (InlineCSSStyleDeclaration):
        * css/WebKitCSSKeyframeRule.cpp:
        (WebCore::WebKitCSSKeyframeRule::reportDescendantMemoryUsage):
        (WebCore):
        * css/WebKitCSSKeyframeRule.h:
        (WebKitCSSKeyframeRule):
        * css/WebKitCSSKeyframesRule.cpp:
        (WebCore::WebKitCSSKeyframesRule::reportDescendantMemoryUsage):
        (WebCore):
        * css/WebKitCSSKeyframesRule.h:
        (WebKitCSSKeyframesRule):
        * css/WebKitCSSRegionRule.cpp:
        (WebCore::WebKitCSSRegionRule::reportDescendantMemoryUsage):
        (WebCore):
        * css/WebKitCSSRegionRule.h:
        (WebKitCSSRegionRule):

2012-08-03  Adam Barth  <abarth@webkit.org>

        WebCore::DragController::cleanupAfterSystemDrag should null-check page
        https://bugs.webkit.org/show_bug.cgi?id=61815

        Reviewed by Eric Seidel.

        * page/DragController.cpp:
        (WebCore::DragController::dragEnteredOrUpdated):
        (WebCore::DragController::doSystemDrag):

2012-08-03  Sergio Carlos Morales Angeles  <carloschilazo@gmail.com>

        Delete text from password does nothing.
        https://bugs.webkit.org/show_bug.cgi?id=92040

        Reviewed by Ryosuke Niwa.

        Use Editor::canDelete() to determine if field is editable or not.
        Added password-delete-contents test.

        Test: editing/deleting/password-delete-contents.html

        * editing/EditorCommand.cpp:
        (WebCore::enabledDelete):

2012-08-03  Jan Keromnes  <janx@linux.com>

        Web Inspector: Make textModel private to textEditor
        https://bugs.webkit.org/show_bug.cgi?id=92999

        Reviewed by Pavel Feldman.

        Making textModel private to the textEditor ensures that it is accessed
        only through the textEditor, making the latter more modular.

        Tests were changed accordingly.

        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.afterTextChanged):
        (WebInspector.JavaScriptSourceFrame.prototype._restoreBreakpointsAfterEditing):
        (WebInspector.JavaScriptSourceFrame.prototype._addBreakpointDecoration):
        (WebInspector.JavaScriptSourceFrame.prototype._removeBreakpointDecoration):
        (WebInspector.JavaScriptSourceFrame.prototype._lineNumberAfterEditing):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame):
        (WebInspector.SourceFrame.prototype.setContent):
        (WebInspector.SourceFrame.prototype.replaceAllWith):
        (WebInspector.SourceFrame.prototype._collectRegexMatches):
        (WebInspector.SourceFrame.prototype.addMessageToSource):
        (WebInspector.SourceFrame.prototype.removeMessageFromSource):
        (WebInspector.TextEditorDelegateForSourceFrame.prototype.commitEditing):
        * inspector/front-end/TextEditor.js:
        (WebInspector.TextEditor.prototype.setText):
        (WebInspector.TextEditor.prototype.text):
        (WebInspector.TextEditor.prototype.range):
        (WebInspector.TextEditor.prototype.line):
        (WebInspector.TextEditor.prototype.get linesCount):
        (WebInspector.TextEditor.prototype.setAttribute):
        (WebInspector.TextEditor.prototype.getAttribute):
        (WebInspector.TextEditor.prototype.removeAttribute):
        * inspector/front-end/UISourceCodeFrame.js:
        (WebInspector.UISourceCodeFrame.prototype.afterTextChanged):

2012-08-03  Adam Barth  <abarth@webkit.org>

        V8Proxy::retrieve(*) leads to really obfuscated code and should be removed
        https://bugs.webkit.org/show_bug.cgi?id=93072

        Reviewed by Eric Seidel.

        Once upon a time, V8Proxy::retrieve did a bunch of checks before
        returning the V8Proxy object (such as checking whether script was
        enabled). Over time, we've removed all of these checks in order to fix
        various bugs. Now all it does is check whether the Frame is 0. However,
        because the function ends up returning 0 when its argument is 0, the
        caller sill needs to have a null check.

        This patch deletes all the variations of V8Proxy::retrieve(*) and
        inlines them into their callers. In several cases, inlining the
        function call showed that we were testing the Frame for 0 twice, and
        I've removed the redundant null checks. In other cases, I've
        uncontorted the callers to make the code more readable.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateToV8Converters):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        (WebCore::V8TestActiveDOMObject::wrapSlow):
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        (WebCore::V8TestNamedConstructorConstructorCallback):
        * bindings/scripts/test/V8/V8TestNode.cpp:
        (WebCore::V8TestNode::wrapSlow):
        * bindings/v8/PageScriptDebugServer.cpp:
        (WebCore::PageScriptDebugServer::addListener):
        * bindings/v8/ScheduledAction.cpp:
        (WebCore::ScheduledAction::execute):
        * bindings/v8/ScriptController.h:
        (WebCore::ScriptController::windowShell):
        * bindings/v8/V8DOMWrapper.cpp:
        (WebCore::V8DOMWrapper::instantiateV8Object):
        * bindings/v8/V8EventListener.cpp:
        (WebCore::V8EventListener::callListenerFunction):
        * bindings/v8/V8Helpers.cpp:
        (WebCore::toV8Proxy):
        * bindings/v8/V8LazyEventListener.cpp:
        (WebCore::V8LazyEventListener::callListenerFunction):
        (WebCore::V8LazyEventListener::prepareListenerObject):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::handleOutOfMemory):
        (WebCore::V8Proxy::retrievePerContextData):
        (WebCore::V8Proxy::mainWorldContext):
        (WebCore::toV8Context):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::V8DOMWindow::addEventListenerCallback):
        (WebCore::V8DOMWindow::removeEventListenerCallback):
        * bindings/v8/custom/V8DocumentCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::V8HTMLDocument::openCallback):
        (WebCore::toV8):
        * bindings/v8/custom/V8SVGDocumentCustom.cpp:
        (WebCore::toV8):

2012-08-03  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Add *explicit* keyword to constructors in WebCore/accessibility
        https://bugs.webkit.org/show_bug.cgi?id=93067

        Reviewed by Kentaro Hara.

        As a step to add *explicit* keyword to constructors which have a parameter,
        *explicit* keyword is added to Source/WebCore/accessibility in order to avoid
        implicit type conversion.

        No new tests. Covered by existing tests.

        * accessibility/AXObjectCache.h:
        (AXObjectCache):
        * accessibility/AccessibilityARIAGrid.h:
        (AccessibilityARIAGrid):
        * accessibility/AccessibilityARIAGridCell.h:
        (AccessibilityARIAGridCell):
        * accessibility/AccessibilityARIAGridRow.h:
        (AccessibilityARIAGridRow):
        * accessibility/AccessibilityList.h:
        (AccessibilityList):
        * accessibility/AccessibilityListBox.h:
        (AccessibilityListBox):
        * accessibility/AccessibilityMediaControls.h:
        (AccessibilityMediaControl):
        (AccessibilityMediaTimeline):
        (AccessibilityMediaControlsContainer):
        (AccessibilityMediaTimeDisplay):
        * accessibility/AccessibilityMenuList.h:
        (AccessibilityMenuList):
        * accessibility/AccessibilityNodeObject.h:
        (AccessibilityNodeObject):
        * accessibility/AccessibilityProgressIndicator.h:
        (AccessibilityProgressIndicator):
        * accessibility/AccessibilityRenderObject.h:
        (AccessibilityRenderObject):
        * accessibility/AccessibilityScrollView.h:
        (AccessibilityScrollView):
        * accessibility/AccessibilityScrollbar.h:
        (AccessibilityScrollbar):
        * accessibility/AccessibilitySlider.h:
        (AccessibilitySlider):
        * accessibility/AccessibilityTable.h:
        (AccessibilityTable):
        * accessibility/AccessibilityTableCell.h:
        (AccessibilityTableCell):
        * accessibility/AccessibilityTableRow.h:
        (AccessibilityTableRow):

2012-08-03  Abhishek Arya  <inferno@chromium.org>

        Regression(r124564): Wrong inlineChildrenBlock->hasLayer() computed in RenderBlock::removeChild.
        https://bugs.webkit.org/show_bug.cgi?id=90800

        Reviewed by Eric Seidel.

        r124564 reversed the sequence of setStyle and removeChildNode calls, but failed to cache the value
        of inlineChildrenBlock->hasLayer(). So, it will be null when the layer is removed from parent in setStyle.
        Fixed by the caching the bool value. 

        Covered by existing test fast/block/layer-not-removed-from-parent-crash.html.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removeChild):

2012-08-03  Mario Sanchez Prada  <msanchez@igalia.com>

        [GTK] Add a new and reusable enchant-based spellchecker in WebCore
        https://bugs.webkit.org/show_bug.cgi?id=90269

        Reviewed by Martin Robinson.

        Move enchant specific code down to WebCore, into a new class
        TextCheckerEnchant, that we can use from WK1 and WK2.

        * GNUmakefile.am: Add flags to handle the SPELLCHECK feature.
        * GNUmakefile.list.am: Added new files.
        * platform/text/gtk/TextCheckerEnchant.cpp: Added.
        (getAvailableDictionariesCallback):
        (TextCheckerEnchant::TextCheckerEnchant):
        (TextCheckerEnchant::~TextCheckerEnchant):
        (TextCheckerEnchant::ignoreWord):
        (TextCheckerEnchant::learnWord):
        (TextCheckerEnchant::checkSpellingOfString):
        (TextCheckerEnchant::getGuessesForWord):
        (TextCheckerEnchant::updateSpellCheckingLanguages):
        (TextCheckerEnchant::freeEnchantBrokerDictionaries):
        * platform/text/gtk/TextCheckerEnchant.h: Added.
        (WebCore):
        (TextCheckerEnchant):
        (WebCore::TextCheckerEnchant::create):

2012-08-03  Kwang Yul Seo  <skyul@company100.net>

        Unreviewed r124536 followup, fix the assertion error on Chromium.

        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):

2012-08-03  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: simple replace objectType with ownerObjectType in NMI code.
        https://bugs.webkit.org/show_bug.cgi?id=93001

        Reviewed by Yury Semikhatsky.

        In all the cases when we are visiting members, objectType field is actually the object type of the member's owner object.

        * dom/MemoryInstrumentation.h:
        (WebCore::MemoryInstrumentation::InstrumentedPointer::InstrumentedPointer):
        (InstrumentedPointer):
        (WebCore::MemoryInstrumentation::addObject):
        (WebCore::MemoryInstrumentation::addInstrumentedObject):
        (WebCore::MemoryInstrumentation::addRawBuffer):
        (WebCore::MemoryInstrumentation::OwningTraits::addInstrumentedObject):
        (WebCore::MemoryInstrumentation::OwningTraits::addObject):
        (WebCore::MemoryObjectInfo::MemoryObjectInfo):
        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl):
        (WebCore::MemoryInstrumentation::addObjectImpl):
        (WebCore::MemoryInstrumentation::addHashMap):
        (WebCore::MemoryInstrumentation::addHashSet):
        (WebCore::MemoryInstrumentation::addInstrumentedCollection):
        (WebCore::MemoryInstrumentation::addListHashSet):
        (WebCore::MemoryInstrumentation::addVector):
        (WebCore::::process):

2012-08-02  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: extend test coverage for nmi code and fix 2 bugs.
        https://bugs.webkit.org/show_bug.cgi?id=92994

        Reviewed by Yury Semikhatsky.

        1) owner object type propagation.
        If a class with object-type DOM has an instrumented member with object-type Other then it has to be recorded as DOM.
        Sample: We have SharedBuffer class and we don't know the object-type for it but we know that it is owned by an object with object-type CachedResourceImage.

        2) the first member of an instrumented non virtual class was skipped even if it was reported properly.
        it happened because the first member has the same address as it's owner

        * dom/MemoryInstrumentation.h:
        (WebCore::MemoryInstrumentation::addRootObject):
        (WebCore::MemoryInstrumentation::InstrumentedPointer::InstrumentedPointer):
        (InstrumentedPointer):
        (WebCore::MemoryInstrumentation::addInstrumentedObject):
        (MemoryInstrumentation):
        (WebCore::MemoryInstrumentation::OwningTraits::addInstrumentedObject):
        (WebCore::MemoryObjectInfo::MemoryObjectInfo):
        (WebCore::MemoryObjectInfo::reportObjectInfo):
        (WebCore::MemoryClassInfo::addInstrumentedMember):
        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl):
        (WebCore::MemoryInstrumentation::addObjectImpl):
        (WebCore::MemoryInstrumentation::addInstrumentedCollection):
        (WebCore::::process):

2012-08-03  Kentaro Hara  <haraken@chromium.org>

        [V8] Make v8NonStringValueToWebCoreString a static method
        https://bugs.webkit.org/show_bug.cgi?id=93066

        Reviewed by Adam Barth.

        v8NonStringValueToWebCoreString() and v8NonStringValueToAtomicWebCoreString()
        are not intended to be used from outside V8Binding.cpp.
        They should be static methods.

        No tests. No change in behavior.

        * bindings/v8/V8Binding.cpp:
        (WebCore::v8NonStringValueToWebCoreString):
        (WebCore):
        (WebCore::v8NonStringValueToAtomicWebCoreString):
        * bindings/v8/V8Binding.h:
        (WebCore::v8StringToWebCoreString):
        (WebCore::v8StringToAtomicWebCoreString):

2012-08-02  Abhishek Arya  <inferno@chromium.org>

        Crash due to layer not removed from parent for anonymous block.
        https://bugs.webkit.org/show_bug.cgi?id=90800

        Reviewed by Kent Tamura.

        Reverse the order of setStyle and removeChildNode calls. This ensures that setting the style
        properly removes its layer from the parent in RenderBoxModelObject::styleDidChange. Calling
        removeChildNode before calling setStyle is problematic since the parent layer never gets
        notified.

        Test: fast/block/layer-not-removed-from-parent-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removeChild):

2012-08-02  Adam Barth  <abarth@webkit.org>

        V8Proxy::retrieveFrameFor*Context are used only by BindingState and should be removed as separate functions
        https://bugs.webkit.org/show_bug.cgi?id=93049

        Reviewed by Eric Seidel.

        No one calls these functions directly anymore. This patch removes them
        from V8Proxy and inlines their logic into BindingState.cpp.

        * bindings/v8/BindingState.cpp:
        (WebCore::activeContext):
        (WebCore):
        (WebCore::activeWindow):
        (WebCore::activeFrame):
        (WebCore::firstFrame):
        (WebCore::currentFrame):
        * bindings/v8/V8Proxy.cpp:
        * bindings/v8/V8Proxy.h:
        (V8Proxy):

2012-08-02  Yoshifumi Inoue  <yosin@chromium.org>

        Make order of attribute/method in HTMLTrackElement.idl as same as specification
        https://bugs.webkit.org/show_bug.cgi?id=80102

        Reviewed by Kentaro Hara.

        No new tests. This patch doesn't change behavior.

        * html/HTMLTrackElement.idl: Reorder attribute/method position.

2012-08-02  Kent Tamura  <tkent@chromium.org>

        Fix crashes for <input> and <textarea> with display:run-in.
        https://bugs.webkit.org/show_bug.cgi?id=87300

        Reviewed by Abhishek Arya.

        Introduce RenderObject::canBeReplacedWithInlineRunIn, and renderers which
        should not be run-in override it so that it returns false.

        Test: fast/runin/input-text-runin.html
              fast/runin/textarea-runin.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::moveRunInUnderSiblingBlockIfNeeded):
        Checks canBeReplacedWithInlineRunIn instead of checking tag names.
        * rendering/RenderFileUploadControl.cpp:
        (WebCore::RenderFileUploadControl::canBeReplacedWithInlineRunIn):
        Added. Disallow run-in.
        * rendering/RenderFileUploadControl.h:
        (RenderFileUploadControl): Declare canBeReplacedWithInlineRunIn.
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::canBeReplacedWithInlineRunIn):
        Added. Disallow run-in. This is not a behavior change.
        * rendering/RenderListBox.h:
        (RenderListBox): Declare canBeReplacedWithInlineRunIn.
        * rendering/RenderMenuList.cpp:
        (WebCore::RenderMenuList::canBeReplacedWithInlineRunIn):
        Added. Disallow run-in. This is not a behavior change.
        * rendering/RenderMenuList.h:
        (RenderMenuList): Declare canBeReplacedWithInlineRunIn.
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::canBeReplacedWithInlineRunIn):
        Added. Allow run-in by default.
        * rendering/RenderObject.h:
        (RenderObject): Declare canBeReplacedWithInlineRunIn.
        * rendering/RenderProgress.cpp:
        (WebCore::RenderProgress::canBeReplacedWithInlineRunIn):
        Added. Disallow run-in. This is not a behavior change.
        * rendering/RenderProgress.h:
        (RenderProgress): Declare canBeReplacedWithInlineRunIn.
        * rendering/RenderSlider.cpp:
        (WebCore::RenderSlider::canBeReplacedWithInlineRunIn):
        Added. Disallow run-in.
        * rendering/RenderSlider.h:
        (RenderSlider): Declare canBeReplacedWithInlineRunIn.
        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::canBeReplacedWithInlineRunIn):
        Added. Disallow run-in.
        * rendering/RenderTextControl.h:
        (RenderTextControl): Declare canBeReplacedWithInlineRunIn.

2012-08-02  Kihong Kwon  <kihong.kwon@samsung.com>

        [EFL] Fix wrong assigned value of BatteryStatus
        https://bugs.webkit.org/show_bug.cgi?id=93058

        Reviewed by Kentaro Hara.

        There is a wrong change in the bug 92964.
        property variable have to be used after assigned value in the setBatteryClient.

        * platform/efl/BatteryProviderEfl.cpp:
        (WebCore::BatteryProviderEfl::setBatteryClient):

2012-08-02  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] Add default implementation of GraphicsLayerClient::contentsVisible()
        https://bugs.webkit.org/show_bug.cgi?id=93036

        Reviewed by George Staikos.

        Returning true by default would cause memory usage to balloon, because
        the LayerTiler would believe every tile is visible and always needs to
        be rendered. Instead, we choose to return false by default, relying
        entirely on reactive rendering through render jobs.

        However this revealed a subtle bug. If the entire layer was invalidated
        every frame, checkerboard would never resolve with this default
        implementation.

        Fixed by not clearing render jobs when the entire layer is invalidated,
        thus making us robust against an incomplete contentsVisible
        implementation.

        Also removed dead code related to the deprecated
        LayerTiler::m_tilesWebKitThread mechanism, which has been replaced by
        the implicit visibility management resulting from render jobs.

        With m_tilesWebKitThread out of the way, rename m_tilesCompositingThread
        to be simply m_tiles.

        PR 187458

        This is not currently testable using BlackBerry testing infrastructure.

        * platform/graphics/GraphicsLayerClient.h:
        (WebCore::GraphicsLayerClient::contentsVisible): Gets a default implementation instead of being pure virtual.
        * platform/graphics/blackberry/LayerTile.cpp:
        (WebCore::LayerTile::LayerTile): Merged LayerTileData into LayerTile now that m_tilesWebKitThread is gone.
        * platform/graphics/blackberry/LayerTile.h:
        (LayerTile):
        * platform/graphics/blackberry/LayerTiler.cpp:
        (WebCore::LayerTiler::~LayerTiler):
        (WebCore::LayerTiler::updateTextureContentsIfNeeded): Bug fix to make us robust against the new default implementation of GraphicsLayerClient::contentsVisible()
        (WebCore::LayerTiler::shouldPerformRenderJob):
        (WebCore::LayerTiler::layerVisibilityChanged):
        (WebCore::LayerTiler::uploadTexturesIfNeeded):
        (WebCore::LayerTiler::drawTexturesInternal):
        (WebCore::LayerTiler::deleteTextures):
        (WebCore::LayerTiler::pruneTextures):
        (WebCore::LayerTiler::bindContentsTexture):
        * platform/graphics/blackberry/LayerTiler.h:
        (LayerTiler):

2012-08-02  Keishi Hattori  <keishi@webkit.org>

        Slider should snap to datalist tick marks
        https://bugs.webkit.org/show_bug.cgi?id=92640

        Reviewed by Kent Tamura.

        Input type=range slider snaps to datalist tick marks.

        Test: fast/forms/datalist/range-snap-to-datalist.html

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::findClosestTickMarkValue): Just calls InputType::findClosestTickMarkValue.
        (WebCore):
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/InputType.cpp:
        (WebCore):
        (WebCore::InputType::findClosestTickMarkValue): Overridden by RangeInputType.
        * html/InputType.h:
        (InputType):
        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::RangeInputType):
        (WebCore):
        (WebCore::RangeInputType::listAttributeTargetChanged): Mark m_tickMarkValues as dirty.
        (WebCore::decimalCompare):
        (WebCore::RangeInputType::updateTickMarkValues): Sets m_tickMarkValues to a list of sorted valid datalist values.
        (WebCore::RangeInputType::findClosestTickMarkValue): Finds closest tick mark value to a given value.
        * html/RangeInputType.h:
        (RangeInputType):
        * html/shadow/SliderThumbElement.cpp:
        (WebCore):
        (WebCore::SliderThumbElement::setPositionFromPoint): Snaps to the closest tick mark value if it is within a certain distance.

2012-08-02  Ryuan Choi  <ryuan.choi@samsung.com>

        [EFL] Crash while loading plugin after r121467
        https://bugs.webkit.org/show_bug.cgi?id=92943

        Reviewed by Laszlo Gombos.

        r121467 replaced POSIX dlopen to helpers in eina_module, but some codes
        are not changed.

        No new tests, behavior has not changed.

        * plugins/efl/PluginPackageEfl.cpp:
        (WebCore::PluginPackage::fetchInfo):
        Changes dlsym to eina_module_symbol_get to follow changes of r121467.

2012-08-02  Adam Barth  <abarth@webkit.org>

        V8 bindings code that tries to find its context should use BindingState functions rather than V8Proxy
        https://bugs.webkit.org/show_bug.cgi?id=93038

        Reviewed by Eric Seidel.

        After this patch, most code in the V8 bindings that tries to determine
        it's "context" goes through BindingState.h rather than V8Proxy. This
        patch is a step towards unifying all these code paths.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNamedConstructorCallback):
        * bindings/v8/BindingState.cpp:
        (WebCore::currentFrame):
        (WebCore):
        * bindings/v8/BindingState.h:
        (WebCore):
        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::retrieveFrameForEnteredContext):
        (WebCore::ScriptController::retrieveFrameForCurrentContext):
        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::v8UncaughtExceptionHandler):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::reportUnsafeAccessTo):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):
        * bindings/v8/V8Utilities.cpp:
        (WebCore::getScriptExecutionContext):
        * bindings/v8/custom/V8AudioContextCustom.cpp:
        (WebCore::V8AudioContext::constructorCallback):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::handlePostMessageCallback):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::V8HTMLDocument::writeCallback):
        (WebCore::V8HTMLDocument::writelnCallback):
        (WebCore::V8HTMLDocument::openCallback):
        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
        (WebCore::v8HTMLImageElementConstructorCallback):

2012-08-02  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124540.
        http://trac.webkit.org/changeset/124540
        https://bugs.webkit.org/show_bug.cgi?id=93055

        Broke compile on Chromium Win bot (Requested by dimich on
        #webkit).

        * Modules/indexeddb/IDBBackingStore.h:
        (IDBBackingStore):
        * Modules/indexeddb/IDBCallbacks.h:
        (IDBCallbacks):
        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::PendingOpenCall::PendingOpenCall):
        (WebCore::IDBDatabaseBackendImpl::IDBDatabaseBackendImpl):
        (WebCore::IDBDatabaseBackendImpl::openInternal):
        (WebCore::IDBDatabaseBackendImpl::metadata):
        (WebCore::IDBDatabaseBackendImpl::setVersion):
        (WebCore::IDBDatabaseBackendImpl::transactionFinished):
        (WebCore::IDBDatabaseBackendImpl::processPendingCalls):
        (WebCore::IDBDatabaseBackendImpl::registerFrontendCallbacks):
        (WebCore::IDBDatabaseBackendImpl::deleteDatabase):
        (WebCore::IDBDatabaseBackendImpl::close):
        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
        (IDBDatabaseBackendImpl):
        * Modules/indexeddb/IDBDatabaseCallbacks.h:
        (IDBDatabaseCallbacks):
        * Modules/indexeddb/IDBFactoryBackendImpl.cpp:
        (WebCore::IDBFactoryBackendImpl::open):
        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
        (WebCore::IDBLevelDBBackingStore::getIDBDatabaseMetaData):
        (WebCore::IDBLevelDBBackingStore::createIDBDatabaseMetaData):
        (WebCore::IDBLevelDBBackingStore::deleteDatabase):
        * Modules/indexeddb/IDBLevelDBBackingStore.h:
        (IDBLevelDBBackingStore):
        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
        (WebCore::IDBTransactionBackendImpl::commit):

2012-08-02  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] Upstream GraphicsLayerClient::contentsVisible()
        https://bugs.webkit.org/show_bug.cgi?id=93040

        Reviewed by George Staikos.

        Our LayerTiler uses both proactive and reactive rendering to populate
        tiles. If contentsVisible() is accurate, it will cause the right tiles
        to be rendered. Failing that, when a dirty tile is found to be visible
        on the compositing thread, a render job is scheduled.

        This is not currently testable using BlackBerry testing infrastructure.

        * platform/graphics/GraphicsLayerClient.h:
        (GraphicsLayerClient): New BlackBerry-specific method "contentsVisible" added.
        * rendering/RenderLayerBacking.cpp:
        (WebCore):
        (WebCore::RenderLayerBacking::contentsVisible): BlackBerry-specific implementation.

2012-08-02  Alexandre Elias  <aelias@google.com>

        [chromium] deviceViewportSize cleanup
        https://bugs.webkit.org/show_bug.cgi?id=92794

        Reviewed by Adrienne Walker.

        In the future, CSS layout size will become increasingly disassociated
        from physical device size, and it will become impossible to infer one
        from the other inside the compositor.  Therefore, this patch allows
        deviceViewportSize to be explicitly passed in by the outside client.

        I also renamed the existing viewportSize field to "layoutViewportSize"
        for clarity, and converted its uses to deviceViewportSize since
        that is more appropriate.

        I had to add some default-value scaffolding to WebLayerTreeView in
        order to avoid breaking ui/compositor.  We can delete it once that's
        updated.

        No new tests (covered by existing tests).

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
        (WebCore::CCLayerTreeHost::setViewportSize):
        (WebCore::CCLayerTreeHost::updateLayers):
        (WebCore::CCLayerTreeHost::setDeviceScaleFactor):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::layoutViewportSize):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::canDraw):
        (WebCore::CCLayerTreeHostImpl::startPageScaleAnimation):
        (WebCore::CCLayerTreeHostImpl::setViewportSize):
        (WebCore::CCLayerTreeHostImpl::setDeviceScaleFactor):
        (WebCore::CCLayerTreeHostImpl::updateMaxScrollPosition):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::layoutViewportSize):

2012-08-02  Adam Barth  <abarth@webkit.org>

        V8Proxy::currentContext() doesn't do anything and should be removed
        https://bugs.webkit.org/show_bug.cgi?id=93041

        Reviewed by Eric Seidel.

        It's just a wrapper for GetCurrent().

        * bindings/v8/DateExtension.cpp:
        (WebCore::DateExtension::setAllowSleep):
        * bindings/v8/V8NPUtils.cpp:
        (WebCore::convertV8ObjectToNPVariant):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::retrieve):
        (WebCore::V8Proxy::mainWorldContext):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):
        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
        (WebCore::getJSListenerFunctions):

2012-08-02  David Grogan  <dgrogan@chromium.org>

        IndexedDB: Core upgradeneeded logic
        https://bugs.webkit.org/show_bug.cgi?id=92558

        Reviewed by Ojan Vafai.

        This is the backend webkit logic needed for integer versions. The rest
        is in https://bugs.webkit.org/show_bug.cgi?id=89505.

        I tried to make use of the existing processPendingCalls and added two
        more queues, pendingOpenWithVersionCalls and
        pendingSecondHalfOpenWithVersionCalls. The "second half" refers to
        how there are two events that need to be fired in response to an
        open-with-version call. The "second half" queue holds the open
        requests that should immediately follow the caller's upgradeneeded
        handler.

        No new tests, there are so many they are in their own patch:
        https://bugs.webkit.org/show_bug.cgi?id=92560

        Though this patch doesn't change any expected behavior anyway, lack of
        regressions is what we're hoping for here.

        * Modules/indexeddb/IDBBackingStore.h:
        (IDBBackingStore):
        * Modules/indexeddb/IDBCallbacks.h:
        (WebCore::IDBCallbacks::onBlocked):
        (WebCore::IDBCallbacks::onUpgradeNeeded):
        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (IDBDatabaseBackendImpl::PendingOpenCall):
        (IDBDatabaseBackendImpl::PendingOpenWithVersionCall):
        (WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::create):
        (WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::callbacks):
        (WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::version):
        (WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::PendingOpenWithVersionCall):
        (WebCore):
        (WebCore::IDBDatabaseBackendImpl::IDBDatabaseBackendImpl):
        (WebCore::IDBDatabaseBackendImpl::openInternal):
        (WebCore::IDBDatabaseBackendImpl::metadata):
        (WebCore::IDBDatabaseBackendImpl::setVersion):
        (WebCore::IDBDatabaseBackendImpl::setIntVersionInternal):
        (WebCore::IDBDatabaseBackendImpl::transactionFinished):
        (WebCore::IDBDatabaseBackendImpl::transactionFinishedAndEventsFired):
        When an upgradeneeded event is fired in response to an
        open-with-version call, the version change transaction must receive its
        complete event before processPendingCalls fires a success event at
        IDBOpenDBRequest. In the future this should probably be changed
        instead to transactionFinishedAndAbortFired and
        transactionFinishedAndCompleteFired so that we'll know to fire a
        success or error event at IDBOpenDBRequest. Currently, instead of
        firing error when there's an abort, we don't fire anything.

        (WebCore::IDBDatabaseBackendImpl::processPendingCalls):
        Now that this is called after a connection is opened, we unfortunately
        lose the invariant that there is only one existing connection when this
        is called, but nothing inside this function actually relied on that.
        Additionally, the secondHalfOpen calls only ever need to be serviced
        in one place: right after a version change transaction completes, so
        it could be moved out of here.

        (WebCore::IDBDatabaseBackendImpl::registerFrontendCallbacks):
        Now that setVersion and deleteDatabase calls are queued up behind
        secondHalfOpen calls, we have to service those queues when
        secondHalfOpen calls complete, which is here.  So call
        processPendingCalls().

        (WebCore::IDBDatabaseBackendImpl::runIntVersionChangeTransaction):
        (WebCore::IDBDatabaseBackendImpl::openConnectionWithVersion):
        (WebCore::IDBDatabaseBackendImpl::deleteDatabase):
        (WebCore::IDBDatabaseBackendImpl::close):
        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
        (IDBDatabaseBackendImpl):
        * Modules/indexeddb/IDBDatabaseCallbacks.h:
        (WebCore::IDBDatabaseCallbacks::onVersionChange):
        * Modules/indexeddb/IDBFactoryBackendImpl.cpp:
        (WebCore::IDBFactoryBackendImpl::open):
        This is refactored some so that the call to openConection{WithVersion}
        happens once, at the end.

        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
        (WebCore::IDBLevelDBBackingStore::getIDBDatabaseMetaData):
        (WebCore::IDBLevelDBBackingStore::createIDBDatabaseMetaData):
        (WebCore::IDBLevelDBBackingStore::updateIDBDatabaseIntVersion):
        (WebCore):
        (WebCore::IDBLevelDBBackingStore::deleteDatabase):
        * Modules/indexeddb/IDBLevelDBBackingStore.h:
        (IDBLevelDBBackingStore):
        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
        (WebCore::IDBTransactionBackendImpl::commit):
        See above comments about transactionFinishedAndEventsFired. I tried
        moving the call to transactionFinished after the events were fired but
        that failed some asserts. But changing those asserts is still an
        alternative to splitting up transactionFinished as is done here.

2012-08-02  Rob Buis  <rwlbuis@webkit.org>

        SVG text selection doesn't work with hyperlinked text
        https://bugs.webkit.org/show_bug.cgi?id=29166

        Reviewed by Eric Seidel.

        Cleanup SVGAElement. There is no need to test for middle mouse button here, this
        is handled elsewhere, so remove isMiddleMouseButtonEvent. Similarly handleLinkClick
        is not used anymore by HTMLAnchorElement, remove it. Finally, _self indeed is not needed.

        No new tests, since no change in behaviour.

        * WebCore.order:
        * html/HTMLAnchorElement.cpp:
        * html/HTMLAnchorElement.h:
        (WebCore):
        * svg/SVGAElement.cpp:
        (WebCore::SVGAElement::defaultEventHandler):

2012-08-02  Kwang Yul Seo  <skyul@company100.net>

        Move causesFosterParenting() to HTMLStackItem
        https://bugs.webkit.org/show_bug.cgi?id=93048

        Reviewed by Adam Barth.

        Changed to share causesFosterParenting() between HTMLTreeBuilder and HTMLConstructionSite
        by moving this function to HTMLStackItem.

        No functional change, so no new tests.

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::shouldFosterParent):
        * html/parser/HTMLStackItem.h:
        (WebCore::HTMLStackItem::causesFosterParenting):
        (HTMLStackItem):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):

2012-08-02  Kwang Yul Seo  <skyul@company100.net>

        Read tag names and attributes from the saved tokens in HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken*)
        https://bugs.webkit.org/show_bug.cgi?id=93047

        Reviewed by Adam Barth.

        This is a follow-up patch for r123577.
        Changed to retrieve the stack item of commonAncestor and read the local name from the saved token.

        No new tests, covered by existing tests.

        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):

2012-08-02  Vincent Scheib  <scheib@chromium.org>

        Remove old Pointer Lock API.
        https://bugs.webkit.org/show_bug.cgi?id=88892

        Reviewed by Adam Barth.

        Removing the old Pointer Lock API as one of the final cleanup
        changes for the Update to Fullscreen style locking Spec meta
        bug https://bugs.webkit.org/show_bug.cgi?id=84402.

        This change primarily removes idl, access in navigator,
        one event, and supporting infrastructure in page/PointerLock.

        In PointerLockController changes were already noted clearly with
        TODOs differentiating old and new api sections.

        Test: pointer-lock/pointerlockchange-event-on-lock-lost.html

        * WebCore.gypi:
        * dom/Element.cpp:
        (WebCore::Element::webkitRequestPointerLock):
        * dom/EventNames.h:
        (WebCore):
        * page/Navigator.cpp:
        * page/Navigator.h:
        (WebCore):
        (Navigator):
        * page/Navigator.idl:
        * page/PointerLock.cpp: Removed.
        * page/PointerLock.h: Removed.
        * page/PointerLock.idl: Removed.
        * page/PointerLockController.cpp:
        (WebCore::PointerLockController::requestPointerLock):
        (WebCore::PointerLockController::didAcquirePointerLock):
        (WebCore::PointerLockController::didNotAcquirePointerLock):
        (WebCore::PointerLockController::didLosePointerLock):
        * page/PointerLockController.h:
        (PointerLockController):

2012-08-02  Ryosuke Niwa  <rniwa@webkit.org>

        scripts in formaction should be stripped upon paste
        https://bugs.webkit.org/show_bug.cgi?id=92298

        Reviewed by Eric Seidel.

        Strip formaction attribute values when the URL is of javascript protocol.

        Test: editing/pasteboard/paste-noscript-xhtml.html
              editing/pasteboard/paste-noscript.html

        * dom/Element.cpp:
        (WebCore::isAttributeToRemove): Explicitly compare with href and nohref instead of comparing
        the ends of strings since comparing two AtomicString is much faster.

2012-08-02  Elliott Sprehn  <esprehn@gmail.com>

        Built in quotes don't use lang attribute
        https://bugs.webkit.org/show_bug.cgi?id=92918

        Reviewed by Alexey Proskuryakov.

        Previously even though there was a table in RenderQuote of languages mapped
        to quotes we always used basic quotes. This patch removes the broken tree
        walking and uses Element::computeInheritedLanguage fixing this.

        Tests: fast/css-generated-content/quotes-lang-expected.html
               fast/css-generated-content/quotes-lang.html
               fast/css-generated-content/quotes-xml-lang-expected.html
               fast/css-generated-content/quotes-xml-lang.html

        * rendering/RenderQuote.cpp:
        (WebCore::RenderQuote::originalText):
        (WebCore::RenderQuote::quotesData): New method that determines the right QuotesData to use.
        (WebCore):
        * rendering/RenderQuote.h:
        (RenderQuote):

2012-08-02  Adam Barth  <abarth@webkit.org>

        Add back a header I mistakenly removed in my previous commit.

        * WebCore.xcodeproj/project.pbxproj:

2012-08-02  Adrienne Walker  <enne@google.com>

        [chromium] Remove dependency on Scrollbar.h from ScrollbarLayerChromium
        https://bugs.webkit.org/show_bug.cgi?id=93024

        Reviewed by James Robinson.

        Change part enum from the Scrollbar version to WebScrollbar's.

        Tested by composited layout tests.

        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        (WebCore::ScrollbarBackgroundPainter::create):
        (WebCore::ScrollbarBackgroundPainter::ScrollbarBackgroundPainter):
        (ScrollbarBackgroundPainter):
        (WebCore::ScrollbarLayerChromium::createTextureUpdaterIfNeeded):

2012-08-02  Adam Barth  <abarth@webkit.org>

        BindingSecurityBase serves no purpose and should be removed
        https://bugs.webkit.org/show_bug.cgi?id=93025

        Reviewed by Eric Seidel.

        Now that we don't use templates in the generic bindings, we can merge
        BindingSecurity and BindingSecurityBase. This patch also removes some
        functions that are no longer used (and reduces the number of
        #includes).

        No behavior change.

        * GNUmakefile.list.am:
        * WebCore.gypi:
        * bindings/generic/BindingSecurity.h:
        (WebCore):
        (BindingSecurity):
        * bindings/generic/BindingSecurityBase.cpp: Removed.
        * bindings/generic/BindingSecurityBase.h: Removed.
        * bindings/v8/V8Binding.h:
        * bindings/v8/V8Utilities.cpp:
        * bindings/v8/custom/V8MutationObserverCustom.cpp:

2012-08-02  Ryosuke Niwa  <rniwa@webkit.org>

        Let Xcode have its own away and also sort the files.

        * WebCore.xcodeproj/project.pbxproj:

2012-08-02  Tien-Ren Chen  <trchen@chromium.org>

        [chromium] Add CCScrollbarAnimationController class for compositor scrollbar animation
        https://bugs.webkit.org/show_bug.cgi?id=91688

        Reviewed by Adrienne Walker.

        Add CCScrollbarAnimationController that serves as the middle man
        between the scrolling layer and scrollbar layer. Now all scroll offset
        information are pushed through the controller, and individual platform
        can provide specialized controller for extra processing.

        A basic fadeout controller for Android scrollbar is included.

        New test: ScrollbarLayerChromiumTest.scrollOffsetSynchronization
                  CCScrollbarAnimationControllerLinearFade.*

        * WebCore.gypi:
        * page/FrameView.cpp:
        (WebCore::FrameView::calculateScrollbarModesForLayout):
        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        (WebCore::createScrollbarLayer):
        * platform/graphics/chromium/TreeSynchronizer.cpp:
        (WebCore::TreeSynchronizer::synchronizeTreeRecursive):
        (WebCore::TreeSynchronizer::updateScrollbarLayerPointersRecursive):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::scrollBy):
        (WebCore::CCLayerImpl::setMaxScrollPosition):
        (WebCore):
        (WebCore::CCLayerImpl::horizontalScrollbarLayer):
        (WebCore::CCLayerImpl::setHorizontalScrollbarLayer):
        (WebCore::CCLayerImpl::verticalScrollbarLayer):
        (WebCore::CCLayerImpl::setVerticalScrollbarLayer):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore):
        (CCLayerImpl):
        (WebCore::CCLayerImpl::scrollbarAnimationController):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::animate):
        (WebCore::CCLayerTreeHostImpl::pinchGestureBegin):
        (WebCore::CCLayerTreeHostImpl::pinchGestureUpdate):
        (WebCore::CCLayerTreeHostImpl::pinchGestureEnd):
        (WebCore::CCLayerTreeHostImpl::animateScrollbars):
        (WebCore):
        (WebCore::CCLayerTreeHostImpl::animateScrollbarsRecursive):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCScrollbarAnimationController.cpp: Added.
        (WebCore):
        (WebCore::CCScrollbarAnimationController::create):
        (WebCore::CCScrollbarAnimationController::CCScrollbarAnimationController):
        (WebCore::CCScrollbarAnimationController::~CCScrollbarAnimationController):
        (WebCore::CCScrollbarAnimationController::getScrollLayerBounds):
        (WebCore::CCScrollbarAnimationController::updateScrollOffset):
        * platform/graphics/chromium/cc/CCScrollbarAnimationController.h: Added.
        (WebCore):
        (CCScrollbarAnimationController):
        (WebCore::CCScrollbarAnimationController::animate):
        (WebCore::CCScrollbarAnimationController::didPinchGestureBegin):
        (WebCore::CCScrollbarAnimationController::didPinchGestureUpdate):
        (WebCore::CCScrollbarAnimationController::didPinchGestureEnd):
        (WebCore::CCScrollbarAnimationController::setHorizontalScrollbarLayer):
        (WebCore::CCScrollbarAnimationController::horizontalScrollbarLayer):
        (WebCore::CCScrollbarAnimationController::setVerticalScrollbarLayer):
        (WebCore::CCScrollbarAnimationController::verticalScrollbarLayer):
        * platform/graphics/chromium/cc/CCScrollbarAnimationControllerAndroid.cpp: Added.
        (WebCore):
        (WebCore::CCScrollbarAnimationController::create):
        (WebCore::CCScrollbarAnimationControllerAndroid::CCScrollbarAnimationControllerAndroid):
        (WebCore::CCScrollbarAnimationControllerAndroid::~CCScrollbarAnimationControllerAndroid):
        (WebCore::CCScrollbarAnimationControllerAndroid::animate):
        (WebCore::CCScrollbarAnimationControllerAndroid::didPinchGestureUpdate):
        (WebCore::CCScrollbarAnimationControllerAndroid::didPinchGestureEnd):
        (WebCore::CCScrollbarAnimationControllerAndroid::updateScrollOffset):
        (WebCore::CCScrollbarAnimationControllerAndroid::opacityAtTime):
        * platform/graphics/chromium/cc/CCScrollbarAnimationControllerAndroid.h: Added.
        (WebCore):
        (CCScrollbarAnimationControllerAndroid):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
        (WebCore::CCScrollbarLayerImpl::CCScrollbarLayerImpl):
        (WebCore):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::value):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::currentPos):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::totalSize):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::maximum):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
        (WebCore::CCScrollbarLayerImpl::orientation):
        (WebCore::CCScrollbarLayerImpl::setCurrentPos):
        (WebCore::CCScrollbarLayerImpl::setTotalSize):
        (WebCore::CCScrollbarLayerImpl::setMaximum):
        (CCScrollbarLayerImpl):

2012-06-15  David Barton  <dbarton@mathscribe.com>

        MathML: nested square root symbols have varying descenders
        https://bugs.webkit.org/show_bug.cgi?id=43819

        Reviewed by Eric Seidel.

        This bug stems from the use of offsetHeight() on a renderer that's possibly a
        RenderInline, in getBoxModelObjectHeight() in RenderMathMLBlock.h.
        RenderInline::offsetHeight() actually returns linesBoundingBox().height(), which can be
        overly large, especially for the big STIX fonts that include a few mathematical symbols
        with unusually tall ascenders or descenders. A better solution for MathML in general is
        the CSS properties { -webkit-line-box-contain: glyphs replaced; line-height: 0; }. This
        gives tight glyph-based formatting in radical expressions, subscripts, superscripts,
        underscripts, overscripts, numerators, denominators, etc. To make this work, inline
        elements such as <mn> and <mi> must be wrapped inside implicit <mrow>s or just
        RenderMathMLBlocks, when a tight height is desired. We also replace
        getBoxModelObjectWidth(), which uses offsetWidth(), with contentLogicalWidth(). Finally,
        we enable the STIXGeneral font for use inside layout tests.

        Tested by existing LayoutTests/mathml/presentation/ files including roots.xhtml.

        * css/mathml.css:
        (math):
        (mtext):
        (mroot > * + *):
        (mtd):
        * rendering/mathml/RenderMathMLBlock.cpp:
        (WebCore::RenderMathMLBlock::preferredLogicalHeightAfterSizing):
        (WebCore::RenderMathMLBlock::baselinePosition):
        * rendering/mathml/RenderMathMLBlock.h:
        * rendering/mathml/RenderMathMLFraction.cpp:
        (WebCore::RenderMathMLFraction::baselinePosition):
        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::createStackableStyle):
        (WebCore::RenderMathMLOperator::baselinePosition):
        * rendering/mathml/RenderMathMLRoot.cpp:
        (WebCore::RenderMathMLRoot::addChild):
        (WebCore::RenderMathMLRoot::computePreferredLogicalWidths):
        (WebCore::RenderMathMLRoot::paint):
        * rendering/mathml/RenderMathMLRoot.h:
        * rendering/mathml/RenderMathMLSquareRoot.cpp:
        * rendering/mathml/RenderMathMLSquareRoot.h:
        * rendering/mathml/RenderMathMLSubSup.cpp:
        (WebCore::RenderMathMLSubSup::layout):
        * rendering/mathml/RenderMathMLUnderOver.cpp:
        (WebCore::RenderMathMLUnderOver::baselinePosition):
        * rendering/mathml/RenderMathMLUnderOver.h:

2012-08-02  Adrienne Walker  <enne@google.com>

        [chromium] Make CCScrollbarLayerImpl handle lost contexts properly
        https://bugs.webkit.org/show_bug.cgi?id=93021

        Reviewed by James Robinson.

        The resource ids that CCScrollbarLayerImpl holds onto need to be
        discarded during a lost context as the resource provider they came
        from is also destroyed.

        Make a scrollbarGeometry function that wraps all uses of the
        m_geometry member to make it possible to test CCScrollbarLayerImpl
        without depending on WebCore.

        Test: CCLayerTreeHostImplTest.dontUseOldResourcesAfterLostContext

        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
        (WebCore::CCScrollbarLayerImpl::scrollbarGeometry):
        (WebCore):
        (WebCore::CCScrollbarLayerImpl::appendQuads):
        (WebCore::CCScrollbarLayerImpl::didLoseContext):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
        (CCScrollbarLayerImpl):

2012-08-02  Oliver Hunt  <oliver@apple.com>

        A few objects aren't being safely protected from GC in all cases
        https://bugs.webkit.org/show_bug.cgi?id=93031

        Reviewed by Filip Pizlo.

        I haven't seen evidence that anyone is hitting bugs due to this, but any
        GC error can lead to later -- hard to diagnose -- bugs if they result in
        resurrecting dead objects.

        * bindings/js/JSCustomXPathNSResolver.cpp:
        (WebCore::JSCustomXPathNSResolver::create):
        (WebCore::JSCustomXPathNSResolver::JSCustomXPathNSResolver):
        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
        * bindings/js/JSCustomXPathNSResolver.h:
        (JSCustomXPathNSResolver):
        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::tryGetProperty):
        * bindings/js/JSDictionary.h:
        (WebCore::JSDictionary::JSDictionary):
        (WebCore::JSDictionary::initializerObject):

2012-08-02  Emil A Eklund  <eae@chromium.org>

        Range::isPointInRange incorrectly throws WRONG_DOCUMENT_ERR
        https://bugs.webkit.org/show_bug.cgi?id=93009

        Reviewed by Ojan Vafai.

        The latest working draft of the DOM4 spec has all but killed the
        WRONG_DOCUMENT_ERR exception. Update isPointInRange to return false
        instead of throwing an exception when the range and point are in
        different documents. This matches the Mozilla behavior.

        Test: fast/html/range-point-in-range-for-different-documents.html

        * dom/Range.cpp:
        (WebCore::Range::isPointInRange):
        Return false instead of throwing WRONG_DOCUMENT_ERR when the point is in
        a different document.

2012-08-02  Erik Arvidsson  <arv@chromium.org>

        DOM4: className should be defined on Element and not on HTMLElement
        https://bugs.webkit.org/show_bug.cgi?id=93014

        Reviewed by Adam Barth.

        DOM4 specs that Element should have the className WebIDL attribute. This moves the
        attribute to the correct IDL file.

        Test: fast/dom/Element/class-name.html

        * dom/Element.idl:
        * html/HTMLElement.idl:

2012-08-02  Erik Arvidsson  <arv@chromium.org>

        [V8] Handle case where Error.prototype returns an empty object
        https://bugs.webkit.org/show_bug.cgi?id=91792

        Reviewed by Kentaro Hara.

        In some edge cases we get an empty object back from Error.prototype.

        No new tests. I cannot reproduce this.

        * bindings/v8/V8BindingPerContextData.cpp:
        (WebCore::V8BindingPerContextData::constructorForTypeSlowCase):

2012-08-02  Eric Seidel  <eric@webkit.org>

        Add back ASSERT(!needsLayout) to RenderTableSection which is now valid
        https://bugs.webkit.org/show_bug.cgi?id=92954

        Unreviewed, follow-up per Mitz's request.

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::paint):

2012-08-02  James Robinson  <jamesr@chromium.org>

        [chromium] Remove unused includes from compositor code
        https://bugs.webkit.org/show_bug.cgi?id=92930

        Reviewed by Adrienne Walker.

        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:

2012-08-02  Adam Barth  <abarth@webkit.org>

        The generic bindings shouldn't use templates
        https://bugs.webkit.org/show_bug.cgi?id=93016

        Reviewed by Eric Seidel.

        We originally created the generic bindings to share code between the
        JavaScriptCore and V8 bindings. However, the code came out sort of ugly
        because we used templates (with the idea that templates would let us
        use more than one scripting engine).

        This patch rips out the templates in an attempt to make the code
        prettier and therefore easier to use in both V8 and JSC. I've tried to
        keep this patch small by remaning things mostly in place. In the next
        patch, I'll move a bunch of code out of headers and into cpp files.

        No behavior change.

        * GNUmakefile.am:
        * UseV8.cmake:
        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * WebCore.pri:
        * bindings/generic/BindingSecurity.h:
        (WebCore):
        (BindingSecurity):
        (WebCore::BindingSecurity::canAccessWindow):
        (WebCore::BindingSecurity::canAccessFrame):
        (WebCore::BindingSecurity::shouldAllowAccessToNode):
        (WebCore::BindingSecurity::allowPopUp):
        (WebCore::BindingSecurity::allowSettingFrameSrcToJavascriptUrl):
        (WebCore::BindingSecurity::allowSettingSrcToJavascriptURL):
        * bindings/generic/GenericBinding.h:
        (WebCore::completeURL):
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateDomainSafeFunctionGetter):
        (GenerateNormalAttrGetter):
        (GenerateReplaceableAttrSetter):
        (GenerateFunctionCallback):
        (GenerateImplementation):
        * bindings/scripts/test/V8/V8Float64Array.cpp:
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        (WebCore::TestActiveDOMObjectV8Internal::excitingFunctionCallback):
        (WebCore::TestActiveDOMObjectV8Internal::postMessageAttrGetter):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        * bindings/scripts/test/V8/V8TestException.cpp:
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        * bindings/scripts/test/V8/V8TestNode.cpp:
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::contentDocumentAttrGetter):
        (WebCore::TestObjV8Internal::getSVGDocumentCallback):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        * bindings/v8/BindingState.cpp: Renamed from Source/WebCore/bindings/v8/specialization/V8BindingState.cpp.
        (WebCore):
        (WebCore::BindingState::instance):
        (WebCore::activeWindow):
        (WebCore::firstWindow):
        (WebCore::activeFrame):
        (WebCore::firstFrame):
        (WebCore::immediatelyReportUnsafeAccessTo):
        * bindings/v8/BindingState.h: Renamed from Source/WebCore/bindings/v8/specialization/V8BindingState.h.
        (WebCore):
        (BindingState):
        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::canAccessFromCurrentOrigin):
        * bindings/v8/V8Binding.h:
        (WebCore):
        * bindings/v8/V8DOMWindowShell.cpp:
        * bindings/v8/V8Proxy.cpp:
        * bindings/v8/V8Utilities.cpp:
        (WebCore::callingOrEnteredFrame):
        (WebCore::completeURL):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::WindowSetTimeoutImpl):
        (WebCore::V8DOMWindow::eventAccessorGetter):
        (WebCore::V8DOMWindow::eventAccessorSetter):
        (WebCore::V8DOMWindow::locationAccessorSetter):
        (WebCore::V8DOMWindow::openerAccessorSetter):
        (WebCore::V8DOMWindow::addEventListenerCallback):
        (WebCore::V8DOMWindow::removeEventListenerCallback):
        (WebCore::V8DOMWindow::showModalDialogCallback):
        (WebCore::V8DOMWindow::openCallback):
        (WebCore::V8DOMWindow::namedSecurityCheck):
        (WebCore::V8DOMWindow::indexedSecurityCheck):
        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
        (WebCore::V8Document::locationAccessorSetter):
        * bindings/v8/custom/V8EntryCustom.cpp:
        * bindings/v8/custom/V8EntrySyncCustom.cpp:
        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
        (WebCore::V8HTMLFrameElement::locationAccessorSetter):
        * bindings/v8/custom/V8HistoryCustom.cpp:
        (WebCore::V8History::indexedSecurityCheck):
        (WebCore::V8History::namedSecurityCheck):
        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
        * bindings/v8/custom/V8InjectedScriptManager.cpp:
        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
        * bindings/v8/custom/V8LocationCustom.cpp:
        (WebCore::V8Location::hashAccessorSetter):
        (WebCore::V8Location::hostAccessorSetter):
        (WebCore::V8Location::hostnameAccessorSetter):
        (WebCore::V8Location::hrefAccessorSetter):
        (WebCore::V8Location::pathnameAccessorSetter):
        (WebCore::V8Location::portAccessorSetter):
        (WebCore::V8Location::protocolAccessorSetter):
        (WebCore::V8Location::searchAccessorSetter):
        (WebCore::V8Location::reloadAccessorGetter):
        (WebCore::V8Location::replaceAccessorGetter):
        (WebCore::V8Location::assignAccessorGetter):
        (WebCore::V8Location::reloadCallback):
        (WebCore::V8Location::replaceCallback):
        (WebCore::V8Location::assignCallback):
        (WebCore::V8Location::toStringCallback):
        (WebCore::V8Location::indexedSecurityCheck):
        (WebCore::V8Location::namedSecurityCheck):
        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
        * bindings/v8/custom/V8NodeCustom.cpp:

2012-08-02  Abhishek Arya  <inferno@chromium.org>

        No isChildAllowed checked when adding RenderFullScreen as the child..
        https://bugs.webkit.org/show_bug.cgi?id=92995

        Reviewed by Eric Seidel.

        Test: fullscreen/fullscreen-child-not-allowed-crash.html

        * dom/Document.cpp:
        (WebCore::Document::webkitWillEnterFullScreenForElement): pass the object's parent
        pointer as an additional argument.
        * dom/NodeRenderingContext.cpp:
        (WebCore::NodeRendererFactory::createRendererIfNeeded): pass the to be parent |parentRenderer|
        as the argument. 
        * rendering/RenderFullScreen.cpp:
        (RenderFullScreen::wrapRenderer): make sure that parent allows RenderFullScreen as the child.
        * rendering/RenderFullScreen.h: 
        (RenderFullScreen): support the object's parent
        pointer as an additional argument.

2012-08-01  James Robinson  <jamesr@chromium.org>

        [chromium] Wrap shared context getters in WebKit API and avoid WebCore::GraphicsContext3D use in compositor internals
        https://bugs.webkit.org/show_bug.cgi?id=92917

        Reviewed by Adrienne Walker.

        This uses Platform API wrappers to access the shared WebGraphicsContext3D / Ganesh contexts from the compositor
        to evaluate accelerated filters or do accelerated painting.

        Filters changes covered by css3/filters/*-hw.html layout tests.

        * WebCore.gypi:
        * platform/chromium/support/WebSharedGraphicsContext3D.cpp:
        (WebKit):
        (WebKit::WebSharedGraphicsContext3D::mainThreadContext):
        (WebKit::WebSharedGraphicsContext3D::mainThreadGrContext):
        (WebKit::WebSharedGraphicsContext3D::compositorThreadContext):
        (WebKit::WebSharedGraphicsContext3D::compositorThreadGrContext):
        (WebKit::WebSharedGraphicsContext3D::haveCompositorThreadContext):
        (WebKit::WebSharedGraphicsContext3D::createCompositorThreadContext):
        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::createAcceleratedCanvas):
        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::Texture::updateRect):
        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h:
        (WebKit):
        (FrameBufferSkPictureCanvasLayerTextureUpdater):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::applyFilters):
        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:
        (WebCore::CCRenderSurfaceFilters::apply):
        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.h:
        (WebKit):
        (CCRenderSurfaceFilters):

2012-08-02  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=93020
        REGRESSION (tiled scrolling): Full-screen video is broken if page is 
        scrolled
        -and corresponding-
        <rdar://problem/11629778>

        Reviewed by Anders Carlsson.

        The bug here is that ScrollingTreeNodeMac::setScrollLayerPosition() 
        uses the CALayer (PlatformLayer) directly to set the position. That 
        means that the GraphicsLayer that owns that PlatformLayer does not 
        have updated position information. That results in this bug when we 
        switch from fast scrolling to main thread scrolling, because at that 
        point, the GraphicsLayer needs to have the correct information. So 
        make sure to update the main thread scroll position and layer 
        position before transitioning to main thread scrolling.
        * page/scrolling/ScrollingCoordinator.cpp:
        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):

2012-08-02  Addy Osmani  <addyo@chromium.org>

        Web Inspector: Rename 'User agent' to 'Overrides' in settings screen
        https://bugs.webkit.org/show_bug.cgi?id=92990

        Reviewed by Pavel Feldman.

        Simple setting rename of User agent -> Overrides

        * English.lproj/localizedStrings.js:
        * inspector/front-end/SettingsScreen.js:

2012-08-02  Philip Rogers  <pdr@google.com>

        Do not dispatch modification events in SVG attribute synchronization
        https://bugs.webkit.org/show_bug.cgi?id=92604

        Reviewed by Ryosuke Niwa.

        Previously, calling hasAttribute() during layout could hit a
        layout-during-layout bug because calling hasAttribute() could dispatch a 
        subtree modification event which could synchronously force a layout. hasAttribute()
        exhibits this behavior because property synchronization is done lazily.

        This patch skips dispatching subtree modification events during attribute
        synchronization.

        Additionally, this patch contains a refactoring of lazy attribute setting. We
        now have a single place where lazy attributes are set (setSynchronizedLazyAttribute)
        and lazy attribute flags have been moved to just Element and ElementAttributeData.

        Test: svg/custom/path-domsubtreemodified-crash.html

        * dom/Element.cpp:
        (WebCore::Element::setAttribute):
        (WebCore::Element::setSynchronizedLazyAttribute):
        (WebCore):
        (WebCore::Element::setAttributeInternal):
        * dom/Element.h:
        (Element):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::addAttribute):
        (WebCore::ElementAttributeData::removeAttribute):
        * dom/ElementAttributeData.h:
        (ElementAttributeData):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::updateStyleAttribute):
        * svg/properties/SVGAnimatedPropertyMacros.h:
        (WebCore::SVGSynchronizableAnimatedProperty::synchronize):

2012-08-02  Konrad Piascik  <kpiascik@rim.com>

        Web Inspector: Override the DeviceOrientation
        https://bugs.webkit.org/show_bug.cgi?id=91008

        Reviewed by Pavel Feldman.

        Re-added the m_page member variable to DeviceOrientationController and
        added InspectorInstrumentation to see if the DeviceOrientationData
        should be overridden or not.

        Added UI to the web inspector front-end to allow users to override the
        device orientation.  This is currently hidden behind an experiment.

        Test: inspector/device-orientation-success.html

        * English.lproj/localizedStrings.js:
        * dom/DeviceOrientationController.cpp:
        (WebCore::DeviceOrientationController::DeviceOrientationController):
        (WebCore::DeviceOrientationController::create):
        (WebCore::DeviceOrientationController::didChangeDeviceOrientation):
        (WebCore::provideDeviceOrientationTo):
        * dom/DeviceOrientationController.h:
        (DeviceOrientationController):
        * inspector/Inspector.json:
        * inspector/InspectorInstrumentation.cpp:
        (WebCore):
        (WebCore::InspectorInstrumentation::overrideDeviceOrientationImpl):
        * inspector/InspectorInstrumentation.h:
        (WebCore):
        (InspectorInstrumentation):
        (WebCore::InspectorInstrumentation::overrideDeviceOrientation):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::setDeviceOrientationOverride):
        (WebCore):
        (WebCore::InspectorPageAgent::clearDeviceOrientationOverride):
        (WebCore::InspectorPageAgent::canOverrideDeviceOrientation):
        (WebCore::InspectorPageAgent::overrideDeviceOrientation):
        * inspector/InspectorPageAgent.h:
        * inspector/front-end/Settings.js:
        (WebInspector.ExperimentsSettings):
        * inspector/front-end/SettingsScreen.js:
        (WebInspector.UserAgentSettingsTab):
        (WebInspector.UserAgentSettingsTab.prototype._createInput):
        (WebInspector.UserAgentSettingsTab.prototype._createDeviceMetricsElement):
        (WebInspector.UserAgentSettingsTab.prototype._createGeolocationOverrideElement):
        (WebInspector.UserAgentSettingsTab.prototype._onDeviceOrientationOverrideCheckboxClicked):
        (WebInspector.UserAgentSettingsTab.prototype._applyDeviceOrientationUserInput):
        (WebInspector.UserAgentSettingsTab.prototype._setDeviceOrientation.set if):
        (WebInspector.UserAgentSettingsTab.prototype._setDeviceOrientation):
        (WebInspector.UserAgentSettingsTab.prototype._createDeviceOrientationOverrideElement):
        * inspector/front-end/UserAgentSupport.js:
        (WebInspector.UserAgentSupport.DeviceOrientation):
        (WebInspector.UserAgentSupport.DeviceOrientation.prototype.toSetting):
        (WebInspector.UserAgentSupport.DeviceOrientation.parseSetting):
        (WebInspector.UserAgentSupport.DeviceOrientation.parseUserInput):
        (WebInspector.UserAgentSupport.DeviceOrientation.clearDeviceOrientationOverride):
        * inspector/front-end/inspector.js:
        (WebInspector.doLoadedDone):

2012-08-02  Arnaud Renevier  <a.renevier@sisa.samsung.com>

        TypedArray set method is slow when called with another typed array
        https://bugs.webkit.org/show_bug.cgi?id=92556

        Reviewed by Kenneth Russell.

        When setting multiples values to a typed array from an array like
        element, try to determine if the argument is a typed array. If so,
        cast the argument to a typed array, and read each element with .item()
        method. That avoid reading the value as a JSValue, and speedups set
        method by approximatively 10x.

        Introduce setWebGLArrayWithTypedArrayArgument template function which
        checks if argument is a typed array. If so, it copies the data to
        target typed array and returns true. Otherwise, it returns false.

        Introduce copyTypedArrayBuffer template function which copies data
        from a typed array to another one. This function is also used from
        constructArrayBufferViewWithTypedArrayArgument.

        * bindings/js/JSArrayBufferViewHelper.h:
        (WebCore):
        (WebCore::copyTypedArrayBuffer):
        (WebCore::setWebGLArrayWithTypedArrayArgument):
        (WebCore::setWebGLArrayHelper):
        (WebCore::constructArrayBufferViewWithTypedArrayArgument):
        * bindings/js/JSFloat32ArrayCustom.cpp:
        (WebCore::JSFloat32Array::set):
        * bindings/js/JSFloat64ArrayCustom.cpp:
        (WebCore::JSFloat64Array::set):
        * bindings/js/JSInt16ArrayCustom.cpp:
        (WebCore::JSInt16Array::set):
        * bindings/js/JSInt32ArrayCustom.cpp:
        (WebCore::JSInt32Array::set):
        * bindings/js/JSInt8ArrayCustom.cpp:
        (WebCore::JSInt8Array::set):
        * bindings/js/JSUint16ArrayCustom.cpp:
        (WebCore::JSUint16Array::set):
        * bindings/js/JSUint32ArrayCustom.cpp:
        (WebCore::JSUint32Array::set):
        * bindings/js/JSUint8ArrayCustom.cpp:
        (WebCore::JSUint8Array::set):
        * bindings/js/JSUint8ClampedArrayCustom.cpp:
        (WebCore::JSUint8ClampedArray::set):

2012-08-02  Chris Fleizach  <cfleizach@apple.com>

        AXEnabled = false for AXIncrementors inside text fields
        https://bugs.webkit.org/show_bug.cgi?id=93008

        Reviewed by Anders Carlsson.

        Mock objects should return "enabled" by default, since they are valid objects.

        * accessibility/AccessibilityMockObject.h:
        (WebCore::AccessibilityMockObject::isEnabled):
        (AccessibilityMockObject):

2012-08-02  Eric Seidel  <eric@webkit.org>

        Add back ASSERT(!needsLayout) to RenderTableSection which is now valid
        https://bugs.webkit.org/show_bug.cgi?id=92954

        Reviewed by Julien Chaffraix.

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::paint):

2012-08-02  Kevin Ellis  <kevers@chromium.org>

        Month-year selector on calendar picker should be touch friendly.
        https://bugs.webkit.org/show_bug.cgi?id=92678

        Reviewed by Kent Tamura.

        Previously the month-year popup menu was implemented using a listbox,
        which does not support CSS customization.  Entries in the listbox
        were too shallow to reliably target with touch gestures.  The
        replacement popup is CSS configurable with larger entries on devices
        that support touch input.

        Manually tested with and without touch support in English, Japanese
        and Arabic.

        * Resources/calendarPicker.css:
        (.month-selector-popup): Update to use scrollable div instead of listbox.
        (.month-selector-popup-contents): Render popup as a table within a scrollable div.
        (.month-selector-popup-entry): Formatting entries in the month-year popup.
        (.selected-month-year): Highlight the selected month-year.
        (@media (pointer:coarse)): Enlarge entries in the popup meu on devices that support touch.
        * Resources/calendarPicker.js:
        (YearMonthController.prototype.attachTo): Change selector popup from a list-box to a div.
        (YearMonthController.prototype._redraw): Populate table based popup rather than listbox.
        (YearMonthController.prototype._showPopup): Set scroll position and resize for scrollbar.
        (YearMonthController.prototype._closePopup): Restore focus to the calendar.
        (YearMonthController.prototype._getSelection): Added to retrieve the selected month-year.
        (YearMonthController.prototype._handleMouseMove): Added to update selected month-year on hover.
        (YearMonthController.prototype._handleMonthPopupKey): Add keyboard navigation.
        (YearMonthController.prototype._handleYearMonthChange): Retrieve value from selected month-year.

2012-08-02  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: [Regression] context menu does not open on Sources panel tabs on mac
        https://bugs.webkit.org/show_bug.cgi?id=93000

        Reviewed by Pavel Feldman.

        * inspector/front-end/UIUtils.js:
        (WebInspector._elementDragStart):

2012-08-02  Kwang Yul Seo  <skyul@company100.net>

        Check if the last table element's parent node is an element when determining the foster parent element.
        https://bugs.webkit.org/show_bug.cgi?id=92977

        Reviewed by Adam Barth.

        According to the HTML5 spec, if the last table element in the stack of open elements has no parent,
        or ITS PARENT NODE IS NOT AN ELEMENT, then the foster parent element is the element
        before the last table element in the stack of open elements.

        Changed to check if the table element's parent node is an element.

        Test: fast/parser/foster-parent.html

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::findFosterSite):

2012-08-02  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] Use GST_DEBUG instead of LOG_VERBOSE
        https://bugs.webkit.org/show_bug.cgi?id=89350

        Reviewed by Martin Robinson.

        Wrap the media player's logging calls to a new macro that also
        hooks into GStreamer's logging facilities. This way the developer
        gets the best of both worlds, leaving the choice between GST_DEBUG
        and WEBKIT_DEBUG environment variables.

        * platform/graphics/gstreamer/GStreamerUtilities.h:
        (WebCore):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::initializeGStreamerAndRegisterWebKitElements):
        (WebCore::MediaPlayerPrivateGStreamer::load):
        (WebCore::MediaPlayerPrivateGStreamer::commitLoad):
        (WebCore::MediaPlayerPrivateGStreamer::playbackPosition):
        (WebCore::MediaPlayerPrivateGStreamer::play):
        (WebCore::MediaPlayerPrivateGStreamer::pause):
        (WebCore::MediaPlayerPrivateGStreamer::duration):
        (WebCore::MediaPlayerPrivateGStreamer::seek):
        (WebCore::MediaPlayerPrivateGStreamer::naturalSize):
        (WebCore::MediaPlayerPrivateGStreamer::setRate):
        (WebCore::MediaPlayerPrivateGStreamer::handleMessage):
        (WebCore::MediaPlayerPrivateGStreamer::processBufferingStats):
        (WebCore::MediaPlayerPrivateGStreamer::fillTimerFired):
        (WebCore::MediaPlayerPrivateGStreamer::maxTimeSeekable):
        (WebCore::MediaPlayerPrivateGStreamer::maxTimeLoaded):
        (WebCore::MediaPlayerPrivateGStreamer::didLoadingProgress):

2012-08-02  Antti Koivisto  <antti@apple.com>

        Inline stylesheets can confuse style sharing
        https://bugs.webkit.org/show_bug.cgi?id=92970

        Reviewed by Dan Bernstein.

        Consider document 
        
        <div class="i30"></div>
        <style>.i30 { background-color:green; }</style>
        <div class="i30"></div>
        
        When processing the <style> element the scope optimization marks the first div as needing style recalc. 
        Next the parser adds the second div to the tree and immediately calculates its style. Since it looks exactly 
        like the first div the style sharing optimization copies the style from there. The pending recalc of the
        first div is resolved by a timer but the second div is left with the old style.
        
        Fix by disallowing style sharing from elements with pending style recalc.

        Test: fast/css/style-sharing-inline-stylesheet.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::canShareStyleWithElement):

2012-08-02  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: Add RTCPeerConnectionHandler infrastructure
        https://bugs.webkit.org/show_bug.cgi?id=92866

        Reviewed by Adam Barth.

        Introducing RTCPeerConnectionHandler & RTCPeerConnectionHandlerClient,
        together with the Chromium WebKit interface, following the pattern of
        the previous PeerConnection00Handler but with the optimizations from MediaStreamCenter.

        Not yet testable due to not enough code landed.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::create):
        (WebCore::RTCPeerConnection::RTCPeerConnection):
        * Modules/mediastream/RTCPeerConnection.h:
        (RTCPeerConnection):
        * WebCore.gypi:
        * platform/mediastream/RTCPeerConnectionHandler.cpp: Added.
        (WebCore):
        (RTCPeerConnectionHandlerDummy):
        (WebCore::RTCPeerConnectionHandler::create):
        (WebCore::RTCPeerConnectionHandlerDummy::RTCPeerConnectionHandlerDummy):
        (WebCore::RTCPeerConnectionHandlerDummy::~RTCPeerConnectionHandlerDummy):
        (WebCore::RTCPeerConnectionHandlerDummy::initialize):
        * platform/mediastream/RTCPeerConnectionHandler.h: Copied from Source/WebCore/Modules/mediastream/RTCPeerConnection.h.
        (WebCore):
        (RTCPeerConnectionHandler):
        (WebCore::RTCPeerConnectionHandler::~RTCPeerConnectionHandler):
        (WebCore::RTCPeerConnectionHandler::RTCPeerConnectionHandler):
        * platform/mediastream/RTCPeerConnectionHandlerClient.h: Copied from Source/WebCore/Modules/mediastream/RTCPeerConnection.h.
        (WebCore):
        (RTCPeerConnectionHandlerClient):
        (WebCore::RTCPeerConnectionHandlerClient::~RTCPeerConnectionHandlerClient):
        * platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.cpp: Added.
        (WebCore):
        (WebCore::RTCPeerConnectionHandler::create):
        (WebCore::RTCPeerConnectionHandlerChromium::RTCPeerConnectionHandlerChromium):
        (WebCore::RTCPeerConnectionHandlerChromium::~RTCPeerConnectionHandlerChromium):
        (WebCore::RTCPeerConnectionHandlerChromium::initialize):
        * platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.h: Added.
        (WebCore):
        (RTCPeerConnectionHandlerChromium):

2012-08-02  Kent Tamura  <tkent@chromium.org>

        Move number localization code in LocaleICU.cpp to new class
        https://bugs.webkit.org/show_bug.cgi?id=92976

        Reviewed by Kentaro Hara.

        The number localization code by character mapping is usefull for non-ICU
        platforms.

        No new tests. This is just a refactoring, and is covered by
        Source/WebKit/chromium/tests/LocalizedNumberICUTest.cpp.

        * WebCore.gypi: Add NumberLocalizer.{cpp,h}.
        * platform/text/LocaleICU.cpp:
        (WebCore::LocaleICU::decimalSymbol):
        Renamed from setDecimalSymbol. This function returns the resultant
        string instead of setting it to a data member.
        (WebCore::LocaleICU::decimalTextAttribute):
        Renamed from setDecimalTextAttributel. This function returns the
        resultant string instead of setting it to the specified string.
        (WebCore::LocaleICU::initializeNumberLocalizerData):
        Renamed from initializeDecimalFormat.
        Calls NumberLocaizer::setNumberLocalizerData.
        (WebCore::LocaleICU::localizedDecimalSeparator):
        Rename initializeDecimalFormat to initializeNumberLocalizerData.
        * platform/text/LocaleICU.h:
        (LocaleICU): Remove some members, and inherit NumberLocalizer.
        * platform/text/NumberLocalizer.cpp: Added. Move the code from LocaleICU.cpp
        (WebCore):
        (WebCore::NumberLocalizer::~NumberLocalizer):
        (WebCore::NumberLocalizer::setNumberLocalizerData): Added.
        (WebCore::NumberLocalizer::convertToLocalizedNumber):
        (WebCore::matches):
        (WebCore::NumberLocalizer::detectSignAndGetDigitRange):
        (WebCore::NumberLocalizer::matchedDecimalSymbolIndex):
        (WebCore::NumberLocalizer::convertFromLocalizedNumber):
        (WebCore::NumberLocalizer::localizedDecimalSeparator):
        * platform/text/NumberLocalizer.h: Added.
        (NumberLocalizer):
        (WebCore::NumberLocalizer::NumberLocalizer):

2012-08-02  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Move DOM breakpoints-related context menu items into a submenu
        https://bugs.webkit.org/show_bug.cgi?id=92989

        Reviewed by Vsevolod Vlasov.

        A "Break on..." submenu is added to the element context menu, to host all DOM breakpoint items.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/DOMBreakpointsSidebarPane.js:
        (WebInspector.DOMBreakpointsSidebarPane):
        (WebInspector.DOMBreakpointsSidebarPane.prototype.populateNodeContextMenu):

2012-08-02  Dominik Röttsches  <dominik.rottsches@intel.com>

        [Cairo] Add complex font drawing using HarfbuzzNG
        https://bugs.webkit.org/show_bug.cgi?id=91864

        Reviewed by Martin Robinson.

        Unfortunately the Freetype based approach that avoids allocations and UTF8 conversion
        fails to produce correct results for some tests.

        No new tests, at least
          fast/dom/52776.html
          fast/text/atsui-negative-spacing-features.html
          fast/text/atsui-spacing-features.html
        expose this problem.

        * platform/graphics/harfbuzz/ng/HarfBuzzNGFaceCairo.cpp:
        (WebCore::harfbuzzGetGlyph): Revert to initial cairo_scaled_font based approach.

2012-08-02  Eugene Klyuchnikov  <eustas.big@gmail.com>

        Web Inspector: Fix protocol version check.
        https://bugs.webkit.org/show_bug.cgi?id=91497

        Reviewed by Pavel Feldman.

        Generated method 'supportsInspectorProtocolVersion' should return
        false when requested  minor version is *greater* than actual
        minor version.

        * inspector/generate-inspector-protocol-version: Fixed stub text

2012-08-02  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: count RenderStyle objects in the native memory profiler
        https://bugs.webkit.org/show_bug.cgi?id=91759

        Reviewed by Yury Semikhatsky.

        The patch adds instrumentation to the following classes:
          - RenderStyle
          - StyleRareInheritedData
          - StyleRareNonInheritedData

        * bindings/js/ScriptWrappable.h:
        * bindings/v8/ScriptWrappable.h:
        * dom/MemoryInstrumentation.h:
        (WebCore):
        (WebCore::MemoryInstrumentation::OwningTraits::addObject):
        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl):
        (WebCore::MemoryInstrumentation::addObjectImpl):
        * dom/Node.cpp:
        (WebCore::Node::reportMemoryUsage):
        * dom/Node.h:
        (WebCore):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::reportMemoryUsage):
        (WebCore):
        * rendering/style/RenderStyle.h:
        (WebCore):
        * rendering/style/StyleRareInheritedData.cpp:
        (WebCore::StyleRareInheritedData::reportMemoryUsage):
        (WebCore):
        * rendering/style/StyleRareInheritedData.h:
        (WebCore):
        (StyleRareInheritedData):
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::reportMemoryUsage):
        (WebCore):
        * rendering/style/StyleRareNonInheritedData.h:
        (WebCore):
        (StyleRareNonInheritedData):

2012-08-02  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: rename host->origin in the inspector protocol DOMStorage entry
        https://bugs.webkit.org/show_bug.cgi?id=92979

        Reviewed by Yury Semikhatsky.

        * inspector/Inspector.json:
        * inspector/InspectorDOMStorageResource.cpp:
        (WebCore::InspectorDOMStorageResource::bind):
        * inspector/front-end/DOMStorage.js:
        (WebInspector.DOMStorageDispatcher.prototype.addDOMStorage):

2012-08-02  Kihong Kwon  <kihong.kwon@samsung.com>

        [EFL] Change return value of battey level
        https://bugs.webkit.org/show_bug.cgi?id=92964

        Reviewed by Simon Hausmann.

        Change return value of navigator.webkitBattery.level from 0~100 to 0~1.0.
        Battery level have to returns 0~1.0 by Battery Status API spec.

        * platform/efl/BatteryProviderEfl.cpp:
        (WebCore::BatteryProviderEfl::setBatteryClient):

2012-08-02  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: remove extraObjectSize parameter from MemoryClassInfo constructor
        https://bugs.webkit.org/show_bug.cgi?id=92981

        Reviewed by Alexander Pavlov.

        Refactored MemoryInstrumentation to get rid of extraSize parameter from
        MemoryObjectInfo constructor and MemoryObjectInfo::reportObjectInfo. The
        extra size should always be reported as an object that occupies these extra
        bytes.

        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::reportMemoryUsage):
        (WebCore):
        * dom/ElementAttributeData.h:
        (WebCore):
        (ElementAttributeData):
        * dom/MemoryInstrumentation.h:
        (WebCore::MemoryObjectInfo::reportObjectInfo):
        (WebCore::MemoryClassInfo::MemoryClassInfo):

2012-08-02  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124439.
        http://trac.webkit.org/changeset/124439
        https://bugs.webkit.org/show_bug.cgi?id=92980

        Broke Chromium Mac Release compile (Requested by apavlov on
        #webkit).

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::create):
        (WebCore::RTCPeerConnection::RTCPeerConnection):
        * Modules/mediastream/RTCPeerConnection.h:
        * WebCore.gypi:
        * platform/mediastream/RTCPeerConnectionHandler.cpp: Removed.
        * platform/mediastream/RTCPeerConnectionHandler.h: Removed.
        * platform/mediastream/RTCPeerConnectionHandlerClient.h: Removed.
        * platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.cpp: Removed.
        * platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.h: Removed.

2012-08-02  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] Uninitialized memory read in QObject runtime bridge
        https://bugs.webkit.org/show_bug.cgi?id=92972

        Reviewed by Kenneth Rohde Christiansen.

        The vargs array has an initial size of 0 and when calling a method with no return value
        and no arguments, vargs remains empty. Therefore unconditional access to vargs[0] results
        in access to uninitialized memory.

        No new tests, covered by valgrind in existing qobjectbridge tests.

        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::QtRuntimeMetaMethod::call):
        * bridge/qt/qt_runtime_qt4.cpp:
        (JSC::Bindings::QtRuntimeMetaMethod::call):

2012-08-02  Zoltan Herczeg  <zherczeg@webkit.org>

        Alignment issue for readTime in PluginDatabase.cpp
        https://bugs.webkit.org/show_bug.cgi?id=92746

        Reviewed by Simon Hausmann.

        When the byte stream is written, nothing guarantees that
        the time_t data is aligned. This issue caused alignment
        traps on ARM CPUs.

        No new tests. Covered by existing tests.

        * plugins/PluginDatabase.cpp:
        (WebCore::readTime):

2012-08-02  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: Add RTCPeerConnectionHandler infrastructure
        https://bugs.webkit.org/show_bug.cgi?id=92866

        Reviewed by Kentaro Hara.

        Introducing RTCPeerConnectionHandler & RTCPeerConnectionHandlerClient,
        together with the Chromium WebKit interface, following the pattern of
        the previous PeerConnection00Handler but with the optimizations from MediaStreamCenter.

        Not yet testable due to not enough code landed.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::create):
        (WebCore::RTCPeerConnection::RTCPeerConnection):
        * Modules/mediastream/RTCPeerConnection.h:
        (RTCPeerConnection):
        * WebCore.gypi:
        * platform/mediastream/RTCPeerConnectionHandler.cpp: Added.
        (WebCore):
        (RTCPeerConnectionHandlerDummy):
        (WebCore::RTCPeerConnectionHandler::create):
        (WebCore::RTCPeerConnectionHandlerDummy::RTCPeerConnectionHandlerDummy):
        (WebCore::RTCPeerConnectionHandlerDummy::~RTCPeerConnectionHandlerDummy):
        (WebCore::RTCPeerConnectionHandlerDummy::initialize):
        * platform/mediastream/RTCPeerConnectionHandler.h: Copied from Source/WebCore/Modules/mediastream/RTCPeerConnection.h.
        (WebCore):
        (RTCPeerConnectionHandler):
        (WebCore::RTCPeerConnectionHandler::~RTCPeerConnectionHandler):
        (WebCore::RTCPeerConnectionHandler::RTCPeerConnectionHandler):
        * platform/mediastream/RTCPeerConnectionHandlerClient.h: Copied from Source/WebCore/Modules/mediastream/RTCPeerConnection.h.
        (WebCore):
        (RTCPeerConnectionHandlerClient):
        (WebCore::RTCPeerConnectionHandlerClient::~RTCPeerConnectionHandlerClient):
        * platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.cpp: Added.
        (WebCore):
        (WebCore::RTCPeerConnectionHandler::create):
        (WebCore::RTCPeerConnectionHandlerChromium::RTCPeerConnectionHandlerChromium):
        (WebCore::RTCPeerConnectionHandlerChromium::~RTCPeerConnectionHandlerChromium):
        (WebCore::RTCPeerConnectionHandlerChromium::initialize):
        * platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.h: Added.
        (WebCore):
        (RTCPeerConnectionHandlerChromium):

2012-08-02  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: rename reportMemoryUsage to reportDescendantMemoryUsage in StyleRuleBase descendants
        https://bugs.webkit.org/show_bug.cgi?id=92966

        Reviewed by Alexander Pavlov.

        Renamed reportMemoryUsage to reportDescendantMemoryUsage in all descendants of
        StyleRuleBase to avoid accidental recursive calls to StyleRuleBase::reportMemoryUsage
        when a new type of rule is added.

        * css/StyleRule.cpp:
        (WebCore::StyleRuleBase::reportMemoryUsage):
        (WebCore::StyleRule::reportDescendantMemoryUsage):
        (WebCore::StyleRulePage::reportDescendantMemoryUsage):
        (WebCore::StyleRuleFontFace::reportDescendantMemoryUsage):
        (WebCore::StyleRuleBlock::reportDescendantMemoryUsage):
        (WebCore::StyleRuleMedia::reportDescendantMemoryUsage):
        (WebCore::StyleRuleRegion::reportDescendantMemoryUsage):
        * css/StyleRule.h:
        (StyleRule):
        (StyleRuleFontFace):
        (StyleRulePage):
        (StyleRuleBlock):
        (StyleRuleMedia):
        (StyleRuleRegion):
        * css/StyleRuleImport.cpp:
        (WebCore::StyleRuleImport::reportDescendantMemoryUsage):
        * css/StyleRuleImport.h:
        (StyleRuleImport):
        * css/WebKitCSSKeyframesRule.cpp:
        (WebCore::StyleRuleKeyframes::reportDescendantMemoryUsage):
        * css/WebKitCSSKeyframesRule.h:
        (StyleRuleKeyframes):

2012-08-02  Hironori Bono  <hbono@chromium.org>

        [Chromium] Implement hyphenation for Chromium
        https://bugs.webkit.org/show_bug.cgi?id=48610

        Reviewed by Eric Seidel.

        This change adds a couple of methods canHyphenate and computeLastHyphenLocation
        to Platform so Chromium can implement them. Also, this change uses these methods
        to implement the hyphenation methods of WebCore. (This change does not change
        any behaviors until Chromium implements these methods.)

        No new tests because this change is for fixing a couple of existing layout tests
        'fast/text/hyphenate-character.html' and 'fast/text/hyphens.html'.

        * WebCore.gypi:
        * platform/text/chromium/Hyphenation.cpp: Added.
        (WebCore):
        (WebCore::canHyphenate): Called Platform::canHyphenation().
        (WebCore::lastHyphenLocation): Called Platform::computeLastHyphenLocation().

2012-08-02  ulan@chromium.org  <ulan@chromium.org>

        [chromium] Improve garbage collector hint if page uses Canvas contexts
        https://bugs.webkit.org/show_bug.cgi?id=92856

        Reviewed by Kentaro Hara.

        Request GC by sending context disposed and idle notification to V8 instead
        of sending low memory notification. It is faster as it causes one GC
        instead of seven GCs caused by low memory notification.

        * bindings/v8/V8Binding.cpp:
        (WebCore::V8BindingPerIsolateData::V8BindingPerIsolateData):
        * bindings/v8/V8Binding.h:
        (V8BindingPerIsolateData):
        (WebCore::V8BindingPerIsolateData::setShouldCollectGarbageSoon):
        (WebCore::V8BindingPerIsolateData::clearShouldCollectGarbageSoon):
        (WebCore::V8BindingPerIsolateData::shouldCollectGarbageSoon):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::hintForGCIfNecessary):
        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
        (WebCore::V8HTMLCanvasElement::getContextCallback):

2012-08-02  Mihnea Ovidenie  <mihnea@adobe.com>

        CSSRegions: Crash when reattaching a region to a named flow.
        https://bugs.webkit.org/show_bug.cgi?id=91307

        Reviewed by Abhishek Arya.

        The lifetime of a flow thread  has changed from not being destroyed (until the RenderView is destroyed) to being destroyed,
        under certain conditions, no attached regions and no content, before RenderView is destroyed.
        When the flow thread does not have any content and the region to be detached is the last region for the flow thread,
        the flow thread is destroyed.
        In this case, if the same region has to be attached again to the flow thread, the flow thread needs to be
        recreated, otherwise the crash will result.

        Test: fast/regions/region-flow-reattach-crash.html

        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::attachRegion):
        We skip the attach if we are in the middle of document destruction.
        We recreate the flow thread to which the region is intended to be attached only if the region was
        not previously marked as invalid in relation to the flow thread (because the region was part of a
        circular dependency).
        (WebCore::RenderRegion::detachRegion): After the region is detached from flow thread,
        null the region internal pointer to the flow thread to mark that the region is not
        attached.

2012-08-02  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: Move RTCConfiguration to its proper place
        https://bugs.webkit.org/show_bug.cgi?id=92867

        Reviewed by Adam Barth.

        This patch moves RTCConfiguration to Source/WebCore/platform/mediastream,
        and adds its WebKit interface for chromium.

        No functional code changes.

        * GNUmakefile.list.am:
        * Modules/mediastream/RTCPeerConnection.cpp:
        * WebCore.gypi:
        * platform/chromium/support/WebRTCConfiguration.cpp: Added.
        (WebKit):
        (WebKit::WebRTCICEServer::WebRTCICEServer):
        (WebKit::WebRTCICEServer::assign):
        (WebKit::WebRTCICEServer::reset):
        (WebKit::WebRTCICEServer::uri):
        (WebKit::WebRTCICEServer::credential):
        (WebKit::WebRTCConfiguration::WebRTCConfiguration):
        (WebKit::WebRTCConfiguration::assign):
        (WebKit::WebRTCConfiguration::reset):
        (WebKit::WebRTCConfiguration::numberOfServers):
        (WebKit::WebRTCConfiguration::server):
        * platform/mediastream/RTCConfiguration.h: Added.
        (WebCore):
        (RTCIceServer):
        (WebCore::RTCIceServer::create):
        (WebCore::RTCIceServer::~RTCIceServer):
        (WebCore::RTCIceServer::uri):
        (WebCore::RTCIceServer::credential):
        (WebCore::RTCIceServer::RTCIceServer):
        (RTCConfiguration):
        (WebCore::RTCConfiguration::create):
        (WebCore::RTCConfiguration::~RTCConfiguration):
        (WebCore::RTCConfiguration::appendServer):
        (WebCore::RTCConfiguration::numberOfServers):
        (WebCore::RTCConfiguration::server):
        (WebCore::RTCConfiguration::RTCConfiguration):

2012-08-02  Alexander Shalamov  <alexander.shalamov@intel.com>

        [EFL] Browser crashes when non-progress element with -webkit-appearance:progress-bar is rendered
        https://bugs.webkit.org/show_bug.cgi?id=92747

        Reviewed by Hajime Morita.

        When https://bugs.webkit.org/show_bug.cgi?id=40158 was fixed, all ports
        were fixed except EFL port. This patch fixes assert that is hit when
        non-progress element is rendered with -webkit-appearance:progress-bar style.

        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::paintProgressBar):

2012-08-02  Yoshifumi Inoue  <yosin@chromium.org>

        REGRESSION(r102741): [Forms] In selects, when disabled, browser skips first option if not in optgroup, then selects first option in optgroup
        https://bugs.webkit.org/show_bug.cgi?id=92833

        Reviewed by Kent Tamura.

        This patch changes implementation of HTMLOptionElement::disabled() to
        follow the "disabled" concept of option element in HTML5 specification[1],
        the option element is disabled if option element has "disabled"
        attribute or parent optgroup element has "disabled" attribute. Before
        this patch, HTMLOptionElement::disabled() checks presenting "disabled"
        attribute in option element itself and any parent element.

        Before this patch, HTMLSelectElement::recalcListItems() didn't considers
        non-disabled option as default selected option if select element is
        disabled because HTMLOptionElement::disabled() returned true if select
        element is disabled.

        After this patch, HTMLOptionElement::disabled() is independent from
        select element. HTMLSelectElement::recalcListItems() considers
        non-disabled option as default selected option.

        [1] http://www.whatwg.org/specs/web-apps/current-work/multipage/the-button-element.html#concept-option-disabled

        Tests: fast/forms/basic-selects.html: Fixed expectation to right thing.

        * css/html.css:
        (select[disabled]>option): Added to render option elements in disabled
        select element to disabled color as before this patch.
        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::disabled): Changed to check parent element
        is optgroup.
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler): On mouse up
        and down, don't update selection if select element is disabled.
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::paintItemForeground): Added checking select
        element is disabled. Before this patch, it was done by HTMLOptionElement::disabled().

2012-08-01  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124406.
        http://trac.webkit.org/changeset/124406
        https://bugs.webkit.org/show_bug.cgi?id=92951

        it set the Mac bots on fire (Requested by pizlo on #webkit).

        * bindings/js/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::setBreakpoint):
        (WebCore::ScriptDebugServer::removeBreakpoint):
        (WebCore::ScriptDebugServer::hasBreakpoint):
        (WebCore::ScriptDebugServer::createCallFrameAndPauseIfNeeded):
        (WebCore::ScriptDebugServer::updateCallFrameAndPauseIfNeeded):
        (WebCore::ScriptDebugServer::callEvent):
        (WebCore::ScriptDebugServer::atStatement):
        (WebCore::ScriptDebugServer::returnEvent):
        (WebCore::ScriptDebugServer::exception):
        (WebCore::ScriptDebugServer::willExecuteProgram):
        (WebCore::ScriptDebugServer::didExecuteProgram):
        (WebCore::ScriptDebugServer::didReachBreakpoint):
        * bindings/js/ScriptDebugServer.h:
        (ScriptDebugServer):

2012-08-01  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: test native memory instrumentation code with help of unittests
        https://bugs.webkit.org/show_bug.cgi?id=92743

        Reviewed by Yury Semikhatsky.

        Test a part of existing Native Memory Instrumentation code with help of unit tests.
        6 tests were added and two bugs were fixed.
        a drive-by improvement: the method MemoryInstrumentation::addInstrumentedObject
        was marked as private and addRootObject was introduced instead of it.
        The new function also calls processDeferedPointers.

        * bindings/v8/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
        * dom/MemoryInstrumentation.h:
        (WebCore::MemoryInstrumentation::addRootObject):
        (MemoryInstrumentation):
        (WebCore::MemoryInstrumentation::addInstrumentedObject):
        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl):
        (WebCore):
        (WebCore::MemoryInstrumentation::addObjectImpl):
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):
        * inspector/MemoryInstrumentationImpl.h:
        (MemoryInstrumentationImpl):
        (WebCore::MemoryInstrumentationImpl::totalSize):
        (WebCore::MemoryInstrumentationImpl::reportedSizeForAllTypes):

2012-08-01  Ryosuke Niwa  <rniwa@webkit.org>

        Chromium Android build fix after r124402.
        Initialize the out variables as suggested by the compiler.

        * Modules/indexeddb/IDBLevelDBCoding.cpp:
        (WebCore::IDBLevelDBCoding::DatabaseFreeListKey::decode):
        (WebCore::IDBLevelDBCoding::DatabaseNameKey::decode):
        (WebCore::IDBLevelDBCoding::ObjectStoreMetaDataKey::decode):
        (WebCore::IDBLevelDBCoding::IndexMetaDataKey::decode):
        (WebCore::IDBLevelDBCoding::ObjectStoreFreeListKey::decode):
        (WebCore::IDBLevelDBCoding::IndexFreeListKey::decode):
        (WebCore::IDBLevelDBCoding::ObjectStoreNamesKey::decode):
        (WebCore::IDBLevelDBCoding::IndexNamesKey::decode):

2012-08-01  Keishi Hattori  <keishi@webkit.org>

        Fix typo in colorSuggestionPicker.js
        https://bugs.webkit.org/show_bug.cgi?id=92936

        Reviewed by Kent Tamura.

        Fixes typo.

        Test: platform/chromium/fast/forms/color/color-suggestion-picker-with-scrollbar-appearance.html

        * Resources/colorSuggestionPicker.js:
        (getScrollbarWidth):

2012-08-01  Shinya Kawanaka  <shinyak@chromium.org>

        The elements in Shadow DOM of input should not be modifiable.
        https://bugs.webkit.org/show_bug.cgi?id=92200

        Reviewed by Kent Tamura.

        Since we don't have "-webkit-user-modify: read-only !important;" for the elements in Shadow DOM of
        input element, user can change them and it causes a crash.

        We should have "-webkit-user-modify: read-only !important;" for those elements.

        Test: fast/forms/input-user-modify.html

        * css/html.css:
        (input::-webkit-textfield-decoration-container):
        (input[type="search"]::-webkit-search-cancel-button):
        (input[type="search"]::-webkit-search-decoration):
        (input[type="search"]::-webkit-search-results-decoration):
        (input[type="search"]::-webkit-search-results-button):
        (input::-webkit-inner-spin-button):
        (input::-webkit-input-speech-button):
        (input::-webkit-input-placeholder, isindex::-webkit-input-placeholder):
        (input[type="file"]::-webkit-file-upload-button):
        (input[type="range"]::-webkit-slider-container, input[type="range"]::-webkit-media-slider-container):
        (input[type="range"]::-webkit-slider-runnable-track):
        (input[type="range"]::-webkit-slider-thumb, input[type="range"]::-webkit-media-slider-thumb):
        (input[type="color"]::-webkit-color-swatch-wrapper):
        (input[type="color"]::-webkit-color-swatch):
        (input::-webkit-calendar-picker-indicator):

2012-08-01  Peter Wang  <peter.wang@torchmobile.com.cn>

        Web Inspector: [JSC] implement setting breakpoints by line:column
        https://bugs.webkit.org/show_bug.cgi?id=53003

        Reviewed by Geoffrey Garen.

        As JSC is enabled to provide column info of statement, ScriptDebugServer can use it to
        support "Pretty Print" debug mode.

        No new test case for this patch.

        * bindings/js/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::setBreakpoint):
        (WebCore::ScriptDebugServer::removeBreakpoint):
        (WebCore):
        (WebCore::ScriptDebugServer::updateCurrentStatementPosition):
        (WebCore::ScriptDebugServer::hasBreakpoint):
        (WebCore::ScriptDebugServer::createCallFrameAndPauseIfNeeded):
        (WebCore::ScriptDebugServer::updateCallFrameAndPauseIfNeeded):
        (WebCore::ScriptDebugServer::callEvent):
        (WebCore::ScriptDebugServer::atStatement):
        (WebCore::ScriptDebugServer::returnEvent):
        (WebCore::ScriptDebugServer::exception):
        (WebCore::ScriptDebugServer::willExecuteProgram):
        (WebCore::ScriptDebugServer::didExecuteProgram):
        (WebCore::ScriptDebugServer::didReachBreakpoint):
        * bindings/js/ScriptDebugServer.h:
        (ScriptDebugServer):

2012-08-01  Xingnan Wang  <xingnan.wang@intel.com>

        IndexedDB: ObjectStoreMetaDataKey::m_metaDataType should use byte type
        https://bugs.webkit.org/show_bug.cgi?id=92725

        Reviewed by Kentaro Hara.

        No new tests - Low level functions covered by existing layout tests and also covered by Chromium
        webkit_unit_tests IDBLevelIDBCodingTest.*.

        * Modules/indexeddb/IDBLevelDBCoding.cpp:
        (IDBLevelDBCoding):
        (WebCore::IDBLevelDBCoding::decodeByte):
        (WebCore::IDBLevelDBCoding::DatabaseFreeListKey::decode):
        (WebCore::IDBLevelDBCoding::DatabaseNameKey::decode):
        (WebCore::IDBLevelDBCoding::ObjectStoreMetaDataKey::decode):
        (WebCore::IDBLevelDBCoding::ObjectStoreMetaDataKey::encode):
        (WebCore::IDBLevelDBCoding::ObjectStoreMetaDataKey::metaDataType):
        (WebCore::IDBLevelDBCoding::IndexMetaDataKey::decode):
        (WebCore::IDBLevelDBCoding::ObjectStoreFreeListKey::decode):
        (WebCore::IDBLevelDBCoding::IndexFreeListKey::decode):
        (WebCore::IDBLevelDBCoding::ObjectStoreNamesKey::decode):
        (WebCore::IDBLevelDBCoding::IndexNamesKey::decode):
        * Modules/indexeddb/IDBLevelDBCoding.h:
        (IDBLevelDBCoding):

2012-08-01  James Robinson  <jamesr@chromium.org>

        [chromium] Use new-style tracing macros with explicit category
        https://bugs.webkit.org/show_bug.cgi?id=92928

        Reviewed by Adam Barth.

        The chromium tracing system supports using a string identifier for trace categories that can be used to filter
        events. This switches over to setting an explicit category for all traces and removes the old-style
        TRACE_EVENT() macro.

        * bindings/v8/ScheduledAction.cpp:
        (WebCore::ScheduledAction::execute):
        * platform/ScrollAnimatorNone.cpp:
        (WebCore::ScrollAnimatorNone::scroll):
        (WebCore::ScrollAnimatorNone::animationTimerFired):
        * platform/chromium/TraceEvent.h:
        * platform/graphics/chromium/ProgramBinding.cpp:
        (WebCore::ProgramBindingBase::init):
        * platform/graphics/skia/ImageSkia.cpp:
        (WebCore::drawResampledBitmap):
        (WebCore::paintSkBitmap):
        (WebCore::Image::drawPattern):
        * platform/graphics/skia/NativeImageSkia.cpp:
        (WebCore::NativeImageSkia::resizedBitmap):
        * platform/graphics/skia/PlatformContextSkia.cpp:
        (WebCore::PlatformContextSkia::bitmap):
        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
        (WebCore::BMPImageDecoder::decode):
        * platform/image-decoders/gif/GIFImageDecoder.cpp:
        (WebCore::GIFImageDecoder::decode):
        * platform/image-decoders/ico/ICOImageDecoder.cpp:
        (WebCore::ICOImageDecoder::decode):
        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
        (WebCore::JPEGImageDecoder::decode):
        * platform/image-decoders/png/PNGImageDecoder.cpp:
        (WebCore::PNGImageDecoder::decode):
        * platform/image-decoders/webp/WEBPImageDecoder.cpp:
        (WebCore::WEBPImageDecoder::decode):

2012-08-01  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>

        [EFL] Crash at WebCore::toRenderSlider
        https://bugs.webkit.org/show_bug.cgi?id=92893

        Reviewed by Hajime Morita.

        Added a type check before casting a render object to RenderSlider as 
        an arbitrary element can have for example webkit-appearance: slider-horizontal.

        No new tests. Existing test fast/forms/range/slider-appearance-crash.html covers the case.

        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::paintThemePart):

2012-08-01  Koji Ishii  <kojiishi@gmail.com>

        Cache support for OpenTypeVerticalData
        https://bugs.webkit.org/show_bug.cgi?id=81332

        Reviewed by Tony Chang.

        This patch adds FontCache to cache OpenTypeVerticalData class
        instances that was introduced in bug 81326.

        We need one instance of the class per OpenType font file, and we don't
        have a class to hold such instances today.

        ENABLE_OPENTYPE_VERTICAL isn't enabled for any platforms yet, so this
        patch isn't on any code path. Apple Windows port (bug 48459) is going
        to use this code, and probably Chromium (51450, 69282) as well.

        "FIXME" comment in SimpleFontData.h will be implemented in 48459.

        No new tests are required. No behavior changes.

        * platform/graphics/FontCache.cpp:
        (WebCore::FontCache::getCachedFontPlatformData): Ignore leading "@" on Windows to disable Windows feature for vertical flow.
        (WebCore):
        (WebCore::FontCache::getVerticalData): Get cached OpenTypeVerticalData from FontPlatformData, or crete one.
        (WebCore::FontCache::purgeInactiveFontData): Purge inactive OpenTypeVerticalData.
        * platform/graphics/FontCache.h:
        (WebCore):
        * platform/graphics/SimpleFontData.h:
        (SimpleFontData):
        (WebCore::SimpleFontData::verticalData): A dummy implementation for purgeInactiveFontData() to work.
        * platform/graphics/opentype/OpenTypeVerticalData.h: Added m_inFontCache for mark & sweep.
        (OpenTypeVerticalData):

2012-08-01  James Robinson  <jamesr@chromium.org>

        [chromium] Move compositor HUD font atlas initialization code out of compositor core
        https://bugs.webkit.org/show_bug.cgi?id=92924

        Reviewed by Adrienne Walker.

        This moves the HUD font atlas initialization code out of the compositor implementation to cut out Font-related
        dependencies. The new flow is that an embedder can pass a font atlas to the CCLayerTreeHost, after which the
        atlas is provided the HUD layer (if any) on the next commit. The HUD layer renders text using the font atlas if
        it has any if the settings require text.

        HUD tested manually, we don't have automated tests for this debugging-only feature.

        * platform/graphics/chromium/CompositorHUDFontAtlas.cpp:
        (WebCore):
        (WebCore::CompositorHUDFontAtlas::generateFontAtlas):
        * platform/graphics/chromium/CompositorHUDFontAtlas.h:
        (CompositorHUDFontAtlas):
        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.cpp:
        (WebCore::HeadsUpDisplayLayerChromium::create):
        (WebCore::HeadsUpDisplayLayerChromium::HeadsUpDisplayLayerChromium):
        (WebCore::HeadsUpDisplayLayerChromium::setFontAtlas):
        (WebCore):
        (WebCore::HeadsUpDisplayLayerChromium::createCCLayerImpl):
        (WebCore::HeadsUpDisplayLayerChromium::pushPropertiesTo):
        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.h:
        (HeadsUpDisplayLayerChromium):
        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
        (WebCore::CCFontAtlas::CCFontAtlas):
        * platform/graphics/chromium/cc/CCFontAtlas.h:
        (WebCore):
        (WebCore::CCFontAtlas::create):
        (CCFontAtlas):
        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
        (WebCore::CCHeadsUpDisplayLayerImpl::CCHeadsUpDisplayLayerImpl):
        (WebCore::CCHeadsUpDisplayLayerImpl::setFontAtlas):
        (WebCore):
        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.h:
        (WebCore::CCHeadsUpDisplayLayerImpl::create):
        (CCHeadsUpDisplayLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::setFontAtlas):
        (WebCore):
        (WebCore::CCLayerTreeHost::willCommit):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore):
        (CCLayerTreeHost):

2012-08-01  Antoine Labour  <piman@chromium.org>

        [chromium] factor out the optimization pass in CCRenderSurfaceFilters::apply
        https://bugs.webkit.org/show_bug.cgi?id=92453

        Reviewed by James Robinson.

        This separates the "optimization" pass in CCRenderSurfaceFilters::apply
        to resolve a succession of color matrix filters into a single operation.
        This allows testing of that code.
        This introduces a new generic color matrix WebFilterOperation, which can
        also be used on its own.

        New test: CCRenderSurfaceFiltersTest.

        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:
        (WebCore::CCRenderSurfaceFilters::optimize):
        (WebCore):
        (WebCore::CCRenderSurfaceFilters::apply):
        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.h:
        (CCRenderSurfaceFilters):

2012-08-01  Jian Li  <jianli@chromium.org>

        Add new CSS property "-webkit-widget-region" to expose dashboard region support for other port
        https://bugs.webkit.org/show_bug.cgi?id=90298

        Reviewed by Adam Barth.

        The css property "-webkit-widget-region" is essentially a synonym of
        "-webkit-dashboard-region" that allows us to expose dashboard region
        support for other port. This patch also adds a new feature define
        ENABLE(WIDGET_REGION) such that "-webkit-dashboard-region" is only
        provided under ENABLE(DASHBOARD_SUPPORT) as it is now and
        "-webkit-widget-region" is only exposed under ENABLE(WIDGET_REGION).

        Change almost all the code pieces guarded by ENABLE(DASHBOARD_SUPPORT)
        to make them also guarded by ENABLE(WIDGET_REGION), except those
        that are specific to Apple/WebKit.

        Currently ENABLE(WIDGET_REGION) has been turned on by default for
        Mac/WebKit and chromium ports.

        Test: fast/css/widget-region-parser.html

        * Configurations/FeatureDefines.xcconfig: Add ENABLE_WIDGET_REGION define.
        * DerivedSources.make:
        * GNUmakefile.am: Add ENABLE_WIDGET_REGION define.
        * WebCore.exp.in:
        * css/CSSComputedStyleDeclaration.cpp: Handle CSSPropertyWebkitWidgetRegion.
        (WebCore):
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp: Parse "-webkit-widget-region".
        (WebCore::CSSParser::parseValue):
        (WebCore):
        (WebCore::CSSParser::parseDashboardRegions):
        * css/CSSProperty.cpp: Handle CSSPropertyWebkitWidgetRegion.
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPrimitiveValue.cpp:
        (WebCore):
        (WebCore::CSSPrimitiveValue::customCssText):
        (WebCore::CSSPrimitiveValue::cloneForCSSOM):
        * css/CSSPropertyNames.in: Add "-webkit-widget-region" property.
        * css/DashboardRegion.h:
        (DashboardRegion):
        * css/StyleResolver.cpp: Handle CSSPropertyWebkitWidgetRegion.
        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore):
        * dom/Document.h:
        (WebCore):
        (Document):
        * page/Chrome.cpp:
        (WebCore):
        * page/ChromeClient.h:
        (ChromeClient):
        * page/FrameView.cpp:
        (WebCore::FrameView::layout):
        (WebCore):
        (WebCore::FrameView::paintContents):
        * page/FrameView.h:
        (FrameView):
        * rendering/RenderInline.cpp:
        (WebCore):
        * rendering/RenderInline.h:
        (RenderInline):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollTo):
        (WebCore::RenderLayer::setHasHorizontalScrollbar):
        (WebCore::RenderLayer::setHasVerticalScrollbar):
        (WebCore::RenderLayer::updateScrollbarsAfterLayout):
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::setHasVerticalScrollbar):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::styleWillChange):
        (WebCore):
        * rendering/RenderObject.h:
        (RenderObject):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::diff):
        (WebCore):
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleDashboardRegion.h:
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:
        (WebCore):
        (StyleRareNonInheritedData):

2012-08-01  Arnaud Renevier  <a.renevier@sisa.samsung.com>

        [V8] TypedArray binding performance improvements
        https://bugs.webkit.org/show_bug.cgi?id=92557

        Reviewed by Kenneth Russell.

        Improve TypedArray bindings performance:
        - create arrays with createUninitialized when possible. Typed Array
        construction is about 10% faster.
        - when creating a typed array from a same typed array, memcpy data
        from source to target.

        In order to detect if argument array is the same type as
        implementation array, we pass the javascript wrapper type as a new
        type argument to template function constructWebGLArray.

        Introduce wrapArrayBufferView which wraps typed array into a v8::Value

        No new tests: Performance tests are already handled by
        Bindings/typed-array-construct-from-same-type.html and
        Bindings/typed-array-construct-from-typed.html

        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore):
        (WebCore::constructWebGLArray):
        * bindings/v8/custom/V8Float32ArrayCustom.cpp:
        (WebCore::V8Float32Array::constructorCallback):
        * bindings/v8/custom/V8Float64ArrayCustom.cpp:
        (WebCore::V8Float64Array::constructorCallback):
        * bindings/v8/custom/V8Int16ArrayCustom.cpp:
        (WebCore::V8Int16Array::constructorCallback):
        * bindings/v8/custom/V8Int32ArrayCustom.cpp:
        (WebCore::V8Int32Array::constructorCallback):
        * bindings/v8/custom/V8Int8ArrayCustom.cpp:
        (WebCore::V8Int8Array::constructorCallback):
        * bindings/v8/custom/V8Uint16ArrayCustom.cpp:
        (WebCore::V8Uint16Array::constructorCallback):
        * bindings/v8/custom/V8Uint32ArrayCustom.cpp:
        (WebCore::V8Uint32Array::constructorCallback):
        * bindings/v8/custom/V8Uint8ArrayCustom.cpp:
        (WebCore::V8Uint8Array::constructorCallback):
        * bindings/v8/custom/V8Uint8ClampedArrayCustom.cpp:
        (WebCore::V8Uint8ClampedArray::constructorCallback):

2012-08-01  Antoine Labour  <piman@chromium.org>

        [chromium] Fix lost context handling on hud layer
        https://bugs.webkit.org/show_bug.cgi?id=92915

        Reviewed by Adrienne Walker.

        On lost context we need to release CCScopedTextures, otherwise later on
        we will try to re-allocate it using a stale CCResourceProvider.

        Test CCLayerTreeHostImplTest.dontUseOldResourcesAfterLostContext
        extended.

        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
        (WebCore::CCHeadsUpDisplayLayerImpl::didLoseContext):
        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.h:

2012-08-01  Kwang Yul Seo  <skyul@company100.net>

        Read tag names and attributes from the saved tokens in HTMLElementStack
        https://bugs.webkit.org/show_bug.cgi?id=92830

        Reviewed by Adam Barth.

        This is a follow-up patch for r123577.
        Replaced top()->hasTagName(x) with topStackItem()->hasTagName(x).
        Also replaced item->element()->hasTagName(x) with item->hasTagName(x).

        No new tests, covered by existing tests.

        * html/parser/HTMLElementStack.cpp:
        (WebCore::HTMLElementStack::pop):
        (WebCore::HTMLElementStack::popUntil):
        (WebCore::HTMLElementStack::pushHTMLHtmlElement):
        (WebCore::HTMLElementStack::pushHTMLHeadElement):
        (WebCore::HTMLElementStack::pushHTMLBodyElement):
        (WebCore::HTMLElementStack::push):
        (WebCore::HTMLElementStack::insertAbove):
        (WebCore::HTMLElementStack::popCommon):

2012-08-01  Antoine Labour  <piman@chromium.org>

        [chromium] remove unused fields from LayerRendererCapabilities
        https://bugs.webkit.org/show_bug.cgi?id=92906

        Reviewed by James Robinson.

        No new tests (just removing dead code).

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::initialize):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::LayerRendererCapabilities::LayerRendererCapabilities):
        (LayerRendererCapabilities):

2012-08-01  James Robinson  <jamesr@chromium.org>

        [chromium] Move compositor HUD font atlas generation out of compositor core
        https://bugs.webkit.org/show_bug.cgi?id=92901

        Reviewed by Adrienne Walker.

        This moves the font atlas generation out of CCFontAtlas into a separate helper class and ports the CCFontAtlas
        text drawing code over to use skia directly.

        * WebCore.gypi:
        * platform/graphics/chromium/CompositorHUDFontAtlas.cpp: Added.
        (WebCore):
        (WebCore::wrapPositionIfNeeded):
        (WebCore::CompositorHUDFontAtlas::generateFontAtlas):
        * platform/graphics/chromium/CompositorHUDFontAtlas.h: Added.
        (WebCore):
        (CompositorHUDFontAtlas):
        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
        (WebCore::CCFontAtlas::CCFontAtlas):
        (WebCore::CCFontAtlas::~CCFontAtlas):
        (WebCore::CCFontAtlas::initialize):
        (WebCore::CCFontAtlas::drawText):
        (WebCore::CCFontAtlas::drawOneLineOfTextInternal):
        (WebCore::CCFontAtlas::drawDebugAtlas):
        * platform/graphics/chromium/cc/CCFontAtlas.h:
        (WebCore):
        (CCFontAtlas):
        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:

2012-08-01  Peter Beverloo  <peter@chromium.org>

        [Text Autosizing] Provide an API for influencing the font scale factor
        https://bugs.webkit.org/show_bug.cgi?id=92882

        Reviewed by Adam Barth.

        Add the font scale factor to settings, and provide an API in
        window.internal.settings to change it from layout tests.

        The font scale factor applied to Text Autosizing influences the sizing
        of text, and will influence the scaling of boosted blocks once the
        implementation progresses. For Android, it will be set to the font size
        chosen in the user's system-wide preferences.

        Test: fast/text-autosizing/font-scale-factor.html

        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        (WebCore):
        (WebCore::Settings::setTextAutosizingFontScaleFactor):
        * page/Settings.h:
        (Settings):
        (WebCore::Settings::textAutosizingFontScaleFactor):
        * rendering/TextAutosizer.cpp:
        (WebCore::TextAutosizer::processBlock):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::Backup):
        (WebCore::InternalSettings::Backup::restoreTo):
        (WebCore::InternalSettings::setTextAutosizingFontScaleFactor):
        (WebCore):
        * testing/InternalSettings.h:
        (Backup):
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-08-01  Mike West  <mkwst@chromium.org>

        CSP should correctly block plugin resources rendered in PluginDocuments.
        https://bugs.webkit.org/show_bug.cgi?id=92675

        Reviewed by Adam Barth.

        In certain cases, plugins aren't loaded directly, but are stuffed into a
        newly-created PluginDocument before rendering. While we were already
        correctly populating information that allowed us to make decisions about
        that document's security origin, and already dealing with sandbox
        status by creating a 'SinkDocument' that ignored plugin data, we weren't
        correctly inheriting the parent frame's Content Security Policy. This
        patch ensures that PluginDocuments correctly inherit their parent's
        Content Security Policy, meaning that the plugin is blocked or allowed
        according to the policy of the protected resource in which the
        PluginDocument is embedded.

        Tests: http/tests/security/contentSecurityPolicy/object-src-url-allowed.html
               http/tests/security/contentSecurityPolicy/object-src-url-blocked.html

        * dom/Document.cpp:
        (WebCore::Document::initContentSecurityPolicy):
            Populate a created PluginDocument with its frame's parent's Content
            Security Policy.

2012-08-01  Florin Malita  <fmalita@chromium.org>

        SVG animation not working for elements inserted after parsing is finished
        https://bugs.webkit.org/show_bug.cgi?id=92025

        Reviewed by Nikolas Zimmermann.

        Time containers for SVG elements inserted after document parsing is finished need to be
        initialized on insertion (since they've missed the Document::implicitClose() initialization
        point).

        Test: svg/animations/deferred-insertion.html

        * svg/SVGSVGElement.cpp:
        (WebCore::SVGSVGElement::insertedInto):

2012-08-01  Vincent Scheib  <scheib@chromium.org>

        Block pointer lock for sandboxed iframes.
        https://bugs.webkit.org/show_bug.cgi?id=92796

        Reviewed by Adam Barth.

        Sandboxed iframe documents should be blocked from using the
        pointer lock API until there is specification agreement
        on what attribute to use to allow the feature. After
        specification this restriction can be relaxed, but not
        restricting it now would require breaking applications
        later.

        Test: http/tests/pointer-lock/iframe-sandboxed.html

        * dom/SecurityContext.h:
        * page/PointerLockController.cpp:
        (WebCore::PointerLockController::requestPointerLock):

2012-08-01  Patrick Gansterer  <paroga@webkit.org>

        Replace WTF::getCurrentLocalTime() with GregorianDateTime::setToCurrentLocalTime()
        https://bugs.webkit.org/show_bug.cgi?id=92286

        Reviewed by Geoffrey Garen.

        Add a method to GregorianDateTime to set its values to the current locale time.
        Replacing all occurrences of getCurrentLocalTime with the new function allows
        us to remove getCurrentLocalTime in a next step.

        * html/FTPDirectoryDocument.cpp:
        (WebCore::processFileDateString):
        * loader/archive/mhtml/MHTMLArchive.cpp:
        (WebCore::MHTMLArchive::generateMHTMLData):

2012-08-01  Ojan Vafai  <ojan@chromium.org>

        Remove code duplication in determining if display is inline or replaced
        https://bugs.webkit.org/show_bug.cgi?id=92880

        Reviewed by Julien Chaffraix.

        Deduplicate lists of display types by using private helpers.

        No new tests. No change in behavior.

        * rendering/style/RenderStyle.h:

2012-08-01  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: Add ExtraData capability to MediaStreamSource
        https://bugs.webkit.org/show_bug.cgi?id=92860

        Reviewed by Adam Barth.

        The Chromium port needs to store some related data in MediaStreamSource objects.

        Not testable from a LayoutTest.

        * platform/chromium/support/WebMediaStreamSource.cpp:
        (ExtraDataContainer):
        (WebKit::ExtraDataContainer::ExtraDataContainer):
        (WebKit::ExtraDataContainer::extraData):
        (WebKit):
        (WebKit::WebMediaStreamSource::extraData):
        (WebKit::WebMediaStreamSource::setExtraData):
        * platform/mediastream/MediaStreamSource.h:
        (ExtraData):
        (WebCore::MediaStreamSource::ExtraData::~ExtraData):
        (MediaStreamSource):
        (WebCore::MediaStreamSource::extraData):
        (WebCore::MediaStreamSource::setExtraData):

2012-08-01  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: IDBCursor.continue(key) does not throw for key "behind" cursor
        https://bugs.webkit.org/show_bug.cgi?id=92562

        Reviewed by Ojan Vafai.

        Per spec, IDBCursor.continue(key) should throw for forward cursors
        if key <= current key, and for reverse cursors if key >= current key.
        Code was present on the back end but the error code was ignored, possibly
        broken in a recent refactor, and there were no tests for this case.

        Test: storage/indexeddb/cursor-continue-dir.html

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::advance): Handle async transaction termination.
        (WebCore::IDBCursor::continueFunction): Move checks here from backend.
        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
        (WebCore::IDBCursorBackendImpl::IDBCursorBackendImpl): Don't need direction param.
        (WebCore::IDBCursorBackendImpl::continueFunction): Remove checks.
        * Modules/indexeddb/IDBCursorBackendImpl.h: Only IDBBackingStore::cursor needs direction now.
        (WebCore::IDBCursorBackendImpl::create):
        (IDBCursorBackendImpl):
        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
        (WebCore::IDBIndexBackendImpl::openCursorInternal): Drop unused param.
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::openCursorInternal): Ditto.

2012-08-01  Rick Byers  <rbyers@chromium.org>

        Don't request a clickCount of 1 on mouseMove event generated by tap gestures
        https://bugs.webkit.org/show_bug.cgi?id=92779

        Reviewed by Adam Barth.

        mousemove events don't have a click count, so we shouldn't be passing 1
        here.  Note this makes no real difference in practice since the value is
        ignored - fixed strictly for pedantics.
        
        Test: fast/events/touch/gesture/gesture-click

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleGestureTap):

2012-08-01  Kihong Kwon  <kihong.kwon@samsung.com>

        Dropping webkit prefix from Vibration API
        https://bugs.webkit.org/show_bug.cgi?id=92840

        Reviewed by Adam Barth.

        Remove webkit prefix from navigator.webkitVibrate().
        - Vibration API have been entered CR already.
        - Firefox already implements Vibration API.

        No new tests. Covered by fast/dom/navigator-vibration.html

        * Modules/vibration/NavigatorVibration.cpp:
        (WebCore::NavigatorVibration::vibrate):
        * Modules/vibration/NavigatorVibration.h:
        (NavigatorVibration):
        * Modules/vibration/NavigatorVibration.idl:

2012-08-01  Kwang Yul Seo  <skyul@company100.net>

        Read tag names and attributes from the saved tokens in HTMLFormattingElementList::closestElementInScopeWithName(const AtomicString&)
        https://bugs.webkit.org/show_bug.cgi?id=92841

        Reviewed by Adam Barth.

        This is a follow-up patch for r123577.
        Replaced entry.element()->hasLocalName(targetName) with entry.stackItem()->hasLocalName(targetName).

        No new tests, covered by existing tests.

        * html/parser/HTMLFormattingElementList.cpp:
        (WebCore::HTMLFormattingElementList::closestElementInScopeWithName):

2012-08-01  Kwang Yul Seo  <skyul@company100.net>

        HTMLTreeBuilder passes a wrong token when pushing the head element
        https://bugs.webkit.org/show_bug.cgi?id=92838

        Reviewed by Adam Barth.

        When the tree builder pushes the head element in the "after head" insertion mode,
        it creates a HTMLStackItem from a wrong token.

        Added HTMLConstructionSite::headStackItem() to retrieve the stack item for the head
        element. Modified the tree builder to pass the correct stack item when pushing the head
        element in the "after head" insertion mode.

        No new tests, covered by existing tests.

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::insertHTMLHeadElement):
        * html/parser/HTMLConstructionSite.h:
        (WebCore::HTMLConstructionSite::head):
        (WebCore::HTMLConstructionSite::headStackItem):
        (HTMLConstructionSite):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::processStartTag):

2012-08-01  Andrei Bucur  <abucur@adobe.com>

        [CSS Regions] The regionLayoutUpdate event should be dispatched on the NamedFlow object
        https://bugs.webkit.org/show_bug.cgi?id=88778

        Reviewed by Adam Barth.

        Spec: http://www.w3.org/TR/css3-regions/#region-flow-layout-events

        This patch implements the regionLayoutUpdate event per May 3rd CSS Regions spec recommendation.
        Before this patch the event was dispatched individually on each region whenever its overflow state changed. The trigger conditions are preserved with the following additions:
        - the event is dispatched when the last region is removed
        - the event is not dispatched when the named flow switches to the NULL state
        Also, the NamedFlow objects are not deleted if they switch to the NULL state and have listeners attached. In that scenario the JS wrapper will not release the reference
        until the parent Document is destroyed.

        Tests: The old tests have been modified to use the event on the NamedFlow object rather the one on the Region. New tests have been added to verify the
        correct behavior in the special states of the NamedFlow (no region chain, NULL state).

        * dom/Document.cpp:
        (WebCore::Document::addListenerTypeIfNeeded): Listeners are not added on Nodes any more so the regionLayoutUpdate type was removed from the list.
        * dom/Document.h:
        * dom/EventTarget.h:
        (WebCore):
        * dom/EventTargetFactory.in:
        * dom/Node.cpp:
        * dom/Node.h:
        (Node):
        * dom/WebKitNamedFlow.cpp:
        (WebCore::WebKitNamedFlow::eventTargetData):
        (WebCore):
        (WebCore::WebKitNamedFlow::ensureEventTargetData):
        (WebCore::WebKitNamedFlow::dispatchRegionLayoutUpdateEvent): The 3rd May WD says the event is bubbling. However this doesn't make sense as this object doesn't belong to the DOM tree. This was fixed in the ED.
        (WebCore::WebKitNamedFlow::interfaceName):
        (WebCore::WebKitNamedFlow::scriptExecutionContext):
        (WebCore::WebKitNamedFlow::base): Getter for the owner Document used by the wrapper to determine if the object is reachable.
        * dom/WebKitNamedFlow.h:
        (WebCore):
        (WebKitNamedFlow):
        (WebCore::WebKitNamedFlow::refEventTarget):
        (WebCore::WebKitNamedFlow::derefEventTarget):
        * dom/WebKitNamedFlow.idl:
        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::RenderFlowThread):
        (WebCore::RenderFlowThread::layout): The event dispatching is now handled by the implementation of RenderFlowThread.
        (WebCore::RenderFlowThread::computeOverflowStateForRegions):
        * rendering/RenderFlowThread.h:
        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::RenderNamedFlowThread):
        (WebCore::RenderNamedFlowThread::removeRegionFromThread): The layout doesn't detect changes caused by removing the last region. This case is handled separately.
        (WebCore::RenderNamedFlowThread::dispatchRegionLayoutUpdateEvent):
        (WebCore):
        (WebCore::RenderNamedFlowThread::regionLayoutUpdateEventTimerFired):
        * rendering/RenderNamedFlowThread.h:
        (RenderNamedFlowThread):
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::RenderRegion):
        * rendering/RenderRegion.h:
        (RenderRegion):

2012-07-31  Robert Hogan  <robert@webkit.org>

        CSS 2.1 failure: margin-collapse-012 fails
        https://bugs.webkit.org/show_bug.cgi?id=80219

        Reviewed by Eric Seidel.

        Tests: css2.1/20110323/margin-collapse-012.htm
               fast/css/margin-collapse-abspos-negmargin.htm

        I also ran this against the full margin-collapse-* CSS 2.1 suite without regressions.

        Per http://www.w3.org/TR/CSS21/box.html#collapsing-margins don't collapse the margins of 
        positioned blocks. Instead, just use the margin of the sibling/container to offset the 
        positioned block's logical top - its own margin gets added in later at 
        RenderBox::computePositionedLogicalHeightUsing().

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::adjustPositionedBlock):

2012-08-01  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124334.
        http://trac.webkit.org/changeset/124334
        https://bugs.webkit.org/show_bug.cgi?id=92879

        Broke MemoryInstrumentationTest.sizeOf from webkit_unit_tests
        on Chromium canaries (Requested by apavlov1 on #webkit).

        * bindings/v8/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
        * dom/MemoryInstrumentation.h:
        (WebCore::MemoryInstrumentation::addInstrumentedObject):
        (MemoryInstrumentation):
        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl):
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):
        * inspector/MemoryInstrumentationImpl.h:
        (MemoryInstrumentationImpl):
        (WebCore::MemoryInstrumentationImpl::totalTypeSize):

2012-08-01  Han Shen  <shenhan@google.com>

        Fix gcc 4.7 compile warnings.
        https://bugs.webkit.org/show_bug.cgi?id=92797

        Reviewed by Kentaro Hara.

        GCC 4.7 gives (more strict) warnings on uninitialized variables,
        fixed by providing initilization values.

        Tested by gcc 4.7 building. No change in behavior.

        * platform/graphics/filters/arm/NEONHelpers.h:
        (WebCore::loadRGBA8AsFloat): Add initilizaton value for local variable.

2012-08-01  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r122498): Assertion failure: m_nodeListCounts is sometimes not zero in the Document destructor
        https://bugs.webkit.org/show_bug.cgi?id=92742

        Reviewed by Andreas Kling.

        The bug was caused by adoptTreeScope's not always calling unregisterNodeListCache and registerNodeListCache
        on node lists that use m_atomicNameCaches and m_nameCaches.

        Tests: fast/dom/NodeList/nodelist-moved-to-fragment-2.html
               fast/dom/NodeList/nodelist-moved-to-fragment.html

        * dom/NodeRareData.h:
        (WebCore::NodeListsNodeData::adoptTreeScope):

2012-08-01  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Crashes in NetworkResourcesData.
        https://bugs.webkit.org/show_bug.cgi?id=92874

        Reviewed by Yury Semikhatsky.

        * inspector/NetworkResourcesData.cpp:
        (WebCore::contentSizeInBytes):
        (WebCore):
        (WebCore::NetworkResourcesData::ResourceData::removeContent):
        (WebCore::NetworkResourcesData::ResourceData::decodeDataToContent):
        (WebCore::NetworkResourcesData::setResourceContent):
        (WebCore::NetworkResourcesData::maybeDecodeDataToContent):

2012-08-01  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: test native memory instrumentation code with help of unittests
        https://bugs.webkit.org/show_bug.cgi?id=92743

        Reviewed by Yury Semikhatsky.

        Test a part of existing Native Memory Instrumentation code with help of unit tests.
        6 tests were added and two bugs were fixed.
        a drive-by improvement: the method MemoryInstrumentation::addInstrumentedObject
        was marked as private and addRootObject was introduced instead of it.
        The new function also calls processDeferedPointers.

        * bindings/v8/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
        * dom/MemoryInstrumentation.h:
        (WebCore::MemoryInstrumentation::addRootObject):
        (MemoryInstrumentation):
        (WebCore::MemoryInstrumentation::addInstrumentedObject):
        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl):
        (WebCore):
        (WebCore::MemoryInstrumentation::addObjectImpl):
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):
        * inspector/MemoryInstrumentationImpl.h:
        (MemoryInstrumentationImpl):

2012-08-01  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>

        [GTK] Memory leak found while running webaudio tests
        https://bugs.webkit.org/show_bug.cgi?id=92861

        Reviewed by Philippe Normand.

        Fix a memory leak in decodeAudioForBusCreation by adopting
        an allocation of GInputStream.

        No new tests. No change in behavior.

        * platform/audio/gstreamer/AudioFileReaderGStreamer.cpp:
        (WebCore::AudioFileReader::decodeAudioForBusCreation):

2012-08-01  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: count DOM storage cache memory for native snapshot
        https://bugs.webkit.org/show_bug.cgi?id=91617

        Reviewed by Yury Semikhatsky.

        Add memory size used for DOM storage cache reporting interface.
        Report it to the native memory snapshot instrumentation framework.

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        * inspector/InspectorDOMStorageAgent.cpp:
        (WebCore::InspectorDOMStorageAgent::memoryBytesUsedByStorageCache):
        (WebCore):
        * inspector/InspectorDOMStorageAgent.h:
        (InspectorDOMStorageAgent):
        * inspector/InspectorMemoryAgent.cpp:
        (MemoryBlockName):
        (WebCore):
        (WebCore::dumpDOMStorageCache):
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
        (WebCore::InspectorMemoryAgent::InspectorMemoryAgent):
        * inspector/InspectorMemoryAgent.h:
        (WebCore):
        (WebCore::InspectorMemoryAgent::create):
        (InspectorMemoryAgent):
        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.MemoryBlockViewProperties._initialize):
        * storage/StorageArea.h:
        (StorageArea):
        * storage/StorageAreaImpl.cpp:
        (WebCore::StorageAreaImpl::memoryBytesUsedByCache):
        (WebCore):
        * storage/StorageAreaImpl.h:
        (StorageAreaImpl):

2012-07-31  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add CSSStyleSheet memory instrumentation
        https://bugs.webkit.org/show_bug.cgi?id=92748

        Reviewed by Antti Koivisto.

        Added MemoryInstrumentation for CSSStyleSheet, StyleSheetContents, StyleRule,
        CSSSelectorList and StylePropertySet. The coverage is not complete as the
        patch was growing too big.

        * css/CSSSelectorList.cpp:
        (WebCore::CSSSelectorList::CSSSelectorList):
        (WebCore::CSSSelectorList::length):
        (WebCore):
        (WebCore::CSSSelectorList::reportMemoryUsage):
        * css/CSSSelectorList.h:
        (WebCore):
        (CSSSelectorList):
        * css/CSSStyleSheet.cpp:
        (WebCore::CSSStyleSheet::reportMemoryUsage):
        (WebCore):
        * css/CSSStyleSheet.h:
        (WebCore):
        (CSSStyleSheet):
        * css/MediaList.cpp:
        (WebCore):
        (WebCore::MediaQuerySet::reportMemoryUsage):
        (WebCore::MediaList::reportMemoryUsage):
        * css/MediaList.h:
        (WebCore):
        (MediaQuerySet):
        (MediaList):
        * css/MediaQuery.cpp:
        (WebCore::MediaQuery::reportMemoryUsage):
        (WebCore):
        * css/MediaQuery.h:
        (WebCore):
        (MediaQuery):
        * css/MediaQueryExp.cpp:
        (WebCore::MediaQueryExp::reportMemoryUsage):
        (WebCore):
        * css/MediaQueryExp.h:
        (WebCore):
        (MediaQueryExp):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::reportMemoryUsage):
        (WebCore):
        * css/StylePropertySet.h:
        (WebCore):
        (StylePropertySet):
        * css/StyleRule.cpp:
        (WebCore::StyleRuleBase::reportMemoryUsage): We cannot make
        reportMemoryUsage virtual as it would add vtable to StyleRuleBase
        and its descendants and would blow its memory footprint. This
        is why we have a switch over StyleRule type here.
        (WebCore):
        (WebCore::StyleRule::reportMemoryUsage):
        (WebCore::StyleRulePage::reportMemoryUsage):
        (WebCore::StyleRuleFontFace::reportMemoryUsage):
        (WebCore::StyleRuleBlock::reportMemoryUsage):
        (WebCore::StyleRuleMedia::reportMemoryUsage):
        (WebCore::StyleRuleRegion::reportMemoryUsage):
        * css/StyleRule.h:
        (WebCore):
        (StyleRuleBase):
        (StyleRule):
        (StyleRuleFontFace):
        (StyleRulePage):
        (StyleRuleBlock):
        (StyleRuleMedia):
        (StyleRuleRegion):
        * css/StyleSheetContents.cpp:
        (WebCore::StyleSheetContents::reportMemoryUsage):
        (WebCore):
        * css/StyleSheetContents.h:
        (WebCore):
        (StyleSheetContents):
        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        * dom/MemoryInstrumentation.h:
        (WebCore::MemoryClassInfo::addInstrumentedVectorPtr):
        (WebCore::MemoryClassInfo::addVectorPtr):

2012-08-01  Keishi Hattori  <keishi@webkit.org>

        Attempt to fix flakiness of color-suggestion-picker-appearance.html
        https://bugs.webkit.org/show_bug.cgi?id=92848

        Reviewed by Kent Tamura.

        * Resources/colorSuggestionPicker.js:
        (ColorPicker.prototype._layout): We put the width and height into
        variables so we don't call window.onresize twice.

2012-08-01  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix GTK+ build with recent version of GTK+.

        Use g_threads_enter/leave instead of the wrapper macros. This
        gives a compile warning because they are now deprecated but at
        least it builds.

        * plugins/gtk/gtk2xtbin.c:
        (xt_event_prepare):
        (xt_event_check):
        (xt_event_dispatch):

2012-08-01  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Add native memory used by GlyphCache to the snapshot
        https://bugs.webkit.org/show_bug.cgi?id=90615

        Reviewed by Yury Semikhatsky.

        Adds interface for reporting memory usage of platform specific
        components.
        Report memory usage of the font cache allocated by skia in chromium.

        * inspector/InspectorMemoryAgent.cpp:
        (WebCore::addPlatformComponentsInfo):
        (WebCore):
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.MemoryBlockViewProperties._initialize):
        * platform/MemoryUsageSupport.cpp:
        (WebCore::MemoryUsageSupport::memoryUsageByComponents):
        (WebCore):
        * platform/MemoryUsageSupport.h:
        (MemoryUsageSupport):
        (ComponentInfo):
        (WebCore::MemoryUsageSupport::ComponentInfo::ComponentInfo):
        * platform/chromium/MemoryUsageSupportChromium.cpp:
        (WebCore::MemoryUsageSupport::memoryUsageByComponents):
        (WebCore):
        * platform/qt/MemoryUsageSupportQt.cpp:
        (WebCore::MemoryUsageSupport::memoryUsageByComponents):
        (WebCore):

2012-08-01  Yoshifumi Inoue  <yosin@chromium.org>

        [CSS] Add selectors for multiple fields time input UI.
        https://bugs.webkit.org/show_bug.cgi?id=92834

        Reviewed by Kent Tamura.

        This patch adds new selectors and "height" property to spin button
        for multiple fields time input UI.

        RenderTextControlSingleLine::layout() sets height of spin button for
        input type "number" and other input types using RenderTextControlSingleLine
        as renderer object. However, multiple fields time input UI doesn't use
        it and needs to set height of spin button.

        No new tests. This patch doesn't change behavior.

        * css/html.css:
        (input::-webkit-datetime-edit): Added.
        (input::-webkit-datetime-edit-ampm-field): Added.
        (input::-webkit-datetime-edit-hour-field): Added.
        (input::-webkit-datetime-edit-millisecond-field): Added.
        (input::-webkit-datetime-edit-minute-field): Added.
        (input::-webkit-datetime-edit-minute-field[readonly]): Added. This selector
        is used for step>=3600 second and time format contains minute field.
        (input::-webkit-datetime-edit-second-field): Added.
        (input::-webkit-datetime-edit-second-field[readonly]): Added. This selector
        is used for step>=60 second and time format contains second field.
        (input::-webkit-inner-spin-button): Add "height" property for using
        spin button other than RenderTextControlSingleLine.

2012-08-01  Kwang Yul Seo  <skyul@company100.net>

        Make HTMLConstructionSite::createHTMLElement(AtomicHTMLToken*) private.
        https://bugs.webkit.org/show_bug.cgi?id=92846

        Reviewed by Eric Seidel.

        This method is internal to HTMLConstructionSite.

        No functional change.

        * html/parser/HTMLConstructionSite.h:
        (HTMLConstructionSite):

2012-08-01  Kinuko Yasuda  <kinuko@chromium.org>

        [Filesystem] Assertion on $0.webkitEntries while on the input field.
        https://bugs.webkit.org/show_bug.cgi?id=91954

        Reviewed by Kent Tamura.

        Accessing .webkitEntries should not crash when input type is not for file.

        Tests: fast/filesystem/input-access-entries.html

        * Modules/filesystem/HTMLInputElementFileSystem.cpp:
        (WebCore::HTMLInputElementFileSystem::webkitEntries):

2012-08-01  Eugene Klyuchnikov  <eustas.big@gmail.com>

        Web Inspector: Profiles: cleanup HeapSnapshotReceiver interface
        https://bugs.webkit.org/show_bug.cgi?id=92390

        Reviewed by Yury Semikhatsky.

        Remove callback parameter and return values from methods startLoading
        and finishLoading. All implementations of HeapSnapshotReceiver honestly
        override interface methods now.

        * inspector/front-end/HeapSnapshotLoader.js: Adopted new API.
        * inspector/front-end/HeapSnapshotProxy.js: Adopted new API. 
        (WebInspector.HeapSnapshotLoaderProxy.prototype.isStarted): Added.
        (WebInspector.HeapSnapshotLoaderProxy.prototype.addConsumer): Added.
        (WebInspector.HeapSnapshotLoaderProxy.prototype.finishLoading):
        Explicitly finishes loading and build snapshot.
        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapSnapshotReceiver.prototype.startLoading):
        Removed callback parameter and return value.
        (WebInspector.HeapSnapshotReceiver.prototype.finishLoading):
        Removed callback parameter.
        (WebInspector.HeapSnapshotSaveToFileReceiver): Adopted new API.

2012-04-07  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: extract MemoryInstrumentationImpl into separate files for future reusing in unit tests
        https://bugs.webkit.org/show_bug.cgi?id=92751

        Reviewed by Yury Semikhatsky.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/InspectorAllInOne.cpp:
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):
        * inspector/MemoryInstrumentationImpl.cpp: Added.
        (WebCore):
        (WebCore::MemoryInstrumentationImpl::MemoryInstrumentationImpl):
        (WebCore::MemoryInstrumentationImpl::processDeferredInstrumentedPointers):
        (WebCore::MemoryInstrumentationImpl::countObjectSize):
        (WebCore::MemoryInstrumentationImpl::deferInstrumentedPointer):
        (WebCore::MemoryInstrumentationImpl::visited):
        (WebCore::MemoryInstrumentationImpl::selfSize):
        * inspector/MemoryInstrumentationImpl.h: Added.
        (WebCore):
        (MemoryInstrumentationImpl):
        (WebCore::MemoryInstrumentationImpl::totalTypeSize):

2012-07-31  MORITA Hajime  <morrita@google.com>

        Internals::setAuthorShadowDOMForAnyElementEnabled should be on InternalSettings
        https://bugs.webkit.org/show_bug.cgi?id=92823

        Reviewed by Kentaro Hara.

        This change moves Internals::setAuthorShadowDOMForAnyElementEnabled() to
        InternalSettings to support original value recovery.

        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::Backup):
        (WebCore::InternalSettings::Backup::restoreTo):
        (WebCore::InternalSettings::setAuthorShadowDOMForAnyElementEnabled): Moved from Internals.
        (WebCore):
        * testing/InternalSettings.h:
        (Backup):
        (InternalSettings):
        * testing/InternalSettings.idl:
        * testing/Internals.cpp:
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-07-31  Vincent Scheib  <scheib@chromium.org>

        webkitRequestPointerLock and webkitExitPointerLock limited to the same document of an active Pointer lock.
        https://bugs.webkit.org/show_bug.cgi?id=91284

        Reviewed by Adrienne Walker.

        Previously, cross-talk between documents was possible, e.g. allowing one
        document.webkitExitPointerLock to exit the lock from another document.
        This change brings Pointer Lock closer to the Fullscreen API behavior,
        and stops the pointer lock target from being transferable between
        documents.

        Test: http/tests/pointer-lock/requestPointerLock-can-not-transfer-between-documents.html

        * dom/Document.cpp:
        (WebCore::Document::webkitExitPointerLock):
        * page/PointerLockController.cpp:
        (WebCore::PointerLockController::requestPointerLock):

2012-07-31  Keishi Hattori  <keishi@webkit.org>

        ColorInputType::typeMismatchFor is returning the opposite bool
        https://bugs.webkit.org/show_bug.cgi?id=92836

        Reviewed by Kent Tamura.

        No new tests. Covered by color-suggestion-picker-appearance.html.

        * html/ColorInputType.cpp:
        (WebCore::ColorInputType::typeMismatchFor):

2012-07-31  Douglas Stockwell  <dstockwell@chromium.org>

        -webkit-flex-flow does not work with inherit/initial values
        https://bugs.webkit.org/show_bug.cgi?id=92709

        Reviewed by Ojan Vafai.

        Add a new handler for flex-flow and move flex to StyleBuilder to mirror the standard pattern for handling initial/inherit in shorthands.

        Test: css3/flexbox/flex-flow-initial.html

        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder): Added handlers for flex and flex-flow.
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList): Removed hand written logic for handling flex.

2012-07-31  Emil A Eklund  <eae@chromium.org>

        Float imprecision causes incorrect wrapping in LineLayout with subpixel layout
        https://bugs.webkit.org/show_bug.cgi?id=92778

        Reviewed by Eric Seidel.

        Due to float imprecision an incorrect wrapping decision is made in
        certain cases where the values being compare are close but not exactly
        the same. This can happen as the size of blocks is represented in layout
        units while line layout uses floats.

        Test: fast/sub-pixel/inline-block-should-not-wrap.html

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::LineWidth::fitsOnLine):
        Use LayoutUnit::epsilon when comparing values as that is the maximum
        precision we support.

2012-07-31  Hayato Ito  <hayato@chromium.org>

        Refactor EventDispatcher::dispatchEvent() so that we can call each phase (Caputure, Target and Bubbling) of event dispatching separately.
        https://bugs.webkit.org/show_bug.cgi?id=92621

        Reviewed by Dimitri Glazkov.

        This is one of the required refactorings to support event
        propagation for seamless iframes.  I've removed 'goto' statements
        from EventDispatcher::dispatchEvent() as a result.

        I've verified that all separated functions are successfully
        inlined. I could not see any performance regression.  The
        benchmark result is:

        Before this patch:
        % ./Tools/Scripts/run-perf-tests PerformanceTests/DOM/Events.html
        Running 1 tests
        Running DOM/Events.html (1 of 1)
        RESULT DOM: Events= 243.986607143 ms
        median= 242.297619048 ms, stdev= 5.74748351315 ms, min= 239.80952381 ms, max= 268.0 ms

        After this patch:
        % ./Tools/Scripts/run-perf-tests PerformanceTests/DOM/Events.html
        Running 1 tests
        Running DOM/Events.html (1 of 1)
        RESULT DOM: Events= 242.291666667 ms
        median= 240.452380952 ms, stdev= 5.8718643632 ms, min= 238.214285714 ms, max= 266.5 ms

        No new tests, no behavior change.

        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::dispatchEvent):
        (WebCore::EventDispatcher::dispatchEventPreProcess):
        (WebCore):
        (WebCore::EventDispatcher::dispatchEventAtCapturing):
        (WebCore::EventDispatcher::dispatchEventAtTarget):
        (WebCore::EventDispatcher::dispatchEventAtBubbling):
        (WebCore::EventDispatcher::dispatchEventPostProcess):
        (WebCore::EventDispatcher::topEventContext):
        * dom/EventDispatcher.h:
        (WebCore):
        (EventDispatcher):

2012-07-31  Yoshifumi Inoue  <yosin@chromium.org>

        [Chromium] Enable ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS
        https://bugs.webkit.org/show_bug.cgi?id=92822

        Reviewed by Kent Tamura.

        This patch touches header files for compiling files which contains
        ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS.

        No new tests. This patch doesn't change behavior.

        * platform/text/DateTimeFormat.h:
        * platform/text/LocaleICU.h:
        * platform/text/LocaleWin.h:
        * platform/text/LocalizedDate.h:
        * platform/text/LocalizedNumber.h:
        * platform/text/mac/LocaleMac.h:

2012-07-30  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r120979): Node list returned by getElementsByTagNameNS isn't invalidated when children changes
        https://bugs.webkit.org/show_bug.cgi?id=92705

        Reviewed by Abhishek Arya.

        The bug was caused by a typo in NodeListsNodeData::invalidateCaches. We need to invalidate
        tag name node lists when child nodes change and not when attributes change.

        Test: fast/dom/NodeList/nodelist-namespace-invalidation.html

        * dom/Node.cpp:
        (WebCore::NodeListsNodeData::invalidateCaches):

2012-07-31  Tony Chang  <tony@chromium.org>

        flexbox should avoid floats
        https://bugs.webkit.org/show_bug.cgi?id=92661

        Reviewed by Ojan Vafai.

        Block types should avoid floats. Deprecated flexbox and grid already avoid floats.

        Tests: css3/flexbox/floated-flexbox.html - added a test case.

        * rendering/RenderFlexibleBox.h:

2012-07-31  Tony Chang  <tony@chromium.org>

        REGRESSION: flexbox content-size fails to exclude scrollbar
        https://bugs.webkit.org/show_bug.cgi?id=92667

        Reviewed by Ojan Vafai.

        In r123909, we switched to computing the height using computeContentLogicalHeightUsing().
        Unfortunately, this includes the scrollbar when we want the content height. Add a helper
        method for computing the value needed by flexbox.

        Test: css3/flexbox/content-height-with-scrollbars.html

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::mainAxisContentExtent): Use computeLogicalClientHeight
        (WebCore::RenderFlexibleBox::computeLogicalClientHeight): Add new method for taking scrollbar into consideration.
        (WebCore::RenderFlexibleBox::computeAvailableFreeSpace): Use computeLogicalClientHeight
        (WebCore::RenderFlexibleBox::lineBreakLength): Use computeLogicalClientHeight
        * rendering/RenderFlexibleBox.h:

2012-07-31  Kwang Yul Seo  <skyul@company100.net>

        Remove unused method HTMLElementStack::bottom()
        https://bugs.webkit.org/show_bug.cgi?id=92807

        Reviewed by Kentaro Hara.

        HTMLElementStack::bottom() was replaced with HTMLElementStack::rootNode()
        in r80231.

        No functional change, so no new tests.

        * html/parser/HTMLElementStack.cpp:
        * html/parser/HTMLElementStack.h:
        (HTMLElementStack):

2012-07-31  Tony Chang  <tony@chromium.org>

        -webkit-order should take an integer, not a number
        https://bugs.webkit.org/show_bug.cgi?id=92688

        Reviewed by Ojan Vafai.

        The spec changed back from floats to integers:
        http://lists.w3.org/Archives/Public/www-style/2012Jul/0607.html

        Tests: css3/flexbox/css-properties.html: Updated.
               css3/flexbox/flex-order.html: Test cases modified.


        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * rendering/RenderFlexibleBox.cpp:
        (WebCore):
        (RenderFlexibleBox::OrderHashTraits):
        (WebCore::RenderFlexibleBox::OrderHashTraits::emptyValue):
        (WebCore::RenderFlexibleBox::OrderHashTraits::constructDeletedValue):
        (WebCore::RenderFlexibleBox::OrderHashTraits::isDeletedValue):
        (RenderFlexibleBox::OrderIterator):
        * rendering/RenderFlexibleBox.h:
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleRareNonInheritedData.h:
        (StyleRareNonInheritedData):

2012-07-31  James Robinson  <jamesr@chromium.org>

        [chromium] Use skia directly in CCHeadsUpDisplayLayerImpl
        https://bugs.webkit.org/show_bug.cgi?id=92810

        Reviewed by Adrienne Walker.

        The chromium compositor HUD doesn't need to use a full GraphicsContext/etc, all it draws are rectangles and a
        simple stroked path. This draws the HUD with straight skia calls and removes the now unnecessary PlatformCanvas
        wrapper.

        * WebCore.gypi:
        * platform/graphics/chromium/PlatformCanvas.cpp: Removed.
        * platform/graphics/chromium/PlatformCanvas.h: Removed.
        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
        (WebCore::CCFontAtlas::drawText):
        * platform/graphics/chromium/cc/CCFontAtlas.h:
        (CCFontAtlas):
        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
        (WebCore::CCHeadsUpDisplayLayerImpl::willDraw):
        (WebCore::CCHeadsUpDisplayLayerImpl::drawHudContents):
        (WebCore::CCHeadsUpDisplayLayerImpl::drawFPSCounter):
        (WebCore::CCHeadsUpDisplayLayerImpl::drawFPSCounterText):
        (WebCore::CCHeadsUpDisplayLayerImpl::drawDebugRects):
        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.h:
        (WebCore):

2012-07-31  Dean Jackson  <dino@apple.com>

        ImageCG doesn't initialize m_decodedPropertiesSize in BitmapImage constructor
        https://bugs.webkit.org/show_bug.cgi?id=92418

        Reviewed by Dan Bernstein.

        Tested by existing content.

        * platform/graphics/cg/ImageCG.cpp:
        (WebCore::BitmapImage::BitmapImage): initialize m_decodedPropertiesSize to zero.

2012-07-31  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Hit test points are being clipped by layers that should not clip
        https://bugs.webkit.org/show_bug.cgi?id=92786

        Reviewed by James Robinson.

        On impl-side hit testing for chromium compositor, we are
        accidentally checking all ancestor layers for clipping, instead of
        only layers that actually clip something. This patch fixes it.

        Added new unit test that reproduces the scenario:
          CCLayerTreeHostCommonTest.verifyHitTestingForNonClippingIntermediateLayer

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::pointIsClippedBySurfaceOrClipRect):

2012-07-31  James Robinson  <jamesr@chromium.org>

        [chromium] REGRESSION(r123644) Compositor HUD crashes immediately with --show-paint-rects
        https://bugs.webkit.org/show_bug.cgi?id=92775

        Reviewed by Adrienne Walker.

        In r123644, the compositor HUD was turned into a normal layer. When the HUD is supposed to cover the entire
        viewport - for instance if the showPlatformLayerTree or showDebugRects settings are true -
        HeadsUpDisplayLayerChromium's constructor tries to size itself to its layerTreeHost()'s device viewport size.
        Unfortunately, its layerTreeHost pointer is always nil in the constructor since the layer is not yet in the
        tree. Additionally, this doesn't handle resize at all.

        To fix this, this grabs the device viewport size and settings in a LayerChromium::update() OVERRIDE. Also
        changes CCLayerTreeHost::willCommit to only reparent the HUD layer if needed instead of on every frame.

        Tested manually, we don't have any layout tests for the debug HUD.

        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.cpp:
        (WebCore::HeadsUpDisplayLayerChromium::create):
        (WebCore::HeadsUpDisplayLayerChromium::HeadsUpDisplayLayerChromium):
        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.h:
        (HeadsUpDisplayLayerChromium):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::willCommit):

2012-07-31  Sam Weinig  <sam@webkit.org>

        Stop masking 8 bits off of the visited link hash. We need all the bits!
        https://bugs.webkit.org/show_bug.cgi?id=92799

        Reviewed by Anders Carlsson.

        * loader/appcache/ApplicationCacheStorage.cpp:
        (WebCore::urlHostHash):
        * platform/network/blackberry/CredentialBackingStore.cpp:
        (WebCore::hashCredentialInfo):
        * plugins/blackberry/PluginPackageBlackBerry.cpp:
        (WebCore::PluginPackage::hash):
        Update for new function names.

2012-07-31  Chris Rogers  <crogers@google.com>

        Allow AudioDestination to support local/live audio input
        https://bugs.webkit.org/show_bug.cgi?id=90318

        Reviewed by Kenneth Russell.

        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:
        * GNUmakefile.list.am:
        Add AudioIOCallback.h to make files.

        * Modules/webaudio/AudioDestinationNode.h:
        * Modules/webaudio/AudioDestinationNode.cpp:
        (WebCore::AudioDestinationNode::render):
        Change provideInput() method to render() to support optional audio input.

        (AudioDestinationNode):
        (WebCore::AudioDestinationNode::localAudioInputProvider):
        Expose public access to an AudioSourceProvider for local/live audio input.

        (LocalAudioInputProvider):
        (WebCore::AudioDestinationNode::LocalAudioInputProvider::LocalAudioInputProvider):
        (WebCore::AudioDestinationNode::LocalAudioInputProvider::set):
        (WebCore::AudioDestinationNode::LocalAudioInputProvider::provideInput):
        Add simple AudioSourceProvider implementation which dishes out a single AudioBus each
        render quantum for optional local/live audio input.

        * Modules/webaudio/OfflineAudioDestinationNode.h:
        * Modules/webaudio/OfflineAudioDestinationNode.cpp:
        (WebCore::OfflineAudioDestinationNode::startRendering):
        (WebCore::OfflineAudioDestinationNode::offlineRenderEntry):
        (WebCore::OfflineAudioDestinationNode::offlineRender):
        Simple name change using "offline" prefix to avoid confusion with AudioDestinationNode::render() method (implementing AudioIOCallback)

        * platform/audio/AudioDestination.h:
        Switch create() method to take an AudioIOCallback instead of AudioSourceProvider.

        * platform/audio/AudioIOCallback.h:
        (WebCore::AudioIOCallback::~AudioIOCallback):
        Add new AudioIOCallback interface for audio input/output.

        * platform/audio/gstreamer/AudioDestinationGStreamer.cpp:
        (WebCore::AudioDestination::create):
        (WebCore::AudioDestinationGStreamer::AudioDestinationGStreamer):
        * platform/audio/gstreamer/AudioDestinationGStreamer.h:
        (AudioDestinationGStreamer):
        (WebCore::AudioDestinationGStreamer::callback):
        * platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
        (_WebKitWebAudioSourcePrivate):
        (webKitWebAudioSrcSetProperty):
        (webKitWebAudioSrcLoop):
        Small tweaks to AudioDestinationGStreamer implementation to account for switch to AudioIOCallback.

        * platform/audio/mac/AudioDestinationMac.cpp:
        (WebCore::AudioDestination::create):
        (WebCore::AudioDestinationMac::AudioDestinationMac):
        (WebCore::AudioDestinationMac::render):
        * platform/audio/mac/AudioDestinationMac.h:
        (AudioDestinationMac):
        Small tweaks to AudioDestinationMac implementation to account for switch to AudioIOCallback.

2012-07-31  Kwang Yul Seo  <skyul@company100.net>

        Read tag names and attributes from the saved tokens in HTMLTreeBuilder::processEndTag(AtomicHTMLToken*)
        https://bugs.webkit.org/show_bug.cgi?id=92715

        Reviewed by Adam Barth.

        This is a follow-up patch for r123577. Changed oneBelowTop to return HTMLStackItem*.

        No new tests, covered by existing tests.

        * html/parser/HTMLConstructionSite.h:
        (WebCore::HTMLConstructionSite::oneBelowTop):
        * html/parser/HTMLElementStack.cpp:
        (WebCore::HTMLElementStack::oneBelowTop):
        * html/parser/HTMLElementStack.h:
        (HTMLElementStack):

2012-07-31  Eric Seidel  <eric@webkit.org>

        StyleResolver::canShareStyleWithElement does not need to use getAttribute for classAttr in the non-SVG case
        https://bugs.webkit.org/show_bug.cgi?id=92687

        Reviewed by Antti Koivisto.

        Previously 10% of samples in canShareStyleWithElement hit this line, after this change < 1% do.
        This is a small speedup for the non-SVG case.  Since this call is made for every element
        when style is resolved, any small speedup in this function matters on large documents.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-07-31  Luke Macpherson   <macpherson@chromium.org>

        Heap-use-after-free in WebCore::StyleResolver::loadPendingImage
        https://bugs.webkit.org/show_bug.cgi?id=92606

        Reviewed by Abhishek Arya.

        Changes StyleResolver's m_pendingImageProperties set to a map, such that for each property we keep
        a RefPtr to the CSSValue used to set that property. This ensures that CSSValues are not freed before
        they are needed by loadPendingImage.

        Test: fast/css/variables/deferred-image-load-from-variable.html

        * css/StyleResolver.cpp:
        * css/StyleResolver.h:

2012-07-31  Chris Rogers  <crogers@google.com>

        Add stub implementation for MediaStreamAudioSourceNode
        https://bugs.webkit.org/show_bug.cgi?id=90110

        Reviewed by Kenneth Russell.

        Test: webaudio/mediastreamaudiosourcenode.html

        * CMakeLists.txt:
        * DerivedSources.make:
        * GNUmakefile.list.am:
        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:
        Add MediaStreamAudioSourceNode files to make files.

        * Modules/webaudio/AudioContext.cpp:
        * Modules/webaudio/AudioContext.h:
        * Modules/webaudio/AudioContext.idl:
        (WebCore::AudioContext::createMediaStreamSource):
        Add new createMediaStreamSource() method.

        * Modules/webaudio/AudioNode.h:
        Add NodeTypeMediaStreamAudioSource.

        * Modules/webaudio/MediaStreamAudioSourceNode.cpp: Added.
        * Modules/webaudio/MediaStreamAudioSourceNode.h: Added.
        (WebCore::MediaStreamAudioSourceNode::create):
        (WebCore::MediaStreamAudioSourceNode::MediaStreamAudioSourceNode):
        (WebCore::MediaStreamAudioSourceNode::~MediaStreamAudioSourceNode):
        (WebCore::MediaStreamAudioSourceNode::setFormat):
        (WebCore::MediaStreamAudioSourceNode::process):
        (WebCore::MediaStreamAudioSourceNode::reset):
        (WebCore::MediaStreamAudioSourceNode::mediaStream):
        (WebCore::MediaStreamAudioSourceNode::audioSourceProvider):
        Basic MediaStreamAudioSourceNode implementation.

        * Modules/webaudio/MediaStreamAudioSourceNode.idl: Added.

2012-07-31  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        FractionalLayoutUnit minor math bugs
        https://bugs.webkit.org/show_bug.cgi?id=86065

        Reviewed by Levi Weintraub.

        Implement a consistent set of subject modifying operators, to ensure
        operations that need to be in float are performed in float.

        Scale FractionalLayoutSize in FractionalLayoutUnits instead of intergers.

        No new functionality. No new tests.

        * platform/FractionalLayoutUnit.h:
        (WebCore::operator-=):
        (WebCore::operator*=):
        (WebCore::operator/=):
        * platform/graphics/FractionalLayoutSize.h:
        (WebCore::FractionalLayoutSize::scale):

2012-07-31  Joshua Netterfield  <jnetterfield@rim.com>

        [BlackBerry] Enable CSS Filter Effects
        https://bugs.webkit.org/show_bug.cgi?id=92685

        Reviewed by Rob Buis.

        Enable CSS filter effects, with the exception of custom effects (CSS shaders) and reference effects (SVG effects)

        No new tests, because this is covered by tests from other platforms.

        Internally reviewed by Arvid Nilsson <anilsson@rim.com> and Antonio Gomes <agomes@rim.com>.

        * CMakeLists.txt:
        * PlatformBlackBerry.cmake:
        * platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp:
        (WebCore):
        (WebCore::GraphicsLayerBlackBerry::setFilters):
        (WebCore::GraphicsLayerBlackBerry::updateFilters):
        * platform/graphics/blackberry/GraphicsLayerBlackBerry.h:
        (GraphicsLayerBlackBerry):
        (WebCore::GraphicsLayerBlackBerry::filters):
        * platform/graphics/blackberry/LayerCompositingThread.h:
        (LayerOverride):
        (WebCore):
        (WebCore::LayerCompositingThread::filterOperationsChanged):
        (WebCore::LayerCompositingThread::setFilterOperationsChanged):
        (LayerCompositingThread):
        (WebCore::LayerCompositingThread::filterActions):
        (WebCore::LayerCompositingThread::setFilterActions):
        * platform/graphics/blackberry/LayerData.h:
        (LayerData):
        (WebCore::LayerData::filters):
        * platform/graphics/blackberry/LayerFilterRenderer.cpp: Added.
        (WebCore):
        (WebCore::operationTypeToProgramID):
        (WebCore::Uniformf::Uniformf):
        (WebCore::Uniform1f::apply):
        (WebCore::Uniform1f::create):
        (WebCore::Uniform1f::Uniform1f):
        (WebCore::Uniform2f::apply):
        (WebCore::Uniform2f::create):
        (WebCore::Uniform2f::Uniform2f):
        (WebCore::Uniform3f::apply):
        (WebCore::Uniform3f::create):
        (WebCore::Uniform3f::Uniform3f):
        (WebCore::LayerFilterRendererAction::create):
        (WebCore::LayerFilterRendererAction::LayerFilterRendererAction):
        (WebCore::LayerFilterRendererAction::~LayerFilterRendererAction):
        (WebCore::LayerFilterRendererAction::useActionOn):
        (WebCore::LayerFilterRenderer::create):
        (WebCore::LayerFilterRenderer::LayerFilterRenderer):
        (WebCore::LayerFilterRenderer::bindCommonAttribLocation):
        (WebCore::LayerFilterRenderer::initializeSharedGLObjects):
        (WebCore::LayerFilterRenderer::ping):
        (WebCore::LayerFilterRenderer::pong):
        (WebCore::LayerFilterRenderer::pushSnapshot):
        (WebCore::LayerFilterRenderer::popSnapshot):
        (WebCore::LayerFilterRenderer::actionsForOperations):
        (WebCore::LayerFilterRenderer::applyActions):
        * platform/graphics/blackberry/LayerFilterRenderer.h: Added.
        (WebCore):
        (Uniformf):
        (WebCore::Uniformf::location):
        (Uniform1f):
        (Uniform2f):
        (Uniform3f):
        (LayerFilterRendererAction):
        (WebCore::LayerFilterRendererAction::shouldPushSnapshot):
        (WebCore::LayerFilterRendererAction::setPushSnapshot):
        (WebCore::LayerFilterRendererAction::shouldPopSnapshot):
        (WebCore::LayerFilterRendererAction::setPopSnapshot):
        (WebCore::LayerFilterRendererAction::appendUniform):
        (LayerFilterRenderer):
        (WebCore::LayerFilterRenderer::isEnabled):
        (WebCore::LayerFilterRenderer::disable):
        * platform/graphics/blackberry/LayerRenderer.cpp:
        (WebCore::LayerRenderer::loadShader):
        (WebCore::LayerRenderer::loadShaderProgram):
        (WebCore::LayerRenderer::drawLayersOnSurfaces):
        (WebCore::LayerRenderer::updateLayersRecursive):
        (WebCore):
        (WebCore::LayerRenderer::initializeSharedGLObjects):
        * platform/graphics/blackberry/LayerRenderer.h:
        (LayerRenderer):
        * platform/graphics/blackberry/LayerWebKitThread.cpp:
        (WebCore::LayerWebKitThread::LayerWebKitThread):
        (WebCore::LayerWebKitThread::commitOnCompositingThread):
        (WebCore):
        (WebCore::LayerWebKitThread::filtersCanBeComposited):
        * platform/graphics/blackberry/LayerWebKitThread.h:
        (LayerWebKitThread):
        (WebCore::LayerWebKitThread::setFilters):
        * platform/graphics/filters/FECustomFilter.cpp:
        (WebCore::FECustomFilter::platformApplySoftware):
        (WebCore::FECustomFilter::resizeContext):
        (WebCore::FECustomFilter::bindProgramAndBuffers):
        * platform/graphics/filters/FilterOperation.h:
        (WebCore):
        (FilterOperation):

2012-07-31  Alexis Menard  <alexis.menard@openbossa.org>

        Get rid of "parser" type casts in CSSGrammar.y
        https://bugs.webkit.org/show_bug.cgi?id=92760

        Reviewed by Adam Barth.

        r124099 now type the parser parameter, it is therefore not needed to
        cast to CSSParser* everywhere as we know have a CSSParser* type
        already.

        No new tests : refactor with no behavior change expected.

        * css/CSSGrammar.y:

2012-07-31  Ian Vollick  <vollick@chromium.org>

        [chromium] Use WebAnimation and related classes in GraphicsLayerChromium and AnimTranslationUtil
        https://bugs.webkit.org/show_bug.cgi?id=90468

        Reviewed by James Robinson.

        No new tests. No new functionality.

        * WebCore.gypi:
        * platform/graphics/chromium/AnimationTranslationUtil.cpp:
        (WebCore::appendKeyframe):
        (WebCore::WebTransformAnimationCurve):
        (WebCore::createWebAnimation):
        * platform/graphics/chromium/AnimationTranslationUtil.h:
        (WebKit):
        (WebCore):
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::willBeDestroyed):
        (WebCore::GraphicsLayerChromium::addAnimation):
        (WebCore::GraphicsLayerChromium::pauseAnimation):
        (WebCore::GraphicsLayerChromium::removeAnimation):
        (WebCore::GraphicsLayerChromium::suspendAnimations):
        (WebCore::GraphicsLayerChromium::resumeAnimations):
        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D):
        * platform/graphics/chromium/GraphicsLayerChromium.h:
        (GraphicsLayerChromium):
        * platform/graphics/chromium/LayerChromium.cpp:
        * platform/graphics/chromium/LayerChromium.h:
        (WebKit):
        (WebCore):
        (WebCore::LayerChromium::setLayerAnimationDelegate):
        (LayerChromium):
        * platform/graphics/chromium/LinkHighlight.h:
        (LinkHighlight):

2012-07-31  Taiju Tsuiki  <tzik@chromium.org>

        Fix potential build error on LocalFileSystem::deleteFileSystem.
        https://bugs.webkit.org/show_bug.cgi?id=92695

        Non-Chrome build of WebKit with FILE_SYSTEM flag will be broken at
        LocalFileSystem::deleteFileSystem.
        Chrome does not use this source and most of other ports don't turn on
        FILE_SYSTEM flag for now. So, we've not seen the breakage explicitly yet.

        Reviewed by Adam Barth.

        Non-Chrome WebKit build with FILE_SYSTEM should be finished successfully.

        * Modules/filesystem/LocalFileSystem.cpp:
        (WebCore::LocalFileSystem::deleteFileSystem):

2012-07-31  Li Yin  <li.yin@intel.com>

        AudioPannerNode should raise exception when distanceModel is set incorrectly
        https://bugs.webkit.org/show_bug.cgi?id=90952

        Reviewed by Chris Rogers.

        Spec: http://www.w3.org/TR/webaudio/#AudioPannerNode-section
        The distance model can be only set to LINEAR_DISTANCE, INVERSE_DISTANCE or EXPONENTIAL_DISTANCE.
        If the incorrect value is set, it will raise the exception.
        Use the unsigned short to replace unsigned long in AudioPannerNode.idl.

        Test: webaudio/audiopannernode-basic.html

        * Modules/webaudio/AudioPannerNode.cpp:
        (WebCore::AudioPannerNode::setDistanceModel): raise exception
        (WebCore):
        * Modules/webaudio/AudioPannerNode.h:
        (AudioPannerNode):
        * Modules/webaudio/AudioPannerNode.idl: using unsigned short to replace unsigned long

2012-07-31  Max Vujovic  <mvujovic@adobe.com>

        [CSS Shaders] CSS parser rejects parameter names that are also CSS keywords
        https://bugs.webkit.org/show_bug.cgi?id=92537

        Reviewed by Dirk Schulze.

        Remove the CSS keyword check for CSS Shaders parameter names. Parameters are allowed to be
        any valid CSS identifier, including CSS keywords. See the spec:
        https://dvcs.w3.org/hg/FXTF/raw-file/tip/custom/index.html#feCustom

        The CSS parser was rejecting input like the following because it uses a CSS keyword
        "background" as a parameter name:
        -webkit-filter: custom(none url(fragment.shader), background 0 1 0 1);

        Test: css3/filters/custom/custom-filter-css-keyword-as-parameter-name.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseCustomFilter): Do not return early when the parameter name is a
        CSS keyword (i.e. when the CSSParserValue has a non-zero id).

2012-07-31  Pravin D  <pravind.2k4@gmail.com>

        Caret position is wrong when a editable container has word-wrap:normal set
        https://bugs.webkit.org/show_bug.cgi?id=89649

        Reviewed by Levi Weintraub.

        Correcting the incorrect addumption that the min and max position for the caret rect is constrained to 
        the logical containing block width. This assumption is incorrect when the text has word-wrap:normal and 
        flows beyound the visible rect of the container.

        Test: editing/input/editable-container-with-word-wrap-normal.html

        * rendering/RenderText.cpp:
        (WebCore::RenderText::localCaretRect):

2012-07-31  Antti Koivisto  <antti@apple.com>

        Crash in FrameLoader::checkLoadComplete with non-browser client app
        https://bugs.webkit.org/show_bug.cgi?id=92774

        Reviewed by Alexey Proskuryakov..

        Speculative fix. It is possible that CSSFontSelector could get deleted during the timer callback
        and memory reused, making m_document point to some garbage when it is tested at the end.

        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::beginLoadTimerFired):

2012-07-31  Hans Wennborg  <hans@chromium.org>

        Speech JavaScript API: Throw exception for start() when already started
        https://bugs.webkit.org/show_bug.cgi?id=92756

        Reviewed by Adam Barth.

        Make the start() function throw an exception if the SpeechRecognition
        object was already started.

        Test: fast/speech/scripted/start-exception.html

        * Modules/speech/SpeechRecognition.cpp:
        (WebCore::SpeechRecognition::start):
        (WebCore::SpeechRecognition::stopFunction):
        (WebCore::SpeechRecognition::abort):
        (WebCore::SpeechRecognition::didReceiveError):
        (WebCore::SpeechRecognition::didEnd):
        (WebCore::SpeechRecognition::SpeechRecognition):
        * Modules/speech/SpeechRecognition.h:
        (SpeechRecognition):
        * Modules/speech/SpeechRecognition.idl:

2012-07-31  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124207.
        http://trac.webkit.org/changeset/124207
        https://bugs.webkit.org/show_bug.cgi?id=92773

        Patch causes crashes on the 64-bit debug builder (and other
        builders likely) (Requested by zdobersek on #webkit).

        * GNUmakefile.am:
        * GNUmakefile.list.am:
        * platform/text/gtk/TextCheckerEnchant.cpp: Removed.
        * platform/text/gtk/TextCheckerEnchant.h: Removed.

2012-07-07  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] Live stream support is weak
        https://bugs.webkit.org/show_bug.cgi?id=90084

        Reviewed by Martin Robinson.

        Make sure on-disk buffering is disabled for live streams. It is
        enabled initially when loading any remote media file if preload is
        set to Auto. Later on if the player detects that the media is live
        it disables on-disk buffering. This patch also adds support for
        caching the total size of the media.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
        (WebCore::MediaPlayerPrivateGStreamer::load): Keep track of the
        media url as an instance attribute.
        (WebCore::MediaPlayerPrivateGStreamer::duration): Logging improvement.
        (WebCore::MediaPlayerPrivateGStreamer::setRate): use the new
        isLiveStream() method.
        (WebCore::MediaPlayerPrivateGStreamer::buffered): Ditto.
        (WebCore::MediaPlayerPrivateGStreamer::handleMessage): Indicate
        source of duration message.
        (WebCore::MediaPlayerPrivateGStreamer::fillTimerFired): Perform an
        anonymous duration change emission, mostly to cache its value.
        (WebCore::MediaPlayerPrivateGStreamer::totalBytes): Return
        cached size when available.
        (WebCore::MediaPlayerPrivateGStreamer::updateStates): Use the new
        isLiveStream() method and handle state change corner cases for live streams.
        (WebCore::MediaPlayerPrivateGStreamer::durationChanged): Cache
        media total size and re-enable on-disk buffering if caching succeeds.
        (WebCore::MediaPlayerPrivateGStreamer::movieLoadType): New
        implementation handling on-disk buffered and live streaming cases.
        (WebCore::MediaPlayerPrivateGStreamer::setPreload): Remember the
        case where preload is updated from Auto to another value, do
        on-disk buffering only for Auto preload attribute.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
        (MediaPlayerPrivateGStreamer):
        (WebCore::MediaPlayerPrivateGStreamer::isLiveStream): Utility
        method, a stream is live if it goes to PAUSE without prerolling.

2012-07-17  Antonio Gomes  <agomes@rim.com>

        [Blackberry][FullScreen] HTML5 <video> controls are scaled differently depending on the current webpage scale
        https://bugs.webkit.org/show_bug.cgi?id=90884
        PR #162839

        Reviewed by Rob Buis.

        The way the BlackBerry port implements the FULLSCREEN_API for media
        elements might result in the controls being oversized, proportionally
        to the current page scale. That happens because the fullscreen element
        gets sized to be as big as the viewport size, and the viewport size might
        get outstretched to fit to the screen dimensions.

        In order to fix that, the patch strips out the Page scale factor from
        the media controls multiplier.

        Patch also changes many integer-based calculations to be float-based, in
        order to get the needed precision.

        Internally reviewed by Jacky Jiang.

        * platform/blackberry/RenderThemeBlackBerry.cpp:
        (WebCore):
        (WebCore::determineFullScreenMultiplier):
        (WebCore::RenderThemeBlackBerry::adjustSliderThumbSize):
        (WebCore::RenderThemeBlackBerry::adjustMediaControlStyle):
        (WebCore::RenderThemeBlackBerry::adjustSliderTrackStyle):
        (WebCore::RenderThemeBlackBerry::paintMediaSliderTrack):
        (WebCore::RenderThemeBlackBerry::paintMediaSliderThumb):

2012-07-31  Stephen White  <senorblanco@chromium.org>

        Remove the clone() method from FilterOperation (and subclasses).
        https://bugs.webkit.org/show_bug.cgi?id=92757

        Reviewed by Kentaro Hara.

        Since the move to WebFilterOperation in Chromium, this is now dead
        code.

        Covered by existing tests in css3/filters.

        * platform/graphics/filters/CustomFilterOperation.h:
        * platform/graphics/filters/FilterOperation.h:

2012-07-31  Thiago Marcos P. Santos  <thiago.santos@intel.com>

        Regression(r124135): SVG tests crashing on ports using Cairo
        https://bugs.webkit.org/show_bug.cgi?id=92752

        Reviewed by Martin Robinson.

        * platform/graphics/cairo/PathCairo.cpp:
        (WebCore::Path::operator=):

2012-07-31  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124208.
        http://trac.webkit.org/changeset/124208
        https://bugs.webkit.org/show_bug.cgi?id=92765

        it broke compilation on mac (Requested by loislo on #webkit).

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * inspector/InspectorAllInOne.cpp:
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):
        * inspector/MemoryInstrumentationImpl.cpp: Removed.
        * inspector/MemoryInstrumentationImpl.h: Removed.

2012-07-31  Stephen Chenney  <schenney@chromium.org>

        xmlserializer strips xlink from xlink:html svg image tag
        https://bugs.webkit.org/show_bug.cgi?id=79586

        Reviewed by Nikolas Zimmermann.

        Adding code to ensure the correct prefix on attributes in the xml,
        xmlns and xlink namespaces. We now follow the rules in
        http://www.whatwg.org/specs/web-apps/current-work/multipage/the-end.html#serializing-html-fragments
        (circa the time of this change).

        Rob Buis wrote the original test for this patch and did the initial work.

        Tests: fast/dom/XMLSerializer-xml-namespace.html
               svg/custom/xlink-prefix-in-attributes.html

        * editing/MarkupAccumulator.cpp:
        (WebCore::attributeIsInSerializedNamespace): Test for an attribute in
        a specially serialized namespace: xml, xmlns, xlink.
        (WebCore):
        (WebCore::MarkupAccumulator::appendAttribute): Check the namespace of
        attributes upon serialization, and add any necessary prefixes.
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::adjustForeignAttributes): Use WTF::xmlAtom etc for AtomicString arguments.

2012-07-31  Mike Reed  <reed@google.com>

        skia: switch to conical gradient to match css/svg spec for two-point gradients
        https://bugs.webkit.org/show_bug.cgi?id=92754

        Reviewed by Stephen White.

        Switching to skia's TwoPointConical gradient, which has been written explicitly to match the css/svg spec.
        Leaving the existing TwoPointRadial gradient in skia, for other callers that may want the old behavior.

        No new tests. existing layouttests exercise this change (9 pending rebaselines associated with this CL).

        * platform/graphics/skia/GradientSkia.cpp:
        (WebCore::Gradient::platformGradient):

2012-04-06  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: extract MemoryInstrumentationImpl into separate files for future reusing in unit tests
        https://bugs.webkit.org/show_bug.cgi?id=92751

        Reviewed by Yury Semikhatsky.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/InspectorAllInOne.cpp:
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):
        * inspector/MemoryInstrumentationImpl.cpp: Added.
        (WebCore):
        (WebCore::MemoryInstrumentationImpl::MemoryInstrumentationImpl):
        (WebCore::MemoryInstrumentationImpl::processDeferredInstrumentedPointers):
        (WebCore::MemoryInstrumentationImpl::countObjectSize):
        (WebCore::MemoryInstrumentationImpl::deferInstrumentedPointer):
        (WebCore::MemoryInstrumentationImpl::visited):
        (WebCore::MemoryInstrumentationImpl::selfSize):
        * inspector/MemoryInstrumentationImpl.h: Added.
        (WebCore):
        (MemoryInstrumentationImpl):
        (WebCore::MemoryInstrumentationImpl::totalTypeSize):

2012-07-31  Mario Sanchez Prada  <msanchez@igalia.com>

        [GTK] Add a new and reusable enchant-based spellchecker in WebCore
        https://bugs.webkit.org/show_bug.cgi?id=90269

        Reviewed by Martin Robinson.

        Move enchant specific code down to WebCore, into a new class
        TextCheckerEnchant, that we can use from WK1 and WK2.

        * GNUmakefile.am: Add flags to handle the SPELLCHECK feature.
        * GNUmakefile.list.am: Added new files.
        * platform/text/gtk/TextCheckerEnchant.cpp: Added.
        (getAvailableDictionariesCallback):
        (TextCheckerEnchant::TextCheckerEnchant):
        (TextCheckerEnchant::~TextCheckerEnchant):
        (TextCheckerEnchant::ignoreWord):
        (TextCheckerEnchant::learnWord):
        (TextCheckerEnchant::checkSpellingOfString):
        (TextCheckerEnchant::getGuessesForWord):
        (TextCheckerEnchant::updateSpellCheckingLanguages):
        (TextCheckerEnchant::freeEnchantBrokerDictionaries):
        * platform/text/gtk/TextCheckerEnchant.h: Added.
        (WebCore):
        (TextCheckerEnchant):
        (WebCore::TextCheckerEnchant::create):

2012-07-31  Joe Mason  <jmason@rim.com>

        [BlackBerry] Support Negotiate auth
        https://bugs.webkit.org/show_bug.cgi?id=91871

        Reviewed by George Staikos.

        Add Negotiate to the list of auth schemes allowed in the platform request.

        Add "success" and "requireCredentials" parameters to notifyAuthReceived (which is now called
        with success = true on successful authentication, as well as on failures).

        When success is true, update the stored credential to use the auth scheme actually reported
        rather than that set in the request. (This is used when Negotiate auth can't get a ticket
        and falls back to a different supported auth type.)

        When requireCredentials is false, just set the auth type and start a new request using empty
        credentials.

        RIM PR# 166514
        Internally reviewed by Jonathan Dong

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::notifyAuthReceived): Add Negotiate to the auth scheme switch. Handle
        success param by updating auth type in stored credentials; pass requireCredentials param on
        to sendRequestWithCredentials.
        (WebCore::NetworkJob::startNewJobWithRequest): Fix typo in increaseRedirectCount parameter
        name.
        (WebCore::NetworkJob::sendRequestWithCredentials): Use empty credentials if
        requireCredentials is false.
        * platform/network/blackberry/NetworkJob.h:
        (NetworkJob):
        * platform/network/blackberry/NetworkManager.cpp:
        (WebCore::NetworkManager::startJob): Add Negotiate to the auth scheme switch.

2012-07-31  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: take into account the whole security origin instead of just host
        https://bugs.webkit.org/show_bug.cgi?id=92740

        Reviewed by Pavel Feldman.

        Make the DOM Storage Agent take into account all the
        information relevant to the security origin, i.e. protocol, host, and
        port. Previously only the host was taken into account. That caused
        inspector to show the first storage only in the case a page operated
        over several security origins sharing the same host (but having
        different protocols e.g. http and https).

        * inspector/InspectorDOMStorageAgent.cpp:
        (WebCore::InspectorDOMStorageAgent::storageId):
        (WebCore::InspectorDOMStorageAgent::didUseDOMStorage):
        * inspector/InspectorDOMStorageResource.cpp:
        (WebCore::InspectorDOMStorageResource::isSameOriginAndType):
        (WebCore::InspectorDOMStorageResource::bind):
        * inspector/InspectorDOMStorageResource.h:
        (InspectorDOMStorageResource):

2012-07-31  Keishi Hattori  <keishi@webkit.org>

        Slider ticks are drawn at wrong positions
        https://bugs.webkit.org/show_bug.cgi?id=92720

        Reviewed by Kent Tamura.

        Slider tick marks for vertical sliders were drawn reversed. And the tick
        mark positions were slightly off from the thumb position because of rounding.

        No new tests. Covered in input-appearance-range-with-datalist.html.

        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::paintSliderTicks):

2012-07-31  Shinya Kawanaka  <shinyak@chromium.org>

        Older ShadowDOM is still rendered when a new ShadowDOM is added when they don't have any InsertionPoints.
        https://bugs.webkit.org/show_bug.cgi?id=92456

        Reviewed by Hajime Morita.

        When adding a new ShadowRoot to an element having other ShadowRoots, and they don't have any InsretionPoint,
        the older ShadowDOM is still rendered.

        When ContentDistributor's validity is 'Undetermined', ElementShadow reattaches the host and the whole shadow
        subtree. Since adding a new ShadowRoot makes the validity 'Undetermined', we have had to make it 'Undetermined'.

        This change enables us to remove a unnecessary InvalidationType flag from the code. We should call
        setValidityUndetermined() instead of using InvalidateAndForceReattach.

        Test: fast/dom/shadow/invalidate-distribution.html

        * dom/ElementShadow.cpp:
        (WebCore::ElementShadow::addShadowRoot): Calls setValidityUndetermined().
        (WebCore::ElementShadow::removeAllShadowRoots):
        (WebCore::ElementShadow::setValidityUndetermined):
        (WebCore::ElementShadow::invalidateDistribution): When validity is undetermined, we will reattach the
        host and the shadow subtree.
        * dom/ElementShadow.h:
        (ElementShadow):
        * html/shadow/ContentDistributor.cpp:
        * html/shadow/ContentDistributor.h:
        (WebCore::ContentDistributor::setValidity):
        (ContentDistributor):
        * html/shadow/InsertionPoint.cpp:
        (WebCore::InsertionPoint::insertedInto): Calls setValidityUndetermined().

2012-07-31  Tommy Widenflycht  <tommyw@google.com>

        Introduce a minimal RTCPeerConnection together with Dictionary changes
        https://bugs.webkit.org/show_bug.cgi?id=92380

        Reviewed by Kentaro Hara.

        This patch introduces a shell RTCPeerConnection together with neccecary changes to
        Dictionary.

        The W3C specification can be found here:
        http://dev.w3.org/2011/webrtc/editor/webrtc.html#rtcpeerconnection

        Since Dictionaries can't be fully copied around adding
        get(const String& name, Vector<Dictionary>& result)
        isn't feasible so I have added a new ArrayValue class.

        Test: fast/mediastream/RTCPeerConnection.html

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Modules/mediastream/DOMWindowMediaStream.idl:
        * Modules/mediastream/RTCPeerConnection.cpp: Added.
        (WebCore):
        (RTCIceServer):
        (WebCore::RTCIceServer::create):
        (WebCore::RTCIceServer::~RTCIceServer):
        (WebCore::RTCIceServer::uri):
        (WebCore::RTCIceServer::credential):
        (WebCore::RTCIceServer::RTCIceServer):
        (RTCConfiguration):
        (WebCore::RTCConfiguration::create):
        (WebCore::RTCConfiguration::~RTCConfiguration):
        (WebCore::RTCConfiguration::appendServer):
        (WebCore::RTCConfiguration::numberOfServers):
        (WebCore::RTCConfiguration::server):
        (WebCore::RTCConfiguration::RTCConfiguration):
        (WebCore::RTCPeerConnection::parseConfiguration):
        (WebCore::RTCPeerConnection::create):
        (WebCore::RTCPeerConnection::RTCPeerConnection):
        (WebCore::RTCPeerConnection::~RTCPeerConnection):
        (WebCore::RTCPeerConnection::interfaceName):
        (WebCore::RTCPeerConnection::scriptExecutionContext):
        (WebCore::RTCPeerConnection::stop):
        (WebCore::RTCPeerConnection::eventTargetData):
        (WebCore::RTCPeerConnection::ensureEventTargetData):
        * Modules/mediastream/RTCPeerConnection.h: Added.
        (WebCore):
        (RTCPeerConnection):
        (WebCore::RTCPeerConnection::refEventTarget):
        (WebCore::RTCPeerConnection::derefEventTarget):
        * Modules/mediastream/RTCPeerConnection.idl: Added.
        * Target.pri:
        * UseJSC.cmake:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/generic/RuntimeEnabledFeatures.h:
        (WebCore::RuntimeEnabledFeatures::webkitRTCPeerConnectionEnabled):
        * bindings/js/ArrayValue.cpp: Added.
        (WebCore):
        (WebCore::ArrayValue::ArrayValue):
        (WebCore::ArrayValue::operator=):
        (WebCore::ArrayValue::isUndefinedOrNull):
        (WebCore::ArrayValue::length):
        (WebCore::ArrayValue::get):
        * bindings/js/ArrayValue.h: Added.
        (WebCore):
        (ArrayValue):
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::convertValue):
        (WebCore):
        * bindings/js/JSDictionary.h:
        (WebCore):
        * bindings/v8/ArrayValue.cpp: Added.
        (WebCore):
        (WebCore::ArrayValue::operator=):
        (WebCore::ArrayValue::isUndefinedOrNull):
        (WebCore::ArrayValue::length):
        (WebCore::ArrayValue::get):
        * bindings/v8/ArrayValue.h: Added.
        (WebCore):
        (ArrayValue):
        (WebCore::ArrayValue::ArrayValue):
        (WebCore::ArrayValue::~ArrayValue):
        * bindings/v8/Dictionary.cpp:
        (WebCore::Dictionary::get):
        (WebCore):
        * bindings/v8/Dictionary.h:
        (WebCore):
        (Dictionary):
        * dom/EventTargetFactory.in:

2012-07-31  Raul Hudea  <rhudea@adobe.com>

        Inspector crashes when trying to inspect a page with CSS region styling
        https://bugs.webkit.org/show_bug.cgi?id=91503

        Reviewed by Alexander Pavlov.

        Fix by making sure a CSSRuleSourceData is always created when parsing @-webkit-region rules.

        Test: inspector/styles/region-style-crash.html

        * css/CSSGrammar.y: Made ruleset called explicitly markRuleBodyStart instead of depending on updateLastSelectorLineAndPosition to call it.
        * css/CSSParser.cpp:
        (WebCore::CSSParser::updateLastSelectorLineAndPosition): markRuleBodyStart should be called via at_rule_body_start. 
        * css/CSSPropertySourceData.h:

2012-07-31  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124179.
        http://trac.webkit.org/changeset/124179
        https://bugs.webkit.org/show_bug.cgi?id=92730

        Breaks Chromium Linux 32 bots with "error: integer constant is
        too large for 'long' type" in IDBLevelDBCodingTest.cpp
        (Requested by apavlov on #webkit).

        * Modules/indexeddb/IDBLevelDBCoding.cpp:
        (WebCore::IDBLevelDBCoding::encodeByte):
        (WebCore::IDBLevelDBCoding::encodeBool):
        (WebCore::IDBLevelDBCoding::encodeInt):
        (WebCore::IDBLevelDBCoding::encodeVarInt):
        (WebCore::IDBLevelDBCoding::encodeString):
        (WebCore::IDBLevelDBCoding::encodeDouble):
        (WebCore::IDBLevelDBCoding::encodeIDBKey):
        (WebCore::IDBLevelDBCoding::encodeIDBKeyPath):
        (WebCore::IDBLevelDBCoding::KeyPrefix::encode):
        * Modules/indexeddb/IDBLevelDBCoding.h:
        (IDBLevelDBCoding):

2012-07-31  Danilo Cesar Lemes de Paula  <danilo.cesar@collabora.co.uk>

        add Farstream flags/deps to WebKit, for WebRTC
        https://bugs.webkit.org/show_bug.cgi?id=87524

        Reviewed by Philippe Normand.

        Since Farstream will be used as the backend for GTK's WebRTC, this
        patch adds it as a dependency to the build system.

        No new features or code changes were added, so new tests aren't necessary.

        * GNUmakefile.am:

2012-07-31  Zan Dobersek  <zandobersek@gmail.com>

        Unreviewed crash fix after r124135.

        * platform/graphics/cairo/PathCairo.cpp:
        (WebCore::Path::Path): Ensure the Cairo path when acquiring its context,
        crashes ensue otherwise.

2012-07-31  Yoshifumi Inoue  <yosin@chromium.org>

        Change Element::isReadOnlyFormControl to Element::shouldMatchReadOnlySelector/shouldMatchReadWriteSelector or HTMLFormControlElement::readOnly
        https://bugs.webkit.org/show_bug.cgi?id=92602

        Reviewed by Kent Tamura.

        This patch replaces Element::isReadOnlyFormControl() by
        Element::shouldMatchReadOnlySelector/shouldMatchReadOnlySelector or
        HTMLFormControlElement::readOnly() to make intention of functions
        self descriptive.

        No new tests. This patch doesn't change behavior.

        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOneSelector): Replaced isReadOnlyFormControl() by shouldMatchReadOnlySelector() for :read-only pseudo class, and replaced isReadOnlyFormControl() by shouldMatchReadOnlySelector() for :read-only pseudo class.
        * dom/Element.cpp:
        (WebCore::Element::shouldMatchReadOnlySelector): Added for default implementation.
        (WebCore::Element::shouldMatchReadWriteSelector): for default implementation.
        * dom/Element.h:
        (Element): Removed isReadOnlyFormControl() and added shouldMatchReadOnlySelector and shouldMatchReadWriteSelector.
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::shouldMatchReadOnlySelector): Added.
        (WebCore::HTMLFormControlElement::shouldMatchReadWriteSelector): Added.
        * html/HTMLFormControlElement.h:
        (HTMLFormControlElement): Removed isReadOnlyFormControl() and added shouldMatchReadOnlySelector and shouldMatchReadWriteSelector.
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::shouldMatchReadOnlySelector): Added.
        (WebCore::SliderThumbElement::shouldMatchReadWriteSelector): Added.
        (WebCore::SliderThumbElement::willRespondToMouseMoveEvents): Replaced isReadOnlyFormControl() by readOnly().
        (WebCore::SliderThumbElement::willRespondToMouseClickEvents): ditto.
        (SliderThumbElement):
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::SearchFieldCancelButtonElement::willRespondToMouseClickEvents): Replaced isReadOnlyFormControl() by readOnly().
        (WebCore::SpinButtonElement::willRespondToMouseMoveEvents): ditto.
        (WebCore::SpinButtonElement::willRespondToMouseClickEvents): ditto.
        (WebCore::SpinButtonElement::shouldMatchReadOnlySelector): Added.
        (WebCore::SpinButtonElement::shouldMatchReadWriteSelector): Added.
        (WebCore::InputFieldSpeechButtonElement::willRespondToMouseClickEvents): Replaced isReadOnlyFormControl() by readOnly().
        * html/shadow/TextControlInnerElements.h:
        (SpinButtonElement): Removed isReadOnlyFormControl() and added shouldMatchReadOnlySelector and shouldMatchReadWriteSelector.
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::isReadOnlyControl): Replaced isReadOnlyControl() by shouldMatchReadOnlySelector().

2012-07-31  Xingnan Wang  <xingnan.wang@intel.com>

        IndexedDB: Size the Vector in encodeInt/encodeVarInt/encodeString
        https://bugs.webkit.org/show_bug.cgi?id=91813

        Reviewed by Kentaro Hara.

        To avoid memory re-allocation in Vector, init the capability or size of Vector in encodeInt(), encodeVarInt(),
        encodeBool(), encodeIDBKey() etc.

        No new tests - Low level functions covered by existing layout tests and also covered by Chromium
        webkit_unit_tests IDBLevelIDBCodingTest.* which validates the sizes of buffers returned by encodeVarInt.

        * Modules/indexeddb/IDBLevelDBCoding.cpp:
        (WebCore::IDBLevelDBCoding::encodeInt):
        (WebCore::IDBLevelDBCoding::encodeVarInt):
        (WebCore::IDBLevelDBCoding::encodeString):

2012-07-30  Huang Dongsung  <luxtella@company100.net>

        [Texmap] Remove the backing store after 'style.visibility' for an element sets 'hidden'.
        https://bugs.webkit.org/show_bug.cgi?id=92492

        Reviewed by Noam Rosenthal.

        This patch's purpose is to save vram memory.
        When visibility of the element sets hidden, we do not need to draw the element,
        so we do not need to keep a texture of the backing store.
        Currently, Texmap does not draw the element with visibility:hidden because
        RenderLayerBacking::paintIntoLayer does not draw anything.
        This patch just removes unused textures.

        No new tests - no new testable functionality.

        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
        (WebCore::GraphicsLayerTextureMapper::setContentsVisible):
        (WebCore):
        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
        (GraphicsLayerTextureMapper):
        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::updateBackingStore):
        (WebCore::TextureMapperLayer::paintSelf):
        (WebCore::TextureMapperLayer::isVisible):
        (WebCore::TextureMapperLayer::syncCompositingStateSelf):
        * platform/graphics/texmap/TextureMapperLayer.h:
        (State):
        (WebCore::TextureMapperLayer::State::State):

2012-07-30  Keishi Hattori  <keishi@webkit.org>

        Implement datalist UI for input type color for Chromium
        https://bugs.webkit.org/show_bug.cgi?id=92075

        Reviewed by Kent Tamura.

        Test: platform/chromium/fast/forms/color/color-suggestion-picker-appearance.html

        * rendering/RenderThemeChromiumCommon.cpp:
        (WebCore::RenderThemeChromiumCommon::supportsDataListUI): Added color to types supporting datalist.

2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124171.
        http://trac.webkit.org/changeset/124171
        https://bugs.webkit.org/show_bug.cgi?id=92712

        Start failing fast/css/square-button-appearance.html
        (Requested by yosin on #webkit).

        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOneSelector):
        * dom/Element.cpp:
        * dom/Element.h:
        (Element):
        (WebCore::Element::isReadOnlyFormControl):
        * html/HTMLFormControlElement.h:
        (WebCore::HTMLFormControlElement::isReadOnlyFormControl):
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::isReadOnlyFormControl):
        (WebCore::SliderThumbElement::willRespondToMouseMoveEvents):
        (WebCore::SliderThumbElement::willRespondToMouseClickEvents):
        * html/shadow/SliderThumbElement.h:
        (SliderThumbElement):
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::SearchFieldCancelButtonElement::willRespondToMouseClickEvents):
        (WebCore::SpinButtonElement::willRespondToMouseMoveEvents):
        (WebCore::SpinButtonElement::willRespondToMouseClickEvents):
        (WebCore::InputFieldSpeechButtonElement::willRespondToMouseClickEvents):
        * html/shadow/TextControlInnerElements.h:
        (WebCore::SpinButtonElement::isReadOnlyFormControl):
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::isReadOnlyControl):

2012-07-30  Yoshifumi Inoue  <yosin@chromium.org>

        [CSS] Change Element::isReadOnlyFormControl to shouldMatchReadWriteSelector or HTMLTextFormControlElement::readOnly
        https://bugs.webkit.org/show_bug.cgi?id=92602

        Reviewed by Kent Tamura.

        This patch renames Element::isReadOnlyFormControl() to Element::shouldMatchReadWriteSelector()
        or HTMLTextFormControlElement::readOnly() to make intention of
        shouldMatchReadWriteSelector(was isReadOnlyFormControl) self descriptive.

        No new tests. This patch doesn't change behavior.

        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOneSelector): Replaced isReadOnlyFormControl() by shouldMatchReadWriteSelector().
        * dom/Element.cpp:
        (WebCore::Element::shouldMatchReadWriteSelector): Added default implementation.
        * dom/Element.h:
        (WebCore::Element::shouldMatchReadWriteSelector): Replaced isReadOnlyFormControl() by shouldMatchReadWriteSelector().
        * html/HTMLFormControlElement.h:
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::shouldMatchReadWriteSelector): Replaced isReadOnlyFormControl() by shouldMatchReadWriteSelector().
        (WebCore::SliderThumbElement::willRespondToMouseMoveEvents): Replaced isReadOnlyFormControl() by readOnly().
        (WebCore::SliderThumbElement::willRespondToMouseClickEvents): ditto.
        * html/shadow/SliderThumbElement.h:
        (SliderThumbElement): Replaced isReadOnlyFormControl() by shouldMatchReadWriteSelector().
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::SearchFieldCancelButtonElement::willRespondToMouseClickEvents): Replaced isReadOnlyFormControl() by readOnly().
        (WebCore::SpinButtonElement::willRespondToMouseMoveEvents): Replaced isReadOnlyFormControl() by readOnly().
        (WebCore::SpinButtonElement::willRespondToMouseClickEvents): Replaced isReadOnlyFormControl() by readOnly().
        (WebCore::InputFieldSpeechButtonElement::willRespondToMouseClickEvents): Replaced isReadOnlyFormControl() by readOnly().
        * html/shadow/TextControlInnerElements.h:
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::isReadOnlyControl): Replaced isReadOnlyFormControl() by shouldMatchReadWriteSelector().

2012-07-30  Julien Chaffraix  <jchaffraix@webkit.org>

        Remove overflow: scroll handling in block flow layout methods
        https://bugs.webkit.org/show_bug.cgi?id=92689

        Reviewed by Simon Fraser.

        The overflow: scroll scrollbars creation was done at layout time for all RenderBlocks and
        descendants. This was not only wrong ('overflow' only changes at style change time) but it
        was also introducing some code duplication.

        The gist of this change is to share the code by moving it to RenderLayer::updateScrollbarsAfterStyleChange,
        this includes the code from bug 69993 to special case list box part.

        Covered by existing tests:
        - All fast/overflow ones.
        - For the list box change:
            fast/forms/select-overflow-scroll-inherited.html
            fast/forms/select-overflow-scroll.html
        - For the flexbox:
            css3/flexbox/preferred-widths-orthogonal.html
            css3/flexbox/preferred-widths.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::layoutBlock):
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::layoutBlock):
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::layoutBlock):
        Removed the common code here.

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::computePreferredLogicalWidths):
        Changed to an ASSERT now that the right scrollbars are created. This is
        fine as overflow-x/y are physical coordinates and our access was following that.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::invalidateScrollbarRect):
        Added an early return here if we are not attached yet as RenderLayer::styleChanged
        is called at attachment time before we are inserted in the tree. This is fine as the
        scrollbars are part of the object which will be painted after the first layout.

        (WebCore::overflowRequiresAScrollbar):
        (WebCore::overflowDefinesAutomaticScrollbar):
        Split the logic in those 2 functions.

        (WebCore::RenderLayer::updateScrollbarsAfterLayout):
        Updated to use the require / can-have functions. Also added
        an early return for list box parts as required by bug 69993.

        (WebCore::RenderLayer::updateScrollbarsAfterStyleChange):
        Added an early return for list box parts as required by bug 69993,
        also removed some unneeded NULL-checks that were added for list box parts.

2012-07-30  Vivek Galatage  <vivekgalatage@gmail.com>

        fillWithEmptyClients method should also initialize chromeClient with EmptyChromeClient
        https://bugs.webkit.org/show_bug.cgi?id=92703

        Reviewed by Kent Tamura.

        fillWithEmptyClients should also intialize PageClients.chromeClient with EmptyChromeClient 
        as its required for creating a Empty page and to minimize the exported symbols.

        No new tests as no change in functionality.

        * loader/EmptyClients.cpp:
        (WebCore::fillWithEmptyClients):

2012-07-30  Adrienne Walker  <enne@google.com>

        [chromium] Wrap ScrollbarLayerChromium in WebScrollbarLayer
        https://bugs.webkit.org/show_bug.cgi?id=91032

        Reviewed by James Robinson.

        Modify ScrollingCoordinatorChromium to operate on WebScrollbarLayer
        instead of ScrollbarLayerChromium. This removes the dependency on
        ScrollbarLayerChromium.

        No change in functionality, so no new tests.

        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        (WebCore::ScrollingCoordinatorPrivate::setScrollLayer):
        (WebCore::ScrollingCoordinatorPrivate::setHorizontalScrollbarLayer):
        (WebCore::ScrollingCoordinatorPrivate::setVerticalScrollbarLayer):
        (ScrollingCoordinatorPrivate):
        (WebCore::createScrollbarLayer):

2012-07-30  Ryosuke Niwa  <rniwa@webkit.org>

        Another Qt build fix attempt after r124098.
        "interface" is a keyword. Don't use it. 

        * dom/GestureEvent.cpp:
        (WebCore::GestureEvent::interfaceName):

2012-07-30  Elliott Sprehn  <esprehn@gmail.com>

        Make QuotesData use a Vector of pairs
        https://bugs.webkit.org/show_bug.cgi?id=92448

        Reviewed by Julien Chaffraix.

        QuotesData::create returned an array of memory that contained in place instantiations
        of a QuotesData and then String instances. This changes the code to use a Vector of
        pairs making it safer and ensuring that quotes are always balanced. This also uses a
        HashMap directly in the QuoteRenderer instead of building it on first access reducing
        the amount of code needed for picking quotes by language.

        Test: fast/css-generated-content/close-quote-negative-depth.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList): Create pairs and use the new QuotesData API.
        * rendering/RenderQuote.cpp:
        (WebCore):
        (WebCore::quotesDataLanguageMap): New function that returns the HashMap of languages.
        (WebCore::basicQuotesData): Returns the simple form of quotes, " and '.
        (WebCore::defaultQuotes): Changed to use the new map.
        (WebCore::RenderQuote::styleDidChange):
        (WebCore::RenderQuote::originalText): Changed to use the new getOpenQuote and getCloseQuote which ensure bounds checks.
        * rendering/style/QuotesData.cpp:
        (WebCore::QuotesData::create): Now returns a plain instance of QuotesData without the in place allocation.
        (WebCore):
        (WebCore::QuotesData::addPair): Adds an std::pair of strings ensuring quotes are always balanced.
        (WebCore::QuotesData::getOpenQuote):
        (WebCore::QuotesData::getCloseQuote):
        (WebCore::QuotesData::equals): Renamed equals (added the s).
        * rendering/style/QuotesData.h:
        (WebCore::QuotesData::create):
        (QuotesData):
        (WebCore::QuotesData::QuotesData):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::setQuotes):
        * rendering/style/StyleRareInheritedData.cpp:
        (WebCore::StyleRareInheritedData::operator==):

2012-07-30  MORITA Hajime  <morrita@google.com>

        Node::replaceChild() can create bad DOM topology with MutationEvent
        https://bugs.webkit.org/show_bug.cgi?id=92619

        Reviewed by Ryosuke Niwa.

        Node::replaceChild() calls insertBeforeCommon() after dispatching
        a MutationEvent event for removeChild(). But insertBeforeCommon()
        expects call sites to check the invariant and doesn't have
        suffient check. So a MutationEvent handler can let some bad tree
        topology to slip into insertBeforeCommon().

        This change adds a guard for checking the invariant using
        checkReplaceChild() between removeChild() and insertBeforeCommon().

        Test: fast/events/mutation-during-replace-child.html

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::replaceChild): Added a guard.

2012-07-30  Ryosuke Niwa  <rniwa@webkit.org>

        Qt Windows build fix attempt after r124098.

        * dom/GestureEvent.cpp:

2012-07-30  Wei James  <james.wei@intel.com>

        [Chromium] Enable web audio IPP for x86 chromium android
        https://bugs.webkit.org/show_bug.cgi?id=91973

        Reviewed by Tony Chang.

        Include the IPP libraries at link-time for Android builds when
        compiling the Web Audio API with IPP support.

        * WebCore.gyp/WebCore.gyp:

2012-07-30  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Get rid of Element::isReadOnlyFormControl other than CSS related
        https://bugs.webkit.org/show_bug.cgi?id=92612

        Reviewed by Kent Tamura.

        This patch replaces Element::isReadOnlyFormControl() not related to
        CSS selector matching to HTMLFormControlElement::readOnly() for
        preparation of introducing Element::shouldMatchReadWriteSelector(), bug 92602.

        No new tests. This patch doesn't change behavior.

        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::defaultEventHandler): Changed isReadOnlyFormControl() to readOnly().
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::SearchFieldCancelButtonElement::defaultEventHandler): Changed isReadOnlyFormControl() to readOnly().
        (WebCore::SpinButtonElement::defaultEventHandler): ditto.
        (WebCore::SpinButtonElement::step): ditto.
        (WebCore::InputFieldSpeechButtonElement::defaultEventHandler): ditto.
        (WebCore::InputFieldSpeechButtonElement::setRecognitionResult): ditto.
        * rendering/RenderTextControl.cpp:
        (updateUserModifyProperty): Changed isReadOnlyFormControl() to readOnly().
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintSearchFieldCancelButton): Changed isReadOnlyFormControl() to readOnly().

2012-07-30  Eric Seidel  <eric@webkit.org>

        Grid Demo spends 1.5% of total time allocating Path objects in RenderBoxModelObject::paintBorderSides
        https://bugs.webkit.org/show_bug.cgi?id=92252

        Reviewed by Simon Fraser.

        This change introduces the concept of a "null Path" very similar to a null WTF::String.
        Just like String functions as a RefPtr around a StringImpl, Path (for most ports)
        functions as an OwnPtr around a PlatformPathPtr.

        In various places in the code, we declare a local Path variable, but don't necessarily
        use that Path variable in all code paths, or might pass that Path variable along to GraphicsContext
        functions, without ever actually adding points to that Path.
        On most platforms, this Path default constructor was causing a malloc!
        In some of these case, the code-path in question (like paintBorderSides) can be quite hot.
        Introducing this null-Path and delaying instantiation of the PlatformPath object
        until it's actually needed, saves a malloc for these hot paths.

        To test this, I loaded a few popular pages, and added printfs to both the Path constructor
        and destructor, logging during construction and destruction when the path was still null at destruction time.

        This simple testing showed this to be a small win (avoiding mallocs) on many sites and a huge win for Google Spreadsheets:
        apple.com: 147 Paths created, 9 (6%) destroyed null.
        google.com: 58 Paths created, 26 (44%) destroyed null (google seems creating 5 paths every second after load?  1 of which is destroyed empty.)
        amazon.com: 130 Paths created, 130 (100%) destroyed null.
        Loading an empty spreadsheet from drive.google.com: 5237 created, 4861 destroyed null (92%!) :)

        * platform/graphics/Path.h:
        (Path):
        (WebCore::Path::isNull):
        (WebCore::Path::ensurePlatformPath):
        * platform/graphics/cairo/CairoUtilities.cpp:
        (WebCore::appendWebCorePathToCairoContext):
        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::fillPath):
        (WebCore::GraphicsContext::strokePath):
        (WebCore::GraphicsContext::clipPath):
        (WebCore::GraphicsContext::clip):
        * platform/graphics/cairo/PathCairo.cpp:
        (WebCore::Path::Path):
        (WebCore::Path::~Path):
        (WebCore::Path::ensurePlatformPath):
        (WebCore):
        (WebCore::Path::operator=):
        (WebCore::Path::clear):
        (WebCore::Path::isEmpty):
        (WebCore::Path::currentPoint):
        (WebCore::Path::translate):
        (WebCore::Path::moveTo):
        (WebCore::Path::addLineTo):
        (WebCore::Path::addRect):
        (WebCore::Path::addQuadCurveTo):
        (WebCore::Path::addBezierCurveTo):
        (WebCore::Path::addArc):
        (WebCore::Path::addArcTo):
        (WebCore::Path::addEllipse):
        (WebCore::Path::closeSubpath):
        (WebCore::Path::boundingRect):
        (WebCore::Path::strokeBoundingRect):
        (WebCore::Path::contains):
        (WebCore::Path::strokeContains):
        (WebCore::Path::apply):
        (WebCore::Path::transform):
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::drawPath):
        (WebCore::GraphicsContext::fillPath):
        (WebCore::GraphicsContext::strokePath):
        (WebCore::GraphicsContext::clipPath):
        (WebCore::GraphicsContext::clipOut):
        * platform/graphics/cg/PathCG.cpp:
        (WebCore::Path::Path):
        (WebCore::Path::~Path):
        (WebCore):
        (WebCore::Path::ensurePlatformPath):
        (WebCore::Path::operator=):
        (WebCore::Path::contains):
        (WebCore::Path::strokeContains):
        (WebCore::Path::translate):
        (WebCore::Path::boundingRect):
        (WebCore::Path::fastBoundingRect):
        (WebCore::Path::strokeBoundingRect):
        (WebCore::Path::moveTo):
        (WebCore::Path::addLineTo):
        (WebCore::Path::addQuadCurveTo):
        (WebCore::Path::addBezierCurveTo):
        (WebCore::Path::addArcTo):
        (WebCore::Path::platformAddPathForRoundedRect):
        (WebCore::Path::closeSubpath):
        (WebCore::Path::addArc):
        (WebCore::Path::addRect):
        (WebCore::Path::addEllipse):
        (WebCore::Path::clear):
        (WebCore::Path::isEmpty):
        (WebCore::Path::currentPoint):
        (WebCore::Path::apply):
        * platform/graphics/gpu/LoopBlinnPathProcessor.cpp:
        (WebCore):
        (WebCore::LoopBlinnPathProcessor::buildContours):
        * platform/graphics/mac/GraphicsContextMac.mm:
        (WebCore::GraphicsContext::drawFocusRing):
        * platform/graphics/openvg/PainterOpenVG.cpp:
        (WebCore::PainterOpenVG::drawPath):
        * platform/graphics/skia/GraphicsContextSkia.cpp:
        (WebCore::GraphicsContext::clip):
        (WebCore::GraphicsContext::canvasClip):
        (WebCore::GraphicsContext::clipOut):
        (WebCore::GraphicsContext::clipPath):
        (WebCore::GraphicsContext::fillPath):
        (WebCore::GraphicsContext::strokePath):
        * platform/graphics/skia/PathSkia.cpp:
        (WebCore::Path::Path):
        (WebCore::Path::~Path):
        (WebCore):
        (WebCore::Path::ensurePlatformPath):
        (WebCore::Path::operator=):
        (WebCore::Path::isEmpty):
        (WebCore::Path::hasCurrentPoint):
        (WebCore::Path::currentPoint):
        (WebCore::Path::contains):
        (WebCore::Path::translate):
        (WebCore::Path::boundingRect):
        (WebCore::Path::moveTo):
        (WebCore::Path::addLineTo):
        (WebCore::Path::addQuadCurveTo):
        (WebCore::Path::addBezierCurveTo):
        (WebCore::Path::addArcTo):
        (WebCore::Path::closeSubpath):
        (WebCore::Path::addArc):
        (WebCore::Path::addRect):
        (WebCore::Path::addEllipse):
        (WebCore::Path::clear):
        (WebCore::Path::apply):
        (WebCore::Path::transform):
        (WebCore::Path::strokeBoundingRect):
        (WebCore::Path::strokeContains):
        * platform/graphics/wince/GraphicsContextWinCE.cpp:
        (WebCore::GraphicsContext::fillPath):
        (WebCore::GraphicsContext::strokePath):
        * platform/graphics/wx/GraphicsContextWx.cpp:
        (WebCore::GraphicsContext::clipPath):
        (WebCore::GraphicsContext::fillPath):
        (WebCore::GraphicsContext::strokePath):
        * platform/graphics/wx/PathWx.cpp:
        (WebCore::Path::Path):
        (WebCore::Path::~Path):
        (WebCore::Path::boundingRect):
        (WebCore::Path::operator=):
        (WebCore::Path::ensurePlatformPath):
        (WebCore):
        (WebCore::Path::clear):
        (WebCore::Path::moveTo):
        (WebCore::Path::addLineTo):
        (WebCore::Path::addQuadCurveTo):
        (WebCore::Path::addBezierCurveTo):
        (WebCore::Path::addArcTo):
        (WebCore::Path::closeSubpath):
        (WebCore::Path::addArc):
        (WebCore::Path::addRect):
        (WebCore::Path::addEllipse):
        (WebCore::Path::transform):
        (WebCore::Path::currentPoint):

2012-07-30  Dominik Röttsches  <dominik.rottsches@intel.com>

        Avoid Assertion Failure in HarfBuzzRun::characterIndexForXPosition
        https://bugs.webkit.org/show_bug.cgi?id=92376

        Reviewed by Tony Chang.

        Previously, the if condition in offsetForPosition gating the call to
        characterIndexForXPosition was comparing a different value than what was actually used
        as the argument to calling it. In some cases, this can lead to a minuscule difference
        when comparing the two floats - enough to trigger the assertion. To resolve this,
        the accuracy of the index calculation is improved by changing the types from int
        to floats and rephrasing the if condition to be exactly the same as what is checked
        for in the assertion.

        Manual test ManualTests/harfbuzz-mouse-selection-crash.html added
        which reliably reproduces the assertion failure before this change.

        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp:
        (WebCore::HarfBuzzShaper::HarfBuzzRun::characterIndexForXPosition): Types changed to float.
        (WebCore::HarfBuzzShaper::offsetForPosition): Types changed to float, if condition rephrased.
        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.h:
        (HarfBuzzRun):

2012-06-29  James Robinson  <jamesr@chromium.org>

        [chromium] Remove WebTransformationMatrix::mapPoint overrides
        https://bugs.webkit.org/show_bug.cgi?id=90329

        Reviewed by Adrienne Walker.

        Add more functionality for mapping points to CCMathUtil and use it in CCLayerSorter / drawTileQuad. These
        mappings should never clip.

        * platform/chromium/support/WebTransformationMatrix.cpp:
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawTileQuad):
        * platform/graphics/chromium/cc/CCLayerSorter.cpp:
        (WebCore::CCLayerSorter::LayerShape::LayerShape):
        * platform/graphics/chromium/cc/CCMathUtil.cpp:
        (WebCore::mapHomogeneousPoint):
        (WebCore::CCMathUtil::mapPoint):
        (WebCore):
        * platform/graphics/chromium/cc/CCMathUtil.h:
        (WebCore::HomogeneousCoordinate::cartesianPoint3d):
        (HomogeneousCoordinate):
        (CCMathUtil):

2012-07-30  Anders Carlsson  <andersca@apple.com>

        Crash in logging code if MIME type is null
        https://bugs.webkit.org/show_bug.cgi?id=92683
        <rdar://problem/11985295>

        Reviewed by Dan Bernstein.

        If the MIME type is null, try to figure it out from the URL extension. If this fails, return early instead of crashing
        trying to insert the null string into a hash set.

        * loader/SubframeLoader.cpp:
        (WebCore::logPluginRequest):

2012-07-30  Alexis Menard  <alexis.menard@openbossa.org>

        Build fix with newer bison 2.6.
        https://bugs.webkit.org/show_bug.cgi?id=92264

        Reviewed by Adam Barth.

        As stated in http://www.gnu.org/software/bison/manual/html_node/Table-of-Symbols.html
        YYLEX_PARAM and YYPARSE_PARAM are depecreated since version 1.875. So far all Mac OS
        version I had access to as well as recent Linux runs at least version 2.3 so it's safe
        to use the replacement of these deprecated macros in favor of %lex-param and %parse-param.
        As announced http://lists.gnu.org/archive/html/info-gnu/2012-07/msg00011.html with the release
        of version 2.6 YYLEX_PARAM and YYPARSE_PARAM are not supported anymore.

        No new tests : build fix and the patch should not trigger any regressions

        * css/CSSGrammar.y:
        * css/CSSParser.cpp:
        * xml/XPathGrammar.y: Refactored a bit to not use an intermediate PARSER define.
        * xml/XPathParser.cpp: bison 2.6 declare xpathyyparse in the .h file now, i.e. XPathGrammar.h
        therefore including this file within the namespace {} declarations leads to xpathyyparse being
        defined part of WebCore::XPath namespaces but the actual implementation of xpathyyparse is in XPathGrammar.cpp
        (generated) and not implemented within the WebCore::XPath so it lead to linking issues. Last, XPathGrammar.h needs 
        to be included after the other includes as it uses some XPath types. It breaks the style but CSSParser.cpp is doing the same.

2012-07-30  Sadrul Habib Chowdhury  <sadrul@chromium.org>

        Propagate gesture events to plugins.
        https://bugs.webkit.org/show_bug.cgi?id=92281

        Reviewed by Adam Barth.

        Propagate gesture events to plugins. This change does not expose the gesture events
        to JavaScript, since there is no spec for that at the moment. Exposing gesture events
        to JavaScript will be done separately, once there is a spec for it.

        Test: platform/chromium/plugins/gesture-events.html

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/EventNames.h:
        (WebCore):
        (WebCore::EventNames::isGestureEventType):
        (EventNames):
        * dom/GestureEvent.cpp: Added.
        (WebCore):
        (WebCore::GestureEvent::create):
        (WebCore::GestureEvent::initGestureEvent):
        (WebCore::GestureEvent::interfaceName):
        (WebCore::GestureEvent::GestureEvent):
        (WebCore::GestureEventDispatchMediator::GestureEventDispatchMediator):
        (WebCore::GestureEventDispatchMediator::event):
        (WebCore::GestureEventDispatchMediator::dispatchEvent):
        * dom/GestureEvent.h: Added.
        (WebCore):
        (GestureEvent):
        (WebCore::GestureEvent::~GestureEvent):
        (WebCore::GestureEvent::deltaX):
        (WebCore::GestureEvent::deltaY):
        (WebCore::GestureEvent::GestureEvent):
        (GestureEventDispatchMediator):
        (WebCore::GestureEventDispatchMediator::create):
        * dom/Node.cpp:
        (WebCore):
        (WebCore::Node::dispatchGestureEvent):
        * dom/Node.h:
        (WebCore):
        (Node):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::clear):
        (WebCore::EventHandler::handleGestureEvent):
        * page/EventHandler.h:

2012-07-30  John Bates  <jbates@google.com>

        Plumb vsync-enabled flag up to compositor thread and support disable-vsync
        https://bugs.webkit.org/show_bug.cgi?id=92323

        Reviewed by James Robinson.

        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
        (WebCore::CCFrameRateController::CCFrameRateController):
        (WebCore::CCFrameRateController::disableTimeSourceThrottling):
        (WebCore):
        (WebCore::CCFrameRateController::setActive):
        (WebCore::CCFrameRateController::postManualTick):
        (WebCore::CCFrameRateController::onTimerFired):
        (WebCore::CCFrameRateController::didBeginFrame):
        (WebCore::CCFrameRateController::didFinishFrame):
        * platform/graphics/chromium/cc/CCFrameRateController.h:
        (WebCore):
        (CCFrameRateController):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::CCLayerTreeSettings::CCLayerTreeSettings):
        (CCLayerTreeSettings):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::CCThreadProxy):
        (WebCore::CCThreadProxy::initializeImplOnImplThread):
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (CCThreadProxy):

2012-07-30  James Robinson  <jamesr@chromium.org>

        [chromium] Add miscellaneous missing includes and OVERRIDE declarations in compositor code
        https://bugs.webkit.org/show_bug.cgi?id=92680

        Reviewed by Adrienne Walker.

        * platform/graphics/chromium/TextureCopier.h:
        (AcceleratedTextureCopier):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.h:
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
        * platform/graphics/chromium/cc/CCResourceProvider.h:
        (WebCore):

2012-07-30  Adrienne Walker  <enne@google.com>

        [chromium] Remove dependency on ScrollbarTheme from the compositor
        https://bugs.webkit.org/show_bug.cgi?id=90528

        Reviewed by James Robinson.

        Tested by existing layout tests.

        ScrollbarLayerChromium is modified to use the Platform API for
        WebScrollbar, WebScrollbarThemePainter, and WebScrollbarThemeGeometry.
        This prevents API dependencies from the compositor code into WebCore
        scrollbar and theme code.

        CCScrollbarLayerImpl::CCScrollbar now implements the WebScrollbar API
        instead of the ScrollbarThemeClient API.

        Also, CCScrollbarLayerImpl now no longer gets the theme from a static
        accessor. It now gets a "copy" of the theme from the main thread via
        WebScrollbarThemeGeometry, which is more correct for render theme
        scrollbars which were previously using the native theme to get part
        geometry. Using the correct theme unfortunately causes crashes due to
        bad casts in RenderScrollbarTheme, so this patch turns back off the
        use of ScrollbarLayerChromium for themed scrollbars until that can be
        resolved.

        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        (WebCore::createScrollbarLayer):
        * platform/ScrollbarThemeClient.h:
        (ScrollbarThemeClient):
        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        (WebCore::ScrollbarLayerChromium::create):
        (WebCore::ScrollbarLayerChromium::ScrollbarLayerChromium):
        (WebCore::ScrollbarLayerChromium::pushPropertiesTo):
        (WebCore::ScrollbarBackgroundPainter::create):
        (WebCore::ScrollbarBackgroundPainter::ScrollbarBackgroundPainter):
        (ScrollbarBackgroundPainter):
        (WebCore::ScrollbarThumbPainter::create):
        (WebCore::ScrollbarThumbPainter::ScrollbarThumbPainter):
        (ScrollbarThumbPainter):
        (WebCore::ScrollbarLayerChromium::createTextureUpdaterIfNeeded):
        (WebCore::ScrollbarLayerChromium::setTexturePriorities):
        (WebCore::ScrollbarLayerChromium::update):
        * platform/graphics/chromium/ScrollbarLayerChromium.h:
        (ScrollbarLayerChromium):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
        (WebCore::CCScrollbarLayerImpl::CCScrollbarLayerImpl):
        (WebCore::CCScrollbarLayerImpl::setScrollbarData):
        (WebCore::toUVRect):
        (WebCore::CCScrollbarLayerImpl::appendQuads):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::isOverlay):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::value):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::location):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::size):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::enabled):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::maximum):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::totalSize):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::isScrollViewScrollbar):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::isScrollableAreaActive):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::getTickmarks):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::controlSize):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::pressedPart):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::hoveredPart):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::scrollbarOverlayStyle):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::orientation):
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::isCustomScrollbar):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
        (CCScrollbarLayerImpl):
        (CCScrollbar):

2012-07-30  Andreas Kling  <kling@webkit.org>

        REGRESSION(r123636): Heap-use-after-free in StyleResolver::collectMatchingRules.
        <http://webkit.org/b/92430>

        Reviewed by Antti Koivisto.

        Don't hold on to a reference to StyledElement::classNames() as that may become
        invalid after mutating the element's attribute data.

        In this case it was happening below Element::hasAttributes() which is unfortunately
        naive enough to always serialize lazy attributes. That is a minor inefficiency that
        can be addressed in a separate patch.

        Covered by valgrind on existing tests.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRules):

2012-07-30  James Robinson  <jamesr@chromium.org>

        [chromium] CCThreadTask should not depend on CrossThreadTask and does not need to depend on CrossThreadCopier
        https://bugs.webkit.org/show_bug.cgi?id=90132

        Reviewed by David Levin.

        CrossThreadTask is defined in WebCore/dom/ and depends on concepts like ScriptExecutionConcept. CCThreadTask,
        being in WebCore/platform/, should not depend on /dom/ or anything from that layer.

        CrossThreadCopier is not a layering violation per se, but it's also not at all helpful for CCThreadTask - we
        never use any types for which it would be useful.

        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::compositeAndReadback):
        (WebCore::CCThreadProxy::finishAllRendering):
        (WebCore::CCThreadProxy::initializeContext):
        (WebCore::CCThreadProxy::setVisible):
        (WebCore::CCThreadProxy::initializeLayerRenderer):
        (WebCore::CCThreadProxy::recreateContext):
        (WebCore::CCThreadProxy::implSideRenderingStats):
        (WebCore::CCThreadProxy::start):
        (WebCore::CCThreadProxy::stop):
        (WebCore::CCThreadProxy::forceSerializeOnSwapBuffers):
        (WebCore::CCThreadProxy::beginFrame):
        (WebCore::CCThreadProxy::acquireLayerTextures):
        * platform/graphics/chromium/cc/CCThreadTask.h:
        (CCThreadTask1):
        (WebCore::CCThreadTask1::create):
        (WebCore::CCThreadTask1::CCThreadTask1):
        (CCThreadTask2):
        (WebCore::CCThreadTask2::create):
        (WebCore::CCThreadTask2::CCThreadTask2):
        (CCThreadTask3):
        (WebCore::CCThreadTask3::create):
        (WebCore::CCThreadTask3::CCThreadTask3):
        (CCThreadTask4):
        (WebCore::CCThreadTask4::create):
        (WebCore::CCThreadTask4::CCThreadTask4):
        (CCThreadTask5):
        (WebCore::CCThreadTask5::create):
        (WebCore::CCThreadTask5::CCThreadTask5):
        (WebCore::createCCThreadTask):

2012-07-30  Paul Irish  <paul.irish@gmail.com>

        Web Inspector: Rename Databases to Web SQL
        https://bugs.webkit.org/show_bug.cgi?id=92646

        Reviewed by Pavel Feldman.

        Renamed Databases to Web SQL. Drive-by fix for EmptyView
        selection.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/EmptyView.js:
        * inspector/front-end/ResourcesPanel.js:

2012-07-30  Tony Chang  <tony@chromium.org>

        new flexbox should ignore float set on flexitems
        https://bugs.webkit.org/show_bug.cgi?id=70792

        Reviewed by Ojan Vafai.

        Force flex items to not float.

        Test: css3/flexbox/floated-flexitem.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::adjustRenderStyle): Force NoFloat on flex items.

2012-07-30  Adrienne Walker  <enne@google.com>

        [chromium] Turn back on ScrollbarLayerChromium for Windows
        https://bugs.webkit.org/show_bug.cgi?id=92409

        Reviewed by James Robinson.

        This reverts r122791. As GDI issues were addressed in Chromium via
        http://src.chromium.org/viewvc/chrome?view=rev&revision=148215,
        scrollbar parts can now be composited on the thread.

        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        (WebCore::createScrollbarLayer):

2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124025.
        http://trac.webkit.org/changeset/124025
        https://bugs.webkit.org/show_bug.cgi?id=92658

        Causes color-suggestion-picker-appearance layout test to time
        out on all Chromium platforms (Requested by tomhudson_ on
        #webkit).

        * rendering/RenderThemeChromiumCommon.cpp:
        (WebCore::RenderThemeChromiumCommon::supportsDataListUI):

2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r123966 and r123967.
        http://trac.webkit.org/changeset/123966
        http://trac.webkit.org/changeset/123967
        https://bugs.webkit.org/show_bug.cgi?id=92656

        This patch is causing assertion failures on the debug bot
        (also rolling out a dependent patch) (Requested by mrobinson
        on #webkit).

        * GNUmakefile.am:
        * GNUmakefile.list.am:
        * platform/text/gtk/TextCheckerEnchant.cpp: Removed.
        * platform/text/gtk/TextCheckerEnchant.h: Removed.

2012-07-30  Julien Chaffraix  <jchaffraix@webkit.org>

        ASSERTION FAILED: !rect.isEmpty()  : void WebCore::GraphicsContext::drawRect(const WebCore::IntRect &)
        https://bugs.webkit.org/show_bug.cgi?id=92187

        Reviewed by Simon Fraser.

        The border painting logic (RenderBoxModelObject::paintOneBorderSide) would pass a rect with a 0px length
        to RenderObject::drawLineForBoxSide. We do check the width (thickness) but not the length so we would pass
        the rect to GraphicsContext and hit the ASSERT. This change adds a check for the length too as it is the safest
        way, it means that we may still do unneeded operations before bailing out but that's an existing problem in the code.

        Tests: fast/borders/0px-borders-no-line-height.html
               fast/borders/double-1px-border-assert.html

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::drawLineForBoxSide):
        Added a 0px length check. While renaming confusing variables and re-using others,
        I also found a potential empty border that I fixed (tested by the 2nd case above).

2012-07-26  Stephen White  <senorblanco@chromium.org>

        [chromium] Refactor the computation of resampled bitmap size in
        drawImage and drawPattern.
        https://bugs.webkit.org/show_bug.cgi?id=92408

        Reviewed by Adrienne Walker.

        We used to have a special-purpose function called TransformDimensions()
        which did pretty much the same thing as SkRect::mapRect() does.  This
        change unifies the drawPattern code to use mapRect() in the same way
        that drawImage() does.

        Covered by existing tests, e.g., fast/backgrounds/size/*.

        * platform/graphics/skia/ImageSkia.cpp:
        (WebCore):
        (WebCore::Image::drawPattern):
        Note:  we're now doing using the original (float) source rect, and
        converting to int only after applying the matrix transform.  This
        might result in different decisions about resampling mode, but it's
        more correct anyway.

2012-07-30  Vineet Chaudhary  <rgf748@motorola.com>

        https://bugs.webkit.org/show_bug.cgi?id=92642
        [Bindings]Remove custom JS/V8 bindings for WebSocket::close() using [Clamp]

        Reviewed by Kentaro Hara.

        With support of [Clamp] as extended attribute we can replace custom bindings from WebSocket::close().
        Spec for WebSocket::close() : http://www.whatwg.org/specs/web-apps/current-work/multipage/network.html#websocket

        No new tests. There should be no behavioural changes 
        Existing tests under http/websocket/tests/hybi/ should cover this.

        * Modules/websockets/WebSocket.h:
        (WebCore::WebSocket::close):
        * Modules/websockets/WebSocket.idl: Used [Clamp].
        * bindings/js/JSWebSocketCustom.cpp: Removed custom call close().
        (WebCore):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheck):
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateParametersCheck):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionClassMethodWithClamp):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::classMethodWithClampCallback):
        * bindings/v8/custom/V8WebSocketCustom.cpp: Removed custom call close().
        (WebCore):

2012-07-29  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Resource agent's reference to cached resources should be weak.
        https://bugs.webkit.org/show_bug.cgi?id=92108

        Reviewed by Pavel Feldman.

        NetworkResourcesData now stores a raw pointer to CachedResource.
        CachedResource now notifies InspectorInstrumentation that it will be destroyed.
        InspectorInstrumentation stores a set of InstrumentingAgents and broadcasts willDestroyCachedResource event to all available resourceAgents.
        Destroyed resources content is saved to NetworkResourcesData.

        Tests: http/tests/inspector/network/cached-resource-destroyed-moved-to-storage.html
               http/tests/inspector/network/cached-resource-destroyed-too-big-discarded.html

        * WebCore.exp.in:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::inspectedPageDestroyed):
        * inspector/InspectorInstrumentation.cpp:
        (WebCore):
        (WebCore::InspectorInstrumentation::willDestroyCachedResourceImpl):
        (WebCore::InspectorInstrumentation::registerInstrumentingAgents):
        (WebCore::InspectorInstrumentation::unregisterInstrumentingAgents):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        (WebCore::InspectorInstrumentation::willDestroyCachedResource):
        (WebCore):
        * inspector/InspectorResourceAgent.cpp:
        (WebCore::InspectorResourceAgent::didReceiveData):
        (WebCore::InspectorResourceAgent::willDestroyCachedResource):
        (WebCore):
        (WebCore::InspectorResourceAgent::getResponseBody):
        * inspector/InspectorResourceAgent.h:
        (InspectorResourceAgent):
        * inspector/NetworkResourcesData.cpp:
        (WebCore::NetworkResourcesData::ResourceData::ResourceData):
        (WebCore::NetworkResourcesData::ResourceData::setContent):
        (WebCore::NetworkResourcesData::setResourceContent):
        (WebCore::NetworkResourcesData::removeCachedResource):
        (WebCore):
        * inspector/NetworkResourcesData.h:
        (ResourceData):
        (WebCore::NetworkResourcesData::ResourceData::base64Encoded):
        (WebCore::NetworkResourcesData::ResourceData::cachedResource):
        (NetworkResourcesData):
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::~CachedResource):
        (WebCore::CachedResource::removeClient):
        (WebCore::CachedResource::deleteIfPossible):
        (WebCore):
        * loader/cache/CachedResource.h:
        (CachedResource):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::garbageCollectDocumentResourcesTimerFired):
        (WebCore::CachedResourceLoader::garbageCollectDocumentResources):
        (WebCore::CachedResourceLoader::clearPreloads):
        * loader/cache/CachedResourceLoader.h:
        (CachedResourceLoader):
        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::evict):
        * testing/InternalSettings.cpp:
        * testing/Internals.cpp:
        (WebCore::Internals::garbageCollectDocumentResources):
        (WebCore):
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-07-30  Shinya Kawanaka  <shinyak@chromium.org>

        Prohibit having AuthorShadowDOM of input or textarea element for a while and having a flag to enable it in Internals.
        https://bugs.webkit.org/show_bug.cgi?id=92611

        Reviewed by Hajime Morita.

        Prohibit having AuthorShadowDOM of input elemnet unless a flag in RuntimeEnabledFeatures is not enabled.
        The flag can be enabled in Internals.

        The elements in UserAgentShadowDOM of input element assume that they have a renderer when the input
        element has a renderer. However, this does not hold when AuthorShadowDOM is added to input element.
        So until we fix the issue, we should disable to have AuthorShadowDOM for input element, because it may
        cause crashes and security problems.

        Tests: fast/dom/shadow/input-with-validation-without-shadow.html
               fast/dom/shadow/input-with-validation.html
               fast/dom/shadow/shadow-disable.html

        * bindings/generic/RuntimeEnabledFeatures.cpp:
        (WebCore):
        * bindings/generic/RuntimeEnabledFeatures.h:
        (RuntimeEnabledFeatures):
        (WebCore::RuntimeEnabledFeatures::authorShadowDOMForAnyElementEnabled):
        (WebCore::RuntimeEnabledFeatures::setAuthorShadowDOMForAnyElementEnabled):
        * dom/ShadowRoot.cpp:
        (WebCore::allowsAuthorShadowRoot): The input element or textarea element does not allow to have a ShadowDOM unless
        is a flag in RuntimeEnabledFeatures is not enabled.
        * html/HTMLInputElement.h:
        (WebCore::isHTMLInputElement):
        (WebCore):
        * html/HTMLTextAreaElement.h:
        (WebCore::isHTMLTextAreaElement):
        (WebCore):
        * testing/Internals.cpp:
        (WebCore::Internals::setAuthorShadowDOMForAnyElementEnabled):
        (WebCore):
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-07-30  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: support --line-numbers mapping for SASS
        https://bugs.webkit.org/show_bug.cgi?id=92400

        Reviewed by Vsevolod Vlasov.

        There is --debug-info and --line-numbers ways of referencing the source scss file, adding support for --line-numbers here.

        * inspector/front-end/SASSSourceMapping.js:
        (WebInspector.SASSSourceMapping.prototype._resourceAdded.didRequestContent):
        (WebInspector.SASSSourceMapping.prototype._resourceAdded):
        (_bindUISourceCode):

2012-07-30  Keishi Hattori  <keishi@webkit.org>

        Implement datalist UI for input type color for Chromium
        https://bugs.webkit.org/show_bug.cgi?id=92075

        Reviewed by Kent Tamura.

        Test: platform/chromium/fast/forms/color/color-suggestion-picker-appearance.html

        * rendering/RenderThemeChromiumCommon.cpp:
        (WebCore::RenderThemeChromiumCommon::supportsDataListUI): Added color to types supporting datalist.

2012-07-30  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Wheel events on a page with frames are not handled in fixed layout
        https://bugs.webkit.org/show_bug.cgi?id=90550

        Reviewed by Antonio Gomes.

        Based on patch by Andras Becsi.

        Frame-rect size is not the right value to check against to see if the document
        can be contained within the full visible content rect, since it does not handle
        fixedVisibleContentRect. Instead visibleContentRect(true) should be used which
        returns the full visible content rect disregarding scrollbars, and which is
        the same a frame-rect size when fixedVisibleContentRect is not set.

        * platform/ScrollView.cpp:
        (WebCore::ScrollView::updateScrollbars):

2012-07-30  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        There is no way to tell whether an element can be activated or not
        https://bugs.webkit.org/show_bug.cgi?id=92093

        Reviewed by Antonio Gomes.

        This patch adds the willRespondToMouseClickEvents and willRespondToMouseMoveEvents
        functions, named after similar functions in the iOS fork of WebKit.

        Touch-adjustment will now use these two functions, which improves accuracy when
        targeting shadow-dom elements, and also means touch adjustment will prefer enabled
        form-elements over disabled ones.

        Test: touchadjustment/disabled-formelements.html

        * dom/Node.cpp:
        (WebCore::Node::willRespondToMouseMoveEvents):
        (WebCore::Node::willRespondToMouseClickEvents):
        * dom/Node.h:
        (Node):
        * editing/DeleteButton.h:
        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::willRespondToMouseClickEvents):
        * html/HTMLAnchorElement.h:
        (HTMLAnchorElement):
        * html/HTMLButtonElement.cpp:
        (WebCore::HTMLButtonElement::willRespondToMouseClickEvents):
        * html/HTMLButtonElement.h:
        (HTMLButtonElement):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::willRespondToMouseClickEvents):
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/HTMLLabelElement.cpp:
        (WebCore::HTMLLabelElement::willRespondToMouseClickEvents):
        * html/HTMLLabelElement.h:
        (HTMLLabelElement):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::willRespondToMouseClickEvents):
        * html/HTMLMediaElement.h:
        * html/HTMLSummaryElement.cpp:
        (WebCore::HTMLSummaryElement::willRespondToMouseClickEvents):
        * html/HTMLSummaryElement.h:
        (HTMLSummaryElement):
        * html/shadow/CalendarPickerElement.cpp:
        (WebCore::CalendarPickerElement::willRespondToMouseClickEvents):
        * html/shadow/CalendarPickerElement.h:
        (CalendarPickerElement):
        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlTimelineElement::willRespondToMouseClickEvents):
        (WebCore::MediaControlTimelineElement::setPosition):
        (WebCore::MediaControlVolumeSliderElement::willRespondToMouseMoveEvents):
        (WebCore::MediaControlVolumeSliderElement::willRespondToMouseClickEvents):
        * html/shadow/MediaControlElements.h:
        (MediaControlTimelineElement):
        (MediaControlVolumeSliderElement):
        * html/shadow/MediaControlRootElement.h:
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::willRespondToMouseMoveEvents):
        (WebCore::SliderThumbElement::willRespondToMouseClickEvents):
        * html/shadow/SliderThumbElement.h:
        (SliderThumbElement):
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::SearchFieldResultsButtonElement::willRespondToMouseClickEvents):
        (WebCore::SearchFieldCancelButtonElement::willRespondToMouseClickEvents):
        (WebCore::SpinButtonElement::willRespondToMouseMoveEvents):
        (WebCore::SpinButtonElement::willRespondToMouseClickEvents):
        (WebCore::InputFieldSpeechButtonElement::willRespondToMouseClickEvents):
        * html/shadow/TextControlInnerElements.h:
        (SearchFieldResultsButtonElement):
        (SearchFieldCancelButtonElement):
        (SpinButtonElement):
        * html/shadow/TextFieldDecorationElement.cpp:
        (WebCore::TextFieldDecorationElement::willRespondToMouseClickEvents):
        * html/shadow/TextFieldDecorationElement.h:
        (TextFieldDecorationElement):
        * page/TouchAdjustment.cpp:
        (WebCore::TouchAdjustment::nodeRespondsToTapGesture):

2012-07-30  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Content size variables in NetworkResourcesData should have size_t type instead of int.
        https://bugs.webkit.org/show_bug.cgi?id=92618

        Reviewed by Yury Semikhatsky.

        Changed content size variables type in NetworkResourcesData from int to size_t.
        Drive-by: Switched String length calculation to recently added StringImpl's sizeInBytes.

        * inspector/NetworkResourcesData.cpp:
        (WebCore::NetworkResourcesData::ResourceData::removeContent):
        (WebCore::NetworkResourcesData::ResourceData::dataLength):
        (WebCore::NetworkResourcesData::ResourceData::appendData):
        (WebCore::NetworkResourcesData::ResourceData::decodeDataToContent):
        (WebCore::NetworkResourcesData::setResourceContent):
        (WebCore::NetworkResourcesData::maybeAddResourceData):
        (WebCore::NetworkResourcesData::maybeDecodeDataToContent):
        (WebCore::NetworkResourcesData::setResourcesDataSizeLimits):
        (WebCore::NetworkResourcesData::ensureFreeSpace):
        * inspector/NetworkResourcesData.h:
        (ResourceData):
        (NetworkResourcesData):

2012-07-30  Hayato Ito  <hayato@chromium.org>

        Remove an useless member variable, m_shouldPreventDispatch, from EventDispatcher.
        https://bugs.webkit.org/show_bug.cgi?id=92625

        Reviewed by Hajime Morita.

        EventDispatcher::m_shouldPreventDispatch does not have any effects. We can remove that.

        No new tests, no behavior change.

        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::EventDispatcher):
        (WebCore::EventDispatcher::dispatchEvent):
        * dom/EventDispatcher.h:
        (EventDispatcher):

2012-07-30  Hayato Ito  <hayato@chromium.org>

        Remove an useless member variable, m_shouldPreventDispatch, from EventDispatcher.
        https://bugs.webkit.org/show_bug.cgi?id=92625

        Reviewed by Hajime Morita.

        EventDispatcher::m_shouldPreventDispatch does not have any effects. We can remove that.

        No new tests, no behavior change.

        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::EventDispatcher):
        (WebCore::EventDispatcher::dispatchEvent):
        * dom/EventDispatcher.h:
        (EventDispatcher):

2012-07-26  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: make MemoryInstrumentation methods private
        https://bugs.webkit.org/show_bug.cgi?id=92379

        Reviewed by Vsevolod Vlasov.

        MemoryInstrumentation was refactored.
        - All reporting methods on MemoryInstrumentation except add*Object are
          private to enforce MemoryClassInfo usage.
        - MemoryInstrumentation::Add*Member methods renamed to Add*Object
        - String reporting is implemented directly in the MemoryInstrumentation,
          not in its descendants.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/v8/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
        * dom/MemoryInstrumentation.cpp: Added.
        (WebCore):
        (WebCore::MemoryInstrumentation::addString):
        * dom/MemoryInstrumentation.h:
        (WebCore::MemoryInstrumentation::addInstrumentedObject):
        (WebCore::MemoryInstrumentation::addObject):
        (MemoryInstrumentation):
        (InstrumentedPointerBase):
        (WebCore::MemoryInstrumentation::InstrumentedPointerBase::~InstrumentedPointerBase):
        (InstrumentedPointer):
        (WebCore::MemoryInstrumentation::InstrumentedPointer::InstrumentedPointer):
        (WebCore::MemoryInstrumentation::OwningTraits::addInstrumentedObject):
        (WebCore::MemoryInstrumentation::OwningTraits::addObject):
        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl):
        (WebCore::MemoryClassInfo::addInstrumentedMember):
        (WebCore::MemoryClassInfo::addMember):
        (WebCore):
        (WebCore::MemoryInstrumentation::addObjectImpl):
        (WebCore::MemoryInstrumentation::addInstrumentedCollection):
        (WebCore::MemoryInstrumentation::calculateContainerSize):
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):

2012-07-30  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: [Styles] No color swatch for the SVG "fill" and "stroke" property values
        https://bugs.webkit.org/show_bug.cgi?id=92638

        Reviewed by Vsevolod Vlasov.

        Added the "fill" and "stroke" properties to the list of color-aware properties.

        * inspector/front-end/CSSKeywordCompletions.js:

2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124000.
        http://trac.webkit.org/changeset/124000
        https://bugs.webkit.org/show_bug.cgi?id=92632

        seems to have broken chromium Range_InstanceSizeUnknown unit
        test across many platforms (Requested by tomhudson on
        #webkit).

        * WebCore.exp.in:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::inspectedPageDestroyed):
        * inspector/InspectorInstrumentation.cpp:
        (WebCore):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        * inspector/InspectorResourceAgent.cpp:
        (WebCore::InspectorResourceAgent::didReceiveData):
        (WebCore::InspectorResourceAgent::getResponseBody):
        * inspector/InspectorResourceAgent.h:
        (InspectorResourceAgent):
        * inspector/NetworkResourcesData.cpp:
        (WebCore::NetworkResourcesData::ResourceData::ResourceData):
        (WebCore::NetworkResourcesData::ResourceData::setContent):
        (WebCore::NetworkResourcesData::setResourceContent):
        * inspector/NetworkResourcesData.h:
        (ResourceData):
        (WebCore::NetworkResourcesData::ResourceData::cachedResource):
        (NetworkResourcesData):
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::~CachedResource):
        (WebCore::CachedResource::removeClient):
        (WebCore::CachedResource::deleteIfPossible):
        (WebCore):
        * loader/cache/CachedResource.h:
        (CachedResource):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::garbageCollectDocumentResourcesTimerFired):
        (WebCore::CachedResourceLoader::clearPreloads):
        * loader/cache/CachedResourceLoader.h:
        (CachedResourceLoader):
        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::evict):
        * testing/InternalSettings.cpp:
        * testing/Internals.cpp:
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-07-30  Hayato Ito  <hayato@chromium.org>

        Remove an unused member variable, m_originalTarget, from EventDispatcher.
        https://bugs.webkit.org/show_bug.cgi?id=92614

        Reviewed by Andreas Kling.

        No one uses EventDispatcher::m_originalTarget.

        No new tests, no behavior change.

        * dom/EventDispatcher.h:
        (EventDispatcher):

2012-07-27  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>

        [Qt] Fix issues remaining with fixed positioned layers
        https://bugs.webkit.org/show_bug.cgi?id=92528

        Reviewed by Noam Rosenthal.

        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::syncCompositingStateSelf):
        Make sure that the delta is used when syncCompositingStateSelf is called afterward.
        (WebCore::TextureMapperLayer::setScrollPositionDeltaIfNeeded):
        * platform/graphics/texmap/TextureMapperLayer.h:
        Use a FloatSize instead of an IntPoint for the delta.
        (TextureMapperLayer):
        (WebCore::TextureMapperLayer::adjustedPosition):

2012-07-30  Patrick Gansterer  <paroga@webkit.org>

        Replace UnicodeWinCE with UnicodeWchar
        https://bugs.webkit.org/show_bug.cgi?id=92539

        Reviewed by Ryosuke Niwa.

        UnicodeWinCE never contained WinCE specific code. UnicodeWchar
        is a replacement for it, which is mainly based on the functions
        from <wchar.h>. It is ment as a minimal Unicode backend, which
        can be used very easy and has no external dependencies.

        * platform/text/TextEncoding.cpp:
        (WebCore::TextEncoding::encode):
        * platform/text/TextEncodingRegistry.cpp:
        (WebCore::extendTextCodecMaps):

2012-07-30  Hayato Ito  <hayato@chromium.org>

        Remove unnecessary code which set event's target from EventDispatcher::dispatchEvent.
        https://bugs.webkit.org/show_bug.cgi?id=92613

        Reviewed by Hajime Morita.

        EventContext::handleLocalEvents does all required jobs so we don't
        need to set target in EventDispacher::dispatchEvent() for TARGET phase.

        No new tests, no behavior change.

        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::dispatchEvent):

2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r124004.
        http://trac.webkit.org/changeset/124004
        https://bugs.webkit.org/show_bug.cgi?id=92622

        Broke Android build (Requested by keishi on #webkit).

        * rendering/RenderThemeChromiumCommon.cpp:
        (WebCore::RenderThemeChromiumCommon::supportsDataListUI):

2012-07-30  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: element tag disappears after editing
        https://bugs.webkit.org/show_bug.cgi?id=92385

        Reviewed by Vsevolod Vlasov.

        This has regressed when we started hiding elements panel upon
        batch updates. Narrowing hiding cases, updating selection
        in on-screen mode only.

        * inspector/front-end/ElementsTreeOutline.js:
        (WebInspector.ElementsTreeElement.prototype.updateSelection):

2012-07-26  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: move StringImpl size calculation to StringImpl
        https://bugs.webkit.org/show_bug.cgi?id=92359

        Reviewed by Pavel Feldman.

        Moved stringSize(StringImpl*) implementation from InspectorMemoryAgent to
        StringImpl::sizeInBytes();

        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):

2012-07-30  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: workers inspector is broken in the remote debugging mode
        https://bugs.webkit.org/show_bug.cgi?id=92540

        Reviewed by Yury Semikhatsky.

        The problem was that worker manager re-used complete url with query parameters
        for spin-off worker front-ends. As a result, in case of remote debugging, newly
        created front-ends were connecting to the same web socket (because of the ws parameter).

        * inspector/front-end/WorkerManager.js:
        (WebInspector.WorkerManager.isDedicatedWorkerFrontend):
        * inspector/front-end/inspector.js:

2012-07-30  Keishi Hattori  <keishi@webkit.org>

        Implement datalist UI for input type color for Chromium
        https://bugs.webkit.org/show_bug.cgi?id=92075

        Reviewed by Kent Tamura.

        Test: platform/chromium/fast/forms/color/color-suggestion-picker-appearance.html

        * rendering/RenderThemeChromiumCommon.cpp:
        (WebCore::RenderThemeChromiumCommon::supportsDataListUI): Added color to types supporting datalist.

2012-07-30  Mario Sanchez Prada  <msanchez@igalia.com>

        REGRESSION (r123767): platform/gtk/accessibility/object-with-title.html failing on GTK
        https://bugs.webkit.org/show_bug.cgi?id=92477

        Reviewed by Chris Fleizach.

        Consider title and accessibilityDescription together with helpText to
        decide whether an object should be exposed in the accessibility tree.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):

2012-07-29  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Resource agent's reference to cached resources should be weak.
        https://bugs.webkit.org/show_bug.cgi?id=92108

        Reviewed by Pavel Feldman.

        NetworkResourcesData now stores a raw pointer to CachedResource.
        CachedResource now notifies InspectorInstrumentation that it will be destroyed.
        InspectorInstrumentation stores a set of InstrumentingAgents and broadcasts willDestroyCachedResource event to all available resourceAgents.
        Destroyed resources content is saved to NetworkResourcesData.

        Tests: http/tests/inspector/network/cached-resource-destroyed-moved-to-storage.html
               http/tests/inspector/network/cached-resource-destroyed-too-big-discarded.html

        * WebCore.exp.in:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::inspectedPageDestroyed):
        * inspector/InspectorInstrumentation.cpp:
        (WebCore):
        (WebCore::InspectorInstrumentation::willDestroyCachedResourceImpl):
        (WebCore::InspectorInstrumentation::registerInstrumentingAgents):
        (WebCore::InspectorInstrumentation::unregisterInstrumentingAgents):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        (WebCore::InspectorInstrumentation::willDestroyCachedResource):
        (WebCore):
        * inspector/InspectorResourceAgent.cpp:
        (WebCore::InspectorResourceAgent::didReceiveData):
        (WebCore::InspectorResourceAgent::willDestroyCachedResource):
        (WebCore):
        (WebCore::InspectorResourceAgent::getResponseBody):
        * inspector/InspectorResourceAgent.h:
        (InspectorResourceAgent):
        * inspector/NetworkResourcesData.cpp:
        (WebCore::NetworkResourcesData::ResourceData::ResourceData):
        (WebCore::NetworkResourcesData::ResourceData::setContent):
        (WebCore::NetworkResourcesData::setResourceContent):
        (WebCore::NetworkResourcesData::removeCachedResource):
        (WebCore):
        * inspector/NetworkResourcesData.h:
        (ResourceData):
        (WebCore::NetworkResourcesData::ResourceData::base64Encoded):
        (WebCore::NetworkResourcesData::ResourceData::cachedResource):
        (NetworkResourcesData):
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::~CachedResource):
        (WebCore::CachedResource::removeClient):
        (WebCore::CachedResource::deleteIfPossible):
        (WebCore):
        * loader/cache/CachedResource.h:
        (CachedResource):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::garbageCollectDocumentResourcesTimerFired):
        (WebCore::CachedResourceLoader::garbageCollectDocumentResources):
        (WebCore::CachedResourceLoader::clearPreloads):
        * loader/cache/CachedResourceLoader.h:
        (CachedResourceLoader):
        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::evict):
        * testing/InternalSettings.cpp:
        * testing/Internals.cpp:
        (WebCore::Internals::garbageCollectDocumentResources):
        (WebCore):
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-07-29  YoungTaeck Song  <youngtaeck.song@samsung.com>

        [WK2][EFL] Accelerated compositing support using TextureMapper on Efl WebKit2
        https://bugs.webkit.org/show_bug.cgi?id=91583

        Reviewed by Noam Rosenthal.

        This patch is a subset of Efl's UI_SIDE_COMPOSITING implementation.
        This patch adds Texture Mapper related files to PlatformEfl.cmake.
        And wrapped TextureMapperLayer and TextureMapperBackingStore with USE(ACCELERATED_COMPOSITING) for fixing building error when disable ACCELERATED_COMPOSITING.

        * CMakeLists.txt:
        * PlatformEfl.cmake:
        * platform/graphics/GraphicsLayer.cpp:
        (WebCore):
        * platform/graphics/GraphicsLayer.h:
        (GraphicsLayer):
        * platform/graphics/GraphicsLayerAnimation.cpp:
        * platform/graphics/GraphicsLayerAnimation.h:
        * platform/graphics/PlatformLayer.h:
        (WebCore):
        * platform/graphics/texmap/TextureMapperBackingStore.cpp:
        * platform/graphics/texmap/TextureMapperBackingStore.h:
        * platform/graphics/texmap/TextureMapperLayer.h:

2012-07-29  YoungTaeck Song  <youngtaeck.song@samsung.com>

        [WK2][EFL] TILED_BACKING_STORE support on Efl WebKit2
        https://bugs.webkit.org/show_bug.cgi?id=91582

        Reviewed by Noam Rosenthal.

        This patch is a subset of Efl's UI_SIDE_COMPOSITING implementation.
        This patch adds TILED_BACKING_STORE related files to CMakeLists.txt and PlatformEfl.cmake

        * CMakeLists.txt:
        * PlatformEfl.cmake:

2012-07-29  Keishi Hattori  <keishi@webkit.org>

        Fix removing invalid values from color input suggestions
        https://bugs.webkit.org/show_bug.cgi?id=92502

        Reviewed by Kent Tamura.

        Make ColorInputType::typeMismatchFor() return false for invalid color
        values so that they don't appear in the list of suggestions that
        ColorInputType::suggestions() returns.

        No new tests. Tests to be added in Bug 92075.

        * html/ColorInputType.cpp:
        (WebCore::ColorInputType::typeMismatchFor):
        (WebCore):
        * html/ColorInputType.h:
        (ColorInputType):

2012-07-29  Li Yin  <li.yin@intel.com>

        getChannelData should raise exception when index is more than numberOfChannels.
        https://bugs.webkit.org/show_bug.cgi?id=92223

        Reviewed by Kentaro Hara.

        Spec: https://dvcs.w3.org/hg/audio/raw-file/tip/webaudio/specification.html#AudioBuffer-section
        In getChannelData function, the index value MUST be less than numberOfChannels
        or an exception will be thrown.

        Test: webaudio/audiobuffer.html

        * Modules/webaudio/AudioBuffer.cpp:
        (WebCore::AudioBuffer::getChannelData):
        (WebCore):
        * Modules/webaudio/AudioBuffer.h:
        (WebCore):
        (AudioBuffer):
        * Modules/webaudio/AudioBuffer.idl: raise exception when index is not less than numberOfChannels.

2012-07-29  Sukolsak Sakshuwong  <sukolsak@google.com>

        forward-delete in the last cell of a table moves the caret after the table
        https://bugs.webkit.org/show_bug.cgi?id=24250

        Reviewed by Ryosuke Niwa.

        The ForwardDelete command moved the cursor after the table when it's invoked
        in an empty cell that is the last cell of a table. It also removed the break
        element when invoked in an empty cell that is not the last cell of a table.
        Make it do nothing inside an empty table cell.

        Test: editing/deleting/forward-delete-empty-table-cell.html

        * editing/TypingCommand.cpp:
        (WebCore::TypingCommand::forwardDeleteKeyPressed):

2012-07-29  Kwang Yul Seo  <skyul@company100.net>

        Remove unused method HTMLConstructionSiteTask::take(HTMLConstructionSiteTask&)
        https://bugs.webkit.org/show_bug.cgi?id=92601

        Reviewed by Adam Barth.

        This method was introduced in r104000, but has never been used from the beginning.

        No functional change.

        * html/parser/HTMLConstructionSite.h:

2012-07-29  Kenichi Ishibashi  <bashi@chromium.org>

        [Chromium] HarfBuzzShaper can't handle segmented text run
        https://bugs.webkit.org/show_bug.cgi?id=92445

        Reviewed by Tony Chang.

        Pass the range to be displayed to HarfBuzzShaper. The shaper calculates positions and advances of each glyph
        regardless of the range, but only add glyphs which are in the range.

        No new tests. platform/chromium-linux/fast/text/international/draw-complex-text-from-to.html should
        work as expected once we move to use harfbuzz-ng on linux. Note that the current expectation will need to be rebaselined
        because the old hb shaper (ComplexTextController) mishandles the range. |to| should be exclusive. I'll rebaseline
        the expectation later.

        * platform/graphics/harfbuzz/FontHarfBuzz.cpp:
        (WebCore::Font::drawComplexText): Call shaper.setDrawRange().
        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp:
        (WebCore::HarfBuzzShaper::HarfBuzzShaper):
        (WebCore::HarfBuzzShaper::setDrawRange): Added.
        (WebCore):
        (WebCore::HarfBuzzShaper::shouldDrawCharacterAt): Added.
        (WebCore::HarfBuzzShaper::shapeHarfBuzzRuns): Added variables that hold pending advances.
        (WebCore::HarfBuzzShaper::setGlyphPositionsForHarfBuzzRun): Add only glyphs which are in the given range to glyphBuffer.
        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.h:
        (HarfBuzzShaper):
        * platform/graphics/mac/FontComplexTextMac.cpp:
        (WebCore::Font::drawComplexText): Call shaper.setDrawRange().

2012-07-29  Dan Bernstein  <mitz@apple.com>

        Hit testing in the gap between pages returns incorrect results in flipped blocks writing modes
        https://bugs.webkit.org/show_bug.cgi?id=92600

        Reviewed by Simon Fraser.

        Test: fast/multicol/hit-test-gap-between-pages-flipped.html

        * rendering/RenderBlock.h:
        (WebCore::RenderBlock): Promoted offsetForContents() from private to protected, and demoted
        adjustPointToColumnContents() back to private.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::hitTest): Changed to flip the point passed to updateHitTestResults().
        * rendering/RenderView.cpp:
        (WebCore::RenderView::updateHitTestResult): Changed to call offsetForContents(), which, as
        of r123977, correctly accounts for flippedness.

2012-07-29  Dan Bernstein  <mitz@apple.com>

        In flipped blocks, a point on the top edge of a text box is considered outside the box (and vice versa)
        https://bugs.webkit.org/show_bug.cgi?id=92597

        Reviewed by Ryosuke Niwa.

        This is similar to <http://webkit.org/b/92593> except for RenderText. Fixing this required
        fixing some code that creates a point inside a box by setting its y coordinate to the
        logical top of the box. In a flipped block, this would be just outside the box.

        Enhanced fast/writing-mode/flipped-blocks-hit-test-line-edges.html to cover this.

        * editing/visible_units.cpp:
        (WebCore::absoluteLineDirectionPointToLocalPointInBlock): Changed to use
        RootInlineBox::blockDirectionPointInLine in the vertical case as well.
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::positionForPointWithInlineChildren): Changed to use
        RootInlineBox::blockDirectionPointInLine.
        * rendering/RenderText.cpp:
        (WebCore::RenderText::positionForPoint): Changed the strictness of y inequalities based on
        the flippedness of the block. This fixes the bug.
        * rendering/RootInlineBox.cpp:
        (WebCore::RootInlineBox::blockDirectionPointInLine): Moved the implementation here from the
        header, and made it return the bottom in the flipped block case, so that the returned point
        is inside the line in that case as well.
        * rendering/RootInlineBox.h:

2012-07-29  Rik Cabanier  <cabanier@adobe.com>

        ENABLE_CSS_COMPOSITING flag
        https://bugs.webkit.org/show_bug.cgi?id=92553

        Reviewed by Dirk Schulze.

        Adds compiler flag CSS_COMPOSITING to build systems to enable CSS blending and compositing. See spec https://dvcs.w3.org/hg/FXTF/rawfile/tip/compositing/index.html

        * GNUmakefile.am:
        * Configurations/FeatureDefines.xcconfig:

2012-07-29  Dan Bernstein  <mitz@apple.com>

        In flipped blocks, a point on the top edge of a box is considered outside the box (and vice versa)
        https://bugs.webkit.org/show_bug.cgi?id=92593

        Reviewed by Simon Fraser.

        With respect to hit testing, boxes should always behave as half-open intervals which include
        the physical top and left edges and not the bottom and right edges.
        RenderBlock::positionForPoint was not adhering to this, since it was comparing flipped
        coordinates.

        Tests: fast/writing-mode/flipped-blocks-hit-test-box-edges.html
               fast/writing-mode/flipped-blocks-hit-test-line-edges.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::positionForPointWithInlineChildren): When blocks are flipped, changed
        strict inequalities of y coordinates into non-strict ones and non-strict inequalities into
        strict ones.
        (WebCore::RenderBlock::positionForPoint): Ditto, except for the test for being under the top
        of the last candidate box, which was made non-strict in the unflipped case and remained
        strict.

2012-07-28  Dan Bernstein  <mitz@apple.com>

        RenderBlock::offsetForContents() is wrong in flipped blocks writing modes
        https://bugs.webkit.org/show_bug.cgi?id=92588

        Reviewed by Sam Weinig.

        Tests: fast/multicol/hit-test-block-axis-flipped.html
               fast/writing-mode/flipped-blocks-hit-test-overflow-scroll.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::offsetForContents): Flip the point, which puts it back in unflipped
        coordinates, before adding the scroll offset and adjusting for columns, then flip it back.
        (WebCore::RenderBlock::adjustPointToColumnContents): Changed the inline-axis cases to
        work with an unflipped point.

2012-07-28  Dan Bernstein  <mitz@apple.com>

        In flipped lines writing modes, hit testing at the beginning of a column may return a result from the previous column
        https://bugs.webkit.org/show_bug.cgi?id=92566

        Reviewed by Simon Fraser.

        Enhanced the fix for <http://webkit.org/b/92524> to work with flipped lines.

        Extended fast/multicol/hit-test-end-of-column-with-line-height.html.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::positionForPointWithInlineChildren): For flipped lines, check if the
        hit line is the last one before a page break, and in that case, check if the hit point was
        after the break.

2012-07-28  Simon Fraser  <simon.fraser@apple.com>

        Size changes on a layer with negative z-index children don't repaint correctly
        https://bugs.webkit.org/show_bug.cgi?id=92583

        Reviewed by Dean Jackson.

        Negative z-index descendants cause a composited layer to have a separate
        layer for foreground content. If something caused that foreground layer
        to change size (like toggling visibility on a descendant), we failed to
        repaint the foreground layer, resulting in stretched content.

        Test: compositing/geometry/bounds-ignores-hidden-dynamic-negzindex.html

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Repaint the foreground
        layer if its size changes, like we do for the main layer.

2012-07-28  Simon Fraser  <simon.fraser@apple.com>

        Ignore visibility:hidden elements when computing compositing layer bounds
        https://bugs.webkit.org/show_bug.cgi?id=92569

        Reviewed by Dan Bernstein.

        When computing the bounds of compositing layers, we would take into account
        layers with no visible content (visibility:hidden, and no non-hidden descendants).
        This caused some huge layers in mobile Google maps.

        Tests: compositing/geometry/bounds-ignores-hidden-composited-descendant.html
               compositing/geometry/bounds-ignores-hidden-dynamic.html
               compositing/geometry/bounds-ignores-hidden.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::calculateLayerBounds): If the ExcludeHiddenDescendants flag is set, return
        the empty rect for layers with no visible content or descendants, as long as the layer is not
        the root of the subtree whose bounds are being computed.
        calculateLayerBounds() currently (I think incorrectly) passes the default flags to the recursive calls.
        It should probably just pass 'flags', but to make this change safe, OR in the ExcludeHiddenDescendants
        flag.
        * rendering/RenderLayer.h: Add an ExcludeHiddenDescendants flag to the CalculateLayerBoundsFlags.
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::calculateCompositedBounds): Pass the ExcludeHiddenDescendants
        flag.

2012-07-28  Min Qin  <qinmin@chromium.org>

        Add an overlay play button to media controls on android
        https://bugs.webkit.org/show_bug.cgi?id=92132

        Reviewed by Adam Barth.

        This change adds an overlay play button to the media controls for android.
        No tests for now as this setting is not being used by other port.
        Will add a test and adjust all the test expectations when we upstream the layout tests for android.

        * WebCore.gypi:
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        * css/CSSValueKeywords.in:
        * css/mediaControls.css:
        (audio::-webkit-media-controls-overlay-play-button, video::-webkit-media-controls-overlay-play-button):
        * css/mediaControlsChromiumAndroid.css:
        (audio::-webkit-media-controls-overlay-enclosure):
        (video::-webkit-media-controls-overlay-enclosure):
        (audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button):
        (video::-webkit-media-controls-overlay-play-button):
        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlOverlayPlayButtonElement::MediaControlOverlayPlayButtonElement):
        (WebCore):
        (WebCore::MediaControlOverlayPlayButtonElement::create):
        (WebCore::MediaControlOverlayPlayButtonElement::defaultEventHandler):
        (WebCore::MediaControlOverlayPlayButtonElement::updateDisplayType):
        (WebCore::MediaControlOverlayPlayButtonElement::shadowPseudoId):
        * html/shadow/MediaControlElements.h:
        (MediaControlOverlayPlayButtonElement):
        (WebCore):
        * html/shadow/MediaControlRootElementChromium.cpp:
        (WebCore::MediaControlPanelEnclosureElement::MediaControlPanelEnclosureElement):
        (WebCore::MediaControlPanelEnclosureElement::create):
        (WebCore):
        (WebCore::MediaControlPanelEnclosureElement::shadowPseudoId):
        (WebCore::MediaControlRootElementChromium::create):
        (WebCore::MediaControlRootElementChromium::initializeControls):
        * html/shadow/MediaControlRootElementChromium.h:
        (MediaControlChromiumEnclosureElement):
        (WebCore):
        (MediaControlPanelEnclosureElement):
        (MediaControlRootElementChromium):
        * html/shadow/MediaControlRootElementChromiumAndroid.cpp: Added.
        (WebCore):
        (WebCore::MediaControlOverlayEnclosureElement::MediaControlOverlayEnclosureElement):
        (WebCore::MediaControlOverlayEnclosureElement::create):
        (WebCore::MediaControlOverlayEnclosureElement::shadowPseudoId):
        (WebCore::MediaControlRootElementChromiumAndroid::MediaControlRootElementChromiumAndroid):
        (WebCore::MediaControls::create):
        (WebCore::MediaControlRootElementChromiumAndroid::create):
        (WebCore::MediaControlRootElementChromiumAndroid::setMediaController):
        (WebCore::MediaControlRootElementChromiumAndroid::playbackStarted):
        (WebCore::MediaControlRootElementChromiumAndroid::playbackStopped):
        * html/shadow/MediaControlRootElementChromiumAndroid.h: Added.
        (WebCore):
        (MediaControlOverlayEnclosureElement):
        (MediaControlRootElementChromiumAndroid):
        * platform/ThemeTypes.h:
        * rendering/RenderMediaControlsChromium.cpp:
        (WebCore::paintMediaOverlayPlayButton):
        (WebCore):
        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart):
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::paint):
        * rendering/RenderTheme.h:
        (WebCore::RenderTheme::paintMediaOverlayPlayButton):
        * rendering/RenderThemeChromiumAndroid.cpp:
        (WebCore::RenderThemeChromiumAndroid::paintMediaOverlayPlayButton):
        (WebCore):
        * rendering/RenderThemeChromiumAndroid.h:

2012-07-28  Mario Sanchez Prada  <msanchez@igalia.com>

        [GTK] Add a new and reusable enchant-based spellchecker in WebCore
        https://bugs.webkit.org/show_bug.cgi?id=90269

        Reviewed by Martin Robinson.

        Move enchant specific code down to WebCore, into a new class
        TextCheckerEnchant, that we can use from WK1 and WK2.

        * GNUmakefile.am: Add flags to handle the SPELLCHECK feature.
        * GNUmakefile.list.am: Added new files.
        * platform/text/gtk/TextCheckerEnchant.cpp: Added.
        (getAvailableDictionariesCallback):
        (TextCheckerEnchant::TextCheckerEnchant):
        (TextCheckerEnchant::~TextCheckerEnchant):
        (TextCheckerEnchant::ignoreWord):
        (TextCheckerEnchant::learnWord):
        (TextCheckerEnchant::checkSpellingOfString):
        (TextCheckerEnchant::getGuessesForWord):
        (TextCheckerEnchant::updateSpellCheckingLanguages):
        (TextCheckerEnchant::freeEnchantBrokerDictionaries):
        * platform/text/gtk/TextCheckerEnchant.h: Added.
        (WebCore):
        (TextCheckerEnchant):
        (WebCore::TextCheckerEnchant::create):

2012-07-28  Vineet Chaudhary  <rgf748@motorola.com>

        [Clamp] support in binding generator.
        https://bugs.webkit.org/show_bug.cgi?id=77605

        Reviewed by Kentaro Hara.

        Currently [Clamp] extended attribute in IDL files.
        Spec: http://www.w3.org/TR/2012/CR-WebIDL-20120419/#Clamp

        Tests: TestObj.idl

        * bindings/scripts/CodeGeneratorCPP.pm:
        (SkipFunction): Skips methods with [Clamp] parameters.
        * bindings/scripts/CodeGeneratorGObject.pm:
        (SkipFunction): Skips methods with [Clamp] parameters.
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheck): Support [Clamp] for JSBindings.
        * bindings/scripts/CodeGeneratorObjC.pm:
        (SkipFunction): Skips methods with [Clamp] parameters.
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateParametersCheck): Support [Clamp] for V8Bindings.
        * bindings/scripts/IDLAttributes.txt: Added [Clamp] to attributes list.
        * bindings/scripts/test/JS/JSTestObj.cpp: Test.
        (WebCore::jsTestObjPrototypeFunctionClassMethodWithClamp):
        * bindings/scripts/test/JS/JSTestObj.h:
        * bindings/scripts/test/TestObj.idl:
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::classMethodWithClampCallback):
        (TestObjV8Internal):

2012-07-27  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r123908.
        http://trac.webkit.org/changeset/123908
        https://bugs.webkit.org/show_bug.cgi?id=92572

        Broke Chromium Linux compile (Requested by pkasting on
        #webkit).

        * WebCore.gypi:
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        * css/CSSValueKeywords.in:
        * css/mediaControls.css:
        * css/mediaControlsChromiumAndroid.css:
        (audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button):
        * html/shadow/MediaControlElements.cpp:
        (WebCore):
        * html/shadow/MediaControlElements.h:
        (WebCore):
        * html/shadow/MediaControlRootElementChromium.cpp:
        (WebCore::MediaControlChromiumEnclosureElement::create):
        (WebCore):
        (WebCore::MediaControlChromiumEnclosureElement::shadowPseudoId):
        (WebCore::MediaControls::create):
        (WebCore::MediaControlRootElementChromium::create):
        * html/shadow/MediaControlRootElementChromium.h:
        (MediaControlChromiumEnclosureElement):
        (MediaControlRootElementChromium):
        * html/shadow/MediaControlRootElementChromiumAndroid.cpp: Removed.
        * html/shadow/MediaControlRootElementChromiumAndroid.h: Removed.
        * platform/ThemeTypes.h:
        * rendering/RenderMediaControlsChromium.cpp:
        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart):
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::paint):
        * rendering/RenderTheme.h:
        * rendering/RenderThemeChromiumAndroid.cpp:
        * rendering/RenderThemeChromiumAndroid.h:

2012-07-27  Eli Fidler  <efidler@rim.com>

        [BlackBerry] Use new LocaleHandler.
        https://bugs.webkit.org/show_bug.cgi?id=92548

        Reviewed by Yong Li.

        RIM PR 128381

        * platform/blackberry/LocalizedStringsBlackBerry.cpp:
        (WebCore::platformLanguage):
        * platform/network/blackberry/ResourceRequestBlackBerry.cpp:
        (WebCore::ResourceRequest::initializePlatformRequest):
        * platform/text/blackberry/TextBreakIteratorInternalICUBlackBerry.cpp:
        (WebCore::currentSearchLocaleID):
        (WebCore::currentTextBreakLocaleID):

2012-07-27  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Change constructor with explicit constructor in WebCore/Modules
        https://bugs.webkit.org/show_bug.cgi?id=92529

        Reviewed by Kentaro Hara.

        As a step to let *explicit* keyword add to constructors which have a parameter,
        *explicit* keyword is added to Source/WebCore/Modules in order to avoid implicit
        type conversion.

        No new tests. Covered by existing tests.

        * Modules/filesystem/LocalFileSystem.h:
        (WebCore::LocalFileSystem::LocalFileSystem):
        * Modules/filesystem/Metadata.h:
        (WebCore::Metadata::Metadata):
        * Modules/filesystem/SyncCallbackHelper.h:
        (WebCore::SyncCallbackHelper::SuccessCallbackImpl::SuccessCallbackImpl):
        (WebCore::SyncCallbackHelper::ErrorCallbackImpl::ErrorCallbackImpl):
        * Modules/mediastream/IceCandidate.h:
        (IceCandidate):
        * Modules/mediastream/NavigatorUserMediaError.h:
        (WebCore::NavigatorUserMediaError::NavigatorUserMediaError):
        * Modules/mediastream/SessionDescription.h:
        (SessionDescription):
        * Modules/mediastream/UserMediaController.h:
        (UserMediaController):
        * Modules/notifications/NotificationController.h:
        (NotificationController):
        * Modules/speech/SpeechRecognition.h:
        (SpeechRecognition):
        * Modules/speech/SpeechRecognitionController.h:
        (SpeechRecognitionController):
        * Modules/speech/SpeechRecognitionEvent.h:
        (SpeechRecognitionEvent):
        * Modules/speech/SpeechRecognitionResultList.h:
        (SpeechRecognitionResultList):
        * Modules/vibration/Vibration.h:
        (Vibration):
        * Modules/webaudio/AudioBuffer.h:
        (AudioBuffer):
        * Modules/webaudio/AudioContext.h:
        (AudioContext):
        * Modules/webaudio/AudioNodeInput.h:
        (AudioNodeInput):
        * Modules/webaudio/AudioSummingJunction.h:
        (AudioSummingJunction):
        * Modules/webaudio/BiquadDSPKernel.h:
        (WebCore::BiquadDSPKernel::BiquadDSPKernel):
        * Modules/webaudio/DefaultAudioDestinationNode.h:
        (DefaultAudioDestinationNode):
        * Modules/webaudio/DelayDSPKernel.h:
        (DelayDSPKernel):
        * Modules/webaudio/OfflineAudioCompletionEvent.h:
        (OfflineAudioCompletionEvent):
        * Modules/webaudio/WaveShaperDSPKernel.h:
        (WebCore::WaveShaperDSPKernel::WaveShaperDSPKernel):
        * Modules/webaudio/WaveShaperNode.h:
        (WaveShaperNode):
        * Modules/webaudio/WaveTable.h:
        (WaveTable):
        * Modules/webdatabase/DatabaseAuthorizer.h:
        (DatabaseAuthorizer):
        * Modules/webdatabase/DatabaseTask.h:
        (Database::DatabaseTransactionTask):
        * Modules/webdatabase/DatabaseTracker.h:
        (DatabaseTracker):
        * Modules/webdatabase/SQLCallbackWrapper.h:
        (WebCore::SQLCallbackWrapper::SafeReleaseTask::SafeReleaseTask):
        * Modules/webdatabase/SQLException.h:
        (WebCore::SQLException::SQLException):
        * Modules/websockets/WebSocket.h:
        * Modules/websockets/WebSocketExtensionProcessor.h:
        (WebCore::WebSocketExtensionProcessor::WebSocketExtensionProcessor):

2012-07-27  Kentaro Hara  <haraken@chromium.org>

        [V8] Optimize Element::getAttributeNS() by replacing String with AtomicString
        https://bugs.webkit.org/show_bug.cgi?id=90276

        Reviewed by Adam Barth.

        In r121439, we changed the argument type of Element::getAttribute()
        from String to AtomicString for optimization. This patch changes the
        argument type of Element::getAttributeNS() from String to AtomicString.

        Actually this change affects V8 performance only.

        [JSC without the patch]
        The binding code converts a given JavaScript string to a String
        -> the String is passed to getAttributeNS()
        -> the String is converted to an AtomicString when it is passed to
        QualifiedName() constructor.

        [JSC with the patch]
        The binding code converts a given JavaScript string to a String
        -> the String is converted to an AtomicString when it is passed to
        getAttributeNS()
        -> the AtomicString is passed to QualifiedName() constructor.

        [V8 without the patch]
        The binding code retrieves a cached external String for a given
        JavaScript string
        -> the String is passed to getAttributeNS()
        -> the String is converted to AtomicString when it is passed to
        QualifiedName() constructor.

        [V8 with the patch]
        The binding code retrieves a cached external AtomicString for a given
        JavaScript string
        -> the AtomicString is passed to getAttributeNS()
        -> the AtomicString is passed to QualifiedName() constructor.

        In this way, in JSC, the change affects where a String is converted to
        an AtomicString. On the other hand, in V8, (since the AtomicString is already
        cached,) we can skip the conversion step.

        Performance test: https://bugs.webkit.org/attachment.cgi?id=150158

        getAttributeNS (Chromium/Linux):
        577.80ms => 454.60ms

        * dom/Element.cpp:
        (WebCore::Element::getAttributeNS):
        * dom/Element.h:
        (Element):

2012-07-27  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r123679.
        http://trac.webkit.org/changeset/123679
        https://bugs.webkit.org/show_bug.cgi?id=92565

        Slowed down HTML parsing by 3.6% (Requested by abarth on
        #webkit).

        * html/FTPDirectoryDocument.cpp:
        (WebCore::FTPDirectoryDocumentParser::append):
        * html/parser/HTMLEntityParser.cpp:
        (WebCore::HTMLEntityParser::consumeNamedEntity):
        * html/parser/HTMLParserIdioms.cpp:
        (WebCore::stripLeadingAndTrailingHTMLSpaces):
        * html/parser/HTMLSourceTracker.cpp:
        (WebCore::HTMLSourceTracker::sourceForToken):
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::script):
        * platform/text/SegmentedString.cpp:
        (WebCore::SegmentedString::SegmentedString):
        (WebCore::SegmentedString::operator=):
        (WebCore::SegmentedString::clear):
        (WebCore::SegmentedString::append):
        (WebCore::SegmentedString::prepend):
        (WebCore::SegmentedString::advanceSubstring):
        (WebCore::SegmentedString::advance):
        (WebCore::SegmentedString::advanceSlowCase):
        (WebCore::SegmentedString::advanceAndUpdateLineNumberSlowCase):
        * platform/text/SegmentedString.h:
        (WebCore::SegmentedSubstring::SegmentedSubstring):
        (WebCore::SegmentedSubstring::clear):
        (WebCore::SegmentedSubstring::appendTo):
        (SegmentedSubstring):
        (WebCore::SegmentedString::SegmentedString):
        (WebCore::SegmentedString::push):
        (WebCore::SegmentedString::isEmpty):
        (WebCore::SegmentedString::lookAhead):
        (WebCore::SegmentedString::lookAheadIgnoringCase):
        (WebCore::SegmentedString::advance):
        (WebCore::SegmentedString::advanceAndASSERT):
        (WebCore::SegmentedString::advanceAndASSERTIgnoringCase):
        (WebCore::SegmentedString::advancePastNewlineAndUpdateLineNumber):
        (SegmentedString):
        (WebCore::SegmentedString::advancePastNonNewline):
        (WebCore::SegmentedString::advanceAndUpdateLineNumber):
        (WebCore::SegmentedString::operator*):
        (WebCore::SegmentedString::operator->):
        (WebCore::SegmentedString::current):
        (WebCore::SegmentedString::equalsLiterally):
        (WebCore::SegmentedString::equalsIgnoringCase):
        (WebCore::SegmentedString::lookAheadInline):
        (WebCore::SegmentedString::lookAheadSlowCase):
        * xml/parser/CharacterReferenceParserInlineMethods.h:
        (WebCore::consumeCharacterReference):
        * xml/parser/MarkupTokenizerBase.h:
        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::nextInputCharacter):
        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::peek):
        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::advance):

2012-07-27  Jer Noble  <jer.noble@apple.com>

        Reset the set of "seen" plugins when the main frame load is committed.
        https://bugs.webkit.org/show_bug.cgi?id=92564

        Reviewed by Anders Carlsson.

        Because the Page object is re-used across navigation and reload, reset the list
        of seen plugins when the main frame load commits. This gives a good baseline to
        compare against the number of pages loaded.

        No new tests; the "seen" plugin list is for diagnostic purposes only.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::dispatchDidCommitLoad):
        * page/Page.cpp:
        (WebCore::Page::resetSeenPlugins):
        * page/Page.h:

2012-07-27  Sukolsak Sakshuwong  <sukolsak@google.com>

        execCommand copies the backgroung-color of the enclosing element to the element being edited.
        https://bugs.webkit.org/show_bug.cgi?id=91783

        Reviewed by Ryosuke Niwa.

        InsertListCommand and some other edit commands remove redundant
        style properties after their DOM modification by using
        StylePropertySet::removeEquivalentProperties.  However, this method
        does not remove redundant background-color properties such as
        "background-color: white" and "background-color: #fff" because
        it compares them using cssText and thus treats them as different.
        Add code to convert background colors to RGBA and then compare them.

        Test: editing/style/redundant-background-color.html

        * editing/EditingStyle.cpp:
        (WebCore::getRGBABackgroundColor):
        (WebCore):
        (WebCore::getPropertiesNotIn):

2012-07-27  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        [EFL] Return 0 when network is offline
        https://bugs.webkit.org/show_bug.cgi?id=92454

        Reviewed by Kenneth Rohde Christiansen.

        Network Info latest spec says 0 is returned when network is offline.
        r123769 modified to return infinity value when network is offiline.

        * platform/efl/NetworkInfoProviderEfl.cpp:
        (WebCore::NetworkInfoProviderEfl::bandwidth):

2012-07-27  Scott Graham  <scottmg@chromium.org>

        Change navigator.webkitGamepads[] to navigator.webkitGetGamepads()
        https://bugs.webkit.org/show_bug.cgi?id=92533

        Reviewed by Adam Barth.

        Per discussion on public-webapps. Pages that enumerate navigator were
        causing background resources to be created to poll hardware
        unintentionally. By changing to an explicit function call, this is
        avoided (and the API becomes more clear too). This change updates the
        implementation to match the current ED spec.

        * Modules/gamepad/NavigatorGamepad.cpp:
        (WebCore::NavigatorGamepad::webkitGetGamepads):
        * Modules/gamepad/NavigatorGamepad.h:
        (NavigatorGamepad):
        * Modules/gamepad/NavigatorGamepad.idl:
        * bindings/generic/RuntimeEnabledFeatures.h:
        (WebCore::RuntimeEnabledFeatures::setWebkitGetGamepadsEnabled):
        (WebCore::RuntimeEnabledFeatures::webkitGetGamepadsEnabled):

2012-07-27  Brady Eidson  <beidson@apple.com>

        Plugins should not be allowed to override standard properties/attributes in non-standard worlds
        <rdar://problem/11975252> and https://bugs.webkit.org/show_bug.cgi?id=92519

        Reviewed by Anders Carlsson.

        Change the 3 plugin-owning element's custom bindings to prefer built-in properties if they exist.
        When they do they don't give the plugin a chance to override.

        Test: plugins/npruntime/overrides-all-properties.html

        Add plugin custom functions to prefer built-in properties over plugin scriptable object properties:
        * bindings/js/JSPluginElementFunctions.h:
        (WebCore::pluginElementCustomGetOwnPropertySlot):
        (WebCore::pluginElementCustomGetOwnPropertyDescriptor):

        Use those new custom functions for getting properties:
        * bindings/js/JSHTMLAppletElementCustom.cpp:
        (WebCore::JSHTMLAppletElement::getOwnPropertySlotDelegate):
        (WebCore::JSHTMLAppletElement::getOwnPropertyDescriptorDelegate):
        * bindings/js/JSHTMLEmbedElementCustom.cpp:
        (WebCore::JSHTMLEmbedElement::getOwnPropertySlotDelegate):
        (WebCore::JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate):
        * bindings/js/JSHTMLObjectElementCustom.cpp:
        (WebCore::JSHTMLObjectElement::getOwnPropertySlotDelegate):
        (WebCore::JSHTMLObjectElement::getOwnPropertyDescriptorDelegate):

2012-07-27  Arnaud Renevier  <a.renevier@sisa.samsung.com>

        use createUninitialized when creating TypedArray from another array
        https://bugs.webkit.org/show_bug.cgi?id=92518

        Reviewed by Kenneth Russell.

        When creating a Typed Array from another array, we fill it with values
        from the source array. So, we can create it uninitialized. This is
        make constructor about 35% faster when constructed with another typed
        array.

        Test: fast/canvas/webgl/array-constructor.html

        * bindings/js/JSArrayBufferViewHelper.h:
        (WebCore::constructArrayBufferViewWithTypedArrayArgument):
        (WebCore::constructArrayBufferView):

2012-07-27  Eli Fidler  <efidler@rim.com>

        [BlackBerry] Adapt to change in the FontInfo platform API.
        https://bugs.webkit.org/show_bug.cgi?id=92547

        Reviewed by Yong Li

        RIM PR 161263

        * page/blackberry/SettingsBlackBerry.cpp:
        (WebCore::Settings::initializeDefaultFontFamilies):

2012-07-27  Antoine Labour  <piman@chromium.org>

        [chromium] Fix color matrix filter computation so that filters that don't need clamping are correctly detected as such
        https://bugs.webkit.org/show_bug.cgi?id=92452

        Reviewed by Stephen White.

        Because of precision issues, some filters were returning true to
        matrixNeedsClamping when they can return false. This fixes it.

        No new tests in this CL, a follow-up change refactors the code to add
        several tests.

        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:

2012-07-27  Jer Noble  <jer.noble@apple.com>

        Add diagnostic logging for plugins-per-page.
        https://bugs.webkit.org/show_bug.cgi?id=92538

        Reviewed by Anders Carlsson.

        Add some diagnostic logging for whether a page has seen a plugin, and 
        whether a page has seen a plugin of a specific type.

        Move the diagnostic logging out of the elemements themselves:
        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::updateWidget):
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::updateWidget):

        Instead, log when the plugin is requested, thereby catching plugins which are
        rejected because, e.g., Java is disabled or not installed:
        * loader/SubframeLoader.cpp:
        (WebCore::logPluginRequest):
        (WebCore::SubframeLoader::requestObject):
        (WebCore::SubframeLoader::createJavaAppletWidget):

        Add new diagnostic key values:
        * page/DiagnosticLoggingKeys.cpp:
        (WebCore::DiagnosticLoggingKeys::pageContainsPluginKey):
        (WebCore::DiagnosticLoggingKeys::pageContainsAtLeastOnePluginKey):
        * page/DiagnosticLoggingKeys.h:

        Add a map of plugin types seen per-page for diagnostic purposes:
        * page/Page.cpp:
        (WebCore::Page::hasSeenAnyPlugin):
        (WebCore::Page::hasSeenPlugin):
        (WebCore::Page::sawPlugin):
        * page/Page.h:

2012-07-27  Patrick Gansterer  <paroga@webkit.org>

        [WINCE] Use macros from ICU instead of defining the same functionality again
        https://bugs.webkit.org/show_bug.cgi?id=92530

        Reviewed by Ryosuke Niwa.

        Replace isHighSurrogate() with U16_IS_LEAD(), isLowSurrogate() with
        U16_IS_TRAIL() and surrogateToUcs4() with U16_GET_SUPPLEMENTARY().

        * html/FTPDirectoryDocument.cpp:
        (WebCore::processFileDateString):
        * loader/archive/mhtml/MHTMLArchive.cpp:
        (WebCore::MHTMLArchive::generateMHTMLData):
        * platform/graphics/wince/FontWinCE.cpp:
        (WebCore::generateComponents):

2012-07-27  Christophe Dumez  <christophe.dumez@intel.com>

        Build warning in CSSPrimitiveValueMappings.h when CSS_STICKY_POSITION is disabled
        https://bugs.webkit.org/show_bug.cgi?id=92523

        Reviewed by Simon Fraser.

        Move #ifdef in CSSPrimitiveValueMappings.h to silent compilation warning
        when CSS_STICKY_POSITION is disabled.

        No new tests, no behavior change.

        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):

2012-07-27  Vivek Galatage  <vivekgalatage@gmail.com>

        DragController should ascertain dragClient to be non-null
        https://bugs.webkit.org/show_bug.cgi?id=92474

        Reviewed by Tony Chang.

        The DragController must always ensure a valid dragClient object. Hence
        adding the ASSERT to assure that.

        No new tests. Added assertion for PageClient.dragClient.

        * page/DragController.cpp:
        (WebCore::DragController::DragController):

2012-07-27  Adrienne Walker  <enne@google.com>

        [chromium] Clean up LayerRendererChromium::drawTexturedQuad
        https://bugs.webkit.org/show_bug.cgi?id=91823

        Reviewed by James Robinson.

        LayerRendererChromium::drawTexturedQuad has been around forever and
        over time has developed several problems:
         - Confusingly named relative to drawTextureQuad
         - All but one callers identically manipulate the transform matrix
         - Lots of optional parameters that only few functions use

        This patch breaks up drawTexturedQuad into setShaderOpacity (for
        optional opacity values sent to the shader), setShaderFloatQuad (the
        full FloatQuad used by AA shaders), and drawQuadGeometry (actually
        draw the geometry, and wrap the transform logic that was duplicated
        everywhere).

        No new tests; no change in functionality.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawCheckerboardQuad):
        (WebCore::LayerRendererChromium::drawBackgroundFilters):
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
        (WebCore::LayerRendererChromium::drawSolidColorQuad):
        (WebCore::LayerRendererChromium::drawTileQuad):
        (WebCore::LayerRendererChromium::drawYUVVideoQuad):
        (WebCore::LayerRendererChromium::drawStreamVideoQuad):
        (WebCore::LayerRendererChromium::drawTextureQuad):
        (WebCore::LayerRendererChromium::drawIOSurfaceQuad):
        (WebCore::LayerRendererChromium::drawHeadsUpDisplay):
        (WebCore::LayerRendererChromium::setShaderFloatQuad):
        (WebCore::LayerRendererChromium::setShaderOpacity):
        (WebCore::LayerRendererChromium::drawQuadGeometry):
        (WebCore::LayerRendererChromium::copyTextureToFramebuffer):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):

2012-07-27  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] CCLayerTreeHost placeholder scissor should be deviceViewportSize instead of viewportSize
        https://bugs.webkit.org/show_bug.cgi?id=92469

        Reviewed by Adrienne Walker.

        We were accidentally using viewportSize instead of
        deviceViewportSize in a particular place in code. Recent
        refactoring to use tighter scissor rects exposed this problem.

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::updateLayers):

2012-07-27  Kevin Ellis  <kevers@chromium.org>

        Search cancel button is hard to activate with a tap gesture even if touch adjustment is enabled.
        https://bugs.webkit.org/show_bug.cgi?id=91894

        Reviewed by Antonio Gomes.

        Update check for determining if a node responds to tap gestures.
        Previously, the cancel button was being discarded as a candidate for
        touch adjustment if the touch area clipped the text input region
        because the candidate pruning process failed to account for the cancel
        button having a default mouse handler.  Possibly an interim fix,
        depending on resolution to 92093.

        Test: touchadjustment/search-cancel.html

        * page/TouchAdjustment.cpp:
        (TouchAdjustment):
        (WebCore::TouchAdjustment::nodeRespondsToTapGesture):

2012-07-27  Varun Jain  <varunjain@chromium.org>

        Animated SVGs do not clear previous frame completely in hidpi mode.
        https://bugs.webkit.org/show_bug.cgi?id=92395

        Reviewed by Darin Adler.

        The rect thats is cleared in subsequent frames needed to be scaled with device scale.

        Test: svg/as-image/animated-svg-repaints-completely-in-hidpi.html

        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::drawSVGToImageBuffer):

2012-07-27  Scott Graham  <scottmg@chromium.org>

        Fix COMPILE_ASSERT for InlineFlowBox growing
        https://bugs.webkit.org/show_bug.cgi?id=92541

        Reviewed by Dan Bernstein.

        Use unsigned instead of bool to keep size small on Windows.

        No new tests.

        * rendering/InlineFlowBox.h:
        (InlineFlowBox):

2012-07-27  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=92327
        -webkit-background-clip:text is blurry in WebKit 1 apps when
        deviceScaleFactor > 1
        -and corresponding-
        <rdar://problem/11683788>

        Reviewed by Simon Fraser.

        The bug here is that the code to make createCompatibleBuffer() HiDPI-savvy 
        assumed that the deviceScaleFactor would always be baked into the CTM of the
        GraphicsContext. But that is NOT the case in WebKit 1.

        createCompatibleBuffer() is used for clip text and gradients.

        Now getCTM() takes a parameter indicating whether the result should definitely
        include the device scale, or if it should possibly included the device scale, 
        which is the option that matches old behavior.
        * platform/graphics/GraphicsContext.h:
        (GraphicsContext):
        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::getCTM):
        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
        (WebCore::GraphicsContext::getCTM):
        * platform/graphics/qt/GraphicsContextQt.cpp:
        (WebCore::GraphicsContext::getCTM):
        * platform/graphics/skia/GraphicsContextSkia.cpp:
        (WebCore::GraphicsContext::getCTM):
        * platform/graphics/wince/GraphicsContextWinCE.cpp:
        (WebCore::GraphicsContext::getCTM):
        * platform/graphics/wx/GraphicsContextWx.cpp:
        (WebCore::GraphicsContext::getCTM):

        Actually use the new parameter in the CG implementation. Use CG API to get a
        matrix that definitely includes the device scale when that is required. 
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::getCTM):

        Remove some symbol cruft that doesn't seem to require a replacement.
        * WebCore.exp.in:

        Use DefinitelyIncludeDeviceScale when getting the CTM in the buggy spot.
        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::createCompatibleBuffer):

        The ImageBuffer for gradients is created using createCompatibleBuffer(), and since 
        createCompatibleBuffer() now uses getCTM(DefinitelyIncludeDeviceScale) to 
        determine appropriate sizing, drawPattern() should use that same matrix to 
        determine pattern sizing.
        * platform/graphics/GeneratorGeneratedImage.cpp:
        (WebCore::GeneratorGeneratedImage::drawPattern):

2012-07-27  Tony Chang  <tony@chromium.org>

        flex-wrap: wrap not wrapping for % sized items in column flow
        https://bugs.webkit.org/show_bug.cgi?id=92324

        Reviewed by Ojan Vafai.

        We were using trying to use the value of contentLogicalHeight() before having called computeLogicalHeight()
        in a few places. Fix this in mainAxisContentExtent() rather than at the callers.

        Test: css3/flexbox/percentage-heights.html

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::mainAxisContentExtent):
        (WebCore::RenderFlexibleBox::preferredMainAxisContentExtentForChild): If we haven't called computeLogicalHeight, we try to compute
        the height based on the fixed flexbox value. min/max don't matter here since percent values are only based on height/width.
        * rendering/RenderFlexibleBox.h: Drop const because computeContentLogicalHeightUsing is not const. I can
        try making computeContentLogicalHeightUsing const in a follow up change (might be non-trivial).

2012-07-27  Min Qin  <qinmin@chromium.org>

        Add an overlay play button to media controls on android
        https://bugs.webkit.org/show_bug.cgi?id=92132

        Reviewed by Adam Barth.

        This change adds an overlay play button to the media controls for android.
        No tests for now as this setting is not being used by other port.
        Will add a test and adjust all the test expectations when we upstream the layout tests for android.

        * WebCore.gypi:
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        * css/CSSValueKeywords.in:
        * css/mediaControls.css:
        (audio::-webkit-media-controls-overlay-play-button, video::-webkit-media-controls-overlay-play-button):
        * css/mediaControlsChromiumAndroid.css:
        (audio::-webkit-media-controls-overlay-enclosure):
        (video::-webkit-media-controls-overlay-enclosure):
        (audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button):
        (video::-webkit-media-controls-overlay-play-button):
        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlOverlayPlayButtonElement::MediaControlOverlayPlayButtonElement):
        (WebCore):
        (WebCore::MediaControlOverlayPlayButtonElement::create):
        (WebCore::MediaControlOverlayPlayButtonElement::defaultEventHandler):
        (WebCore::MediaControlOverlayPlayButtonElement::updateDisplayType):
        (WebCore::MediaControlOverlayPlayButtonElement::shadowPseudoId):
        * html/shadow/MediaControlElements.h:
        (MediaControlOverlayPlayButtonElement):
        (WebCore):
        * html/shadow/MediaControlRootElementChromium.cpp:
        (WebCore::MediaControlPanelEnclosureElement::MediaControlPanelEnclosureElement):
        (WebCore::MediaControlPanelEnclosureElement::create):
        (WebCore):
        (WebCore::MediaControlPanelEnclosureElement::shadowPseudoId):
        (WebCore::MediaControlRootElementChromium::create):
        (WebCore::MediaControlRootElementChromium::initializeControls):
        * html/shadow/MediaControlRootElementChromium.h:
        (MediaControlChromiumEnclosureElement):
        (WebCore):
        (MediaControlPanelEnclosureElement):
        (MediaControlRootElementChromium):
        * html/shadow/MediaControlRootElementChromiumAndroid.cpp: Added.
        (WebCore):
        (WebCore::MediaControlOverlayEnclosureElement::MediaControlOverlayEnclosureElement):
        (WebCore::MediaControlOverlayEnclosureElement::create):
        (WebCore::MediaControlOverlayEnclosureElement::shadowPseudoId):
        (WebCore::MediaControlRootElementChromiumAndroid::MediaControlRootElementChromiumAndroid):
        (WebCore::MediaControls::create):
        (WebCore::MediaControlRootElementChromiumAndroid::create):
        (WebCore::MediaControlRootElementChromiumAndroid::setMediaController):
        (WebCore::MediaControlRootElementChromiumAndroid::playbackStarted):
        (WebCore::MediaControlRootElementChromiumAndroid::playbackStopped):
        * html/shadow/MediaControlRootElementChromiumAndroid.h: Added.
        (WebCore):
        (MediaControlOverlayEnclosureElement):
        (MediaControlRootElementChromiumAndroid):
        * platform/ThemeTypes.h:
        * rendering/RenderMediaControlsChromium.cpp:
        (WebCore::paintMediaOverlayPlayButton):
        (WebCore):
        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart):
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::paint):
        * rendering/RenderTheme.h:
        (WebCore::RenderTheme::paintMediaOverlayPlayButton):
        * rendering/RenderThemeChromiumAndroid.cpp:
        (WebCore::RenderThemeChromiumAndroid::paintMediaOverlayPlayButton):
        (WebCore):
        * rendering/RenderThemeChromiumAndroid.h:

2012-07-27  Anders Carlsson  <andersca@apple.com>

        Show the unavailable plug-in indicator for Java applets as well
        https://bugs.webkit.org/show_bug.cgi?id=92521

        Reviewed by Sam Weinig.

        Now that <applet> behaves more like <embed> and <object>, make sure that we show the unavailable plug-in indicator
        and call the correct error callbacks if we fail to instantiate the plug-in.

        * WebCore.exp.in:
        Export a symbol needed by WebKit2.

        * html/HTMLAppletElement.cpp:
        (WebCore::HTMLAppletElement::HTMLAppletElement):
        Set the correct service type.

        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::createJavaAppletWidget):
        Enable the unavailable plug-in indicator if we fail to create the java applet widget.

2012-07-27  Dan Bernstein  <mitz@apple.com>

        Hit testing near a column break can return a result from an adjacent column when there is leading
        https://bugs.webkit.org/show_bug.cgi?id=92524

        Reviewed by Anders Carlsson.

        The fix for <http://webkit.org/b/92311> relied on the existence of a pagination strut for
        detecting that a line was at the beginning of a new column. However, when a line naturally
        falls at the beginning of a column, there is no pagination strut, and the check failed.

        Test: fast/multicol/hit-test-end-of-column-with-line-height.html

        * rendering/InlineFlowBox.h:
        (WebCore::InlineFlowBox::InlineFlowBox): Added initializer for new member variable.
        (InlineFlowBox): Added m_isFirstAfterPageBreak member variable.
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::positionForPointWithInlineChildren): Changed the test for whether a
        line was at the beginning of a column from relying on a pagination strut to checking
        isFirstAfterPageBreak(). Also refined the hit test itself to include the leading above such
        a line.
        (WebCore::RenderBlock::adjustLinePositionForPagination): Added calls to
        setIsFirstAfterPageBreak() to first reset this flag, then set it to true if necessary.
        * rendering/RootInlineBox.h:
        (WebCore::RootInlineBox::isFirstAfterPageBreak): Added this accessor.
        (WebCore::RootInlineBox::setIsFirstAfterPageBreak): Ditto.

2012-07-27  John J. Barton  <johnjbarton@johnjbarton.com>

        Web Inspector: Allow front_end to be loaded into an iframe
        https://bugs.webkit.org/show_bug.cgi?id=92437

        Reviewed by Pavel Feldman.

        This change only affects 'embedders' of the inspector/front_end. No change of function for WebKit ports.

        * inspector/front-end/ExtensionAPI.js: 
        Replace window.top with window.parent two places. When WebInspector is loaded as the main window content, 
        then extension iframes have window.top === window.parent; when WebInspector is loaded as an iframe, then
        extensions are iframes in iframes and we need to use a relative address window.parent.
        (injectedExtensionAPI.ExtensionViewImpl.dispatchShowEvent):
        (injectedExtensionAPI.ExtensionViewImpl):
        (injectedExtensionAPI.ExtensionServerClient):
        WebKit/chromium/scripts/generate_devtools_extension_api.py:
        The current number of frames is used in a dynamically created identifier. Again we replace 'top' by 
        window.parent.

2012-07-27  John J. Barton  <johnjbarton@johnjbarton.com>

        Web Inspector: Allow front_end to be loaded into an iframe
        https://bugs.webkit.org/show_bug.cgi?id=92437

        Reviewed by Pavel Feldman.

        This change only affects 'embedders' of the inspector/front_end. No change of function for WebKit ports.

        * inspector/front-end/ExtensionAPI.js: 
        Replace window.top with window.parent two places. When WebInspector is loaded as the main window content, 
        then extension iframes have window.top === window.parent; when WebInspector is loaded as an iframe, then
        extensions are iframes in iframes and we need to use a relative address window.parent.
        (injectedExtensionAPI.ExtensionViewImpl.dispatchShowEvent):
        (injectedExtensionAPI.ExtensionViewImpl):
        (injectedExtensionAPI.ExtensionServerClient):
        WebKit/chromium/scripts/generate_devtools_extension_api.py:
        The current number of frames is used in a dynamically created identifier. Again we replace 'top' by 
        window.parent.

2012-07-27  Vivek Galatage  <vivekgalatage@gmail.com>

        Web Inspector: InspectorPageAgent should ascertain document to be non-null in updateViewMetrics()
        https://bugs.webkit.org/show_bug.cgi?id=92476

        Reviewed by Pavel Feldman.

        InspectorPageAgent should check for document object being null. As pages created with blank URL might
        not have the document object, this causes a crash.

        No new tests as added null check.

        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::updateViewMetrics):

2012-07-27  Mike West  <mkwst@chromium.org>

        CSP directives containing invalid characters should log an error.
        https://bugs.webkit.org/show_bug.cgi?id=92487

        Reviewed by Adam Barth.

        Unknown directive names are currently logged, but we exit the directive
        parser early without logging if we hit an invalid character inside a
        directive. `script-src: ...`, for example, was ignored without letting
        the developer know what happened. This patch changes that behavior,
        logging the whole name (in this case `script-src:`) as an unknown
        directive.

        Test: http/tests/security/contentSecurityPolicy/directive-parsing-04.html

        * page/ContentSecurityPolicy.cpp:
        (WebCore::CSPDirectiveList::parseDirective):

2012-07-27  No'am Rosenthal  <noam.rosenthal@nokia.com>

        [Texmap] Performance regression in texture uploads after r121223
        https://bugs.webkit.org/show_bug.cgi?id=91897

        Reviewed by Jocelyn Turcotte.

        Rolling out r121223, with some conflict fixes.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::swizzleBGRAToRGBA):
        (WebCore):
        (WebCore::driverSupportsBGRASwizzling):
        (WebCore::BitmapTextureGL::didReset):
        (WebCore::BitmapTextureGL::updateContents):

2012-07-27  Joe Mason  <jmason@rim.com>

        [BlackBerry] Update NetworkJob::sendRequestWithCredentials to use new getProxyAddress API
        https://bugs.webkit.org/show_bug.cgi?id=92457

        Reviewed by Yong Li.

        getProxyAddress now returns "host:port", and getProxyPort is gone. Update NetworkJob to use
        the new interface.

        RIM PR: 176166
        Internally reviewed by Jonathan Dong <jonathan.dong@torchmobile.com.cn>

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::sendRequestWithCredentials):

2012-07-27  Kevin Ellis  <kevers@chromium.org>

        Improve touch adjustment for targetting small controls.
        https://bugs.webkit.org/show_bug.cgi?id=92293

        Reviewed by Antonio Gomes.

        Modifies the touch adjustment algorithm to better discriminate small targets without introducing
        a bias towards shorter links.  The revised scoring algorihtm uses a normalized distance to
        center-line score and a normalized overlap score.  The better of the two scores is used for
        determining the best candidate for target adjustment.  The center-line score works well
        for discriminating elements with partial overlaps, where relying solely on percent overlap
        could bias towards the smaller element.  Conversely, a high percentage in overlap provides a 
        strong measure of confidence in a candidate target.  An additonal tie-break algorithm is
        introduced to minimize the adjustment distance if two equally suitable candidates are found.

        Test: touchadjustment/small-target-test.html

        * page/TouchAdjustment.cpp:
        (TouchAdjustment):
        (WebCore::TouchAdjustment::nodeRespondsToTapGesture):
        (WebCore::TouchAdjustment::hybridDistanceFunction):
        (WebCore::TouchAdjustment::findNodeWithLowestDistanceMetric):
        (WebCore::findBestClickableCandidate):

2012-07-27  Kevin Ellis  <kevers@chromium.org>

        [chromium] Calendar for input type=date should be larger on devices that support touch input.
        https://bugs.webkit.org/show_bug.cgi?id=92424

        Reviewed by Kent Tamura.

        Adds touch specific CSS rules to enlarge entries in the calendar on
        screens that support touch input.

        Manually tested with touch support enabled/disabled.

        * Resources/calendarPicker.css:
        (@media (pointer:coarse)):
        * html/shadow/CalendarPickerElement.cpp:
        (WebCore::CalendarPickerElement::contentSize):

2012-07-28  Chris Fleizach  <cfleizach@apple.com>

        WebKit should expose @title as label (AXTitle or AXDescription) sometimes instead of AXHelp, according to the ARIA text alt computation
        https://bugs.webkit.org/show_bug.cgi?id=91911

        Reviewed by Darin Adler.

        Update comments around code to explain rationale.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::helpText):
        (WebCore::AccessibilityRenderObject::accessibilityDescription):

2012-07-27  Zoltan Horvath  <zoltan@webkit.org>

        Add runtime flag to enable/disable JS memory information
        https://bugs.webkit.org/show_bug.cgi?id=92479

        Reviewed by Simon Hausmann.

        We need console.memory JS object to be accessible because of the memory consumption
        measurements of the performance tests, so I added a toggle to InternalSettings.

        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::setMemoryInfoEnabled):
        (WebCore):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-07-27  Arko Saha  <arko@motorola.com>

        Microdata: Remove toJs() and toV8Object() custom methods from JSHTMLElementCustom.cpp and V8HTMLElementCustom.cpp respectively.
        https://bugs.webkit.org/show_bug.cgi?id=92482

        Reviewed by Kentaro Hara.

        Removed custom methods toJS() and toV8Object(). We should use toJS() method defined in
        JSMicroDataItemValueCustom.cpp and toV8() method defined in V8MicroDataItemValueCustom.cpp
        in place of custom toJs() and toV8Object().

        Existing tests :
                fast/dom/MicroData/itemvalue-reflects-data-attr-on-object-element.html
                fast/dom/MicroData/itemvalue-reflects-href-attr.html
                fast/dom/MicroData/itemvalue-reflects-src-attribute-on-img-element.html
                fast/dom/MicroData/itemvalue-reflects-the-content-attr-on-meta-element.html
                fast/dom/MicroData/itemvalue-reflects-the-src-attr.html
                fast/dom/MicroData/itemvalue-returns-element-itself.html
                fast/dom/MicroData/itemvalue-returns-null.html
                fast/dom/MicroData/itemvalue-throws-excpetion-onsetting-001.html
                fast/dom/MicroData/itemvalue-throws-excpetion-onsetting-002.html

        * bindings/js/JSHTMLElementCustom.cpp:
        (WebCore):
        * bindings/v8/custom/V8HTMLElementCustom.cpp:
        (WebCore):
        (WebCore::V8HTMLElement::itemValueAccessorGetter):

2012-07-27  Thiago Marcos P. Santos  <thiago.santos@intel.com>

        REGRESSION(r123856): Breaks the build when disabling inspector
        https://bugs.webkit.org/show_bug.cgi?id=92493

        Reviewed by Kentaro Hara.

        * bindings/js/ScriptGCEvent.h:
        (WebCore):
        * bindings/v8/ScriptGCEvent.h:
        (WebCore):

2012-07-27  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL][WK2] Add API to Ewk_Cookie_Manager to watch for cookie changes
        https://bugs.webkit.org/show_bug.cgi?id=92484

        Reviewed by Kenneth Rohde Christiansen.

        Make use of soup/CookieStorageSoup.cpp for EFL port instead
        of defining empty implementations for cookie storage
        functions.

        No new tests, no behavior change.

        * PlatformEfl.cmake:
        * platform/efl/TemporaryLinkStubs.cpp:

2012-07-27  Keishi Hattori  <keishi@webkit.org>

        Replace ColorChooserClient::elementRectRelativeToWindow with elementRectRelativeToRootView
        https://bugs.webkit.org/show_bug.cgi?id=92488

        Reviewed by Kent Tamura.

        Changing ColorChooserClient interface to return element rectangle that is relative to root view instead of window.

        No new tests. Method is not used yet.

        * html/ColorInputType.cpp:
        (WebCore::ColorInputType::elementRectRelativeToRootView): Replaced elementRectRelativeToWindow. Returns element rectangle relative to root view.
        * html/ColorInputType.h:
        (ColorInputType):
        * platform/ColorChooserClient.h:
        (ColorChooserClient):

2012-07-27  Dominik Röttsches  <dominik.rottsches@intel.com>

        [Cairo] Add complex font drawing using HarfbuzzNG
        https://bugs.webkit.org/show_bug.cgi?id=91864

        Reviewed by Simon Hausmann and Martin Robinson.

        Adding Harfbuzz support to EFL by implementing it with the help of cairo and cairo-ft.
        Reusing Chromium's Harfbuzz-NG support.

        No new tests, complex font support is covered by existing tests.

        * CMakeLists.txt: Adding new cairo based implementations, removing emtpy FontEfl.cpp
        * WebCore.gypi: Removing FontEfl.cpp
        * platform/graphics/cairo/FontCairoHarfbuzzNG.cpp: Added. New implementation that implements cairo & harfbuzz-ng based complex font drawing.
        (WebCore):
        (WebCore::Font::drawComplexText):
        (WebCore::Font::drawEmphasisMarksForComplexText):
        (WebCore::Font::canReturnFallbackFontsForComplexText):
        (WebCore::Font::canExpandAroundIdeographsInComplexText):
        (WebCore::Font::floatWidthForComplexText):
        (WebCore::Font::offsetForPositionForComplexText):
        (WebCore::Font::selectionRectForComplexText):
        * platform/graphics/efl/FontEfl.cpp: Removed.
        * platform/graphics/freetype/FontPlatformData.h: Adding a getter that retrieves a harfbuzz face.
        (FontPlatformData):
        * platform/graphics/freetype/FontPlatformDataFreeType.cpp: Adding a getter that retrieves a harfbuzz face.
        (WebCore::FontPlatformData::operator=):
        (WebCore::FontPlatformData::FontPlatformData):
        (WebCore):
        (WebCore::FontPlatformData::harfbuzzFace):
        * platform/graphics/harfbuzz/ng/HarfBuzzNGFaceCairo.cpp: Added. Cairo-freetype based approach to get complex font metrics.
        (WebCore):
        (CairoFtFaceLocker):
        (WebCore::CairoFtFaceLocker::CairoFtFaceLocker):
        (WebCore::CairoFtFaceLocker::lock):
        (WebCore::CairoFtFaceLocker::~CairoFtFaceLocker):
        (WebCore::floatToHarfBuzzPosition):
        (WebCore::doubleToHarfBuzzPosition):
        (WebCore::CairoGetGlyphWidthAndExtents):
        (WebCore::harfbuzzGetGlyph):
        (WebCore::harfbuzzGetGlyphHorizontalAdvance):
        (WebCore::harfbuzzGetGlyphHorizontalOrigin):
        (WebCore::harfbuzzGetGlyphExtents):
        (WebCore::harfbuzzCairoTextGetFontFuncs):
        (WebCore::harfbuzzCairoGetTable):
        (WebCore::HarfBuzzNGFace::createFace):
        (WebCore::HarfBuzzNGFace::createFont):
        (WebCore::HarfBuzzShaper::createGlyphBufferAdvance):

2012-07-27  Adam Barth  <abarth@webkit.org>

        Add a Setting to expose quantized, rate-limited MemoryInfo values
        https://bugs.webkit.org/show_bug.cgi?id=80444

        Reviewed by Eric Seidel.

        We do not currently expose real MemoryInfo objects to the web unless
        the user opts in because we're worried that this memory information
        could be used in side-channel attacks.

        We've gotten feedback from a number of web app developers that this
        information is very useful in tracking the performance of their
        applications.  These developers use the setting in their testing labs
        and regression harnesses to catch memory leaks and regressiosn early in
        their development cycle.

        Some of these developers have experimented with enabling this feature
        within their enterprise and have found the memory data from the field
        extremely useful in tracking down memory issues that slip through their
        testing.

        Based on this experience, they've asked whether we can enable this
        functionality on a wider scale so they catch even more problems
        including problems that don't manifest within their enterprise.
        Because we're still worried about side-channel attacks, we don't want
        to expose the raw data, so we've talked with these folks in more detail
        to understand what information they find most valuable.

        This patch is the result of those discussions.  In particular, this
        patch adds an option to expose quantized and rate-limited memory
        information to web pages.  Web pages can only learn new data every 20
        minutes, which helps mitigate attacks where the attacker compares two
        or readings to extract side-channel information.  The patch also only
        reports 100 distinct memory values, which (combined with the rate
        limts) makes it difficult for attackers to learn about small changes in
        memory use.

        * page/MemoryInfo.cpp:
        (WebCore):
        (HeapSizeCache):
        (WebCore::HeapSizeCache::HeapSizeCache):
        (WebCore::HeapSizeCache::getCachedHeapSize):
        (WebCore::HeapSizeCache::maybeUpdate):
        (WebCore::HeapSizeCache::update):
        (WebCore::HeapSizeCache::quantize):
        (WebCore::MemoryInfo::MemoryInfo):
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (WebCore::Settings::setQuantizedMemoryInfoEnabled):
        (WebCore::Settings::quantizedMemoryInfoEnabled):
        (Settings):

2012-07-27  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Move formatting support from JavaScriptSource to UISourceCode.
        https://bugs.webkit.org/show_bug.cgi?id=92373

        Reviewed by Pavel Feldman.

        Moved formatting support from JavaScriptSource to UISourceCode.
        Extracted Formatter interface from ScriptFormatter and created IdentityFormatter
        implememntation and Formatter.createFormatter(contentType) formatter factory.
        Introduced virtual formattedChanged() method on UISourceCode.

        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource):
        (WebInspector.JavaScriptSource.prototype.uiLocationToRawLocation):
        (WebInspector.JavaScriptSource.prototype.breakpointStorageId):
        (WebInspector.JavaScriptSource.prototype.searchInContent):
        (WebInspector.JavaScriptSource.prototype.formattedChanged):
        * inspector/front-end/ScriptFormatter.js:
        (WebInspector.Formatter):
        (WebInspector.Formatter.createFormatter):
        (WebInspector.Formatter.locationToPosition):
        (WebInspector.Formatter.positionToLocation):
        (WebInspector.Formatter.prototype.formatContent):
        (WebInspector.ScriptFormatter):
        (WebInspector.IdentityFormatter):
        (WebInspector.IdentityFormatter.prototype.formatContent):
        (WebInspector.FormatterSourceMappingImpl.prototype.originalToFormatted):
        (WebInspector.FormatterSourceMappingImpl.prototype.formattedToOriginal):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode):
        (WebInspector.UISourceCode.prototype.requestContent):
        (WebInspector.UISourceCode.prototype._fireContentAvailable):
        (WebInspector.UISourceCode.prototype.uiLocationToRawLocation):
        (WebInspector.UISourceCode.prototype.overrideLocation):
        (WebInspector.UISourceCode.prototype.togglingFormatter):
        (WebInspector.UISourceCode.prototype.formatted):
        (WebInspector.UISourceCode.prototype.setFormatted.if):
        (WebInspector.UISourceCode.prototype.setFormatted.didGetContent.formattedChanged):
        (WebInspector.UISourceCode.prototype.setFormatted.didGetContent):
        (WebInspector.UISourceCode.prototype.setFormatted):
        (WebInspector.UISourceCode.prototype.createFormatter):
        (WebInspector.UISourceCode.prototype.formattedChanged):

2012-07-27  Vivek Galatage  <vivekgalatage@gmail.com>

        Page object should ascertain EditorClient to be non-null
        https://bugs.webkit.org/show_bug.cgi?id=92458

        Reviewed by Ryosuke Niwa.

        The EditorClient should always be available in Page object. Added the assertion to ascertain this.

        No new tests. Added assertion to make sure EditorClient always exist.

        * page/Page.cpp:
        (WebCore::Page::Page):

2012-07-27  Huang Dongsung  <luxtella@company100.net>

        Gather the duplicated timer code into CachedResource.
        https://bugs.webkit.org/show_bug.cgi?id=92332

        Reviewed by Nate Chapin.

        Internal review by Jae Hyun Park.

        When all clients are removed, CachedImage, CachedScript and CachedCSSStyleSheet
        start the timer to destroy decoded data. Those three classes have their own
        timer.
        Changed CachedCSSStyleSheet::didAddClient to call super class method in order to
        stop the timer. This change does not have any side effect because
        CachedResource::didAddClient only stops the timer in this case.

        No new tests - no new testable functionality.

        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::CachedCSSStyleSheet):
        (WebCore::CachedCSSStyleSheet::didAddClient):
        * loader/cache/CachedCSSStyleSheet.h:
        (CachedCSSStyleSheet):
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::CachedImage):
        (WebCore::CachedImage::didAddClient):
        (WebCore::CachedImage::allClientsRemoved):
        * loader/cache/CachedImage.h:
        (CachedImage):
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::CachedResource):
        (WebCore::CachedResource::didAddClient):
        (WebCore::CachedResource::removeClient):
        (WebCore::CachedResource::destroyDecodedDataIfNeeded):
        (WebCore):
        (WebCore::CachedResource::decodedDataDeletionTimerFired):
        * loader/cache/CachedResource.h:
        (CachedResource):
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::CachedScript):
        * loader/cache/CachedScript.h:
        (CachedScript):

2012-07-27  Huang Dongsung  <luxtella@company100.net>

        Gather the duplicated timer code into CachedResource.
        https://bugs.webkit.org/show_bug.cgi?id=92332

        Reviewed by Nate Chapin.

        Internal review by Jae Hyun Park.

        When all clients are removed, CachedImage, CachedScript and CachedCSSStyleSheet
        start the timer to destroy decoded data. Those three classes have their own
        timer.
        Changed CachedCSSStyleSheet::didAddClient to call super class method in order to
        stop the timer. This change does not have any side effect because
        CachedResource::didAddClient only stops the timer in this case.

        No new tests - no new testable functionality.

        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::CachedCSSStyleSheet):
        (WebCore::CachedCSSStyleSheet::didAddClient):
        * loader/cache/CachedCSSStyleSheet.h:
        (CachedCSSStyleSheet):
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::CachedImage):
        (WebCore::CachedImage::didAddClient):
        (WebCore::CachedImage::allClientsRemoved):
        * loader/cache/CachedImage.h:
        (CachedImage):
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::CachedResource):
        (WebCore::CachedResource::didAddClient):
        (WebCore::CachedResource::removeClient):
        (WebCore::CachedResource::destroyDecodedDataIfNeeded):
        (WebCore):
        (WebCore::CachedResource::decodedDataDeletionTimerFired):
        * loader/cache/CachedResource.h:
        (CachedResource):
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::CachedScript):
        * loader/cache/CachedScript.h:
        (CachedScript):

2012-07-27  Dana Jansens  <danakj@chromium.org>

        [chromium] Don't add a HUD layer when there is no rootLayer
        https://bugs.webkit.org/show_bug.cgi?id=92442

        Reviewed by Adrienne Walker.

        When the compositor is shutting down in threaded mode, it does a commit
        without a root layer. We should not try stick the hud layer onto the
        null root layer.

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::willCommit):

2012-07-27  Alec Flett  <alecflett@chromium.org>

        IndexedDB: inject index keys on cursor/objectstore/index get success handlers
        https://bugs.webkit.org/show_bug.cgi?id=91123

        Reviewed by Tony Chang.

        Move key-injection into the frontend, by injecting the key into
        the value on get rather than set for autoincremented keys. This
        gives a potential performance win by avoiding an IPC call to the
        V8 utility process on chromium, and generally cleans up the key
        management.

        Note that this duplicates the logic of generateIndexKeys into the
        frontend until that method can be expunged from the backend. This
        will be cleaned up in a later patch.

        In order to account for both old data (which has the duplicate
        primary key already injected and serialized) and any new data, an
        assertion was removed from IDBBindingUtilities.

        This also includes some minor refactoring such as the deprecation
        of IDBCursorBackendInterface::update in favor of a direct call to
        IDBObjectStoreBackendImpl::put, and removal of the now-defunct
        IDBBackingStore::getObjectViaIndex.

        Tests: storage/indexdb/index-duplicate-keypaths.html

        * Modules/indexeddb/IDBBackingStore.h:
        (IDBBackingStore):
        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::update):
        (WebCore::IDBCursor::setValueReady):
        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
        (WebCore::IDBCursorBackendImpl::update):
        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
        (WebCore::IDBIndexBackendImpl::getInternal):
        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
        * Modules/indexeddb/IDBLevelDBBackingStore.h:
        (IDBLevelDBBackingStore):
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::generateIndexKeysForValue):
        (WebCore):
        (WebCore::IDBObjectStore::add):
        (WebCore::IDBObjectStore::put):
        * Modules/indexeddb/IDBObjectStore.h:
        (IDBObjectStore):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::put):
        (WebCore::IDBObjectStoreBackendImpl::putWithIndexKeys):
        (WebCore):
        (WebCore::IDBObjectStoreBackendImpl::putInternal):
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::onSuccess):
        * bindings/v8/IDBBindingUtilities.cpp:
        (WebCore):

2012-07-27  Tony Chang  <tony@chromium.org>

        changing -webkit-order should change the paint order of flex items
        https://bugs.webkit.org/show_bug.cgi?id=92041

        Reviewed by Ojan Vafai.

        Override paintChildren and use the flex order iterator to determine the order to paint the children.

        Test: css3/flexbox/order-painting.html

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::layoutBlock): Save a reference to the order iterator.
        (WebCore::RenderFlexibleBox::paintChildren):
        * rendering/RenderFlexibleBox.h:
        (RenderFlexibleBox): Hold a reference to the order iterator so we don't have to recreate it at paint time.
            Also mark all the virtual methods with OVERRIDE.

2012-07-26  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r123820.
        http://trac.webkit.org/changeset/123820
        https://bugs.webkit.org/show_bug.cgi?id=92465

        It made all tests crash on all port (Requested by Ossy_home on
        #webkit).

        * dom/EventNames.cpp:
        (WebCore):

2012-07-26  Ryosuke Niwa  <rniwa@webkit.org>

        Qt build fix after r123788. Fixed the typo.

        * xml/parser/XMLDocumentParserQt.cpp:
        (WebCore::handleElementAttributes):

2012-07-26  Hironori Bono  <hbono@chromium.org>

        [Qt] Build fix for Qt after r123811
        https://bugs.webkit.org/show_bug.cgi?id=92460

        Reviewed by Ryosuke Niwa.

        This change explicitly converts from AtomicString to String to avoid ambiguities
        when compiling HTMLAppletWidget.cpp on Qt.

        No new tests because it is a build fix.

        * html/HTMLAppletElement.cpp:
        (WebCore::HTMLAppletElement::updateWidget):

2012-07-26  Mike Lawther  <mikelawther@chromium.org>

        Make transitions work between different Length types
        https://bugs.webkit.org/show_bug.cgi?id=92220

        Reviewed by Simon Fraser.

        Use the existing CSS calc machinery for blending between two calculations
        to blend between two Lengths of differing types.

        Test: transitions/mixed-type.html

        * platform/Length.cpp:
        (WebCore::Length::blendMixedTypes):
        * platform/Length.h:
        (WebCore::Length::blend):
        (Length):

2012-07-26  Dan Bernstein  <mitz@apple.com>

        Blocks with reverse column progression don’t have layout overflow for overflowing columns
        https://bugs.webkit.org/show_bug.cgi?id=92440

        Reviewed by Sam Weinig.

        Test: fast/multicol/progression-reverse-overflow.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::addLayoutOverflow): If column progression is reversed, then allow
        layout overflow to go in the opposite direction than it would normally be allowed to go.
        For example, in a block with writing-mode: horizontal-tb, direction: ltr and
        column-progression: reverse, columns overflow to the left, so layout overflow would go on
        the left.

2012-07-26  Keishi Hattori  <keishi@webkit.org>

        Implement ColorSuggestionPicker page popup
        https://bugs.webkit.org/show_bug.cgi?id=92109

        Reviewed by Kent Tamura.

        Implements ColorSuggestionPicker page popup. This will be used in
        certain ports as the datalist UI for <input type=color>.

        No new tests because there is no way to open the popup yet.

        * Resources/colorSuggestionPicker.css: Added.
        (body):
        (#main):
        (.color-swatch):
        (.color-swatch:hover):
        (.color-swatch-container):
        (.other-color):
        * Resources/colorSuggestionPicker.js: Added.
        (getScrollbarWidth):When there are more than 20 colors we need to
        increase the window width to accommodate the scroll bar.
        (createElement):
        (handleMessage):
        (initialize):
        (handleArgumentsTimeout):
        (validateArguments):
        (submitValue): Calls setValueAndClosePopup with a numValue of 0.
        (handleCancel): Calls setValueAndClosePopup with a numValue of -1.
        (chooseOtherColor): Calls setValueAndClosePopup with a numValue of -2.
        (ColorPicker):
        (ColorPicker.prototype._layout): Lays out the color swatches in a 5x4
        grid.
        (ColorPicker.prototype._handleSwatchClick):
        * WebCore.gyp/WebCore.gyp: Added ColorSuggestionPicker action.
        * make-file-arrays.py:
        (main): Windows gets confused when "&&" is in the command, so we will replace " AND " with " && " internally.

2012-07-26  Anish Bhayani  <anish.bhayani@gmail.com>

        De-virtualize WrapShape classes
        https://bugs.webkit.org/show_bug.cgi?id=90998

        Reviewed by Andreas Kling.

        The destructor for WrapShapes classes did not need to use a virtual
        pointer. WrapShapes.cpp is created to cast the WrapShape destructor 
        to the subclass type saving memory and avoiding virtual calls. 

        There are existing tests that cover the validity of shapes. The
        added changes merely change the destructor of the shape objects
        which is also tested by LayoutTests/fast/exclusions.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * rendering/style/WrapShapes.cpp: Added.
        (WebCore):
        (WebCore::WrapShape::destroy):
        * rendering/style/WrapShapes.h:
        (WebCore::WrapShape::deref):
        (WrapShape):
        (WebCore::WrapShape::type):
        (WebCore::WrapShape::setType):
        (WrapShapeRectangle):
        (WebCore::WrapShapeRectangle::WrapShapeRectangle):
        (WebCore::WrapShapeCircle::WrapShapeCircle):
        (WebCore::WrapShapeEllipse::WrapShapeEllipse):
        (WebCore::WrapShapePolygon::WrapShapePolygon):
        (WrapShapePolygon):

2012-07-26  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r123808.
        http://trac.webkit.org/changeset/123808
        https://bugs.webkit.org/show_bug.cgi?id=92443

        Broke Apple Mac debug tests ASSERTION FAILED: !hasClients()
        (Requested by msaboff_ on #webkit).

        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::CachedCSSStyleSheet):
        (WebCore::CachedCSSStyleSheet::didAddClient):
        (WebCore::CachedCSSStyleSheet::allClientsRemoved):
        (WebCore::CachedCSSStyleSheet::decodedDataDeletionTimerFired):
        (WebCore):
        * loader/cache/CachedCSSStyleSheet.h:
        (CachedCSSStyleSheet):
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::CachedImage):
        (WebCore::CachedImage::decodedDataDeletionTimerFired):
        (WebCore):
        (WebCore::CachedImage::didAddClient):
        (WebCore::CachedImage::allClientsRemoved):
        * loader/cache/CachedImage.h:
        (CachedImage):
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::CachedResource):
        (WebCore::CachedResource::didAddClient):
        (WebCore::CachedResource::removeClient):
        * loader/cache/CachedResource.h:
        (CachedResource):
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::CachedScript):
        (WebCore::CachedScript::didAddClient):
        (WebCore):
        (WebCore::CachedScript::allClientsRemoved):
        (WebCore::CachedScript::decodedDataDeletionTimerFired):
        * loader/cache/CachedScript.h:
        (CachedScript):

2012-07-26  Tony Chang  <tony@chromium.org>

        [chromium] Remove some unreachable code in ClipboardChromium.cpp
        https://bugs.webkit.org/show_bug.cgi?id=92427

        Reviewed by Adam Barth.

        convertURIListToURL does the same thing (implementation in ClipboardUtilitiesChromium.*).

        No new tests, just deleting unused code.

        * platform/chromium/ClipboardChromium.cpp:
        (WebCore::ClipboardChromium::getData):

2012-07-26  Sukolsak Sakshuwong  <sukolsak@google.com>

        Implement undoscope attribute.
        https://bugs.webkit.org/show_bug.cgi?id=88793

        Reviewed by Ryosuke Niwa.

        undoscope attribute support as specified at
        http://dvcs.w3.org/hg/undomanager/raw-file/tip/undomanager.html

        Test: editing/undomanager/undoscope-attribute.html

        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * dom/Document.cpp:
        (WebCore::Document::~Document):
        * dom/Element.cpp:
        (WebCore):
        (WebCore::Element::undoScope):
        (WebCore::Element::setUndoScope):
        (WebCore::Element::undoManager):
        (WebCore::Element::disconnectUndoManager):
        (WebCore::Element::disconnectUndoManagersInSubtree):
        * dom/Element.h:
        (Element):
        * dom/Element.idl:
        * dom/ElementRareData.h:
        (ElementRareData):
        * editing/UndoManager.cpp:
        (WebCore::UndoManager::disconnect):
        (WebCore::UndoManager::transact):
        (WebCore::UndoManager::undo):
        (WebCore::UndoManager::redo):
        (WebCore::UndoManager::clearUndo):
        (WebCore):
        (WebCore::UndoManager::clearRedo):
        (WebCore::UndoManager::clearUndoRedo):
        (WebCore::UndoManager::isConnected):
        * editing/UndoManager.h:
        (WebCore):
        (UndoManager):
        (WebCore::UndoManager::length):
        * editing/UndoManager.idl:
        * html/HTMLAttributeNames.in:
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::parseAttribute):
        (WebCore::HTMLElement::setContentEditable):

2012-07-26  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Introduce runtime feature flags for input type datetime, datetimelocal, month, time, week
        https://bugs.webkit.org/show_bug.cgi?id=92339

        Reviewed by Kent Tamura.

        To detect compilation errors and test failure earlier, I would like
        build and run tests for input type datetime, datetime-local, month,
        time and week with runtime feature flags to avoid behavior changes
        other than test shell.

        This patch adds runtime features for input types, datetime, datetime-local,
        month, time and week and integrates them into InputType::createInputTypeFactoryMap
        to follow runtime feature flags.

        At this time, these runtime features are enabled by default for all
        ports define ENABLE_INPUT_TYPE_XXX except for Chromium port other than
        Android. I'll remove these #if after I update Chromium browser for
        disabling them for non-Android.

        No new tests. Enabling disabled tests (fast/forms/datetime, fast/forms/dattimelocal,
        fast/forms/month, fast/forms/time, fast/forms/week)

        * bindings/generic/RuntimeEnabledFeatures.cpp: Added initializations of
        variables for runtime features of input types.
        * bindings/generic/RuntimeEnabledFeatures.h:
        (WebCore::RuntimeEnabledFeatures::inputTypeDateTimeEnabled): Added.
        (WebCore::RuntimeEnabledFeatures::setInputTypeDateTimeEnabled): Added.
        (WebCore::RuntimeEnabledFeatures::inputTypeDateTimeLocalEnabled): Added.
        (WebCore::RuntimeEnabledFeatures::setInputTypeDateTimeLocalEnabled): Added.
        (WebCore::RuntimeEnabledFeatures::inputTypeMonthEnabled): Added.
        (WebCore::RuntimeEnabledFeatures::setInputTypeMonthEnabled): Added.
        (WebCore::RuntimeEnabledFeatures::inputTypeTimeEnabled): Added.
        (WebCore::RuntimeEnabledFeatures::setInputTypeTimeEnabled): Added.
        (WebCore::RuntimeEnabledFeatures::inputTypeWeekEnabled): Added.
        (WebCore::RuntimeEnabledFeatures::setInputTypeWeekEnabled): Added.
        * html/InputType.cpp:
        (WebCore::createInputTypeFactoryMap): Register input types datetime,
        datetime-local, month, time and week if corresponding runtime feature
        flag is enabled.
        * html/InputType.h: Changed indentation to force building *InputType.cpp for
        making Chromium-win bots to be happy.

2012-07-26  Xianzhu Wang  <wangxianzhu@chromium.org>

        [Chromium-Android] Don't overlay scrollbars in layout test mode
        https://bugs.webkit.org/show_bug.cgi?id=92419

        Reviewed by Adam Barth.

        No new tests. This fixes failures of existing tests, e.g. css1/box_properties/border.html and many others.

        * platform/chromium/ScrollbarThemeChromiumAndroid.cpp:
        (WebCore::ScrollbarThemeChromiumAndroid::usesOverlayScrollbars): Returns false in layout test mode.
        (WebCore):
        (WebCore::ScrollbarThemeChromiumAndroid::hasThumb): Returns false in layout test mode (to match pixel test expectations).
        * platform/chromium/ScrollbarThemeChromiumAndroid.h:
        (ScrollbarThemeChromiumAndroid):

2012-07-26  Jeffrey Pfau  <jpfau@apple.com>

        Reloading substitute-data/alternate html string for unreachableURL will add an item to the back-forward-history for each reload
        https://bugs.webkit.org/show_bug.cgi?id=84041

        Reviewed by Brady Eidson.

        Previously, loadAlternateHTMLString:baseURL:forUnreachableURL: would insert a new history item, regardless of
        the load type of the original frame load. This could cause navigation to a broken website to make back and
        forward navigation difficult to use. This change ensures that a reload type makes it through all the way.

        Added API test 'mac/BackForwardList.mm'.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::load): Prevent m_loadType from being overwritten early and check if it's a reload.
        * loader/HistoryController.cpp:
        (WebCore::HistoryController::updateForCommit): Amend check when committing the provisional item for a reload.
        (WebCore::HistoryController::isReloadTypeWithProvisionalItem): Check that a reload type has a provisional item.
        (WebCore):
        * loader/HistoryController.h:
        (HistoryController): Add prototype for isReloadTypeWithProvisionalItem.

2012-07-26  Silvia Pfeiffer  <silviapf@chromium.org>

        [Chromium] Regression: Global-buffer-overflow in WebCore::mediaControlElementType
        https://bugs.webkit.org/show_bug.cgi?id=91333

        Reviewed by Eric Seidel.

        MediaControlChromiumEnclosureElement now is a subclass of MediaControlElement, which
        fixes the broken cast detected in the bug.
        The displayType() of MediaControlChromiumEnclosureElement is set to 'MediaControlsPanel',
        since the Panel element is sufficiently close in functionality to the Enclosure element.
        By reusing this type, we do not need to introduce a Chromium-specific constant into
        the generally used MediaControlElementType.

        Test: accessibility/media-controls.html

        * html/shadow/MediaControlRootElementChromium.cpp:
        (WebCore::MediaControlChromiumEnclosureElement::MediaControlChromiumEnclosureElement):
        Subclass MediaControlChromiumEnclosureElement from MediaControlElement.
        (WebCore::MediaControlChromiumEnclosureElement::displayType):
        Give the enclosure the MediaPanels type.
        * html/shadow/MediaControlRootElementChromium.h:
        Add the MediaControlElement.h header file.
        (MediaControlChromiumEnclosureElement):
        Subclass MediaControlChromiumEnclosureElement from MediaControlElement.

2012-07-26  Arnaud Renevier  <arno@renevier.net>

        [GTK] avoid unneeded object creation when calling Vector::append
        https://bugs.webkit.org/show_bug.cgi?id=88805

        Reviewed by Alexey Proskuryakov.

        No new tests: no change in functionality.

        * platform/gtk/ContextMenuGtk.cpp:
        (WebCore::contextMenuItemVector):
        * platform/gtk/KeyBindingTranslator.h:
        (WebCore::KeyBindingTranslator::addPendingEditorCommand):

2012-07-26  Benjamin Poulain  <bpoulain@apple.com>

        Initialize the Event Names' strings from read only memory
        https://bugs.webkit.org/show_bug.cgi?id=92435

        Reviewed by Anders Carlsson.

        Similarily to r123689, we can initialize the event names' strings from memory without copying the data.
        This saves us memory and initialization time.

        * dom/EventNames.cpp:
        (WebCore):

2012-07-26  Arnaud Renevier  <a.renevier@sisa.samsung.com>

        constructing TypedArray from another TypedArray is slow
        https://bugs.webkit.org/show_bug.cgi?id=90838

        Reviewed by Kenneth Russell.

        When constructing a typed array from an array like element, try to
        determine if the argument is a typed array. If so, cast the argument
        to a typed array, and read each element with .item() method. That
        avoid reading the value as a JSValue, and speedups construction by
        approximatively 3x (even 30x if TypedArrays are both the same type).

        In order to achieve that, we use virtual getType method. We can use
        this information to cast the TypedArray to the actual type, and then
        read the values from the source.

        Introduce constructArrayBufferViewWithTypedArrayArgument template
        function which returns a new typed array if first argument is a typed
        array, or 0 otherwise.

        This patch also replaces previous is<Type>Array() calls with new
        getType method.

        * bindings/js/JSArrayBufferViewHelper.h:
        (WebCore::constructArrayBufferViewWithTypedArrayArgument):
        (WebCore):
        (WebCore::constructArrayBufferView):
        * bindings/v8/SerializedScriptValue.cpp:
        * html/canvas/DataView.h:
        (DataView):
        (WebCore::DataView::getType):
        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore):
        (WebCore::WebGLRenderingContext::readPixels):
        (WebCore::WebGLRenderingContext::validateTexFuncData):
        * page/Crypto.cpp:

2012-07-26  Max Vujovic  <mvujovic@adobe.com>

        Added binding and updated chromium tests.

        [CSS Filters] Add V8 binding for WebKitCSSFilterValue
        https://bugs.webkit.org/show_bug.cgi?id=92391

        Reviewed by Adam Barth.

        No new tests. This fixes test cases in:
            platform/chromium/css3/filters/custom/custom-filter-property-computed-style-expected.txt
            platform/chromium/css3/filters/custom/custom-filter-property-parsing-expected.txt
            platform/chromium/css3/filters/filter-property-computed-style-expected.txt
            platform/chromium/css3/filters/filter-property-parsing-expected.txt

        * bindings/v8/custom/V8CSSValueCustom.cpp:
        (WebCore::toV8):

2012-07-26  Nayan Kumar K  <nayankk@motorola.com>

        [WebGL] Initial size of canvas can be larger than MAX_VIEWPORT_DIMS.
        https://bugs.webkit.org/show_bug.cgi?id=91976

        Reviewed by Kenneth Russell.

        From section 2.2 of the spec the WebGL implementation says initial size of
        the canvas can be larger than MAX_VIEWPORT_DIMS. With the current WebGL
        implementation, we get error when initial size if greater than MAX_VIEWPORT_DIMS.
        This change limits the width and height of drawingbuffer to MAX_VIEWPORT_DIMS
        when given initial size exceeds it.

        Added tests to LayoutTests/fast/canvas/webgl/drawingbuffer-test.html

        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore):
        (WebCore::WebGLRenderingContext::WebGLRenderingContext):
        (WebCore::WebGLRenderingContext::initializeNewContext):
        (WebCore::WebGLRenderingContext::markContextChanged):

2012-07-26  Adrienne Walker  <enne@google.com>

        [chromium] When computing surface content scale, use top level device scale
        https://bugs.webkit.org/show_bug.cgi?id=92328

        Reviewed by Kenneth Russell.

        Previously, surface scale was calculated with layer->contentsScale(),
        however this value is 1 for any layer that is not ContentLayerChromium
        because of layer->needsContentsScale(). This would cause any surface
        created with a non-content owner layer to look fuzzy on a high DPI
        device. Fix by using the top level device scale.

        Additionally, remove contentsScale from CCLayerImpl as it is no longer
        used.

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::pushPropertiesTo):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateDrawTransformsInternal):
        (WebCore::CCLayerTreeHostCommon::calculateDrawTransforms):

2012-07-26  Anders Carlsson  <andersca@apple.com>

        HTMLAppletElement should inherit from HTMLPlugInImageElement
        https://bugs.webkit.org/show_bug.cgi?id=92320

        Reviewed by Eric Seidel.

        In order to simplify the class hierarchy and eventually merge HTMLPlugInImageElement and HMTLPlugInElement,
        make HTMLAppletElement inherit from HTMLPlugInImageElement. While this does mean that HTMLAppletElement will grow by
        a couple of words, in practice it won't matter.

        Also, make RenderApplet inherit from RenderEmbeddedObject and move the plug-in instantiation to HTMLAppletElement which matches
        both HTMLEmbedElement and HTMLObjectElement.

        * html/HTMLAppletElement.cpp:
        (WebCore::HTMLAppletElement::HTMLAppletElement):
        (WebCore::HTMLAppletElement::create):
        (WebCore::HTMLAppletElement::parseAttribute):
        (WebCore::HTMLAppletElement::rendererIsNeeded):
        (WebCore::HTMLAppletElement::createRenderer):
        (WebCore):
        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
        (WebCore::HTMLAppletElement::updateWidget):
        * html/HTMLAppletElement.h:
        (HTMLAppletElement):
        * html/HTMLTagNames.in:
        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::createJavaAppletWidget):
        * loader/SubframeLoader.h:
        (SubframeLoader):
        * page/FrameView.cpp:
        (WebCore::FrameView::updateWidget):
        * rendering/RenderApplet.cpp:
        (WebCore::RenderApplet::RenderApplet):
        * rendering/RenderApplet.h:
        (RenderApplet):
        * rendering/RenderEmbeddedObject.h:
        (WebCore::toRenderEmbeddedObject):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
        (WebCore::RenderLayer::shouldBeSelfPaintingLayer):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::requiresCompositingForPlugin):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::setStyle):
        * rendering/RenderObject.h:

2012-07-26  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r123799.
        http://trac.webkit.org/changeset/123799
        https://bugs.webkit.org/show_bug.cgi?id=92431

        broke the Apple Mac build (Requested by bweinstein on
        #webkit).

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * dom/EventNames.h:
        (WebCore):
        * dom/GestureEvent.cpp: Removed.
        * dom/GestureEvent.h: Removed.
        * dom/Node.cpp:
        * dom/Node.h:
        (WebCore):
        (Node):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::clear):
        (WebCore::EventHandler::handleGestureEvent):
        * page/EventHandler.h:

2012-07-26  Nima Ghanavatian  <nghanavatian@rim.com>

        [BlackBerry] Support async spellcheck for the blackberry port
        https://bugs.webkit.org/show_bug.cgi?id=92160

        Set USE_UNIFIED_TEXT_CHECKING for PLATFORM(BLACKBERRY) to use the
        asynchronous spellchecking code path.

        Reviewed by Rob Buis.

        Internally reviewed by Mike Fenton.

        * platform/text/TextChecking.h:
        (WebCore):

2012-07-26  Huang Dongsung  <luxtella@company100.net>

        Gather the duplicated timer code into CachedResource.
        https://bugs.webkit.org/show_bug.cgi?id=92332

        Reviewed by Nate Chapin.

        Internal review by Jae Hyun Park.

        When all clients are removed, CachedImage, CachedScript and CachedCSSStyleSheet
        start the timer to destroy decoded data. Those three classes have their own
        timer.
        Changed CachedCSSStyleSheet::didAddClient to call super class method in order to
        stop the timer. This change does not have any side effect because
        CachedResource::didAddClient only stops the timer in this case.

        No new tests - no new testable functionality.

        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::CachedCSSStyleSheet):
        (WebCore::CachedCSSStyleSheet::didAddClient):
        * loader/cache/CachedCSSStyleSheet.h:
        (CachedCSSStyleSheet):
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::CachedImage):
        (WebCore::CachedImage::didAddClient):
        (WebCore::CachedImage::allClientsRemoved):
        * loader/cache/CachedImage.h:
        (CachedImage):
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::CachedResource):
        (WebCore::CachedResource::didAddClient):
        (WebCore::CachedResource::removeClient):
        (WebCore::CachedResource::destroyDecodedDataIfNeeded):
        (WebCore):
        (WebCore::CachedResource::decodedDataDeletionTimerFired):
        * loader/cache/CachedResource.h:
        (CachedResource):
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::CachedScript):
        * loader/cache/CachedScript.h:
        (CachedScript):

2012-07-26  Benjamin Poulain  <bpoulain@apple.com>

        Use the constant count of Tags/Attributes names instead of getting the size when obtaining the tags/attributes
        https://bugs.webkit.org/show_bug.cgi?id=92411

        Reviewed by Julien Chaffraix.

        Since r123582, the number of tags and attributes per "namespace" is exposed in a constant in the header file.
        This makes it possible to access this value through two ways:
        1) The constant.
        2) The first parameter of the tags/attributes getter function.

        Having two ways to access the value is error prone. This patches changes the code to have all accesses done
        through the constant.

        * dom/make_names.pl:
        (printNamesHeaderFile):
        (printNamesCppFile):
        Change the code generator to not provide the size in the getter function.

        * html/HTMLObjectElement.cpp:
        (WebCore::isRecognizedTagName):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::adjustSVGTagNameCase):
        (WebCore):
        (WebCore::adjustAttributes):
        (WebCore::adjustSVGAttributes):
        (WebCore::adjustMathMLAttributes):
        (WebCore::adjustForeignAttributes):

2012-07-26  Chang Shu  <cshu@webkit.org>

        Support constructor-type static readonly attribute for CodeGenerator.
        https://bugs.webkit.org/show_bug.cgi?id=92413.

        Reviewed by Adam Barth.

        Added support for constructor-type static readonly attribute for CodeGenerator.
        This is achieved by putting the attribute entry in the table where static properties
        belong to but leave the implementation same as a non-static constructor-type attribute.

        Tested by running run-bindings-tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr):
        (WebCore::jsTestInterfaceConstructorSupplementalStaticAttr):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore):
        (WebCore::jsTestObjConstructorStaticReadOnlyLongAttr):
        (WebCore::jsTestObjConstructorStaticStringAttr):
        (WebCore::jsTestObjConstructorTestSubObj):
        * bindings/scripts/test/JS/JSTestObj.h:
        (WebCore):
        * bindings/scripts/test/TestObj.idl:
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore):

2012-07-26  Sadrul Habib Chowdhury  <sadrul@chromium.org>

        Propagate gesture events to plugins.
        https://bugs.webkit.org/show_bug.cgi?id=92281

        Reviewed by Adam Barth.

        Propagate gesture events to plugins. This change does not expose the gesture events
        to JavaScript, since there is no spec for that at the moment. Exposing gesture events
        to JavaScript will be done separately, once there is a spec for it.

        Test: platform/chromium/plugins/gesture-events.html

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * dom/EventNames.h:
        (WebCore):
        (WebCore::EventNames::isGestureEventType):
        (EventNames):
        * dom/GestureEvent.cpp: Added.
        (WebCore):
        (WebCore::GestureEvent::create):
        (WebCore::GestureEvent::initGestureEvent):
        (WebCore::GestureEvent::interfaceName):
        (WebCore::GestureEvent::GestureEvent):
        (WebCore::GestureEventDispatchMediator::GestureEventDispatchMediator):
        (WebCore::GestureEventDispatchMediator::event):
        (WebCore::GestureEventDispatchMediator::dispatchEvent):
        * dom/GestureEvent.h: Added.
        (WebCore):
        (GestureEvent):
        (WebCore::GestureEvent::~GestureEvent):
        (WebCore::GestureEvent::deltaX):
        (WebCore::GestureEvent::deltaY):
        (WebCore::GestureEvent::GestureEvent):
        (GestureEventDispatchMediator):
        (WebCore::GestureEventDispatchMediator::create):
        * dom/Node.cpp:
        (WebCore):
        (WebCore::Node::dispatchGestureEvent):
        * dom/Node.h:
        (WebCore):
        (Node):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::clear):
        (WebCore::EventHandler::handleGestureEvent):
        * page/EventHandler.h:

2012-07-26  Gavin Peters  <gavinp@chromium.org>

        Guard Prerenderer against inserting prerenders into detached documents.
        https://bugs.webkit.org/show_bug.cgi?id=92401

        Reviewed by Adam Barth.

        If the document is detached, we should not launch a prerender.

        Test: fast/dom/HTMLLinkElement/prerender-insert-after-stop.html

        * loader/Prerenderer.cpp:
        (WebCore::Prerenderer::render):

2012-07-26  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r123525.
        http://trac.webkit.org/changeset/123525
        https://bugs.webkit.org/show_bug.cgi?id=92421

        it needed to be rolled out after r123779 too (Requested by
        jchaffraix on #webkit).

        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::insertChildNode):

2012-07-26  Pravin D  <pravind.2k4@gmail.com>

        Outline is always painted on the first table row regardless of the row it's set on
        https://bugs.webkit.org/show_bug.cgi?id=92389

        Reviewed by Eric Seidel.

        The outlines of all the rows are drawn on the row instead of their respective rows.
        The paint offset for the outlines does not take the row location into account.

        Test: fast/table/table-row-outline-paint.html

        * rendering/RenderTableRow.cpp:
        (WebCore::RenderTableRow::paintOutlineForRowIfNeeded):
        The row's location is taken into account for calculating the correct paint offset
        for its outline.

2012-07-26  Antoine Labour  <piman@chromium.org>

        [chromium] Combine color matrix filters and apply them in a single pass.
        https://bugs.webkit.org/show_bug.cgi?id=92059

        Reviewed by Stephen White.

        Sequential color matrix filters can easily be combined, by simply
        multiplying the color matrices and applying it in a single pass. This
        helps dramatically with performance (bandwidth savings by avoiding extra
        copy & clear, also saves fragment shader processing).

        Covered by css3/filters layout tests, added effect-brightness-clamping
        and effect-brightness-clamping-hw.

        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:
        (WebCore::CCRenderSurfaceFilters::apply):

2012-07-26  Ryosuke Niwa  <rniwa@webkit.org>

        Href attribute with javascript protocol is stripped when content is pasted into a XML doucment
        https://bugs.webkit.org/show_bug.cgi?id=92310

        Reviewed by Adam Barth.

        The bug was caused by setAttributeNS's stripping attributes for which isAttributeToRemove
        return true instead of setting an empty string. Changing this in setAttributeNS is problematic
        because it will trigger a logic, in HTMLAnchorElement for example, to resolve the URL.

        Fixed the bug by making XML parsers call parserSetAttributes instead of setAttributeNS.
        After this patch, handleNamespaceAttributes and handleElementAttributes simply fills up a Vector
        with which startElementNs (or parseStartElement in Qt) calls parserSetAttributes.

        * dom/Element.cpp:
        (WebCore::Element::parserSetAttributes): Sets emptyAtom instead of nullAtom as nullAtom can be
        turned into "null".
        (WebCore::Element::parseAttributeName): Extracted from setAttributeNS.
        (WebCore::Element::setAttributeNS): No longer takes FragmentScriptingPermission.
        * dom/Element.h:
        (Element):
        * editing/markup.cpp:
        (WebCore::completeURLs): Don't resolve URLs when it's empty since empty attribute has a canonical
        meaning in some cases. e.g. <frame src=""></iframe>
        * xml/parser/XMLDocumentParserLibxml2.cpp:
        (WebCore::handleNamespaceAttributes): Renamed from handleElementNamespaces. Call
        parserSetAttributes even when exiting early to be maintain the same behavior.
        (WebCore::handleElementAttributes):
        (WebCore::XMLDocumentParser::startElementNs):
        * xml/parser/XMLDocumentParserQt.cpp:
        (WebCore::handleNamespaceAttributes): Use XMLNSNames::xmlnsNamespaceURI. Call parserSetAttributes
        even when exiting early to be maintain the same behavior.
        (WebCore::handleElementAttributes):
        (WebCore::XMLDocumentParser::parseStartElement):

2012-07-26  Dan Bernstein  <mitz@apple.com>

        <svg> element with no intrinsic size and max-width gets sized incorrectly
        https://bugs.webkit.org/show_bug.cgi?id=92410

        Reviewed by Dean Jackson.

        Test: svg/css/max-width-2.html

        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::computeReplacedLogicalWidth): The rule for computing the width for
        elements whose computed width and height are both auto and which have no intrinsic size, but
        have an intrinsic ratio was applied only to elements with a content renderer (such as <img>
        with an SVG source). Removed the requirement to have a content renderer, so that it will
        apply to all elements including <svg>.

2012-07-26  Tony Chang  <tony@chromium.org>

        Regression: r123696 made css3/flexbox tests failing
        https://bugs.webkit.org/show_bug.cgi?id=92352

        Reviewed by Levi Weintraub.

        Use roundedLayoutUnit so ports without subpixel layout still pass existing tests.

        Covered by css3/flexbox/flex-algorithm-min-max.html which should pass again.

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::resolveFlexibleLengths):

2012-07-26  Emil A Eklund  <eae@chromium.org>

        Contained div with right 0 sometimes overlaps parent div
        https://bugs.webkit.org/show_bug.cgi?id=91521

        Reviewed by Levi Weintraub.

        Due to unnecessary rounding in clientLogicalWidth and clientLogicalHeight
        we lost precision when computing the width and position of render boxes.
        Change clientLogicalWidth/Height to return values with subpixel precision
        to avoid this.

        Test: fast/sub-pixel/position-right-aligns-with-container.html

        * rendering/RenderBox.h:
        (WebCore::RenderBox::clientLogicalWidth):
        (WebCore::RenderBox::clientLogicalHeight):
        Remove unnecessary rounding.

2012-07-26  Chang Shu  <cshu@webkit.org>

        Build broken when svg is disabled.
        https://bugs.webkit.org/show_bug.cgi?id=92393.

        Reviewed by Laszlo Gombos.

        Need to surpress unused parameters warning.

        * rendering/FilterEffectRenderer.cpp:
        (WebCore::FilterEffectRenderer::buildReferenceFilter):

2012-07-25  Jer Noble  <jer.noble@apple.com>

        Add diagnostic messages when media and plugins load or fail to load.
        https://bugs.webkit.org/show_bug.cgi?id=92341

        Reviewed by Anders Carlsson.

        Send diagnostic messages when a media or plugin element loads or fails to load. Include in
        the trace the media engine description, error code, or plugin mime type.

        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::updateWidget): Send a diagnostic message.
        * html/HTMLMediaElement.cpp:
        (WebCore::stringForNetworkState): Added convenience function to stringify network states.
        (WebCore::HTMLMediaElement::mediaLoadingFailed): Send a diagnostic message.
        (WebCore::HTMLMediaElement::setReadyState): Send a diagnostic message.
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::updateWidget): Send a diagnostic message.

2012-07-26  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r123159, r123165, r123168, r123492,
        and r123650.
        http://trac.webkit.org/changeset/123159
        http://trac.webkit.org/changeset/123165
        http://trac.webkit.org/changeset/123168
        http://trac.webkit.org/changeset/123492
        http://trac.webkit.org/changeset/123650
        https://bugs.webkit.org/show_bug.cgi?id=92406

        allowing inline-table anonymous wrappers is a bad idea due to
        tons of corner cases that should be properly handled
        (Requested by jchaffraix on #webkit).

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::addChildIgnoringContinuation):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::createAnonymousWithParentRenderer):

2012-07-26  Jer Noble  <jer.noble@apple.com>

        Add a ChromeClient method to send diagnostic logging messages from WebCore to the client.
        https://bugs.webkit.org/show_bug.cgi?id=92340

        Reviewed by Anders Carlsson.

        Add a new ChromeClient menthod, to be implemented by WebKit and WebKit2, which sends
        a diagnostic logging message up to the client.

        * page/ChromeClient.h:
        (WebCore::ChromeClient::logDiagnosticMessage):
        * page/ChromeClient.h:
        (WebCore::ChromeClient::logDiagnosticMessage):
        (ChromeClient):
        * page/DiagnosticLoggingKeys.cpp: Added.
        (WebCore::DiagnosticLoggingKeys::mediaLoadedKey):
        (WebCore::DiagnosticLoggingKeys::mediaLoadingFailedKey):
        (WebCore::DiagnosticLoggingKeys::pluginLoadedKey):
        (WebCore::DiagnosticLoggingKeys::pluginLoadingFailedKey):
        (WebCore::DiagnosticLoggingKeys::passKey):
        (WebCore::DiagnosticLoggingKeys::failKey):
        (WebCore::DiagnosticLoggingKeys::noopKey):
        * page/DiagnosticLoggingKeys.h: Added.
        (DiagnosticLoggingKeys):

        Add the new files DiagnosticLoggingKeys.cpp,h to the project:
        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:

2012-07-25  Jer Noble  <jer.noble@apple.com>

        Add setting to enable and disable diagnostic logging.
        https://bugs.webkit.org/show_bug.cgi?id=92337

        Reviewed by Anders Carlsson.

        Add a new entry in Settings, defaulting to false.

        * page/Settings.cpp:
        (WebCore::Settings::Settings): Default the new setting to false.
        * page/Settings.h:
        (WebCore::Settings::setDiagnosticLoggingEnabled): Simple accessor.
        (WebCore::Settings::diagnosticLoggingEnabled): Ditto.

2012-07-26  Olivier Blin  <olivier.blin@softathome.com>

        Add FastMalloc statistics in window.internals
        https://bugs.webkit.org/show_bug.cgi?id=91274

        Reviewed by Ryosuke Niwa.

        Test: fast/harness/fastmallocstatistics-object.html

        * CMakeLists.txt:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * WebCore.vcproj/WebCoreTestSupport.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * testing/FastMallocStatistics.h: Added.
        (WebCore):
        (FastMallocStatistics):
        (WebCore::FastMallocStatistics::create):
        (WebCore::FastMallocStatistics::reservedVMBytes):
        (WebCore::FastMallocStatistics::committedVMBytes):
        (WebCore::FastMallocStatistics::freeListBytes):
        (WebCore::FastMallocStatistics::FastMallocStatistics):
        * testing/FastMallocStatistics.idl: Added.
        * testing/Internals.cpp:
        (WebCore::Internals::fastMallocStatistics):
        (WebCore):
        * testing/Internals.h:
        (WebCore):
        (Internals):
        * testing/Internals.idl:

2012-07-26  Adrienne Walker  <enne@google.com>

        [chromium] Remove redundant surface origin transforms
        https://bugs.webkit.org/show_bug.cgi?id=91815

        Reviewed by Stephen White.

        Bug 91417 changed draw transforms to become equivalent to origin
        transforms for surfaces. This change removes them as they are no
        longer needed for anything.

        No new tests. Just a refactoring.

        * platform/graphics/chromium/RenderSurfaceChromium.h:
        (RenderSurfaceChromium):
        * platform/graphics/chromium/cc/CCDamageTracker.cpp:
        (WebCore::CCDamageTracker::extendDamageForRenderSurface):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::computeScrollCompensationMatrixForChildren):
        (WebCore::calculateDrawTransformsInternal):
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::::leaveToRenderTarget):
        (WebCore::::unoccludedContributingSurfaceContentRect):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
        (WebCore::CCRenderPassDrawQuad::create):
        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
        (CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::createSharedQuadState):
        (WebCore::CCRenderSurface::createReplicaSharedQuadState):
        (WebCore::CCRenderSurface::appendQuads):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (CCRenderSurface):

2012-07-25  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: simplify handling of status bar items
        https://bugs.webkit.org/show_bug.cgi?id=92143

        Reviewed by Pavel Feldman.

        - split status bars into "global" (always in the bottom) and "panel"
            (on top of the drawer when drawer is shown)
        - use "inner" status bar section in global status bar to display either
            panel status bar items or drawer view items (depending on drawer visibility)
        - let panels/views manage their counters as part of their status bar
            items, not through special interface members;
        - get rid of absolute positioning in the status bars where possible;

        * inspector/front-end/AdvancedSearchController.js:
        (WebInspector.SearchView.prototype.get statusBarItems):
        * inspector/front-end/Drawer.js:
        (WebInspector.Drawer):
        (WebInspector.Drawer.prototype.show.animationFinished):
        (WebInspector.Drawer.prototype.show):
        (WebInspector.Drawer.prototype.hide.animationFinished):
        (WebInspector.Drawer.prototype.hide):
        (WebInspector.Drawer.prototype._startStatusBarDragging):
        * inspector/front-end/Panel.js:
        (WebInspector.Panel.prototype.wasShown):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype.get statusBarItems):
        (WebInspector.TimelinePanel.prototype.willHide):
        * inspector/front-end/elementsPanel.css:
        (.crumbs):
        * inspector/front-end/inspector.css:
        (#main):
        (body.drawer-visible #main-panels):
        (.status-bar):
        (.status-bar-item):
        (#panel-status-bar-placeholder):
        (body.drawer-visible #panel-status-bar-placeholder):
        (#panel-status-bar-resizer):
        (#panel-status-bar):
        (#panel-status-bar > div):
        (#error-warning-count):
        (#drawer):
        (#drawer-contents):
        (.status-bar-items):
        (.drawer-header):
        (#inner-status-bar):
        (.search-status-bar-item):
        (.search-status-bar-message):
        (.search-status-bar-progress):
        (body:not(.platform-mac) .search-status-bar-progress):
        (body.platform-mac .search-status-bar-progress):
        (.search-status-bar-stop-button-item):
        (.search-status-bar-stop-button .glyph):
        (.search-results-status-bar-message):
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:
        (WebInspector._createGlobalStatusBarItems):
        (WebInspector.showViewInDrawer):
        (WebInspector._closePreviousDrawerView):
        * inspector/front-end/timelinePanel.css:
        (.timeline-records-counter):

2012-07-26  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL][WK2] Implement Network Information provider
        https://bugs.webkit.org/show_bug.cgi?id=92343

        Reviewed by Kenneth Rohde Christiansen.

        Moved Network Information provider code from WebKit1
        to WebCore so that it can be shared with WebKit2.

        No new tests, no behavior change.

        * PlatformEfl.cmake:
        * platform/efl/NetworkInfoProviderEfl.cpp: Copied from Source/WebKit/efl/WebCoreSupport/NetworkInfoClientEfl.cpp.
        (WebCore):
        (WebCore::NetworkInfoProviderEfl::NetworkInfoProviderEfl):
        (WebCore::NetworkInfoProviderEfl::startUpdating):
        (WebCore::NetworkInfoProviderEfl::stopUpdating):
        (WebCore::NetworkInfoProviderEfl::bandwidth):
        * platform/efl/NetworkInfoProviderEfl.h: Added.
        (WebCore):
        (NetworkInfoProviderEfl):

2012-07-25  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: SASS source mapping straw man (behind experiment)
        https://bugs.webkit.org/show_bug.cgi?id=92265

        Reviewed by Vsevolod Vlasov.

        This change introduces SASS mapping support (behind the experiment).

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/CSSStyleModel.js:
        (WebInspector.CSSStyleModel):
        (WebInspector.CSSStyleModel.prototype.resourceBinding):
        (WebInspector.CSSStyleModel.prototype.setSourceMapping):
        (WebInspector.CSSStyleModel.prototype.resetSourceMappings):
        (WebInspector.CSSStyleModel.prototype._rawLocationToUILocation):
        (WebInspector.CSSLocation):
        (WebInspector.CSSRule):
        (WebInspector.CSSRule.prototype.get isRegular):
        (WebInspector.CSSRule.prototype.uiLocation):
        * inspector/front-end/ContentProviders.js:
        (WebInspector.StaticContentProvider.prototype.contentType):
        * inspector/front-end/SASSSourceMapping.js: Added.
        (WebInspector.SASSSourceMapping):
        (WebInspector.SASSSourceMapping.prototype._populate):
        (WebInspector.SASSSourceMapping.prototype._resourceAdded.didRequestContent):
        (WebInspector.SASSSourceMapping.prototype._resourceAdded):
        (rawLocationToUILocation):
        (uiLocationToRawLocation):
        (uiSourceCodes):
        (reset):
        (WebInspector.SASSSource):
        (WebInspector.SASSSource.prototype.isEditable):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
        * inspector/front-end/Settings.js:
        (WebInspector.ExperimentsSettings):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StylesUISourceCodeProvider):
        (WebInspector.StylesUISourceCodeProvider.prototype.rawLocationToUILocation):
        (WebInspector.StylesUISourceCodeProvider.prototype.uiLocationToRawLocation):
        (WebInspector.StylesUISourceCodeProvider.prototype._resourceAdded):
        (WebInspector.StylesUISourceCodeProvider.prototype.reset):
        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylePropertyTreeElement.prototype):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UILocation.prototype.uiLocationToRawLocation):
        (WebInspector.UILocation.prototype.url):
        * inspector/front-end/Workspace.js:
        (WebInspector.Workspace):
        * inspector/front-end/inspector.html:

2012-07-26  Vsevolod Vlasov  <vsevik@chromium.org>

        Unreviewed r123761 follow-up, inspector closure compilation fix.

        * inspector/front-end/Script.js:
        (WebInspector.Script.Location.prototype.uiLocation):
        * inspector/front-end/ScriptSnippetModel.js:

2012-07-26  Patrick Gansterer  <paroga@webkit.org>

        Cleanup GraphicsContext::(getWindowsContext|releaseWindowsContext)
        https://bugs.webkit.org/show_bug.cgi?id=92113

        Reviewed by Simon Hausmann.

        Cleanup the definition of the two methods across different ports and
        replace the calls to them with LocalWindowsContext where possible.

        * platform/graphics/GraphicsContext.h:
        (GraphicsContext):
        * platform/win/ScrollbarThemeWin.cpp:
        (WebCore::ScrollbarThemeWin::paintThumb):

2012-07-27 Chris Fleizach <cfleizach@apple.com>

        WebKit should expose @title as label (AXTitle or AXDescription) sometimes instead of AXHelp, according to the ARIA text alt computation
        https://bugs.webkit.org/show_bug.cgi?id=91911

        Reviewed by Anders Carlsson.

        The ARIA spec states that the title attribute should be used as the last resort for a description of an element. WebKit needs to honor that.

        Test: platform/mac/accessibility/title-attribute-used-as-last-resort.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::helpText):
        (WebCore::AccessibilityRenderObject::accessibilityDescription):

2012-07-26  Vsevolod Vlasov  <vsevik@chromium.org>

        Unreviewed r123761 follow-up, inspector closure compilation fix.

        * inspector/front-end/Script.js:
        (WebInspector.Script.Location.prototype.uiLocation):
        * inspector/front-end/ScriptSnippetModel.js:

2012-07-26  Patrick Gansterer  <paroga@webkit.org>

        Cleanup GraphicsContext::(getWindowsContext|releaseWindowsContext)
        https://bugs.webkit.org/show_bug.cgi?id=92113

        Reviewed by Simon Hausmann.

        Cleanup the definition of the two methods across different ports and
        replace the calls to them with LocalWindowsContext where possible.

        * platform/graphics/GraphicsContext.h:
        (GraphicsContext):
        * platform/win/ScrollbarThemeWin.cpp:
        (WebCore::ScrollbarThemeWin::paintThumb):

2012-07-26  Vsevolod Vlasov  <vsevik@chromium.org>

        Unreviewed r123761 follow-up, inspector closure compilation fix.

        * inspector/front-end/Script.js:
        (WebInspector.Script.Location.prototype.uiLocation):
        * inspector/front-end/ScriptSnippetModel.js:

2012-07-26  Patrick Gansterer  <paroga@webkit.org>

        Cleanup GraphicsContext::(getWindowsContext|releaseWindowsContext)
        https://bugs.webkit.org/show_bug.cgi?id=92113

        Reviewed by Simon Hausmann.

        Cleanup the definition of the two methods across different ports and
        replace the calls to them with LocalWindowsContext where possible.

        * platform/graphics/GraphicsContext.h:
        (GraphicsContext):
        * platform/win/ScrollbarThemeWin.cpp:
        (WebCore::ScrollbarThemeWin::paintThumb):

2012-07-26  Olivier Blin  <olivier.blin@softathome.com>

        Add FastMalloc statistics in window.internals
        https://bugs.webkit.org/show_bug.cgi?id=91274

        Reviewed by Ryosuke Niwa.

        Test: fast/harness/fastmallocstatistics-object.html

        * CMakeLists.txt:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * WebCore.vcproj/WebCoreTestSupport.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * testing/FastMallocStatistics.h: Added.
        (WebCore):
        (FastMallocStatistics):
        (WebCore::FastMallocStatistics::create):
        (WebCore::FastMallocStatistics::reservedVMBytes):
        (WebCore::FastMallocStatistics::committedVMBytes):
        (WebCore::FastMallocStatistics::freeListBytes):
        (WebCore::FastMallocStatistics::FastMallocStatistics):
        * testing/FastMallocStatistics.idl: Added.
        * testing/Internals.cpp:
        (WebCore::Internals::fastMallocStatistics):
        (WebCore):
        * testing/Internals.h:
        (WebCore):
        (Internals):
        * testing/Internals.idl:

2012-07-26  Adrienne Walker  <enne@google.com>

        [chromium] Remove redundant surface origin transforms
        https://bugs.webkit.org/show_bug.cgi?id=91815

        Reviewed by Stephen White.

        Bug 91417 changed draw transforms to become equivalent to origin
        transforms for surfaces. This change removes them as they are no
        longer needed for anything.

        No new tests. Just a refactoring.

        * platform/graphics/chromium/RenderSurfaceChromium.h:
        (RenderSurfaceChromium):
        * platform/graphics/chromium/cc/CCDamageTracker.cpp:
        (WebCore::CCDamageTracker::extendDamageForRenderSurface):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::computeScrollCompensationMatrixForChildren):
        (WebCore::calculateDrawTransformsInternal):
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::::leaveToRenderTarget):
        (WebCore::::unoccludedContributingSurfaceContentRect):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
        (WebCore::CCRenderPassDrawQuad::create):
        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
        (CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::createSharedQuadState):
        (WebCore::CCRenderSurface::createReplicaSharedQuadState):
        (WebCore::CCRenderSurface::appendQuads):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (CCRenderSurface):

2012-07-25  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: simplify handling of status bar items
        https://bugs.webkit.org/show_bug.cgi?id=92143

        Reviewed by Pavel Feldman.

        - split status bars into "global" (always in the bottom) and "panel"
            (on top of the drawer when drawer is shown)
        - use "inner" status bar section in global status bar to display either
            panel status bar items or drawer view items (depending on drawer visibility)
        - let panels/views manage their counters as part of their status bar
            items, not through special interface members;
        - get rid of absolute positioning in the status bars where possible;

        * inspector/front-end/AdvancedSearchController.js:
        (WebInspector.SearchView.prototype.get statusBarItems):
        * inspector/front-end/Drawer.js:
        (WebInspector.Drawer):
        (WebInspector.Drawer.prototype.show.animationFinished):
        (WebInspector.Drawer.prototype.show):
        (WebInspector.Drawer.prototype.hide.animationFinished):
        (WebInspector.Drawer.prototype.hide):
        (WebInspector.Drawer.prototype._startStatusBarDragging):
        * inspector/front-end/Panel.js:
        (WebInspector.Panel.prototype.wasShown):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype.get statusBarItems):
        (WebInspector.TimelinePanel.prototype.willHide):
        * inspector/front-end/elementsPanel.css:
        (.crumbs):
        * inspector/front-end/inspector.css:
        (#main):
        (body.drawer-visible #main-panels):
        (.status-bar):
        (.status-bar-item):
        (#panel-status-bar-placeholder):
        (body.drawer-visible #panel-status-bar-placeholder):
        (#panel-status-bar-resizer):
        (#panel-status-bar):
        (#panel-status-bar > div):
        (#error-warning-count):
        (#drawer):
        (#drawer-contents):
        (.status-bar-items):
        (.drawer-header):
        (#inner-status-bar):
        (.search-status-bar-item):
        (.search-status-bar-message):
        (.search-status-bar-progress):
        (body:not(.platform-mac) .search-status-bar-progress):
        (body.platform-mac .search-status-bar-progress):
        (.search-status-bar-stop-button-item):
        (.search-status-bar-stop-button .glyph):
        (.search-results-status-bar-message):
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:
        (WebInspector._createGlobalStatusBarItems):
        (WebInspector.showViewInDrawer):
        (WebInspector._closePreviousDrawerView):
        * inspector/front-end/timelinePanel.css:
        (.timeline-records-counter):

2012-07-26  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL][WK2] Implement Network Information provider
        https://bugs.webkit.org/show_bug.cgi?id=92343

        Reviewed by Kenneth Rohde Christiansen.

        Moved Network Information provider code from WebKit1
        to WebCore so that it can be shared with WebKit2.

        No new tests, no behavior change.

        * PlatformEfl.cmake:
        * platform/efl/NetworkInfoProviderEfl.cpp: Copied from Source/WebKit/efl/WebCoreSupport/NetworkInfoClientEfl.cpp.
        (WebCore):
        (WebCore::NetworkInfoProviderEfl::NetworkInfoProviderEfl):
        (WebCore::NetworkInfoProviderEfl::startUpdating):
        (WebCore::NetworkInfoProviderEfl::stopUpdating):
        (WebCore::NetworkInfoProviderEfl::bandwidth):
        * platform/efl/NetworkInfoProviderEfl.h: Added.
        (WebCore):
        (NetworkInfoProviderEfl):

2012-07-25  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: SASS source mapping straw man (behind experiment)
        https://bugs.webkit.org/show_bug.cgi?id=92265

        Reviewed by Vsevolod Vlasov.

        This change introduces SASS mapping support (behind the experiment).

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/CSSStyleModel.js:
        (WebInspector.CSSStyleModel):
        (WebInspector.CSSStyleModel.prototype.resourceBinding):
        (WebInspector.CSSStyleModel.prototype.setSourceMapping):
        (WebInspector.CSSStyleModel.prototype.resetSourceMappings):
        (WebInspector.CSSStyleModel.prototype._rawLocationToUILocation):
        (WebInspector.CSSLocation):
        (WebInspector.CSSRule):
        (WebInspector.CSSRule.prototype.get isRegular):
        (WebInspector.CSSRule.prototype.uiLocation):
        * inspector/front-end/ContentProviders.js:
        (WebInspector.StaticContentProvider.prototype.contentType):
        * inspector/front-end/SASSSourceMapping.js: Added.
        (WebInspector.SASSSourceMapping):
        (WebInspector.SASSSourceMapping.prototype._populate):
        (WebInspector.SASSSourceMapping.prototype._resourceAdded.didRequestContent):
        (WebInspector.SASSSourceMapping.prototype._resourceAdded):
        (rawLocationToUILocation):
        (uiLocationToRawLocation):
        (uiSourceCodes):
        (reset):
        (WebInspector.SASSSource):
        (WebInspector.SASSSource.prototype.isEditable):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
        * inspector/front-end/Settings.js:
        (WebInspector.ExperimentsSettings):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StylesUISourceCodeProvider):
        (WebInspector.StylesUISourceCodeProvider.prototype.rawLocationToUILocation):
        (WebInspector.StylesUISourceCodeProvider.prototype.uiLocationToRawLocation):
        (WebInspector.StylesUISourceCodeProvider.prototype._resourceAdded):
        (WebInspector.StylesUISourceCodeProvider.prototype.reset):
        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylePropertyTreeElement.prototype):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UILocation.prototype.uiLocationToRawLocation):
        (WebInspector.UILocation.prototype.url):
        * inspector/front-end/Workspace.js:
        (WebInspector.Workspace):
        * inspector/front-end/inspector.html:

2012-07-26  Vsevolod Vlasov  <vsevik@chromium.org>

        Unreviewed r123761 follow-up, inspector closure compilation fix.

        * inspector/front-end/Script.js:
        (WebInspector.Script.Location.prototype.uiLocation):
        * inspector/front-end/ScriptSnippetModel.js:

2012-07-26  Patrick Gansterer  <paroga@webkit.org>

        Cleanup GraphicsContext::(getWindowsContext|releaseWindowsContext)
        https://bugs.webkit.org/show_bug.cgi?id=92113

        Reviewed by Simon Hausmann.

        Cleanup the definition of the two methods across different ports and
        replace the calls to them with LocalWindowsContext where possible.

        * platform/graphics/GraphicsContext.h:
        (GraphicsContext):
        * platform/win/ScrollbarThemeWin.cpp:
        (WebCore::ScrollbarThemeWin::paintThumb):

2012-07-27 Chris Fleizach <cfleizach@apple.com>

        WebKit should expose @title as label (AXTitle or AXDescription) sometimes instead of AXHelp, according to the ARIA text alt computation
        https://bugs.webkit.org/show_bug.cgi?id=91911

        Reviewed by Anders Carlsson.

        The ARIA spec states that the title attribute should be used as the last resort for a description of an element. WebKit needs to honor that.

        Test: platform/mac/accessibility/title-attribute-used-as-last-resort.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::helpText):
        (WebCore::AccessibilityRenderObject::accessibilityDescription):

2012-07-26  Vsevolod Vlasov  <vsevik@chromium.org>

        Unreviewed r123761 follow-up, inspector closure compilation fix.

        * inspector/front-end/Script.js:
        (WebInspector.Script.Location.prototype.uiLocation):
        * inspector/front-end/ScriptSnippetModel.js:

2012-07-26  Patrick Gansterer  <paroga@webkit.org>

        Cleanup GraphicsContext::(getWindowsContext|releaseWindowsContext)
        https://bugs.webkit.org/show_bug.cgi?id=92113

        Reviewed by Simon Hausmann.

        Cleanup the definition of the two methods across different ports and
        replace the calls to them with LocalWindowsContext where possible.

        * platform/graphics/GraphicsContext.h:
        (GraphicsContext):
        * platform/win/ScrollbarThemeWin.cpp:
        (WebCore::ScrollbarThemeWin::paintThumb):

2012-07-26  Vsevolod Vlasov  <vsevik@chromium.org>

        Unreviewed r123761 follow-up, inspector closure compilation fix.

        * inspector/front-end/Script.js:
        (WebInspector.Script.Location.prototype.uiLocation):
        * inspector/front-end/ScriptSnippetModel.js:

2012-07-26  Patrick Gansterer  <paroga@webkit.org>

        Cleanup GraphicsContext::(getWindowsContext|releaseWindowsContext)
        https://bugs.webkit.org/show_bug.cgi?id=92113

        Reviewed by Simon Hausmann.

        Cleanup the definition of the two methods across different ports and
        replace the calls to them with LocalWindowsContext where possible.

        * platform/graphics/GraphicsContext.h:
        (GraphicsContext):
        * platform/win/ScrollbarThemeWin.cpp:
        (WebCore::ScrollbarThemeWin::paintThumb):

2012-07-26  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Introduce generic LiveLocation, make Script.Location inherit it.
        https://bugs.webkit.org/show_bug.cgi?id=92388

        Reviewed by Pavel Feldman.

        Introduced abstract LiveLocation implemented by Script.Location.

        * inspector/front-end/Script.js:
        (WebInspector.Script.Location):
        (WebInspector.Script.Location.prototype.uiLocation):
        (WebInspector.Script.Location.prototype.dispose):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode):
        (WebInspector.LiveLocation):
        (WebInspector.LiveLocation.prototype.update):
        (WebInspector.LiveLocation.prototype.rawLocation):
        (WebInspector.LiveLocation.prototype.uiLocation):
        (WebInspector.LiveLocation.prototype.dispose):
        * inspector/front-end/inspector.html:

2012-07-26  Joshua Netterfield  <jnetterfield@rim.com>

        [BlackBerry] readPixels on FBOs are limited to canvas size on SGX platforms
        https://bugs.webkit.org/show_bug.cgi?id=92301

        Reviewed by Rob Buis.

        This fixes fast/canvas/webgl/uninitialized-test.html on BlackBerry, no new tests.

        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
        (WebCore::GraphicsContext3D::readPixels):
        (WebCore::GraphicsContext3D::readPixelsAndConvertToBGRAIfNecessary):

2012-07-26  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: reduce auto refresh rate of the live native memory diagram
        https://bugs.webkit.org/show_bug.cgi?id=92372

        Reviewed by Pavel Feldman.

        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.NativeMemoryBarChart.prototype.wasShown):

2012-07-26  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: add GC button to the profiles panel toolbar.
        https://bugs.webkit.org/show_bug.cgi?id=92369

        Reviewed by Pavel Feldman.

        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
        (WebInspector.ProfilesPanel.prototype._garbageCollectButtonClicked):
        * inspector/front-end/profilesPanel.css:
        (.garbage-collect-status-bar-item .glyph):

2012-07-26  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Move region from HitTestResult to HitTestPoint.
        https://bugs.webkit.org/show_bug.cgi?id=92367

        Reviewed by Antonio Gomes.

        Moves the region to HitTestPoint where it makes more sense, and use this
        change to simplify hit-testing a new region in RenderFlowThread.

        No new functionality. No new tests.

        * rendering/HitTestResult.cpp:
        (WebCore::HitTestPoint::HitTestPoint):
        (WebCore::HitTestPoint::operator=):
        (WebCore::HitTestResult::HitTestResult):
        (WebCore::HitTestResult::operator=):
        * rendering/HitTestResult.h:
        (HitTestPoint):
        (WebCore::HitTestPoint::region):
        (HitTestResult):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::nodeAtPoint):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::nodeAtPoint):
        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::hitTestRegion):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::hitTestLayer):
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::nodeAtPoint):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::nodeAtPoint):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::nodeAtPoint):

2012-07-26  Jan Keromnes  <janx@linux.com>

        Web Inspector: ExtensionView constructor shouldn't take parent argument
        https://bugs.webkit.org/show_bug.cgi?id=92326

        Reviewed by Pavel Feldman.

        ExtensionView's constructor took a parent element parameter and auto-
        showed itself in the constructor. This didn't allow lazy showing and
        was confusing because it didn't work like a classic View object. Fixed.

        No new tests needed: Refactoring with no behavior changes.

        * inspector/front-end/ExtensionPanel.js:
        (WebInspector.ExtensionPanel):
        (WebInspector.ExtensionSidebarPane.prototype.setPage):
        * inspector/front-end/ExtensionView.js:
        (WebInspector.ExtensionView):

2012-07-26  Joshua Netterfield  <jnetterfield@rim.com>

        [WebGL] ANGLEWebKitBridge should support ESSL platforms
        https://bugs.webkit.org/show_bug.cgi?id=92295

        Reviewed by Rob Buis.

        This tells ANGLEWebKitBridge to output ESSL code for the BlackBerry
        platform. This eliminates the need for a previous hack. In addition,
        some (GLSL) ANGLE output that could not be compiled (for example,
        glsl-mat4-to-mat3.html) now compiles.

        * platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp:
        (WebCore::GraphicsContext3D::GraphicsContext3D):
        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:
        (WebCore::Extensions3DOpenGLCommon::getTranslatedShaderSourceANGLE):

2012-07-26  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: replace "textInput" keyboard event listener breakpoint with "input"
        https://bugs.webkit.org/show_bug.cgi?id=92384

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/BreakpointsSidebarPane.js:
        (WebInspector.EventListenerBreakpointsSidebarPane):

2012-07-26  Jer Noble  <jer.noble@apple.com>

        Add a MediaPlayer API to retrieve the description of the current media engine.
        https://bugs.webkit.org/show_bug.cgi?id=92336

        Reviewed by Eric Carlson.

        Add a utility function which retrieves, for diagnostic purposes, a brief description
        of the current media engine. Stubs have been added for each of the MediaPlayerPrivate
        subclasses which return the name of the class.

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::engineDescription):
        * platform/graphics/MediaPlayer.h:
        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::engineDescription):
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
        (WebCore::MediaPlayerPrivateAVFoundation::engineDescription):
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
        (WebCore::MediaPlayerPrivate::engineDescription):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
        (WebCore::MediaPlayerPrivateGStreamer::engineDescription):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        (WebCore::MediaPlayerPrivateQTKit::engineDescription):
        * platform/graphics/qt/MediaPlayerPrivateQt.h:
        (WebCore::MediaPlayerPrivateQt::engineDescription):
        * platform/graphics/wince/MediaPlayerPrivateWinCE.h:
        (WebCore::MediaPlayerPrivate::engineDescription):
        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h:
        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::engineDescription):

2012-07-26  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: Edits of styles declared after invalid selector are not applied
        https://bugs.webkit.org/show_bug.cgi?id=92382

        Reviewed by Vsevolod Vlasov.

        Now popping selectorless rules as well.

        Test: inspector/styles/styles-edit-property-after-invalid-rule.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::createStyleRule):

2012-07-26  Joshua Netterfield  <jnetterfield@rim.com>

        [WebGL] GraphicsContext3D::readPixels has extraneous code from GraphicsContext3D::readPixelsIMG
        https://bugs.webkit.org/show_bug.cgi?id=92302

        Reviewed by Noam Rosenthal.

        This undoes a mistake from https://bugs.webkit.org/show_bug.cgi?id=90567.

        No new tests, because it introduces no new functionality, but it makes the WebGL aquarium demo
        run quite a bit smoother on SGX :)

        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
        (WebCore::GraphicsContext3D::readPixels):

2012-07-26  Yury Semikhatsky  <yurys@chromium.org>

        Unreviewed. Revert r123740 as it breaks AppleMac compilation.

        * WebCore.exp.in:
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):

2012-07-26  Yury Semikhatsky  <yurys@chromium.org>

        Unreviewed. Fix AppleMac compilation after r123740.

        * WebCore.exp.in: Added missing symbol.

2012-07-26  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: move StringImpl size calculation to StringImpl
        https://bugs.webkit.org/show_bug.cgi?id=92359

        Reviewed by Pavel Feldman.

        Moved stringSize(StringImpl*) implementation from InspectorMemoryAgent to
        StringImpl::sizeInBytes();

        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):

2012-07-26  Charles Wei  <charles.wei@torchmobile.com.cn>

        Remove redundant include of PageGroup.h in FrameLoader.cpp
        https://bugs.webkit.org/show_bug.cgi?id=92357

        Reviewed by Kentaro Hara.


        No new tests, just remove redundant include file.

        * loader/FrameLoader.cpp:

2012-07-26  Eric Seidel  <eric@webkit.org>

        2% of all samples running grid demo show up in StyleResolver::canShareStyleWithElement, 20% of those due to getAttribute instead of fastGetAttribute
        https://bugs.webkit.org/show_bug.cgi?id=92257

        Reviewed by Andreas Kling.

        This check was added 7 years ago by hyatt in:
        http://trac.webkit.org/changeset/10984
        And then later made slow after triggering an ASSERT added:
        http://trac.webkit.org/changeset/97670

        SVG uses a "type" attribute (and it is animatable), but only when
        used on filter elements:
        http://www.w3.org/TR/SVG/attindex.html
        In any case, this does not apply here, and is certainly not what
        this check was originally intended for.

        I've moved the check to canShareStyleWithControl
        as it is only needed when the elements in question are both input elements.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-07-26  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add memory reporting routine to StyleResolver
        https://bugs.webkit.org/show_bug.cgi?id=92259

        Reviewed by Vsevolod Vlasov.

        SyleResolver::reportMemoryUsage is added for estimating StyleResolver
        memory footprint.

        * css/StyleResolver.cpp:
        (RuleData):
        (RuleSet):
        (RuleSetSelectorPair):
        (WebCore::StyleResolver::Features::reportMemoryUsage):
        (WebCore):
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleResolver.h:
        (Features):
        (StyleResolver):
        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        * dom/MemoryInstrumentation.h:
        (MemoryInstrumentation):
        (WebCore::MemoryClassInfo::addInstrumentedHashSet):
        (WebCore::MemoryClassInfo::addInstrumentedVector):
        (WebCore::MemoryInstrumentation::addHashMap):
        (WebCore):
        (WebCore::MemoryInstrumentation::addInstrumentedCollection):

2012-07-26  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: Remove DeprecatedPeerConnection
        https://bugs.webkit.org/show_bug.cgi?id=92106

        Reviewed by Adam Barth.

        Since we are getting ready to add an updated PeerConnection
        the old DeprecatedPeerConnection will have to go.

        No new tests, and old tests converted to use PeerConnection00.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Modules/mediastream/DOMWindowMediaStream.idl:
        * Modules/mediastream/DeprecatedPeerConnection.cpp: Removed.
        * Modules/mediastream/DeprecatedPeerConnection.h: Removed.
        * Modules/mediastream/DeprecatedPeerConnection.idl: Removed.
        * Modules/mediastream/SignalingCallback.h: Removed.
        * Modules/mediastream/SignalingCallback.idl: Removed.
        * PlatformBlackBerry.cmake:
        * PlatformEfl.cmake:
        * UseJSC.cmake:
        * WebCore.gypi:
        * bindings/generic/RuntimeEnabledFeatures.h:
        * bindings/js/JSDeprecatedPeerConnectionCustom.cpp: Removed.
        * dom/EventTargetFactory.in:
        * platform/mediastream/DeprecatedPeerConnectionHandler.h: Removed.
        * platform/mediastream/DeprecatedPeerConnectionHandlerClient.h: Removed.
        * platform/mediastream/blackberry/DeprecatedPeerConnectionHandler.cpp: Removed.
        * platform/mediastream/chromium/DeprecatedPeerConnectionHandler.cpp: Removed.
        * platform/mediastream/chromium/DeprecatedPeerConnectionHandlerInternal.cpp: Removed.
        * platform/mediastream/chromium/DeprecatedPeerConnectionHandlerInternal.h: Removed.
        * platform/mediastream/gstreamer/DeprecatedPeerConnectionHandler.cpp: Removed.

2012-07-26  Mike West  <mkwst@chromium.org>

        CSP 1.1: Implement the Content Security Policy script interface.
        https://bugs.webkit.org/show_bug.cgi?id=91707

        Reviewed by Adam Barth.

        The CSP 1.1 editor's draft defines a script interface that gives
        developers the ability to query a document regarding the restrictions
        set by it's currently active content security policy[1]. This patch
        exposes that API in terms of a new DOMSecurityPolicy object.

        Data for the API is gathered from the existing ContentSecurityPolicy
        object on the containing document. CSP's various methods have been
        extended with a `reportingStatus` parameter which, unsurprisingly,
        determines whether a violation report should be sent for blocked
        resources. This allows us to reuse the same codepaths by simply using
        ContentSecurityPolicy::SuppressReport when querying on behalf of the
        API, and ContentSecurityPolicy::SendReport when checking resources a
        page wants to load.

        This feature is gated on the CSP_NEXT flag, which is currently disabled
        for all ports other than Chromium.

        [1]: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#script-interfaces--experimental

        Tests: http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowconnectionto.html
               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-alloweval.html
               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowfontfrom.html
               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowframefrom.html
               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowimagefrom.html
               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowmediafrom.html
               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowobjectfrom.html
               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowscriptfrom.html
               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowstylefrom.html
               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-isactive.html
               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-reporturi.html

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * WebCore.gypi:
        * bindings/gobject/GNUmakefile.am:
        * WebCore.xcodeproj/project.pbxproj:
            We added a new object, so let's tell _everyone!_
        * dom/Document.cpp:
        (WebCore::Document::securityPolicy):
            Expose the SecurityPolicy object via Document, gated on CSP_NEXT.
        (WebCore):
        * dom/Document.h:
        (WebCore):
        (Document):
        * dom/Document.idl:
            Adding the SecurityPolicy object to the document, gated on CSP_NEXT.
        * page/ContentSecurityPolicy.cpp:
        (CSPDirectiveList):
        (WebCore::CSPDirectiveList::checkInline):
        (WebCore::CSPDirectiveList::checkNonce):
        (WebCore::CSPDirectiveList::checkSource):
            Extracting the core checks out into separate methods.
        (WebCore::CSPDirectiveList::checkEvalAndReportViolation):
            Use checkEval.
        (WebCore::CSPDirectiveList::checkNonceAndReportViolation):
            Use checkNonce.
        (WebCore::CSPDirectiveList::checkInlineAndReportViolation):
            Use checkInline.
        (WebCore::CSPDirectiveList::checkSourceAndReportViolation):
            Use checkSource.
        (WebCore::CSPDirectiveList::allowJavaScriptURLs):
        (WebCore::CSPDirectiveList::allowInlineEventHandlers):
        (WebCore::CSPDirectiveList::allowInlineScript):
        (WebCore::CSPDirectiveList::allowInlineStyle):
        (WebCore::CSPDirectiveList::allowEval):
        (WebCore::CSPDirectiveList::allowScriptFromSource):
        (WebCore::CSPDirectiveList::allowObjectFromSource):
        (WebCore::CSPDirectiveList::allowChildFrameFromSource):
        (WebCore::CSPDirectiveList::allowImageFromSource):
        (WebCore::CSPDirectiveList::allowStyleFromSource):
        (WebCore::CSPDirectiveList::allowFontFromSource):
        (WebCore::CSPDirectiveList::allowMediaFromSource):
        (WebCore::CSPDirectiveList::allowConnectToSource):
            These methods now branch on `reportingStatus`: if `SendReoport`,
            they call `checkXAndReportViolation`, otherwise, they call `checkX`.
        (WebCore::CSPDirectiveList::gatherReportURIs):
            New method that gathers the violation report URIs into a DOMStringList.
        (WebCore::isAllowedByAllWithCallStack):
        (WebCore::isAllowedByAllWithContext):
        (WebCore::isAllowedByAllWithURL):
            These now pass reportingStatus through to the various `allowX` methods.
        (WebCore::ContentSecurityPolicy::allowJavaScriptURLs):
        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers):
        (WebCore::ContentSecurityPolicy::allowInlineScript):
        (WebCore::ContentSecurityPolicy::allowInlineStyle):
        (WebCore::ContentSecurityPolicy::allowEval):
        (WebCore::ContentSecurityPolicy::allowScriptFromSource):
        (WebCore::ContentSecurityPolicy::allowObjectFromSource):
        (WebCore::ContentSecurityPolicy::allowChildFrameFromSource):
        (WebCore::ContentSecurityPolicy::allowImageFromSource):
        (WebCore::ContentSecurityPolicy::allowStyleFromSource):
        (WebCore::ContentSecurityPolicy::allowFontFromSource):
        (WebCore::ContentSecurityPolicy::allowMediaFromSource):
        (WebCore::ContentSecurityPolicy::allowConnectToSource):
            These accept a new `reportingStatus` parameter, which is passed through
            to the CSPDirectiveList methods.
        (WebCore::ContentSecurityPolicy::isActive):
            New method that returns `true` if policy is active.
        (WebCore::ContentSecurityPolicy::gatherReportURIs):
            New method that returns a DOMStringList of violation report URIs.
        * page/ContentSecurityPolicy.h:
        (WebCore):
        * page/DOMSecurityPolicy.cpp: Added.
        (WebCore::DOMSecurityPolicy::DOMSecurityPolicy):
        (WebCore):
        (WebCore::DOMSecurityPolicy::~DOMSecurityPolicy):
        (WebCore::DOMSecurityPolicy::isActive):
        (WebCore::DOMSecurityPolicy::reportURIs):
        (WebCore::DOMSecurityPolicy::allowsInlineScript):
        (WebCore::DOMSecurityPolicy::allowsInlineStyle):
        (WebCore::DOMSecurityPolicy::allowsEval):
        (WebCore::DOMSecurityPolicy::allowsConnectionTo):
        (WebCore::DOMSecurityPolicy::allowsFontFrom):
        (WebCore::DOMSecurityPolicy::allowsFrameFrom):
        (WebCore::DOMSecurityPolicy::allowsImageFrom):
        (WebCore::DOMSecurityPolicy::allowsMediaFrom):
        (WebCore::DOMSecurityPolicy::allowsObjectFrom):
        (WebCore::DOMSecurityPolicy::allowsScriptFrom):
        (WebCore::DOMSecurityPolicy::allowsStyleFrom):
        * page/DOMSecurityPolicy.h: Added.
        (WebCore):
        (DOMSecurityPolicy):
        (WebCore::DOMSecurityPolicy::create):
        * page/DOMSecurityPolicy.idl: Added.

2012-07-26  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Unreviewed. Fix build break on mac win port by r123716.

        * platform/KURL.h:
        (KURL):

2012-07-26  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r123715.
        http://trac.webkit.org/changeset/123715
        https://bugs.webkit.org/show_bug.cgi?id=92356

        Breaks compilation on multiple platforms (Requested by vsevik
        on #webkit).

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::inspectedPageDestroyed):
        * inspector/InspectorInstrumentation.cpp:
        (WebCore):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        * inspector/InspectorResourceAgent.cpp:
        (WebCore::InspectorResourceAgent::didReceiveData):
        (WebCore::InspectorResourceAgent::getResponseBody):
        * inspector/InspectorResourceAgent.h:
        (InspectorResourceAgent):
        * inspector/NetworkResourcesData.cpp:
        (WebCore::NetworkResourcesData::ResourceData::ResourceData):
        (WebCore::NetworkResourcesData::ResourceData::setContent):
        (WebCore::NetworkResourcesData::ResourceData::dataLength):
        (WebCore::NetworkResourcesData::ResourceData::appendData):
        (WebCore::NetworkResourcesData::ResourceData::decodeDataToContent):
        (WebCore::NetworkResourcesData::setResourceContent):
        (WebCore::NetworkResourcesData::maybeAddResourceData):
        (WebCore::NetworkResourcesData::maybeDecodeDataToContent):
        (WebCore::NetworkResourcesData::setResourcesDataSizeLimits):
        (WebCore::NetworkResourcesData::ensureFreeSpace):
        * inspector/NetworkResourcesData.h:
        (ResourceData):
        (WebCore::NetworkResourcesData::ResourceData::cachedResource):
        (NetworkResourcesData):
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::~CachedResource):
        (WebCore::CachedResource::removeClient):
        (WebCore::CachedResource::deleteIfPossible):
        * loader/cache/CachedResource.h:
        (CachedResource):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::garbageCollectDocumentResourcesTimerFired):
        (WebCore::CachedResourceLoader::clearPreloads):
        * loader/cache/CachedResourceLoader.h:
        (CachedResourceLoader):
        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::evict):
        * testing/InternalSettings.cpp:
        * testing/Internals.cpp:
        * testing/Internals.h:
        (Internals):

2012-07-26  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Add *explicit* keyword to constructors in WebCore/platform
        https://bugs.webkit.org/show_bug.cgi?id=92238

        Reviewed by Kentaro Hara.

        As a step to let *explicit* keyword add to constructors which have a parameter,
        *explicit* keyword is added to Source/WebCore/platform in order to avoid implicit
        type conversion.

        Some files in platform directory can't use explicit keyword because of build breaks.

        No new tests. Covered by existing tests.

        * platform/AutodrainedPool.h:
        (AutodrainedPool):
        * platform/ContentType.h:
        (ContentType):
        * platform/ContextMenu.h:
        (ContextMenu):
        * platform/ContextMenuItem.h:
        (ContextMenuItem):
        * platform/Cursor.h:
        (WebCore::SharedCursor::SharedCursor):
        (Cursor):
        * platform/KURL.h:
        (WebCore::KURL::KURL):
        (KURL):
        * platform/KURLGooglePrivate.h:
        (KURLGooglePrivate):
        * platform/PODRedBlackTree.h:
        (WebCore::PODRedBlackTree::PODRedBlackTree):
        * platform/Pasteboard.h:
        (Pasteboard):
        * platform/PlatformEvent.h:
        (WebCore::PlatformEvent::PlatformEvent):
        * platform/PlatformKeyboardEvent.h:
        (PlatformKeyboardEvent):
        * platform/PlatformMouseEvent.h:
        (PlatformMouseEvent):
        * platform/PlatformPasteboard.h:
        (PlatformPasteboard):
        * platform/PlatformTouchEvent.h:
        (PlatformTouchEvent):
        * platform/PlatformWheelEvent.h:
        (PlatformWheelEvent):
        * platform/RunLoop.h:
        (TimerBase):
        * platform/ScrollAnimator.h:
        (ScrollAnimator):
        * platform/ScrollAnimatorNone.h:
        (ScrollAnimatorNone):
        * platform/SharedBuffer.h:
        (SharedBuffer):
        * platform/WheelFlingPlatformGestureCurve.h:
        (WheelFlingPlatformGestureCurve):
        * platform/Widget.h:
        (Widget):

2012-07-26  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Resource agent's reference to cached resources should be weak.
        https://bugs.webkit.org/show_bug.cgi?id=92108

        Reviewed by Pavel Feldman.

        NetworkResourcesData now stores a raw pointer to CachedResource.
        CachedResource now notifies InspectorInstrumentation that it will be destroyed.
        InspectorInstrumentation stores a set of InstrumentingAgents and broadcasts willDestroyCachedResource event to all available resourceAgents.
        Destroyed resources content is saved to NetworkResourcesData.
        Changed content size variables type in NetworkResourcesData from int to size_t.

        Tests: http/tests/inspector/network/cached-resource-destroyed-moved-to-storage.html
               http/tests/inspector/network/cached-resource-destroyed-too-big-discarded.html

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::inspectedPageDestroyed):
        * inspector/InspectorInstrumentation.cpp:
        (WebCore):
        (WebCore::InspectorInstrumentation::willDestroyCachedResourceImpl):
        (WebCore::InspectorInstrumentation::registerInstrumentingAgents):
        (WebCore::InspectorInstrumentation::unregisterInstrumentingAgents):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        (WebCore::InspectorInstrumentation::willDestroyCachedResource):
        (WebCore):
        * inspector/InspectorResourceAgent.cpp:
        (WebCore::InspectorResourceAgent::didReceiveData):
        (WebCore::InspectorResourceAgent::willDestroyCachedResource):
        (WebCore):
        (WebCore::InspectorResourceAgent::getResponseBody):
        * inspector/InspectorResourceAgent.h:
        (InspectorResourceAgent):
        * inspector/NetworkResourcesData.cpp:
        (WebCore::NetworkResourcesData::ResourceData::ResourceData):
        (WebCore::NetworkResourcesData::ResourceData::setContent):
        (WebCore::NetworkResourcesData::ResourceData::dataLength):
        (WebCore::NetworkResourcesData::ResourceData::appendData):
        (WebCore::NetworkResourcesData::ResourceData::decodeDataToContent):
        (WebCore::NetworkResourcesData::setResourceContent):
        (WebCore::NetworkResourcesData::maybeAddResourceData):
        (WebCore::NetworkResourcesData::maybeDecodeDataToContent):
        (WebCore::NetworkResourcesData::removeCachedResource):
        (WebCore):
        (WebCore::NetworkResourcesData::setResourcesDataSizeLimits):
        (WebCore::NetworkResourcesData::ensureFreeSpace):
        * inspector/NetworkResourcesData.h:
        (ResourceData):
        (WebCore::NetworkResourcesData::ResourceData::base64Encoded):
        (WebCore::NetworkResourcesData::ResourceData::cachedResource):
        (NetworkResourcesData):
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::~CachedResource):
        (WebCore::CachedResource::removeClient):
        (WebCore::CachedResource::deleteIfPossible):
        * loader/cache/CachedResource.h:
        (CachedResource):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::garbageCollectDocumentResourcesTimerFired):
        (WebCore::CachedResourceLoader::garbageCollectDocumentResources):
        (WebCore::CachedResourceLoader::clearPreloads):
        * loader/cache/CachedResourceLoader.h:
        (CachedResourceLoader):
        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::evict):
        * testing/InternalSettings.cpp:
        * testing/Internals.cpp:
        (WebCore::Internals::garbageCollectDocumentResources):
        (WebCore):
        * testing/Internals.h:
        (Internals):

2012-07-26  Luke Macpherson   <macpherson@chromium.org>

        Fix null ptr deref in CSSParser::storeVariableDeclaration().
        https://bugs.webkit.org/show_bug.cgi?id=92333

        Reviewed by Andreas Kling.

        Fix null pointer deref that occurs if the CSSParserValue couldn't be converted to a CSSValue.

        Test fast/css/variables/variable-unparseable-value-crash.html added.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::storeVariableDeclaration):

2012-07-26  Shinya Kawanaka  <shinyak@chromium.org>

        Add UserAgentShadowDOM to FormControlElement just before adding AuthorShadowDOM
        https://bugs.webkit.org/show_bug.cgi?id=90866

        Reviewed by Hajime Morita.

        It ensures that UserAgentShadowDOM is the oldest ShadowDOM.

        To show ValidationMessage, WebKit adds a Shadow DOM to some of FormControlElements.
        ValidationMessage assumes that the added Shadow DOM is the oldest, however, there was a case
        that a page author might add a Shadow DOM before ValidationMessage adds a Shadow DOM.
        It will break the assumption that the Shadow DOM added by ValidationMessage is the oldest.
        So we have prohibited a page author adding a Shadow DOM to FormControlElement.

        To add UserAgentShadowDOM, we use a callback which is called before a page author adding a Shadow DOM.
        It adds a UserAgentShadowDOM if it does not exist, so we can ensure that UserAgentShadowDOM is the oldest.

        Tests: fast/dom/shadow/input-with-validation-without-shadow.html
               fast/dom/shadow/input-with-validation.html
               fast/dom/shadow/shadowdom-for-button-complex-shadow.html
               fast/dom/shadow/shadowdom-for-button-only-shadow.html
               fast/dom/shadow/shadowdom-for-button-without-shadow.html
               fast/dom/shadow/shadowdom-for-fieldset-complex-shadow.html
               fast/dom/shadow/shadowdom-for-fieldset-only-shadow.html
               fast/dom/shadow/shadowdom-for-fieldset-without-shadow.html
               fast/dom/shadow/shadowdom-for-form-associated-element-useragent.html
               fast/dom/shadow/shadowdom-for-keygen-complex-shadow.html
               fast/dom/shadow/shadowdom-for-keygen-only-shadow.html
               fast/dom/shadow/shadowdom-for-keygen-without-shadow.html
               fast/dom/shadow/shadowdom-for-object-complex-shadow.html
               fast/dom/shadow/shadowdom-for-object-only-shadow.html
               fast/dom/shadow/shadowdom-for-object-without-shadow.html
               fast/dom/shadow/shadowdom-for-output-complex-shadow.html
               fast/dom/shadow/shadowdom-for-output-only-shadow.html
               fast/dom/shadow/shadowdom-for-output-without-shadow.html
               fast/dom/shadow/shadowdom-for-select-complex-shadow.html
               fast/dom/shadow/shadowdom-for-select-only-shadow.html
               fast/dom/shadow/shadowdom-for-select-without-shadow.html
               fast/dom/shadow/shadowdom-for-textarea-complex-shadow.html
               fast/dom/shadow/shadowdom-for-textarea-only-shadow.html
               fast/dom/shadow/shadowdom-for-textarea-without-shadow.html

        * dom/ShadowRoot.cpp:
        (WebCore::allowsAuthorShadowRoot):
        * html/FormAssociatedElement.cpp:
        (WebCore::FormAssociatedElement::ensureUserAgentShadowRoot): Ensures the existence of a UserAgentShadowRoot.
        If it does not exist, we create it with empty content.
        (WebCore):
        * html/FormAssociatedElement.h:
        (FormAssociatedElement):
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::willAddAuthorShadowRoot):
        (WebCore):
        * html/HTMLFormControlElement.h:
        (HTMLFormControlElement):
        * html/ValidationMessage.cpp:
        (WebCore::adjustBubblePosition): When AuthroShadowRoot does not a shadow element, ValidationMessage
        does not have a renderer. So we have to check the existence of renderer.
        (WebCore::ValidationMessage::buildBubbleTree):

2012-07-26  Kaustubh Atrawalkar  <kaustubh@motorola.com>

        [DRT] LTC:: pageNumberForElementById() could be moved to Internals
        https://bugs.webkit.org/show_bug.cgi?id=92091

        Reviewed by Adam Barth.

        Move the pageNumberForElementById from LayoutTestCotroller to Internals and
        remove the old platform specific implementations as it exclusively tests WebCore functionality.

        Covered by existing test cases.

        * testing/Internals.cpp:
        (WebCore::Internals::counterValue):
        (WebCore):
        (WebCore::Internals::pageNumber):
        * testing/Internals.h:
        (Internals):
        (WebCore::Internals::pageNumber):
        * testing/Internals.idl:

2012-07-25  MORITA Hajime  <morrita@google.com>

        [Chromium][Win] <progress> animation on RTL direction is reverse
        https://bugs.webkit.org/show_bug.cgi?id=92236

        Reviewed by Kent Tamura.

        This change modfies the way to handle RTL progress bar painting.
        Originally it computes the flipped coordinates. This change uses transformation for the flip.
        DirectionFlippingScope handles it.

        * rendering/RenderThemeChromiumLinux.cpp:
        (WebCore::RenderThemeChromiumLinux::paintProgressBar): Applied DirectionFlippingScope
        * rendering/RenderThemeChromiumSkia.cpp:
        (WebCore::RenderThemeChromiumSkia::determinateProgressValueRectFor):
        - Deleted RTL handling in favor of DirectionFlippingScope
        (WebCore::RenderThemeChromiumSkia::DirectionFlippingScope::DirectionFlippingScope):
        (WebCore):
        (WebCore::RenderThemeChromiumSkia::DirectionFlippingScope::~DirectionFlippingScope):
        * rendering/RenderThemeChromiumSkia.h:
        (RenderThemeChromiumSkia):
        (DirectionFlippingScope): Added.
        * rendering/RenderThemeChromiumWin.cpp:
        (WebCore):
        (WebCore::RenderThemeChromiumWin::paintProgressBar): Applied DirectionFlippingScope

2012-07-25  Vineet Chaudhary  <rgf748@motorola.com>

        https://bugs.webkit.org/show_bug.cgi?id=92260
        Repalce "int" with "long" from WebCore/*.idls

        Reviewed by Adam Barth.

        As per the WebIDL spec IDL shouldn't have int attributes but long instead.
        Repalced attributes types int with long from WebCore/*.idls.

        No new tests. TestObj.idl already covers this.
        There should be no behavioural changes.

        * dom/Touch.idl: Repalce int with long.
        * dom/WebKitNamedFlow.idl: Ditto.
        * html/canvas/ArrayBuffer.idl: Ditto.
        * html/canvas/WebGLActiveInfo.idl: Ditto.
        * html/canvas/WebGLShaderPrecisionFormat.idl: Ditto.
        * page/WebKitAnimation.idl: Ditto.

2012-07-25  Shinya Kawanaka  <shinyak@chromium.org>

        The elements in ShadowDOM of meter or progress should not be modifiable.
        https://bugs.webkit.org/show_bug.cgi?id=92199

        Reviewed by Hajime Morita.

        A user can set -webkit-user-modify: read-write to the elements in Shadow DOM in a meter or progress element.
        This might cause a undesired crash like Bug 65738. They should be unmodifiable.

        We add default css values to elements in ShadowDOM of meter or progress to prohibit editing them.

        Tests: fast/html/meter-user-modify.html
               fast/html/progress-user-modify.html

        * css/html.css:
        Added -webkit-user-modify: read-only !important; for these elements so that they won't be
        changed by a user.
        (meter::-webkit-meter-bar):
        (meter::-webkit-meter-optimum-value):
        (meter::-webkit-meter-suboptimum-value):
        (meter::-webkit-meter-even-less-good-value):
        (progress::-webkit-progress-bar):
        (progress::-webkit-progress-value):

2012-07-25  Joshua Netterfield  <jnetterfield@rim.com>

        [BlackBerry] GraphicsContext3D::paintToCanvas should not swap 0th and 2nd components of color
        https://bugs.webkit.org/show_bug.cgi?id=92314

        Reviewed by Rob Buis.

        No new tests, because it corrects existing functionality, but it makes BlackBerry
        pass canvas-text.html and others.

        * platform/graphics/GraphicsContext3D.h:
        * platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp:
        (WebCore::GraphicsContext3D::paintToCanvas):
        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):

2012-07-25  Joshua Netterfield  <jnetterfield@rim.com>

        [BlackBerry] GraphicsContext3D::reshapeFBOs does not report when bound FBOs should be restored
        https://bugs.webkit.org/show_bug.cgi?id=92304

        Reviewed by Rob Buis.

        No new tests, because it corrects existing functionality, but it makes BlackBerry
        pass framebuffer-bindings-unaffected-on-resize.html.

        * platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp:
        (WebCore::GraphicsContext3D::reshapeFBOs):

2012-07-25  Joshua Netterfield  <jnetterfield@rim.com>

        [BlackBerry] readPixels should set alpha to 255 instead of 0 when alpha is disabled
        https://bugs.webkit.org/show_bug.cgi?id=92303

        Reviewed by Rob Buis.

        No new tests, because it corrects existing functionality, but it makes BlackBerry
        pass context-attributes-alpha-depth-stencil-antialias.html.

        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore):
        (WebCore::WebGLRenderingContext::readPixels):

2012-07-25  Joshua Netterfield  <jnetterfield@rim.com>

        [WebGL] fast/canvas/webgl/framebuffer-object-attachment.html fails on certain platforms
        https://bugs.webkit.org/show_bug.cgi?id=92296

        Reviewed by Rob Buis.

        No new tests, because it introduces no new functionality, only fixes the above mentioned test.

        * html/canvas/WebGLFramebuffer.cpp:
        (WebCore::WebGLFramebuffer::checkStatus):

2012-07-25  Xingnan Wang  <xingnan.wang@intel.com>

        IndexedDB: IDBTransaction::abort() should throw DOMException
        https://bugs.webkit.org/show_bug.cgi?id=92069

        Reviewed by Kentaro Hara.

        Keep aligned with the W3C spec.
        http://dvcs.w3.org/hg/IndexedDB/raw-file/tip/Overview.html#widl-IDBTransaction-abort-void

        Test: storage/indexeddb/transaction-abort.html.

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::abort):
        (WebCore):
        * Modules/indexeddb/IDBTransaction.h:
        (IDBTransaction):
        * Modules/indexeddb/IDBTransaction.idl:

2012-07-25  Tony Chang  <tony@chromium.org>

        flexitems can overflow the flexbox due to rounding
        https://bugs.webkit.org/show_bug.cgi?id=92163

        Reviewed by Levi Weintraub.

        Don't round flex item sizes and use LayoutPoint for the location of flex items.

        Test: css3/flexbox/flex-rounding.html

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::resolveFlexibleLengths):
        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
        (WebCore::RenderFlexibleBox::layoutColumnReverse):

2012-07-25  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>

        [BlackBerry] Integrate certmgr with CredentialBackingStore
        https://bugs.webkit.org/show_bug.cgi?id=92183

        Reviewed by George Staikos.

        Integrated BlackBerry::Platform::CertMgrWrapper with
        CredentialBackingStore, when certmgr is ready we save
        the password in certmgr and retrieve it from certmgr.

        RIM PR: 171991
        Internally reviewed by Joe Mason <jmason@rim.com>.

        No new tests since there's no functional change.

        * platform/network/blackberry/CredentialBackingStore.cpp:
        (WebCore::hashCredentialInfo):
        (WebCore):
        (WebCore::CredentialBackingStore::CredentialBackingStore):
        (WebCore::CredentialBackingStore::open):
        (WebCore::CredentialBackingStore::addLogin):
        (WebCore::CredentialBackingStore::updateLogin):
        (WebCore::CredentialBackingStore::getLogin):
        * platform/network/blackberry/CredentialBackingStore.h:
        (CredentialBackingStore):

2012-07-25  Kent Tamura  <tkent@chromium.org>

        REGRESSION(r121420): Performance regression of form state saving for pages with multiple forms
        https://bugs.webkit.org/show_bug.cgi?id=91804

        Reviewed by Hajime Morita.

        The complexity of FormKeyGenerator::formKey() was O(N) where N is the
        number form elements with an identical action URL, and formKey() is
        called for every form. So, it's O(N^2). A page in www.reddit.com
        contains hundreds of form elements with action="#". So FormController::
        formElementsState() took a few seconds on a slow machine.

        In order to avoid O(N^2) operation, storing a map from form signatures
        to next index numbers, instead of storing existing formKey strings.

        No new tests. Just a performance improvement.

        Note: This is a re-landing of r123191. We rolled it out because of
        suspicion of a performance regression. However it was innocent.

        * html/FormController.cpp:
        (FormKeyGenerator): Remove m_existingKeys. Add a map from a form
        signature string to the next index number.
        (WebCore::formSignature): Returns a signature string for a form, without
        an index number. This is like "actionURL [name1 name2 ]"
        (WebCore::FormKeyGenerator::formKey):
        Creates a formKey string by concatenating a formSignature and #n. N is
        obtained from m_formSignatureToNextIndexMap in O(1).
        (WebCore::FormKeyGenerator::willDeleteForm):
        Remove the code for m_existingKeys.

2012-07-25  Benjamin Poulain  <bpoulain@apple.com>

        Initialize QualifiedName's strings from the read only data segment
        https://bugs.webkit.org/show_bug.cgi?id=92226

        Reviewed by Anders Carlsson.

        Modify the initialization of static QualifiedName to initialize the AtomicString
        with the data from the read only memory.

        Overall, HTMLNames::init() gets 10% faster.

        * dom/QualifiedName.cpp:
        (WebCore::QualifiedName::QualifiedName):
        * dom/QualifiedName.h:
        (QualifiedName):
        Remove the useless constructor taking a char* and get rid of the init() function.
        The AtomicString representing the name should be constructed by the caller of QualifiedName.

        Because the init() code is relatively large and is only executed once, it is important to
        keep the AtomicString construction separate. The function createQualifiedName() was added
        to improve the cache use. The short version let us reduce the code one more instruction per
        call.

        * dom/make_names.pl:
        (printQualifiedNameMaker):
        (printShortQualifiedNameMaker):
        (printNamesCppFile):
        (printDefinitions):

2012-07-25  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Move HTMLInputElement::updateInnerTextValue to InputType class
        https://bugs.webkit.org/show_bug.cgi?id=92230

        Reviewed by Kent Tamura.

        This patch moves implementaion of HTMLInputElement::updateInnerTextValue()
        into input type classes, removes updateInnerTextValue() from HTMLInputElement,
        and updates call site of updateInnerTextValue().

        No new tests. This patch doesn't change behavior.

        * html/DateInputType.cpp:
        (WebCore::DateInputType::handleBlurEvent): Updated call site of updateInnerTextValue().
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::updateType): Updated call site of updateInnerTextValue().
        (WebCore::HTMLInputElement::parseAttribute): Updated call site of updateInnerTextValue().
        (WebCore::HTMLInputElement::copyNonAttributePropertiesFromElement): Updated call site of updateInnerTextValue().
        (WebCore::HTMLInputElement::setSuggestedValue): Updated call site of updateInnerTextValue().
        * html/HTMLInputElement.h:
        (HTMLInputElement): Removed updateInnerTextValue().
        * html/InputType.cpp:
        (WebCore::InputType::updateInnerTextValue): Added default implementaion.
        * html/InputType.h:
        (InputType): Added declaration of updateInnerTextValue().
        * html/NumberInputType.cpp:
        (WebCore::NumberInputType::handleBlurEvent): Updated call site of updateInnerTextValue().
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::setValue): Updated call site of updateInnerTextValue().
        (WebCore::TextFieldInputType::updateInnerTextValue): Moved implementaion from HTMLInputElement.
        * html/TextFieldInputType.h:
        (TextFieldInputType): Added declaration of updateInnerTextValue().

2012-07-25  Dana Jansens  <danakj@chromium.org>

        [chromium] Move ephemeral data for a single frame in LayerRendererChromium into a structure with a scoped lifetime equal to the frame
        https://bugs.webkit.org/show_bug.cgi?id=92294

        Reviewed by Adrienne Walker.

        The LayerRendererChromium class has a number of member variables that are used
        while drawing a single frame. Because they are member variables, their lifetimes
        are not clear, and some are even updated between frames, which is not needed.

        This change creates a LRC::DrawingFrame structure that holds the data used
        while drawing the current frame, and an instance of this structure is held
        and passed around to functions in LayerRendererChromium, moving all of the
        data out from being member variables on the class to being function
        arguments on the relevant methods.

        The projection and window matrices are a part of this frame data, and are not
        used externally, so they are removed from the CCRenderer interface and included
        within the DrawingFrame structure.

        Covered by existing tests, no change in behaviour intended.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::LayerRendererChromium):
        (WebCore::LayerRendererChromium::viewportChanged):
        (WebCore::LayerRendererChromium::clearFramebuffer):
        (WebCore::LayerRendererChromium::drawFrame):
        (WebCore::LayerRendererChromium::drawRenderPass):
        (WebCore::LayerRendererChromium::drawQuad):
        (WebCore::LayerRendererChromium::drawCheckerboardQuad):
        (WebCore::LayerRendererChromium::drawDebugBorderQuad):
        (WebCore::LayerRendererChromium::drawBackgroundFilters):
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
        (WebCore::LayerRendererChromium::drawSolidColorQuad):
        (WebCore::LayerRendererChromium::drawTileQuad):
        (WebCore::LayerRendererChromium::drawYUVVideoQuad):
        (WebCore::LayerRendererChromium::drawStreamVideoQuad):
        (WebCore::LayerRendererChromium::drawTextureQuad):
        (WebCore::LayerRendererChromium::drawIOSurfaceQuad):
        (WebCore::LayerRendererChromium::finishDrawingFrame):
        (WebCore::LayerRendererChromium::drawTexturedQuad):
        (WebCore::LayerRendererChromium::copyTextureToFramebuffer):
        (WebCore::LayerRendererChromium::isCurrentRenderPass):
        (WebCore::LayerRendererChromium::useRenderPass):
        (WebCore::LayerRendererChromium::useScopedTexture):
        (WebCore::LayerRendererChromium::bindFramebufferToTexture):
        (WebCore::LayerRendererChromium::setScissorToRect):
        (WebCore::LayerRendererChromium::setDrawFramebufferRect):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (DrawingFrame):
        (WebCore::LayerRendererChromium::DrawingFrame::DrawingFrame):
        (LayerRendererChromium):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (CCRenderer):

2012-07-19  Adrienne Walker  <enne@google.com>

        [chromium] Make all compositor screen space transforms operate on content rects
        https://bugs.webkit.org/show_bug.cgi?id=91807

        Reviewed by Kenneth Russell.

        Previously, surface screen space transforms operated on surface
        content space but layer screen space transforms operated on layer
        space. For the purpose of consistency, unify these two so that they
        both operate on content space.

        No tests, because no change in behavior expected. Just a refactoring.

        * platform/graphics/chromium/LayerChromium.h:
        (LayerChromium):
        * platform/graphics/chromium/cc/CCDebugRectHistory.cpp:
        (WebCore::CCDebugRectHistory::savePaintRects):
        (WebCore::CCDebugRectHistory::savePropertyChangedRects):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateDrawTransformsInternal):
        (WebCore::CCLayerTreeHostCommon::findLayerThatIsHitByPoint):
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::::markOccludedBehindLayer):
        (WebCore::::occluded):
        (WebCore::::unoccludedContentRect):

2012-07-25  Dan Bernstein  <mitz@apple.com>

        Hit testing in one column or in the gap between cloumns along the block axis can return a result from the wrong column
        https://bugs.webkit.org/show_bug.cgi?id=92311

        Reviewed by Anders Carlsson.

        Tests: fast/multicol/hit-test-end-of-column.html
               fast/multicol/hit-test-gap-block-axis.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::positionForPointWithInlineChildren): To prevent hits after the last
        line on a given column from returning the next line in the next column, added a check if
        the hit occurred within the pagination strut of a line. Covered by the first test.
        (WebCore::RenderBlock::adjustPointToColumnContents): Added clamp-to-column logic for the
        block-axis case. This prevents hits near the bottom of the top half of the gap from bleeding
        into the top of the next column. Covered by the second test.

2012-07-25  David Grogan  <dgrogan@chromium.org>

        IndexedDB: Make db.version return an integer if appropriate
        https://bugs.webkit.org/show_bug.cgi?id=92195

        Reviewed by Tony Chang.

        Make use of the existing IDBAny mechanism to return an integer if
        integer versions have been used.

        No new tests - no change in behavior expected.

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::version):
        (WebCore):
        * Modules/indexeddb/IDBDatabase.h:
        (IDBDatabase):
        * Modules/indexeddb/IDBDatabase.idl:

2012-07-25  Michael Saboff  <msaboff@apple.com>

        Convert HTML parser to handle 8-bit resources without converting to UChar*
        https://bugs.webkit.org/show_bug.cgi?id=90321

        Reviewed by Geoffrey Garen.

        No new tests, no new functionality therefore covered by existing tests.

        Changed the parsing of HTML to handle 8-bit strings without converting the 
        whole string to 16-bits.  Primary change was to use the appropriate 
        character pointer type (LChar* or UChar*) depending on the source string.
        This access is abstracted in SegmentedSubstring by getCurrentChar{8,16} and
        incrementAndGetCurrentChar{8,16} methods.  In SegmentedString, the advance()
        and advanceAndUpdateLineNumber() methods have been refactored into a
        state machine managed pair of function pointers.  The possible functions
        have not only the 8 and 16 bitness factored out, they also have the 
        "exclude line numbers" logic factored out for advanceAndUpdateLineNumber().
        This provides a net speed-up even with the 8/16 bit testing.
        Other changes involve using String methods to access and compare with the
        source data.

        * html/FTPDirectoryDocument.cpp:
        (WebCore::FTPDirectoryDocumentParser::append): Changed to use currentChar()
        instead of SegmentedString '*' operator.
        * html/parser/HTMLEntityParser.cpp: Changed to use currentChar() instead of
        SegmentedString '*' operator.
        * html/parser/HTMLParserIdioms.cpp:
        (WebCore::stripLeadingAndTrailingHTMLSpaces): Added 8-bit fast path.
        * html/parser/HTMLSourceTracker.cpp:
        (WebCore::HTMLSourceTracker::sourceForToken): Changed to use currentChar() instead of
        SegmentedString '*' operator.
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::script): Updated to use new String::dataSize() method.
        * platform/text/SegmentedString.cpp:
        (WebCore::SegmentedString::SegmentedString):
        (WebCore::SegmentedString::operator=):
        (WebCore::SegmentedString::clear):
        (WebCore::SegmentedString::append):
        (WebCore::SegmentedString::prepend):
        (WebCore::SegmentedString::advanceSubstring):
        (WebCore::SegmentedString::advance): Changed to be a wrapper that invokes current 
        advance function.
        (WebCore::SegmentedString::advance8): Fast path advance function for 8 bit data.
        (WebCore::SegmentedString::advance16): Fast path advance function for 16 bit data.
        (WebCore::SegmentedString::advanceAndUpdateLineNumber8IncludeLineNumbers): Fast
        path advanceAndUpdateLineNumber for 8 bit data when we need to update the line number.
        (WebCore::SegmentedString::advanceAndUpdateLineNumber16IncludeLineNumbers): Fast
        path advanceAndUpdateLineNumber for 16 bit data when we need to update the line number.
        (WebCore::SegmentedString::advanceSlowCase): Slow case advance function for both
        8 and 16 bit advance.
        (WebCore::SegmentedString::advanceAndUpdateLineNumberSlowCase): Slow case
        advanceAndUpdateLineNumber function for both 8 and 16 bit data.
        (WebCore::SegmentedString::advanceEmpty): Advance function when input has been exhausted.
        * platform/text/SegmentedString.h:
        (WebCore::SegmentedSubstring::SegmentedSubstring):
        (WebCore::SegmentedSubstring::clear):
        (SegmentedSubstring):
        (WebCore::SegmentedSubstring::is8Bit): New getter.
        (WebCore::SegmentedSubstring::appendTo):
        (WebCore::SegmentedSubstring::getCurrentChar8): New getter for the 8 bit case.
        (WebCore::SegmentedSubstring::getCurrentChar16): New getter for the 16 bit case.
        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar8): New wrapper functions
        that pre-increments the 8 bit pointer and returns the next character.
        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar16): New wrapper functions
        that pre-increments the 16 bit pointer and returns the next character.
        (WebCore::SegmentedSubstring::currentSubString):
        (WebCore::SegmentedSubstring::getCurrentChar):
        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar):
        (WebCore::SegmentedString::SegmentedString):
        (WebCore::SegmentedString::push):
        (WebCore::SegmentedString::isEmpty):
        (WebCore::SegmentedString::lookAhead):
        (WebCore::SegmentedString::lookAheadIgnoringCase):
        (WebCore::SegmentedString::advance):
        (WebCore::SegmentedString::advanceAndUpdateLineNumber):
        (WebCore::SegmentedString::advanceAndASSERT):
        (WebCore::SegmentedString::advanceAndASSERTIgnoringCase):
        (WebCore::SegmentedString::advancePastNonNewline):
        (WebCore::SegmentedString::advancePastNewlineAndUpdateLineNumber):
        (WebCore::SegmentedString::currentChar):
        (WebCore::SegmentedString::setSlowCase): Set advance function pointers to slow case
        functions.
        (WebCore::SegmentedString::decrementAndCheckLength): Decrement substring length and
        change to slow case functions when only one character left.
        (WebCore::SegmentedString::setAdvanceFunctionPointers): Select appropriate advance
        functions based on current substring.
        (WebCore::SegmentedString::lookAheadInline): Changed to use String::startsWith().
        (WebCore::SegmentedString::lookAheadSlowCase):
        * xml/parser/CharacterReferenceParserInlineMethods.h:
        (WebCore::consumeCharacterReference): Changed to use currentChar() instead of
        SegmentedString '*' operator.
        * xml/parser/MarkupTokenizerBase.h:
        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::nextInputCharacter):
        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::peek): Changed to use
        currentChar() instead of SegmentedString '*' operator.
        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::advance):

2012-07-25  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r123625 and r123672.
        http://trac.webkit.org/changeset/123625
        http://trac.webkit.org/changeset/123672
        https://bugs.webkit.org/show_bug.cgi?id=92315

        Broke Windows and gcc builds (Requested by rniwa on #webkit).

        * platform/AutodrainedPool.h:
        (AutodrainedPool):
        * platform/ContentType.h:
        (ContentType):
        * platform/ContextMenu.h:
        (ContextMenu):
        * platform/ContextMenuItem.h:
        (ContextMenuItem):
        * platform/Cursor.h:
        (WebCore::SharedCursor::SharedCursor):
        (Cursor):
        * platform/KURL.h:
        (WebCore::KURL::KURL):
        (KURL):
        * platform/KURLGooglePrivate.h:
        (KURLGooglePrivate):
        * platform/PODRedBlackTree.h:
        (WebCore::PODRedBlackTree::PODRedBlackTree):
        * platform/Pasteboard.h:
        (Pasteboard):
        * platform/PlatformEvent.h:
        (WebCore::PlatformEvent::PlatformEvent):
        * platform/PlatformKeyboardEvent.h:
        (PlatformKeyboardEvent):
        * platform/PlatformMouseEvent.h:
        (PlatformMouseEvent):
        * platform/PlatformPasteboard.h:
        (PlatformPasteboard):
        * platform/PlatformTouchEvent.h:
        (PlatformTouchEvent):
        * platform/PlatformWheelEvent.h:
        (PlatformWheelEvent):
        * platform/RunLoop.h:
        (TimerBase):
        * platform/ScrollAnimator.h:
        (ScrollAnimator):
        * platform/ScrollAnimatorNone.h:
        (ScrollAnimatorNone):
        * platform/SharedBuffer.h:
        (SharedBuffer):
        * platform/WheelFlingPlatformGestureCurve.h:
        (WheelFlingPlatformGestureCurve):
        * platform/Widget.h:
        (Widget):
        * platform/network/cf/ResourceRequestCFNet.cpp:
        (WebCore::ResourceRequest::doUpdateResourceRequest):

2012-07-25  Ryosuke Niwa  <rniwa@webkit.org>

        Windows build fix attempt after r123625.

        * platform/network/cf/ResourceRequestCFNet.cpp:
        (WebCore::ResourceRequest::doUpdateResourceRequest):

2012-07-25  Kwang Yul Seo  <skyul@company100.net>

        Read tag names and attributes from the saved tokens in HTMLTreeBuilder::resetInsertionModeAppropriately.
        https://bugs.webkit.org/show_bug.cgi?id=92240

        Reviewed by Adam Barth.

        This is a follow-up patch for r123577. Added ItemType enum to HTMLStackItem to handle
        the context element case.

        No new tests, covered by existing tests.

        * html/parser/HTMLStackItem.h:
        (WebCore::HTMLStackItem::create):
        (WebCore::HTMLStackItem::HTMLStackItem):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
        (WebCore::HTMLTreeBuilder::resetInsertionModeAppropriately):

2012-07-25  Nico Weber  <thakis@chromium.org>

        [chromium/mac] Remove mac_bundle_resources section from WebCore.gyp
        https://bugs.webkit.org/show_bug.cgi?id=92207

        Reviewed by Tony Chang.

        It's no longer needed after http://crrev.com/148290 and
        http://crrev.com/148187.

        * WebCore.gyp/WebCore.gyp:

2012-07-25  Dana Jansens  <danakj@chromium.org>

        [chromium] Move WebFilterOperations from RenderPassDrawQuad to RenderPass
        https://bugs.webkit.org/show_bug.cgi?id=91885

        Reviewed by Adrienne Walker.

        We move the filter operations to CCRenderPass to avoid having
        variable-length data in a WebCompositorQuad in order to serialize,
        and also to avoid requiring a virtual destructor for the quad
        classes.

        The drawFrame method now takes a CCRenderPassIdHashMap in order
        to connect RenderPass quads to their source RenderPass.

        Covered by existing tests.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::decideRenderPassAllocationsForFrame):
        (WebCore::LayerRendererChromium::drawFrame):
        (WebCore::LayerRendererChromium::beginDrawingFrame):
        (WebCore::LayerRendererChromium::drawBackgroundFilters):
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::CCLayerTreeHostImpl::drawLayers):
        * platform/graphics/chromium/cc/CCRenderPass.h:
        (WebCore::CCRenderPass::filters):
        (WebCore::CCRenderPass::setFilters):
        (CCRenderPass):
        (WebCore::CCRenderPass::backgroundFilters):
        (WebCore::CCRenderPass::setBackgroundFilters):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
        (WebCore::CCRenderPassDrawQuad::create):
        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
        (CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::appendQuads):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (CCRenderer):

2012-07-25  Mike Reed  <reed@google.com>

        fix test in beginLayerClippedToImage to check for immutability if we're going to do a shallow-copy
        https://bugs.webkit.org/show_bug.cgi?id=92276

        Reviewed by Stephen White.

        PlatformContextSkia::beginLayerClippedToImage

        This function wants to apply the provided ImageBuffer as a clip. Skia does not support this natively yet,
        so the code makes a "copy" of that imageBuffer, to be applied later. The old code, wanting to avoid a
        deep copy if possible, checked for the presence of a SkPixelRef. If it found one, it made a shallow copy.
        This is flawed, since the contents of a pixelref are not guaranteed to be immutable. The new code checks
        against this attribute: if the bitmap is "immutable" then we can make a shallow-copy, else we make a
        deep copy.

        No new tests. Existing svg layouttests work w/ or w/out this change, but at the next Skia deps roll, we see
        failures w/o this change. The change is more "correct", though the problem case does not exhibit itself until
        Skia rev. 4722 or later lands.

        * platform/graphics/skia/PlatformContextSkia.cpp:
        (WebCore::PlatformContextSkia::beginLayerClippedToImage):

2012-07-25  Li Yin  <li.yin@intel.com>

        It is invalid when both numberOfInputChannels and numberOfOutputChannels to be zero in JavaScriptAudioNode.
        https://bugs.webkit.org/show_bug.cgi?id=91364

        Reviewed by Kenneth Russell.

        Spec: http://www.w3.org/TR/webaudio/#JavaScriptAudioNode-section
        It is invalid for both numberOfInputChannels and numberOfOutputChannels to be zero.

        Test: webaudio/javascriptaudionode.html

        * Modules/webaudio/JavaScriptAudioNode.cpp:
        (WebCore::JavaScriptAudioNode::create):

2012-07-24  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Refactor CCLayerTreeHostCommon: move root layer special case initialization into internal code.
        https://bugs.webkit.org/show_bug.cgi?id=88953

        Reviewed by Adrienne Walker.

        This is part 1 of trying to reduce the root layer special
        case. This tries to reduce the special-ness of the root layer from
        the perspective of outside code.

        After this patch, code that uses calcDrawTransforms() no longer
        needs to initialize the root layer's surface, and no longer needs
        to manually append the root layer to the renderSurfaceLayerList.

        Unit tests were also updated (much cleaner!) to account for this change.

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::updateLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore):
        (WebCore::setupRootLayerAndSurfaceForRecursion):
        (WebCore::CCLayerTreeHostCommon::calculateDrawTransforms):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.h:
        (CCLayerTreeHostCommon):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):

2012-07-25  Taiju Tsuiki  <tzik@chromium.org>

        FileSystem should provide a way to delete filesystem.
        https://bugs.webkit.org/show_bug.cgi?id=91861

        Reviewed by Adam Barth.

        We will add a test when we wire-up the feature to Inspector.

        * Modules/filesystem/LocalFileSystem.cpp: Add deleteFileSystem
        (WebCore::deleteFileSystem):
        (WebCore):
        (WebCore::LocalFileSystem::deleteFileSystem):
        * Modules/filesystem/LocalFileSystem.h:
        (LocalFileSystem):
        * platform/AsyncFileSystem.cpp: Add deleteFileSystem
        (WebCore):
        (WebCore::AsyncFileSystem::deleteFileSystem):
        * platform/AsyncFileSystem.h:
        (AsyncFileSystem):
        * platform/blackberry/AsyncFileSystemBlackBerry.cpp: Add deleteFileSystem
        (WebCore::AsyncFileSystem::deleteFileSystem):
        (WebCore):
        * platform/gtk/AsyncFileSystemGtk.cpp: Add deleteFileSystem
        (WebCore::AsyncFileSystem::deleteFileSystem):
        (WebCore):

2012-07-25  Andrey Adaikin  <aandrey@chromium.org>

        Web Inspector: Add more jsdocs to InjectedScriptSource.js
        https://bugs.webkit.org/show_bug.cgi?id=92255

        Reviewed by Pavel Feldman.

        * inspector/InjectedScriptSource.js:

2012-07-24  Dana Jansens  <danakj@chromium.org>

        [chromium] Turn the debug HUD into a layer so that it can be drawn as a WebCompositorQuad
        https://bugs.webkit.org/show_bug.cgi?id=92182

        Reviewed by Adrienne Walker.

        By changing the HUD into a quad, we are able to create a HUD and pass
        it to the host compositor, allowing the HUD to be used for renderers
        under Ubercompositor.

        This also removes the special drawing code for the HUD from
        LayerRendererChromium, allowing us to move finishDrawingFrame
        into LayerRendererChromium as a private method and remove it
        from the CCRenderer interface.

        Finally, we can remove the CCFontAtlas transport code from CCProxy
        and its implementations as the atlas can be synced to impl thread
        through the usual layer commit mechanism.

        The debug HUD is not covered by tests.

        * WebCore.gypi:
        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.cpp: Added.
        (WebCore):
        (WebCore::HeadsUpDisplayLayerChromium::create):
        (WebCore::HeadsUpDisplayLayerChromium::HeadsUpDisplayLayerChromium):
        (WebCore::HeadsUpDisplayLayerChromium::~HeadsUpDisplayLayerChromium):
        (WebCore::HeadsUpDisplayLayerChromium::createCCLayerImpl):
        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.h: Added.
        (WebCore):
        (HeadsUpDisplayLayerChromium):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawFrame):
        (WebCore::LayerRendererChromium::cleanupSharedObjects):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        * platform/graphics/chromium/cc/CCDebugRectHistory.cpp:
        (WebCore::CCDebugRectHistory::savePropertyChangedRects):
        * platform/graphics/chromium/cc/CCDebugRectHistory.h:
        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp.
        (WebCore):
        (WebCore::CCHeadsUpDisplayLayerImpl::CCHeadsUpDisplayLayerImpl):
        (WebCore::CCHeadsUpDisplayLayerImpl::~CCHeadsUpDisplayLayerImpl):
        (WebCore::CCHeadsUpDisplayLayerImpl::willDraw):
        (WebCore::CCHeadsUpDisplayLayerImpl::appendQuads):
        (WebCore::CCHeadsUpDisplayLayerImpl::didDraw):
        (WebCore::CCHeadsUpDisplayLayerImpl::didLoseContext):
        (WebCore::CCHeadsUpDisplayLayerImpl::drawHudContents):
        (WebCore::CCHeadsUpDisplayLayerImpl::drawFPSCounter):
        (WebCore::CCHeadsUpDisplayLayerImpl::drawFPSCounterText):
        (WebCore::CCHeadsUpDisplayLayerImpl::drawDebugRects):
        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.h: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h.
        (WebCore):
        (CCHeadsUpDisplayLayerImpl):
        (WebCore::CCHeadsUpDisplayLayerImpl::create):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore::CCLayerImpl::layerIsAlwaysDamaged):
        This flag is used to mark the HUD as always damaged, so that it is
        continually drawn on the impl thread. It is also used as a hint by
        the CCDebugRectHistory class to not include the layer in the display
        of damage, since always damaged is not interesting damage.
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::create):
        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::initialize):
        (WebCore::CCLayerTreeHost::willCommit):
        (WebCore::CCLayerTreeHost::didCommit):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeSettings):
        (WebCore::CCLayerTreeSettings::showDebugInfo):
        (WebCore::CCLayerTreeSettings::showDebugRects):
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::drawLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (WebCore):
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCProxy.h:
        (CCProxy):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (CCRenderer):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (CCThreadProxy):

2012-07-25  'Pavel Feldman'  <pfeldman@chromium.org>

        Web Inspector: follow up to r123612, fixing CSS value suggest.

        Not reviewed, minor JS fix.

        * inspector/front-end/CSSCompletions.js:
        (WebInspector.CSSCompletions):
        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylePropertyTreeElement.prototype):

2012-07-25  Michael Saboff  <msaboff@apple.com>

        Unreviewed build fix after r123624.

        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::clearGeolocationOverride):
        Changed ASSERT_UNUSED() to UNUSED_PARAM().

2012-07-25  Pavel Feldman  <pfeldman@chromium.org>

        Web inspector auto-completes "optimizequality" but then complains
        https://bugs.webkit.org/show_bug.cgi?id=92262

        Reviewed by Timothy Hatcher.

        Fixed optimizeSpeed, optimizeLegibility, geometricPrecision.

        * inspector/front-end/CSSKeywordCompletions.js:

2012-07-25  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=89114
        REGRESSION (r112919): Setting scrollTop after setting display from none to block 
        fails
        -and corresponding-
        <rdar://problem/11656050>

        Reviewed by Simon Fraser.

        ScrollAnimatorMac::immediateScrollTo() and ScrollAnimatorMac::immediateScrollBy() 
        both have an optimization in place so that they do not call 
        notifyPositionChanged() if the new scroll offset matches the ScrollAnimator's 
        cached m_currentPosX and m_currentPosY. So revision 112919 caused troubled with 
        this optimization because it allowed RenderLayers to restore a scrollOffset from 
        the Element if there is one cached there. This caused the RenderLayer to have a 
        scrollOffset that is improperly out-of-synch with the ScrollAnimator's 
        currentPosition (which will just be 0,0 since it is being re-created like the 
        RenderLayer). This fix makes sure they are in synch by calling 
        setCurrentPosition() on the ScrollAnimator when the cached position is non-zero.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::RenderLayer):

2012-07-25  Andreas Kling  <kling@webkit.org>

        Make ElementAttributeData a variable-sized object to reduce memory use.
        <http://webkit.org/b/88240>

        Reviewed by Ryosuke Niwa.

        Take advantage of the fact that we know at ElementAttributeData construction time how many attributes
        it needs to accomodate and allocate exactly as much space as needed instead of using a Vector.
        For elements that never have their attribute list mutated (the vast majority), this saves a lot of
        memory and removes the indirection to Vector<Attribute>'s heap-allocated storage.

        Introduced a mutability flag to ElementAttributeData and sprinkled assertions all over to make sure
        that nothing tries to mutate an element with a raw attribute array.

        When an Element's attribute(s) are mutated, we reconstruct the ElementAttributeData, this time using
        a Vector as backing instead. This is triggered when calling Element::mutableAttributeData().

        This reduces memory consumption by 3.2MB when viewing the full HTML5 spec at <http://whatwg.org/c/>.
        That is a ~35% reduction in DOM attribute memory use.

        Furthermore, that page ends up promoting 27% of the elements to mutable attribute storage due to dynamic
        adding of "class" attributes. For more static pages, savings are even greater.

        Also did away with ElementAttributeData::removeAttribute(name) and do separate index lookup where
        needed. Not a big deal but avoids double lookup of attributes when removing them.

        * dom/Element.cpp:
        (WebCore::Element::detachAttribute):
        (WebCore::Element::removeAttribute):
        (WebCore::Element::attributes):
        (WebCore::Element::setAttributeInternal):
        (WebCore::Element::parserSetAttributes):
        (WebCore::Element::hasEquivalentAttributes):
        (WebCore::Element::setAttributeNode):
        (WebCore::Element::removeAttributeNode):
        (WebCore::Element::getAttributeNode):
        (WebCore::Element::getAttributeNodeNS):
        (WebCore::Element::hasAttribute):
        (WebCore::Element::hasAttributeNS):
        (WebCore::Element::cloneAttributesFromElement):

            Sprinkle const on ElementAttributeData* pointers.
            Switch to using mutableAttributeData() in code paths that modify attributes.

        (WebCore::Element::normalizeAttributes):

            Cleaner iteration over attributes, I removed ElementAttributeData::attributeVector() since that
            was just incurring a bunch of extra Vector copying. Since ElementAttributeData already exposes
            length() and attributeItem(index), use those to iterate directly over the attributes.

        (WebCore::Element::createMutableAttributeData):

            Added, converts existing ElementAttributeData to a mutable object. Otherwise creates a new
            ElementAttributeData (mutable and empty.)

        * dom/Element.h:
        (WebCore::Element::attributeData):
        (WebCore::Element::updatedAttributeData):
        (WebCore::Element::ensureAttributeData):
        (WebCore::Element::ensureUpdatedAttributeData):

            Made all of these return "const ElementAttributeData*" to ensure at compile-time that nothing
            attempts to modify an ElementAttributeData that may be immutable.

            ensureUpdatedAttributeData() is still const, despite possibly calling mutableAttributeData().
            The goal of having methods be const is to prevent conversion from one ElementAttributeData
            object to another, so that pointers remain intact and no unnecessary work gets done.

        (WebCore::Element::mutableAttributeData):

            Added, returns a guaranteed mutable ElementAttributeData* pointer.

        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::createImmutable):

            Creates a new ElementAttributeData tailored to fit the provided Vector<Attribute>.

        (WebCore::ElementAttributeData::ElementAttributeData):

            Moved constructors out-of-line, getting too complex for header files.

            ElementAttributeData(const Vector<Attribute>&) creates an immutable ElementAttributeData
            containing the provided attributes in an array tacked onto the end of the object.

        (WebCore::ElementAttributeData::~ElementAttributeData):

            Free the attribute vector if mutable.
            For immutable objects, manually invoke destructor on each Attribute object,
            since these won't be destroyed automatically by ~ElementAttributeData.

        (WebCore::ElementAttributeData::attrIfExists):

        (WebCore::ElementAttributeData::ensureAttr):
        (WebCore::ElementAttributeData::setAttr):
        (WebCore::ElementAttributeData::removeAttr):

            Make these const, as they should always have been- they don't affect the ElementAttributeData,
            only the global DOM Attr <-> ElementAttributeData mappings.

        (WebCore::ElementAttributeData::ensureInlineStyle):
        (WebCore::ElementAttributeData::ensureMutableInlineStyle):

            Sprinkle ASSERT(isMutable()). This doesn't mean that all Elements with inline styles automatically
            have mutable attribute data. There's still inlineStyle() for that, which may return null.
            These are only for use where you need a valid StylePropertySet*, even if there is no inline style
            attribute, e.g in editing code that wants to add style.

        (WebCore::ElementAttributeData::updateInlineStyleAvoidingMutation):
        (WebCore::ElementAttributeData::destroyInlineStyle):

            Make these const. While destroyInlineStyle() doesn't sound very const-y, immutable objects that
            contain a style attribute will have a valid inlineStyle() with that style data. This is just
            an interface for ~StyledElement to destroy the style object.
            It'd be nice to do that in ~ElementAttributeData(), but we need a StyledElement* pointer to
            clean up properly and we don't store one in this class.

        (WebCore::ElementAttributeData::addAttribute):
        (WebCore::ElementAttributeData::removeAttribute):
        (WebCore::ElementAttributeData::clearAttributes):
        (WebCore::ElementAttributeData::replaceAttribute):

            Sprinkle ASSERT(isMutable()).
            Always go straight for m_mutableAttributeVector since we know that's the storage being used.

        (WebCore::ElementAttributeData::isEquivalent):
        (WebCore::ElementAttributeData::detachAttrObjectsFromElement):
        (WebCore::ElementAttributeData::getAttributeItemIndexSlowCase):
        (WebCore::ElementAttributeData::removeAttribute):
        (WebCore::ElementAttributeData::getAttributeItem):
        (WebCore::ElementAttributeData::getAttributeItemIndex):

            Use length() and attributeItem(index) to iterate over the attributes.

        (WebCore::ElementAttributeData::cloneDataFrom):

            Sprinkle ASSERT(isMutable()). Added a FIXME that cloning elements could create immutable
            attribute data. I'm not sure this optimization is worthwhile, as cloning elements is already
            a semi-rare occurrence.

            Updated code to handle both immutable and mutable source objects. This could 

        (WebCore::ElementAttributeData::getAttributeNode):

            Const correctness.

        * dom/ElementAttributeData.h:
        (ElementAttributeData):

            Turn attribute storage into what's effectively union { OwnPtr<Vector<Attribute>>; Attribute[]; }
            The new m_isMutable bit determines which union member should be used for access.

        (WebCore::ElementAttributeData::create):
        (WebCore::ElementAttributeData::createImmutable):

            Added createImmutable(const Vector<Attribute>&) as a complement to create().

        (WebCore::ElementAttributeData::setClass):
        (WebCore::ElementAttributeData::setIdForStyleResolution):
        (WebCore::ElementAttributeData::inlineStyle):
        (WebCore::ElementAttributeData::setAttributeStyle):

            Make these const, and their data member counterparts 'mutable'.
            An immutable ElementAttributeData object still has m_classNames, m_idForStyleResolution,
            m_inlineStyleDecl and m_attributeStyle.

        (WebCore::ElementAttributeData::reportMemoryUsage):

            Updated for isMutable().

        (WebCore::ElementAttributeData::makeMutable):

            Returns a mutable clone of itself.

        (WebCore::ElementAttributeData::isEmpty):
        (WebCore::ElementAttributeData::length):
        (WebCore::ElementAttributeData::attributeItem):

            Check isMutable() to know how to access attribute storage.

        * dom/StyledElement.cpp:
        (WebCore::StyledElement::style):
        (WebCore::StyledElement::setInlineStyleProperty):

            Simplify by using StyledElement::ensureInlineStyle().

        (WebCore::StyledElement::classAttributeChanged):

            Use mutableAttributeData() if the attribute is being removed completely.
            In other cases, tiptoe around without causing the attribute data to go mutable.

        (WebCore::StyledElement::removeInlineStyleProperty):

            Use mutableAttributeData() if/when actually removing something.

        (WebCore::StyledElement::addSubresourceAttributeURLs):

            Const correctness.

        * dom/StyledElement.h:
        (WebCore::StyledElement::ensureInlineStyle):

            This now implies conversion to mutable attribute data. Used by codepaths that add/remove
            properties, so conversion is inevitable.

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::mergeAttributesFromTokenIntoElement):
        (WebCore::HTMLConstructionSite::createHTMLElementFromSavedElement):
        * svg/properties/SVGAnimatedPropertyMacros.h:
        (WebCore::SVGSynchronizableAnimatedProperty::synchronize):

            Use mutableAttributeData() as appropriate.

        * xml/parser/XMLDocumentParserQt.cpp:
        (WebCore::XMLDocumentParser::XMLDocumentParser):

            Const correctness.

2012-07-25  Andrew Wilson  <atwilson@chromium.org>

        Unreviewed, rolling out r123560.
        http://trac.webkit.org/changeset/123560
        https://bugs.webkit.org/show_bug.cgi?id=90321

        Breaks chromium valgrind tests.

        * html/FTPDirectoryDocument.cpp:
        (WebCore::FTPDirectoryDocumentParser::append):
        * html/parser/HTMLEntityParser.cpp:
        (WebCore::HTMLEntityParser::consumeNamedEntity):
        * html/parser/HTMLParserIdioms.cpp:
        (WebCore::stripLeadingAndTrailingHTMLSpaces):
        * html/parser/HTMLSourceTracker.cpp:
        (WebCore::HTMLSourceTracker::sourceForToken):
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::script):
        * platform/text/SegmentedString.cpp:
        (WebCore::SegmentedString::SegmentedString):
        (WebCore::SegmentedString::operator=):
        (WebCore::SegmentedString::clear):
        (WebCore::SegmentedString::append):
        (WebCore::SegmentedString::prepend):
        (WebCore::SegmentedString::advanceSubstring):
        (WebCore::SegmentedString::advance):
        (WebCore::SegmentedString::advanceSlowCase):
        (WebCore::SegmentedString::advanceAndUpdateLineNumberSlowCase):
        * platform/text/SegmentedString.h:
        (WebCore::SegmentedSubstring::SegmentedSubstring):
        (WebCore::SegmentedSubstring::clear):
        (WebCore::SegmentedSubstring::appendTo):
        (SegmentedSubstring):
        (WebCore::SegmentedString::SegmentedString):
        (WebCore::SegmentedString::push):
        (WebCore::SegmentedString::isEmpty):
        (WebCore::SegmentedString::lookAhead):
        (WebCore::SegmentedString::lookAheadIgnoringCase):
        (WebCore::SegmentedString::advance):
        (WebCore::SegmentedString::advanceAndASSERT):
        (WebCore::SegmentedString::advanceAndASSERTIgnoringCase):
        (WebCore::SegmentedString::advancePastNewlineAndUpdateLineNumber):
        (SegmentedString):
        (WebCore::SegmentedString::advancePastNonNewline):
        (WebCore::SegmentedString::advanceAndUpdateLineNumber):
        (WebCore::SegmentedString::operator*):
        (WebCore::SegmentedString::operator->):
        (WebCore::SegmentedString::current):
        (WebCore::SegmentedString::equalsLiterally):
        (WebCore::SegmentedString::equalsIgnoringCase):
        (WebCore::SegmentedString::lookAheadInline):
        (WebCore::SegmentedString::lookAheadSlowCase):
        * xml/parser/CharacterReferenceParserInlineMethods.h:
        (WebCore::consumeCharacterReference):
        * xml/parser/MarkupTokenizerBase.h:
        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::nextInputCharacter):
        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::peek):
        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::advance):

2012-07-25  Konrad Piascik  <kpiascik@rim.com>

        Web Inspector: Geolocation override
        https://bugs.webkit.org/show_bug.cgi?id=89365

        Reviewed by Pavel Feldman.

        Re-added the m_page member variable for GeolocationController since
        it's now being used by InspectorInstrumentaiton.

        Added a way to override the GeolocationPosition and GeolocationError
        using Web Inspector. Curretnly only PositionError can be set.

        This will be hidden behind the experiments flag for now.

        Tests: inspector/geolocation-error.html
               inspector/geolocation-success.html
               inspector/geolocation-watchPosition.html

        * English.lproj/localizedStrings.js:
        * Modules/geolocation/GeolocationController.cpp:
        (WebCore::GeolocationController::GeolocationController):
        (WebCore::GeolocationController::positionChanged):
        * Modules/geolocation/GeolocationController.h:
        (GeolocationController):
        * inspector/Inspector.json:
        * inspector/InspectorInstrumentation.cpp:
        (WebCore):
        (WebCore::InspectorInstrumentation::overrideGeolocationPositionImpl):
        * inspector/InspectorInstrumentation.h:
        (WebCore):
        (InspectorInstrumentation):
        (WebCore::InspectorInstrumentation::overrideGeolocationPosition):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::InspectorPageAgent):
        (WebCore::InspectorPageAgent::setGeolocationOverride):
        (WebCore):
        (WebCore::InspectorPageAgent::clearGeolocationOverride):
        (WebCore::InspectorPageAgent::canOverrideGeolocation):
        (WebCore::InspectorPageAgent::overrideGeolocationPosition):
        * inspector/InspectorPageAgent.h:
        * inspector/front-end/Settings.js:
        * inspector/front-end/SettingsScreen.js:
        (WebInspector.UserAgentSettingsTab):
        (WebInspector.UserAgentSettingsTab.prototype._createDeviceMetricsElement):
        (WebInspector.UserAgentSettingsTab.prototype._onGeolocationOverrideCheckboxClicked):
        (WebInspector.UserAgentSettingsTab.prototype._applyGeolocationUserInput):
        (WebInspector.UserAgentSettingsTab.prototype._setGeolocationPosition.set if):
        (WebInspector.UserAgentSettingsTab.prototype._setGeolocationPosition):
        (WebInspector.UserAgentSettingsTab.prototype._createGeolocationOverrideElement.createInput):
        (WebInspector.UserAgentSettingsTab.prototype._createGeolocationOverrideElement):
        * inspector/front-end/UserAgentSupport.js:
        (WebInspector.UserAgentSupport.GeolocationPosition):
        (WebInspector.UserAgentSupport.GeolocationPosition.prototype.toSetting):
        (WebInspector.UserAgentSupport.GeolocationPosition.parseSetting):
        (WebInspector.UserAgentSupport.GeolocationPosition.parseUserInput):
        (WebInspector.UserAgentSupport.GeolocationPosition.clearGeolocationOverride):
        * inspector/front-end/inspector.js:
        (WebInspector.doLoadedDone):

2012-07-25  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Build fix for clang builds after r123628
        https://bugs.webkit.org/show_bug.cgi?id=92266

        Reviewed by Adrienne Walker.

        An un-used variable was causing build failures for clang builds
        after the refactoring in r123628.  It is correct to simply remove
        this value.

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateDrawTransformsInternal):

2012-07-25  Hans Wennborg  <hans@chromium.org>

        Speech JavaScript API: extract function from SpeechRecognitionResult::emma()
        https://bugs.webkit.org/show_bug.cgi?id=92232

        Reviewed by Adam Barth.

        Extract code for creating emma-qualified names to a helper function.

        Just a refactoring; covered by the existing test.

        * Modules/speech/SpeechRecognitionResult.cpp:
        (WebCore::emmaQualifiedName):
        (WebCore):
        (WebCore::SpeechRecognitionResult::emma):

2012-07-25  Adrienne Walker  <enne@google.com>

        [chromium] Unify compositor quadTransform/drawTransform/originTransform
        https://bugs.webkit.org/show_bug.cgi?id=91417

        Reviewed by Kenneth Russell.

        drawTransform used to operate on centered layer rects. To unify quad
        transforms, draw transforms, and origin transforms, make draw
        transforms operate on content rects with the origin in the top left.

        This essentially eliminates the need for surface origin transforms,
        which will be eliminated in a future patch.

        Also, remove the unused CCLayerImpl::getDrawRect function.

        No-op refactoring. Tested by existing tests.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
        (WebCore::RenderSurfaceChromium::drawableContentRect):
        * platform/graphics/chromium/cc/CCDamageTracker.cpp:
        (WebCore::CCDamageTracker::extendDamageForLayer):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::createSharedQuadState):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerSorter.cpp:
        (WebCore::CCLayerSorter::LayerShape::LayerShape):
        (WebCore::CCLayerSorter::createGraphNodes):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateVisibleContentRect):
        (WebCore::calculateDrawTransformsInternal):
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::::markOccludedBehindLayer):
        (WebCore::::occluded):
        (WebCore::::unoccludedContentRect):
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::appendQuadsToFillScreen):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::drawableContentRect):

2012-07-25  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: Update MediaStreamTrack to match the specification
        https://bugs.webkit.org/show_bug.cgi?id=90180

        Reviewed by Adam Barth.

        MediaStreamTracks are now required to show the status of the underlying source,
        and trigger events when that status changes.

        Test: fast/mediastream/MediaStreamTrack.html

        * GNUmakefile.list.am:
        * Modules/mediastream/MediaStream.cpp:
        (WebCore::MediaStream::MediaStream):
        (WebCore::MediaStream::addTrack):
        * Modules/mediastream/MediaStreamTrack.cpp:
        (WebCore::MediaStreamTrack::create):
        (WebCore::MediaStreamTrack::MediaStreamTrack):
        (WebCore::MediaStreamTrack::~MediaStreamTrack):
        (WebCore::MediaStreamTrack::setEnabled):
        (WebCore::MediaStreamTrack::readyState):
        (WebCore):
        (WebCore::MediaStreamTrack::sourceChangedState):
        (WebCore::MediaStreamTrack::stop):
        (WebCore::MediaStreamTrack::interfaceName):
        (WebCore::MediaStreamTrack::scriptExecutionContext):
        (WebCore::MediaStreamTrack::eventTargetData):
        (WebCore::MediaStreamTrack::ensureEventTargetData):
        * Modules/mediastream/MediaStreamTrack.h:
        * Modules/mediastream/MediaStreamTrack.idl:
        * WebCore.gypi:
        * dom/EventNames.h:
        (WebCore):
        * dom/EventTargetFactory.in:
        * platform/chromium/support/WebMediaStreamDescriptor.cpp:
        * platform/chromium/support/WebMediaStreamSource.cpp:
        (WebKit::WebMediaStreamSource::setReadyState):
        (WebKit):
        (WebKit::WebMediaStreamSource::readyState):
        * platform/mediastream/MediaStreamSource.cpp: Copied from Source/WebCore/platform/mediastream/MediaStreamSource.h.
        (WebCore):
        (WebCore::MediaStreamSource::create):
        (WebCore::MediaStreamSource::MediaStreamSource):
        (WebCore::MediaStreamSource::setReadyState):
        (WebCore::MediaStreamSource::addObserver):
        (WebCore::MediaStreamSource::removeObserver):
        * platform/mediastream/MediaStreamSource.h:
        (Observer):
        (WebCore::MediaStreamSource::Observer::~Observer):
        (MediaStreamSource):
        (WebCore::MediaStreamSource::readyState):
        * platform/mediastream/chromium/MediaStreamCenterChromium.cpp:
        (WebCore::MediaStreamCenterChromium::queryMediaStreamSources):
        (WebCore::MediaStreamCenterChromium::didCreateMediaStream):

2012-07-25  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Incorrect rounding in ceiledLayoutUnit and roundedLayoutUnit.
        https://bugs.webkit.org/show_bug.cgi?id=91061

        Reviewed by Adam Barth.

        The two functions are currently both returning the flooredLayoutUnit when subpixel
        layout is enabled. This patch changes them to return the correct fractional rounded
        value.

        * platform/FractionalLayoutUnit.h:
        (WebCore::FractionalLayoutUnit::fromFloatCeil):
        (FractionalLayoutUnit):
        (WebCore::FractionalLayoutUnit::fromFloatRound):
        * rendering/LayoutTypes.h:
        (WebCore::roundedLayoutUnit):
        (WebCore::ceiledLayoutUnit):
        * rendering/RenderBlock.cpp:
        (WebCore::updatePreferredWidth):

2012-07-25  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Add *explicit* keyword to constructors in WebCore/platform
        https://bugs.webkit.org/show_bug.cgi?id=92238

        Reviewed by Kentaro Hara.

        As a step to let *explicit* keyword add to constructors which have a parameter,
        *explicit* keyword is added to Source/WebCore/platform in order to avoid implicit
        type conversion.

        Some files in platform directory can't use explicit keyword because of build breaks.

        No new tests. Covered by existing tests.

        * platform/AutodrainedPool.h:
        (AutodrainedPool):
        * platform/ContentType.h:
        (ContentType):
        * platform/ContextMenu.h:
        (ContextMenu):
        * platform/ContextMenuItem.h:
        (ContextMenuItem):
        * platform/Cursor.h:
        (WebCore::SharedCursor::SharedCursor):
        (Cursor):
        * platform/KURL.h:
        (WebCore::KURL::KURL):
        (KURL):
        * platform/KURLGooglePrivate.h:
        (KURLGooglePrivate):
        * platform/PODRedBlackTree.h:
        (WebCore::PODRedBlackTree::PODRedBlackTree):
        * platform/Pasteboard.h:
        (Pasteboard):
        * platform/PlatformEvent.h:
        (WebCore::PlatformEvent::PlatformEvent):
        * platform/PlatformKeyboardEvent.h:
        (PlatformKeyboardEvent):
        * platform/PlatformMouseEvent.h:
        (PlatformMouseEvent):
        * platform/PlatformPasteboard.h:
        (PlatformPasteboard):
        * platform/PlatformTouchEvent.h:
        (PlatformTouchEvent):
        * platform/PlatformWheelEvent.h:
        (PlatformWheelEvent):
        * platform/RunLoop.h:
        (TimerBase):
        * platform/ScrollAnimator.h:
        (ScrollAnimator):
        * platform/ScrollAnimatorNone.h:
        (ScrollAnimatorNone):
        * platform/SharedBuffer.h:
        (SharedBuffer):
        * platform/WheelFlingPlatformGestureCurve.h:
        (WheelFlingPlatformGestureCurve):
        * platform/Widget.h:
        (Widget):

2012-07-25  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        NodesFromRect and area-based hit-testing can not handle CSS transforms.
        https://bugs.webkit.org/show_bug.cgi?id=85792

        Reviewed by Eric Seidel.

        To support the combination of CSS transforms and rect based hit testing,
        we need to test against the transformed rect, instead of the original rect.

        This patch makes HitTestPoint store the exact transformed FloatPoint and 
        FloatQuad, and modifies the intersection methods so that they will use a 
        new FloatQuad based intersection when transforms requires it.

        Tests: fast/dom/nodesFromRect/nodesFromRect-rotate.html
               fast/dom/nodesFromRect/nodesFromRect-scale.html

        * platform/graphics/FloatQuad.cpp:
        (WebCore::determinant):
        (WebCore::rightMostCornerToVector):
        (WebCore::FloatQuad::intersectsRect):
        (WebCore::FloatQuad::isCounterclockwise):
        * platform/graphics/FloatQuad.h:
        (FloatQuad):
        * rendering/HitTestResult.cpp:
        (WebCore::HitTestPoint::HitTestPoint):
        (WebCore::HitTestPoint::operator=):
        (WebCore::HitTestPoint::move):
        (WebCore::HitTestPoint::intersectsRect):
        (WebCore::HitTestPoint::intersects):
        * rendering/HitTestResult.h:
        (HitTestPoint):
        (WebCore::HitTestPoint::isRectilinear):
        (WebCore::HitTestPoint::transformedPoint):
        (WebCore::HitTestPoint::transformedRect):
        * rendering/HitTestingTransformState.cpp:
        (WebCore::HitTestingTransformState::flattenWithTransform):
        (WebCore::HitTestingTransformState::mappedArea):
        (WebCore::HitTestingTransformState::boundsOfMappedArea):
        * rendering/HitTestingTransformState.h:
        (WebCore::HitTestingTransformState::create):
        (WebCore::HitTestingTransformState::HitTestingTransformState):
        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::hitTestRegion):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::hitTest):
        (WebCore::RenderLayer::createLocalTransformState):
        (WebCore::RenderLayer::hitTestLayer):
        (WebCore::RenderLayer::hitTestChildLayerColumns):
        * rendering/RenderLayer.h:
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::nodeAtFloatPoint):

2012-07-25  Kwang Yul Seo  <skyul@company100.net>

        Add HTMLStackItem.h to project files
        https://bugs.webkit.org/show_bug.cgi?id=92221

        Reviewed by Adam Barth.

        Added HTMLStackItem.h introduced in r123399 to project files.

        Project file changes only, no change in behavior thus no new tests.

        * GNUmakefile.list.am:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:

2012-07-25  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r123606.
        http://trac.webkit.org/changeset/123606
        https://bugs.webkit.org/show_bug.cgi?id=92247

        broke Windows build of Chromium (Requested by tomhudson on
        #webkit).

        * Resources/colorSuggestionPicker.css: Removed.
        * Resources/colorSuggestionPicker.js: Removed.
        * WebCore.gyp/WebCore.gyp:

2012-07-25  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: disabling property should remove "overriden" decoration from overriden UA shorthand.
        https://bugs.webkit.org/show_bug.cgi?id=92253

        Reviewed by Vsevolod Vlasov.

        Bug fix with a test and more compilation markup.

        Test: inspector/styles/styles-disable-then-enable-overriden-ua.html

        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylePropertiesSection.prototype.update):
        (WebInspector.StylePropertyTreeElement):
        (WebInspector.StylePropertyTreeElement.prototype):

2012-07-25  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Improve ObjectPropertiesSection UI by adding a tooltip for the value.
        https://bugs.webkit.org/show_bug.cgi?id=92225

        Reviewed by Pavel Feldman.

        Added tooltip with property value description on the property's valueElement.

        * inspector/front-end/ObjectPropertiesSection.js:
        (WebInspector.ObjectPropertyTreeElement.prototype.update):

2012-07-25  Pavel Feldman  <pfeldman@chromium.org>

        https://bugs.webkit.org/show_bug.cgi?id=91931

        Reviewed by Vsevolod Vlasov.

        - Synthetic shorthand values are now only returned for source-less styles
        - CSSAgents reports longhands along with the property names in getSupportedCSSProperties
        - StylesSidebarPane now has two paths: for source-enabled styles and for CSSOM-based ones (UA styles)
        - CSSStyleModel uses style metainfo as a source of shorthand / longhand relationship now

        Test: inspector/styles/styles-overriden-properties.html

        * inspector/Inspector.json:
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::getSupportedCSSProperties):
        * inspector/InspectorCSSAgent.h:
        (InspectorCSSAgent):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyle::styleWithProperties):
        * inspector/front-end/CSSCompletions.js:
        (WebInspector.CSSCompletions):
        (WebInspector.CSSCompletions.requestCSSNameCompletions):
        (WebInspector.CSSCompletions.prototype._closest):
        (WebInspector.CSSCompletions.prototype.longhands):
        (WebInspector.CSSCompletions.prototype.shorthands):
        * inspector/front-end/CSSStyleModel.js:
        (WebInspector.CSSStyleDeclaration):
        (WebInspector.CSSStyleDeclaration.prototype.longhandProperties):
        (WebInspector.CSSStyleDeclaration.prototype.shorthandValue):
        (WebInspector.CSSStyleDeclaration.prototype.newBlankProperty):
        (WebInspector.CSSProperty):
        (WebInspector.CSSProperty.parsePayload):
        * inspector/front-end/SourceCSSTokenizer.js:
        (WebInspector.SourceCSSTokenizer):
        * inspector/front-end/SourceCSSTokenizer.re2js:
        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
        (WebInspector.StylePropertiesSection.prototype.update):
        (WebInspector.StylePropertiesSection.prototype.onpopulate):
        (WebInspector.StylePropertyTreeElement.prototype):

2012-07-25  Keishi Hattori  <keishi@webkit.org>

        Implement ColorSuggestionPicker page popup
        https://bugs.webkit.org/show_bug.cgi?id=92109

        Reviewed by Kent Tamura.

        Implements ColorSuggestionPicker page popup. This will be used in
        certain ports as the datalist UI for <input type=color>.

        No new tests because there is no way to open the popup yet.

        * Resources/colorSuggestionPicker.css: Added.
        (body):
        (#main):
        (.color-swatch):
        (.color-swatch:hover):
        (.color-swatch-container):
        (.other-color):
        * Resources/colorSuggestionPicker.js: Added.
        (getScrollbarWidth):When there are more than 20 colors we need to
        increase the window width to accommodate the scroll bar.
        (createElement):
        (handleMessage):
        (initialize):
        (handleArgumentsTimeout):
        (validateArguments):
        (submitValue): Calls setValueAndClosePopup with a numValue of 0.
        (handleCancel): Calls setValueAndClosePopup with a numValue of -1.
        (chooseOtherColor): Calls setValueAndClosePopup with a numValue of -2.
        (ColorPicker):
        (ColorPicker.prototype._layout): Lays out the color swatches in a 5x4
        grid.
        (ColorPicker.prototype._handleSwatchClick):
        * WebCore.gyp/WebCore.gyp:

2012-07-25  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Fix arithmetic composite filter for auto-vectorization
        https://bugs.webkit.org/show_bug.cgi?id=92123

        Reviewed by Nikolas Zimmermann.

        Since only clamping of the result prevents GCC from auto-vectorizing the inner loop, this patch 
        adds a faster version of the inner loop to handle cases where clamping is unnecessary, 

        * platform/graphics/filters/FEComposite.cpp:
        (WebCore::computeArithmeticPixelsUnclamped):
        (WebCore::arithmeticSoftware):

2012-07-25  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Fix blend filter for autovectorizing
        https://bugs.webkit.org/show_bug.cgi?id=91398

        Reviewed by Nikolas Zimmermann.

        Get rid of wrapper classes, and use functions directly as template argument.

        * platform/graphics/filters/FEBlend.cpp:
        (WebCore::feBlendNormal):
        (WebCore::feBlendMultiply):
        (WebCore::feBlendScreen):
        (WebCore::feBlendDarken):
        (WebCore::feBlendLighten):
        (WebCore::feBlendUnknown):
        (WebCore::platformApply):
        (WebCore::FEBlend::platformApplyGeneric):

2012-07-25  Keishi Hattori  <keishi@webkit.org>

        Add methods to ColorChooserClient so the color chooser can show suggestions
        https://bugs.webkit.org/show_bug.cgi?id=92114

        Reviewed by Kent Tamura.

        Added methods to ColorChooserClient so the color chooser can ask the
        client for suggestions and current color.

        No new tests. The methods are not used yet.

        * html/ColorInputType.cpp:
        (WebCore::ColorInputType::currentColor): Returns what color the color
        chooser should display.
        (WebCore):
        (WebCore::ColorInputType::shouldShowSuggestions): Returns if the UI for
        suggestions should be shown.
        (WebCore::ColorInputType::suggestions): Returns a list of colors to be
        suggested to the user.
        * html/ColorInputType.h:
        (ColorInputType):
        * html/HTMLInputElement.h:
        (HTMLInputElement): Made dataList() public.
        * platform/ColorChooserClient.h:
        (ColorChooserClient):

2012-07-25  Kentaro Hara  <haraken@chromium.org>

        Replace int with long in test IDL files
        https://bugs.webkit.org/show_bug.cgi?id=92181

        Reviewed by Adam Barth.

        int is not a valid type in WebIDL. It should be long.
        We should replace int with long in bindings/scripts/test/*.idl.
        This is a follow-up patch for r123550.

        Test: bindings/scripts/test/TestObj.idl

        * bindings/scripts/test/CPP/WebDOMTestObj.cpp:
        (WebDOMTestObj::readOnlyLongAttr):
        (WebDOMTestObj::Attr):
        (WebDOMTestObj::setAttr):
        (WebDOMTestObj::voidMethodWithArgs):
        (WebDOMTestObj::Method):
        (WebDOMTestObj::MethodWithArgs):
        (WebDOMTestObj::objMethodWithArgs):
        * bindings/scripts/test/CPP/WebDOMTestObj.h:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_set_property):
        (webkit_dom_test_obj_get_property):
        (webkit_dom_test_obj_class_init):
        (webkit_dom_test_obj_void_method_with_args):
        (webkit_dom_test_obj_method):
        (webkit_dom_test_obj_method_with_args):
        (webkit_dom_test_obj_obj_method_with_args):
        (webkit_dom_test_obj_get_read_only_long_attr):
        (webkit_dom_test_obj_get_attr):
        (webkit_dom_test_obj_set_attr):
        (webkit_dom_test_obj_get_strawberry):
        (webkit_dom_test_obj_set_strawberry):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore):
        (WebCore::jsTestObjReadOnlyLongAttr):
        (WebCore::jsTestObjConstructorStaticReadOnlyLongAttr):
        (WebCore::jsTestObjAttr):
        (WebCore::setJSTestObjAttr):
        (WebCore::setJSTestObjStrawberry):
        (WebCore::jsTestObjPrototypeFunctionVoidMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionMethod):
        (WebCore::jsTestObjPrototypeFunctionMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionObjMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionMethodReturningSequence):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod2):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod4):
        * bindings/scripts/test/JS/JSTestObj.h:
        (WebCore):
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj readOnlyLongAttr]):
        (-[DOMTestObj Attr]):
        (-[DOMTestObj setAttr:]):
        (-[DOMTestObj voidMethodWithArgs:strArg:objArg:]):
        (-[DOMTestObj Method]):
        (-[DOMTestObj MethodWithArgs:strArg:objArg:]):
        (-[DOMTestObj objMethodWithArgs:strArg:objArg:]):
        (-[DOMTestObj customMethodWithArgs:strArg:objArg:]):
        * bindings/scripts/test/TestObj.idl:
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::readOnlyLongAttrAttrGetter):
        (WebCore::TestObjV8Internal::staticReadOnlyLongAttrAttrGetter):
        (WebCore::TestObjV8Internal::AttrAttrGetter):
        (WebCore::TestObjV8Internal::AttrAttrSetter):
        (WebCore::TestObjV8Internal::strawberryAttrSetter):
        (WebCore::TestObjV8Internal::voidMethodWithArgsCallback):
        (WebCore::TestObjV8Internal::MethodCallback):
        (WebCore::TestObjV8Internal::MethodWithArgsCallback):
        (WebCore::TestObjV8Internal::objMethodWithArgsCallback):
        (WebCore::TestObjV8Internal::methodReturningSequenceCallback):
        (WebCore::TestObjV8Internal::overloadedMethod2Callback):
        (WebCore::TestObjV8Internal::overloadedMethod4Callback):
        (WebCore):
        (WebCore::ConfigureV8TestObjTemplate):

2012-07-25  Shinya Kawanaka  <shinyak@chromium.org>

        A validation bubble should not be modifiable.
        https://bugs.webkit.org/show_bug.cgi?id=92217

        Reviewed by Kent Tamura.

        A user can set -webkit-user-modify: read-write to validation message elements.
        This might cause a undesired crash like Bug 65738. They should be unmodifiable.

        Test: fast/forms/validation-user-modify.html

        * css/html.css:
        Added -webkit-user-modify: read-only !important; for these elements so that they won't be
        changed by a user.
        (::-webkit-validation-bubble):
        (::-webkit-validation-bubble-message):
        (::-webkit-validation-bubble-text-block):
        (::-webkit-validation-bubble-heading):
        (::-webkit-validation-bubble-arrow):
        (::-webkit-validation-bubble-arrow-clipper):

2012-07-25  Zeno Albisser  <zeno@webkit.org>

        [Qt][WK2] Disable CopyToTexture for GraphicsSurfaceMac.
        https://bugs.webkit.org/show_bug.cgi?id=92159

        Disable CopyToTexture feature for GraphicsSurface on Mac.
        While this is actually working, it is currently used for Tiles
        that are single buffered, and therefore requires a call to glFlush.
        This call blocks the GPU for about 40ms which would make smooth animations impossible.

        Reviewed by Noam Rosenthal.

        * platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp:
        (WebCore::GraphicsSurface::platformCreate):
        (WebCore::GraphicsSurface::platformImport):

2012-07-25  Kenichi Ishibashi  <bashi@chromium.org>

        [Chromium] Fix up includes in HarfBuzzNGFace.h
        https://bugs.webkit.org/show_bug.cgi?id=92127

        Reviewed by Hajime Morita.

        Move constructors of FontPlatformData from headers to corresponding cpp files
        so that we can use forward declaration for HarfBuzzNGFace instead of including HarfBuzzNGFace.h.
        This way we can include hb.h in HarfBuzzNGFace.h.

        No new tests. No changes in behavior.

        * platform/graphics/FontPlatformData.cpp:
        (WebCore::FontPlatformData::FontPlatformData): Moved from header file.
        (WebCore):
        * platform/graphics/FontPlatformData.h:
        (WebCore):
        (FontPlatformData): Moved to cpp file.
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm: Include HarfBuzzNGFace.h
        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp:
        (WebCore::FontPlatformData::FontPlatformData): Moved from header file.
        (WebCore):
        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h:
        (WebCore):
        (FontPlatformData): Moved to cpp file.
        * platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h: Include hb.h.

2012-07-24  Benjamin Poulain  <bpoulain@apple.com> && Joseph Pecoraro  <pecoraro@apple.com>

        QualifiedName's HashSet should be big enough to hold at least all the static names
        https://bugs.webkit.org/show_bug.cgi?id=91891

        Reviewed by Darin Adler.

        QualifiedName's table has a standard size of 64 buckets. When initializing WebKit,
        we create 850 static QualifiedName for the standard names (HTMLNames, SVGNames etc).

        The small base size forces us to grow and rehash the table several time on startup.

        This patch solves the issue by defining the initial table size to the minimum size that
        can hold all the static QualifiedName.

        * dom/QualifiedName.cpp:
        (QualifiedNameHashTraits):
        * dom/make_names.pl:
        (printNamesHeaderFile):

2012-07-24  Kwang Yul Seo  <skyul@company100.net>

        Remove anonymous namespace and make functions static.
        https://bugs.webkit.org/show_bug.cgi?id=92214

        Reviewed by Adam Barth.

        Mark functions as static instead of enclosing them in anonymous namespaces.
        One exception to this rule is when a function is passed as a template argument.
        In this case, the function must have an external linkage.

        No functional change. Covered by existing tests.

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::hasImpliedEndTag):
        (WebCore::causesFosterParenting):
        (WebCore::isAllWhitespace):
        * html/parser/HTMLDocumentParser.cpp:
        (WebCore):
        (WebCore::tokenizerStateForContextElement):
        * html/parser/HTMLElementStack.cpp:
        (WebCore::isNumberedHeaderElement):
        (WebCore::isRootNode):
        (WebCore):
        * html/parser/HTMLEntityParser.cpp:
        (WebCore::isAlphaNumeric):
        * html/parser/HTMLEntitySearch.cpp:
        (WebCore::halfway):
        * html/parser/HTMLPreloadScanner.cpp:
        (WebCore):
        * html/parser/HTMLTokenizer.cpp:
        (WebCore::toLowerCase):
        (WebCore::vectorEqualsString):
        (WebCore::isEndTagBufferingState):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore):
        (WebCore::uninitializedPositionValue1):
        (WebCore::isAllWhitespace):
        (WebCore::isAllWhitespaceOrReplacementCharacters):
        (WebCore::isNumberedHeaderTag):
        (WebCore::isCaptionColOrColgroupTag):
        (WebCore::isTableCellContextTag):
        (WebCore::isTableBodyContextTag):
        (WebCore::isSpecialNode):
        (WebCore::isNonAnchorNonNobrFormattingTag):
        (WebCore::isNonAnchorFormattingTag):
        (WebCore::isFormattingTag):
        (WebCore::closestFormAncestor):
        (WebCore::mapLoweredLocalNameToName):
        (WebCore::adjustSVGTagNameCase):
        (WebCore::adjustAttributes):
        (WebCore::adjustSVGAttributes):
        (WebCore::adjustMathMLAttributes):
        (WebCore::addNamesWithPrefix):
        (WebCore::adjustForeignAttributes):

2012-07-24  Vsevolod Vlasov  <vsevik@chromium.org>

        Unreviewed r123494 follow-up: fixed inspector undock icon.

        * inspector/front-end/Images/statusbarButtonGlyphs.png:

2012-07-24  Kwang Yul Seo  <skyul@company100.net>

        Read tag names and attributes from the saved tokens where possible.
        https://bugs.webkit.org/show_bug.cgi?id=92079

        Reviewed by Adam Barth.

        Read tag names and attributes from the saved tokens, not from the DOM.
        Also added convenient methods such as hasLocalName, hasTagName, localName,
        isElementNode and isDocumentFragmentNode to HTMLStackItem class.

        No new tests, covered by existing tests.

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLNames::hasImpliedEndTag):
        (WebCore::HTMLNames::causesFosterParenting):
        (WebCore::HTMLConstructionSite::generateImpliedEndTagsWithExclusion):
        (WebCore::HTMLConstructionSite::generateImpliedEndTags):
        (WebCore::HTMLConstructionSite::shouldFosterParent):
        * html/parser/HTMLConstructionSite.h:
        (WebCore::HTMLConstructionSite::currentStackItem):
        * html/parser/HTMLElementStack.cpp:
        (WebCore::HTMLNames::isNumberedHeaderElement):
        (WebCore::HTMLNames::isRootNode):
        (WebCore::HTMLNames::isScopeMarker):
        (WebCore::HTMLNames::isListItemScopeMarker):
        (WebCore::HTMLNames::isTableScopeMarker):
        (WebCore::HTMLNames::isTableBodyScopeMarker):
        (WebCore::HTMLNames::isTableRowScopeMarker):
        (WebCore::HTMLNames::isForeignContentScopeMarker):
        (WebCore::HTMLNames::isButtonScopeMarker):
        (WebCore::HTMLNames::isSelectScopeMarker):
        (WebCore::HTMLElementStack::ElementRecord::replaceElement):
        (WebCore::HTMLElementStack::popUntilNumberedHeaderElementPopped):
        (WebCore::HTMLElementStack::popUntilTableScopeMarker):
        (WebCore::HTMLElementStack::popUntilTableBodyScopeMarker):
        (WebCore::HTMLElementStack::popUntilTableRowScopeMarker):
        (WebCore::HTMLElementStack::isMathMLTextIntegrationPoint):
        (WebCore::HTMLElementStack::isHTMLIntegrationPoint):
        (WebCore::HTMLElementStack::popUntilForeignContentScopeMarker):
        (WebCore::HTMLElementStack::pushRootNode):
        (WebCore::HTMLElementStack::oneBelowTop):
        (WebCore::HTMLElementStack::topmost):
        (WebCore):
        (WebCore::inScopeCommon):
        (WebCore::HTMLElementStack::hasNumberedHeaderElementInScope):
        (WebCore::HTMLElementStack::inScope):
        * html/parser/HTMLElementStack.h:
        (WebCore::HTMLElementStack::topStackItem):
        (HTMLElementStack):
        (WebCore::isInHTMLNamespace):
        * html/parser/HTMLStackItem.h:
        (WebCore::HTMLStackItem::isDocumentFragmentNode):
        (WebCore::HTMLStackItem::isElementNode):
        (HTMLStackItem):
        (WebCore::HTMLStackItem::hasLocalName):
        (WebCore::HTMLStackItem::hasTagName):
        (WebCore::HTMLStackItem::HTMLStackItem):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore):
        (WebCore::HTMLTreeBuilder::constructTreeFromAtomicToken):
        (WebCore::HTMLTreeBuilder::processFakeEndTag):
        (WebCore::HTMLTreeBuilder::processCloseWhenNestedTag):
        (WebCore::HTMLTreeBuilder::processStartTagForInBody):
        (WebCore::HTMLTreeBuilder::processStartTag):
        (WebCore::HTMLTreeBuilder::processAnyOtherEndTagForInBody):
        (WebCore::HTMLTreeBuilder::furthestBlockForFormattingElement):
        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
        (WebCore::HTMLTreeBuilder::processEndTagForInTableBody):
        (WebCore::HTMLTreeBuilder::processEndTagForInCell):
        (WebCore::HTMLTreeBuilder::processEndTagForInBody):
        (WebCore::HTMLTreeBuilder::processCaptionEndTagForInCaption):
        (WebCore::HTMLTreeBuilder::processTrEndTagForInRow):
        (WebCore::HTMLTreeBuilder::processEndTag):
        (WebCore::HTMLTreeBuilder::processCharacterBuffer):
        (WebCore::HTMLTreeBuilder::processEndOfFile):
        (WebCore::HTMLTreeBuilder::shouldProcessTokenInForeignContent):
        (WebCore::HTMLTreeBuilder::processTokenInForeignContent):
        * html/parser/HTMLTreeBuilder.h:

2012-07-24  Hironori Bono  <hbono@chromium.org>

        Avoid moving child objects multiple times when vertical scrollbar are shown at the left side.
        https://bugs.webkit.org/show_bug.cgi?id=91756

        Reviewed by Tony Chang.

        My r123067 moves the top-left origin of an RTL element right when its vertical
        scrollbar is shown at its left side. (That is, r123067 moves all child objects
        in the RTL element right.) This change also increases RenderBox::clientLeft()
        at the same time, i.e. it also moves child objects right. Furthermore, my r109512
        moves positioned objects in an RTL element right at the same time. This makes
        WebKit move objects in an RTL element up to three times by the scrollbar width.
        (Moving an absolute object right increases the scrollWidth value and it causes
        this bug.) This change removes unnecessary code that moves objects right in my
        r109512 and RenderBox::clientLeft().

        Test: scrollbars/rtl/div-absolute.html
              fast/block/float/026.html
              fast/block/float/028.html
              fast/overflow/unreachable-overflow-rtl-bug.html

        * dom/Element.cpp:
        (WebCore::Element::clientLeft): Increase clientLeft value by the width of a vertical scrollbar as written in the CSSOM specification.
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::addOverflowFromPositionedObjects): Removed unnecessary code.
        (WebCore::RenderBlock::determineLogicalLeftPositionForChild): Removed unnecessary code.
        * rendering/RenderBox.h:
        (WebCore::RenderBox::clientLeft): Removed unnecessary code.

2012-07-24  Dan Bernstein  <mitz@apple.com>

        RenderBlock::positionForPoint can fail when the block or its children have a vertical writing mode
        https://bugs.webkit.org/show_bug.cgi?id=92202

        Reviewed by Beth Dakin.

        Test: fast/writing-mode/positionForPoint.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::positionForPoint): Fixed two issues, each of which are covered by
        one of the sub-tests in the new regression test: (1) changed to compare children’s logical
        bounds against pointInLogicalContents, i.e. compare childern’s horizontal bounds to the
        point’s horizontal component; and (2) changed to use logicalTopForChild and
        logicalHeightForChild, which account for this block’s writing mode, instead of logicalTop
        and logicalBottom, which are based on the child’s writing mode.

2012-07-24  MORITA Hajime  <morrita@google.com>

        https://bugs.webkit.org/show_bug.cgi?id=89179
        Rendering LI having Shadow DOM seems weird

        Reviewed by Dimitri Glazkov.

        This incorrect rendering happend because HTMLLIElement::attach()
        wasn't aware of composed shadow subtree. This change makes it
        aware of that using ComposedShadowTreeParentWalker.

        Test: fast/dom/shadow/shadow-and-list-elements.html

        * html/HTMLLIElement.cpp:
        (WebCore::HTMLLIElement::attach):

2012-07-24  Alec Flett  <alecflett@chromium.org>

        IndexedDB: fix #include dependencies so IDBRequest isn't an include root
        https://bugs.webkit.org/show_bug.cgi?id=92167

        Reviewed by Tony Chang.

        Remove implicit dependencies due to using IDBRequest.h, and fix all
        places that break as a result.

        * Modules/indexeddb/IDBCallbacks.h:
        (WebCore):
        * Modules/indexeddb/IDBObjectStore.cpp:
        * Modules/indexeddb/IDBRequest.h:
        * inspector/InspectorIndexedDBAgent.cpp:

2012-07-24  Keishi Hattori  <keishi@webkit.org>

        Move PagePopupClient helper functions so they can be shared
        https://bugs.webkit.org/show_bug.cgi?id=92096

        Reviewed by Kent Tamura.

        Move PagePopupClient helper functions to a separate file,
        so they can be shared with new PagePopupClients.

        No new tests. Covered by fast/forms/date/calendar-picker-appearance.html

        * WebCore.gypi: Added PagePopupClient.cpp
        * html/shadow/CalendarPickerElement.cpp:
        (WebCore::CalendarPickerElement::writeDocument): Modified to use PagePopupClient.
        * page/PagePopupClient.cpp: Added.
        (WebCore):
        (WebCore::PagePopupClient::addJavaScriptString):
        (WebCore::PagePopupClient::addProperty):
        * page/PagePopupClient.h:
        (WebCore::PagePopupClient::addString):

2012-07-24  Jer Noble  <jer.noble@apple.com>

        setting playbackRate on a MediaController doesn't change the playbackRate for slaved media
        https://bugs.webkit.org/show_bug.cgi?id=92035

        Reviewed by Darin Adler.

        Allow updatePlaybackRate() to change the MediaPlayer rate when the media element has a 
        current media controller.

        Test: media/media-controller-playbackrate.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::updatePlaybackRate):

2012-07-24  Hayato Ito  <hayato@chromium.org>

        Rename FocusScope to FocusNavigationScope.
        https://bugs.webkit.org/show_bug.cgi?id=92062

        Reviewed by Dimitri Glazkov.

        FocusNavagationScope is better name than FocusScope since the
        class is only used for controlling focus navigation.

        No new tests - no functional changes.

        * page/FocusController.cpp:
        (WebCore::FocusNavigationScope::FocusNavigationScope):
        (WebCore::FocusNavigationScope::rootNode):
        (WebCore::FocusNavigationScope::owner):
        (WebCore::FocusNavigationScope::focusNavigationScopeOf):
        (WebCore::FocusNavigationScope::focusNavigationScopeOwnedByShadowHost):
        (WebCore::FocusNavigationScope::focusNavigationScopeOwnedByIFrame):
        (WebCore::FocusController::findFocusableNodeDecendingDownIntoFrameDocument):
        (WebCore::FocusController::advanceFocusInDocumentOrder):
        (WebCore::FocusController::findFocusableNodeAcrossFocusScope):
        (WebCore::FocusController::findFocusableNodeRecursively):
        (WebCore::FocusController::findFocusableNode):
        (WebCore::FocusController::nextFocusableNode):
        (WebCore::FocusController::previousFocusableNode):
        * page/FocusController.h:
        (FocusNavigationScope):
        (FocusController):

2012-07-24  Michael Saboff  <msaboff@apple.com>

        Convert HTML parser to handle 8-bit resources without converting to UChar*
        https://bugs.webkit.org/show_bug.cgi?id=90321

        Reviewed by Geoffrey Garen.

        No new tests, no new functionality therefore covered by existing tests.

        Changed the parsing of HTML to handle 8-bit strings without converting the 
        whole string to 16-bits.  Primary change was to use the appropriate 
        character pointer type (LChar* or UChar*) depending on the source string.
        This access is abstracted in SegmentedSubstring by getCurrentChar{8,16} and
        incrementAndGetCurrentChar{8,16} methods.  In SegmentedString, the advance()
        and advanceAndUpdateLineNumber() methods have been refactored into a
        state machine managed pair of function pointers.  The possible functions
        have not only the 8 and 16 bitness factored out, they also have the 
        "exclude line numbers" logic factored out for advanceAndUpdateLineNumber().
        This provides a net speed-up even with the 8/16 bit testing.
        Other changes involve using String methods to access and compare with the
        source data.

        * html/FTPDirectoryDocument.cpp:
        (WebCore::FTPDirectoryDocumentParser::append): Changed to use currentChar()
        instead of SegmentedString '*' operator.
        * html/parser/HTMLEntityParser.cpp: Changed to use currentChar() instead of
        SegmentedString '*' operator.
        * html/parser/HTMLParserIdioms.cpp:
        (WebCore::stripLeadingAndTrailingHTMLSpaces): Added 8-bit fast path.
        * html/parser/HTMLSourceTracker.cpp:
        (WebCore::HTMLSourceTracker::sourceForToken): Changed to use currentChar() instead of
        SegmentedString '*' operator.
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::script): Updated to use new String::dataSize() method.
        * platform/text/SegmentedString.cpp:
        (WebCore::SegmentedString::SegmentedString):
        (WebCore::SegmentedString::operator=):
        (WebCore::SegmentedString::clear):
        (WebCore::SegmentedString::append):
        (WebCore::SegmentedString::prepend):
        (WebCore::SegmentedString::advanceSubstring):
        (WebCore::SegmentedString::advance): Changed to be a wrapper that invokes current 
        advance function.
        (WebCore::SegmentedString::advance8): Fast path advance function for 8 bit data.
        (WebCore::SegmentedString::advance16): Fast path advance function for 16 bit data.
        (WebCore::SegmentedString::advanceAndUpdateLineNumber8IncludeLineNumbers): Fast
        path advanceAndUpdateLineNumber for 8 bit data when we need to update the line number.
        (WebCore::SegmentedString::advanceAndUpdateLineNumber16IncludeLineNumbers): Fast
        path advanceAndUpdateLineNumber for 16 bit data when we need to update the line number.
        (WebCore::SegmentedString::advanceSlowCase): Slow case advance function for both
        8 and 16 bit advance.
        (WebCore::SegmentedString::advanceAndUpdateLineNumberSlowCase): Slow case
        advanceAndUpdateLineNumber function for both 8 and 16 bit data.
        (WebCore::SegmentedString::advanceEmpty): Advance function when input has been exhausted.
        * platform/text/SegmentedString.h:
        (WebCore::SegmentedSubstring::SegmentedSubstring):
        (WebCore::SegmentedSubstring::clear):
        (SegmentedSubstring):
        (WebCore::SegmentedSubstring::is8Bit): New getter.
        (WebCore::SegmentedSubstring::appendTo):
        (WebCore::SegmentedSubstring::getCurrentChar8): New getter for the 8 bit case.
        (WebCore::SegmentedSubstring::getCurrentChar16): New getter for the 16 bit case.
        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar8): New wrapper functions
        that pre-increments the 8 bit pointer and returns the next character.
        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar16): New wrapper functions
        that pre-increments the 16 bit pointer and returns the next character.
        (WebCore::SegmentedSubstring::currentSubString):
        (WebCore::SegmentedSubstring::getCurrentChar):
        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar):
        (WebCore::SegmentedString::SegmentedString):
        (WebCore::SegmentedString::push):
        (WebCore::SegmentedString::isEmpty):
        (WebCore::SegmentedString::lookAhead):
        (WebCore::SegmentedString::lookAheadIgnoringCase):
        (WebCore::SegmentedString::advance):
        (WebCore::SegmentedString::advanceAndUpdateLineNumber):
        (WebCore::SegmentedString::advanceAndASSERT):
        (WebCore::SegmentedString::advanceAndASSERTIgnoringCase):
        (WebCore::SegmentedString::advancePastNonNewline):
        (WebCore::SegmentedString::advancePastNewlineAndUpdateLineNumber):
        (WebCore::SegmentedString::currentChar):
        (WebCore::SegmentedString::setSlowCase): Set advance function pointers to slow case
        functions.
        (WebCore::SegmentedString::decrementAndCheckLength): Decrement substring length and
        change to slow case functions when only one character left.
        (WebCore::SegmentedString::setAdvanceFunctionPointers): Select appropriate advance
        functions based on current substring.
        (WebCore::SegmentedString::lookAheadInline): Changed to use String::startsWith().
        (WebCore::SegmentedString::lookAheadSlowCase):
        * xml/parser/CharacterReferenceParserInlineMethods.h:
        (WebCore::consumeCharacterReference): Changed to use currentChar() instead of
        SegmentedString '*' operator.
        * xml/parser/MarkupTokenizerBase.h:
        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::nextInputCharacter):
        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::peek): Changed to use
        currentChar() instead of SegmentedString '*' operator.
        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::advance):

2012-07-24  Kenneth Russell  <kbr@google.com>

        [chromium] Hint garbage collector to run if page uses Canvas contexts
        https://bugs.webkit.org/show_bug.cgi?id=76225

        Reviewed by Kentaro Hara.

        Upon creating a canvas context, set a hint in the current isolate
        indicating that a full GC should be done upon the next page
        navigation.

        This improves Chrome's robustness on some WebGL stress tests which
        simulate real-world behavior by repeatedly navigating among
        several samples. More general measures are being investigated, but
        this change makes V8 behave the same as JSC on these stress tests.
        JSC doesn't currently use generational garbage collection, so it
        has more opportunities to discover unreferenced canvas contexts.

        Test: fast/canvas/webgl/context-creation-and-destruction.html

        * bindings/v8/V8Binding.cpp:
        (WebCore::V8BindingPerIsolateData::V8BindingPerIsolateData):
            Initialize per-isolate low memory hint.
        * bindings/v8/V8Binding.h:
        (V8BindingPerIsolateData):
        (WebCore::V8BindingPerIsolateData::setLowMemoryNotificationHint):
            Set a per-isolate hint to signal a low memory condition upon the next page navigation.
        (WebCore::V8BindingPerIsolateData::clearLowMemoryNotificationHint):
            Clear the previously set hint.
        (WebCore::V8BindingPerIsolateData::isLowMemoryNotificationHint):
            Get the previously set hint.
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::hintForGCIfNecessary):
            If necessary, send V8 a hint that it should GC.
        (WebCore):
        (WebCore::V8Proxy::clearForClose):
        (WebCore::V8Proxy::clearForNavigation):
            Call hintForGCIfNecessary.
        * bindings/v8/V8Proxy.h:
        (V8Proxy):
        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
        (WebCore::V8HTMLCanvasElement::getContextCallback):
            Set a hint that we should GC upon the next page navigation.

2012-07-24  Dave Tu  <dtu@chromium.org>

        [chromium] Add time spent painting to GPU benchmarking renderingStats() API.
        https://bugs.webkit.org/show_bug.cgi?id=90019

        Reviewed by Adrienne Walker.

        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
        (WebCore::BitmapCanvasLayerTextureUpdater::prepareToUpdate):
        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h:
        (BitmapCanvasLayerTextureUpdater):
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::Texture::prepareRect):
        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::prepareToUpdate):
        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::paintContentsRect):
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
        (Texture):
        (BitmapSkPictureCanvasLayerTextureUpdater):
        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
        (WebCore::CanvasLayerTextureUpdater::paintContents):
        * platform/graphics/chromium/CanvasLayerTextureUpdater.h:
        (CanvasLayerTextureUpdater):
        * platform/graphics/chromium/ContentLayerChromium.cpp:
        (WebCore::ContentLayerChromium::update):
        * platform/graphics/chromium/ContentLayerChromium.h:
        (ContentLayerChromium):
        * platform/graphics/chromium/ImageLayerChromium.cpp:
        (WebCore::ImageLayerChromium::update):
        * platform/graphics/chromium/ImageLayerChromium.h:
        (ImageLayerChromium):
        * platform/graphics/chromium/LayerChromium.h:
        (WebCore):
        (WebCore::LayerChromium::update):
        * platform/graphics/chromium/LayerTextureUpdater.h:
        (WebCore):
        (WebCore::LayerTextureUpdater::Texture::prepareRect):
        (WebCore::LayerTextureUpdater::prepareToUpdate):
        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        (WebCore::ScrollbarLayerChromium::updatePart):
        (WebCore::ScrollbarLayerChromium::update):
        * platform/graphics/chromium/ScrollbarLayerChromium.h:
        (ScrollbarLayerChromium):
        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::SkPictureCanvasLayerTextureUpdater::prepareToUpdate):
        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h:
        (SkPictureCanvasLayerTextureUpdater):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::updateTiles):
        (WebCore::TiledLayerChromium::updateContentRect):
        * platform/graphics/chromium/TiledLayerChromium.h:
        (TiledLayerChromium):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::updateAnimations):
        (WebCore::CCLayerTreeHost::renderingStats):
        (WebCore::CCLayerTreeHost::paintMasksForRenderSurface):
        (WebCore::CCLayerTreeHost::paintLayerContents):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore):
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCRenderingStats.h:
        (CCRenderingStats):
        (WebCore::CCRenderingStats::CCRenderingStats):

2012-07-24  Jian Li  <jianli@chromium.org>

        [V8] Correct WebIDL type should be used in the testing IDL file 
        https://bugs.webkit.org/show_bug.cgi?id=92168

        Reviewed by Kentaro Hara.

        Updated bindings test.

        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_strict_function):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionStrictFunction):
        * bindings/scripts/test/TestObj.idl:
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::enabledAtRuntimeMethod1Callback):
        (WebCore::TestObjV8Internal::enabledAtRuntimeMethod2Callback):
        (WebCore::TestObjV8Internal::enabledPerContextMethod1Callback):
        (WebCore::TestObjV8Internal::enabledPerContextMethod2Callback):
        (WebCore::TestObjV8Internal::strictFunctionCallback):

2012-07-24  Kent Tamura  <tkent@chromium.org>

        Unreviewed, rolling out r123191.
        http://trac.webkit.org/changeset/123191
        https://bugs.webkit.org/show_bug.cgi?id=91804

        It might cause another performance regression.
        http://code.google.com/p/chromium/issues/detail?id=138410

        * html/FormController.cpp:
        (FormKeyGenerator):
        (WebCore::createKey):
        (WebCore::FormKeyGenerator::formKey):
        (WebCore::FormKeyGenerator::willDeleteForm):

2012-07-24  Vineet Chaudhary  <rgf748@motorola.com>

        [JSBinding] Merging jsUnsignedLongArrayToVector() to toNativeArray() using traits.
        https://bugs.webkit.org/show_bug.cgi?id=90381

        Reviewed by Kentaro Hara.

        We can remove jsUnsignedLongArrayToVector() implementaion
        merging it to current and toNativeArray() traits.

        Tests: TestObj.idl
        There should be no behavoiral changes as just refactoring.

        * Modules/vibration/NavigatorVibration.idl: Use sequence<T> as method param than T[]
        * bindings/js/JSDOMBinding.cpp: Moved toJSSequence() to header file.
        * bindings/js/JSDOMBinding.h:
        (WebCore::toJSSequence): Moved toJSSequence() to header file.
        (WebCore::jsArray): Renamed Traits to JSValueTraits
        (WebCore::toNativeArray): Using traits.
        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::convertValue):
        * bindings/js/JSMessagePortCustom.cpp:
        (WebCore::fillMessagePortArray):
        * bindings/scripts/CodeGeneratorJS.pm: Removed unsigned long[] specific binding code.
        (AddIncludesForType):
        (GenerateParametersCheckExpression):
        (JSValueToNative):
        (NativeToJSValue):
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateParametersCheckExpression): Added check sequence<T> check for overloaded methods.
        * bindings/scripts/test/JS/JSTestObj.cpp: Rebased binding test.
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod10):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod):
        (WebCore::jsTestObjPrototypeFunctionMethodWithUnsignedLongSequence):
        * bindings/scripts/test/JS/JSTestObj.h: Rebased binding test.
        * bindings/scripts/test/TestObj.idl: Added test for sequence<T> as method parameter.
        * bindings/scripts/test/V8/V8TestObj.cpp: Rebased binding test.
        (WebCore::TestObjV8Internal::overloadedMethod10Callback):
        (TestObjV8Internal):
        (WebCore::TestObjV8Internal::overloadedMethodCallback):

2012-07-24  Kwang Yul Seo  <skyul@company100.net>

        Remove an invalid assertion introduced in r123536. Unreviewed.

        * xml/parser/MarkupTokenBase.h:
        (WebCore::AtomicMarkupTokenBase::clearExternalCharacters):

2012-07-24  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r123504.
        http://trac.webkit.org/changeset/123504
        https://bugs.webkit.org/show_bug.cgi?id=92169

        broke a bunch of text-related tests in chromium mac debug
        (Requested by zhenyao on #webkit).

        * platform/text/cf/StringCF.cpp:
        (WTF::String::createCFString):
        * platform/text/cf/StringImplCF.cpp:
        (WTF::StringImpl::createCFString):

2012-07-24  Kwang Yul Seo  <skyul@company100.net>

        Ensure Noah's ark without reading the DOM tree.
        https://bugs.webkit.org/show_bug.cgi?id=92065

        Reviewed by Adam Barth.

        Technically we shouldn't read attributes back from the DOM. If JavaScript changes
        the attributes values, we could get a slightly wrong output here.

        Read attributes from tokens saved in the active formatting element list.

        No new tests, covered by existing tests.

        * html/parser/HTMLFormattingElementList.cpp:
        (WebCore::attributeCount):
        (WebCore::HTMLFormattingElementList::append):
        (WebCore::HTMLFormattingElementList::tryToEnsureNoahsArkConditionQuickly):
        (WebCore::HTMLFormattingElementList::ensureNoahsArkCondition):
        * html/parser/HTMLFormattingElementList.h:
        (HTMLFormattingElementList):
        * html/parser/HTMLStackItem.h:
        (WebCore::HTMLStackItem::localName):
        (HTMLStackItem):

2012-07-23  Kwang Yul Seo  <skyul@company100.net>

        Clear the external characters pointer of an AtomicHTMLToken before the raw token is cleared.
        https://bugs.webkit.org/show_bug.cgi?id=92056

        Reviewed by Adam Barth.

        AtomicHTMLToken keeps a pointer to the HTMLToken's buffer instead of copying the
        characters for performance. Clear the external characters pointer before the raw token
        is cleared to make sure that we won't have a dangling pointer.

        No new tests - no functional changes.

        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::constructTreeFromToken):
        * xml/parser/MarkupTokenBase.h:
        (WebCore::AtomicMarkupTokenBase::clearExternalCharacters):
        (AtomicMarkupTokenBase):

2012-07-24  Jian Li  <jianli@chromium.org>

        Add per-context setting for html notifications
        https://bugs.webkit.org/show_bug.cgi?id=91295

        Reviewed by Adam Barth.

        Added a new per-context setting to control the enabling of html notifications.
        For chromium port, we're going to disable html notifications for web
        pages, but still keep it enabled for extensions.

        Also enhance V8 code generator to support V8EnabledPerContext attribute
        for methods.

        Updated the binding tests.

        * Modules/notifications/NotificationCenter.cpp:
        (WebCore::NotificationCenter::document): Expose document for being used by installPerContextProperties.
        (WebCore):
        * Modules/notifications/NotificationCenter.h:
        (NotificationCenter):
        * Modules/notifications/NotificationCenter.idl: Add V8EnabledPerContext attribute.
        * bindings/scripts/CodeGeneratorV8.pm: V8EnabledPerContext now supports methods.
        (GenerateHeader):
        (IsStandardFunction):
        (GenerateNonStandardFunction):
        (GenerateImplementation):
        (GenerateToV8Converters):
        (GetContextEnableFunction):
        * bindings/scripts/test/TestObj.idl: Add test case for V8EnabledPerContext methods.
        * bindings/scripts/test/V8/V8TestObj.cpp: Update test result.
        (WebCore::TestObjV8Internal::enabledAtContextMethod1Callback):
        (TestObjV8Internal):
        (WebCore::TestObjV8Internal::enabledAtContextMethod2Callback):
        (WebCore::V8TestObj::installPerContextProperties):
        (WebCore::V8TestObj::wrapSlow):
        * dom/ContextFeatures.cpp: Add a new per-context feature.
        (WebCore::ContextFeatures::htmlNotificationsEnabled):
        (WebCore):
        * dom/ContextFeatures.h: Add a new per-context feature.

2012-07-24  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r123499.
        http://trac.webkit.org/changeset/123499
        https://bugs.webkit.org/show_bug.cgi?id=92161

        Android fails to compile (Requested by zhenyao on #webkit).

        * GNUmakefile.list.am:
        * Modules/mediastream/MediaStream.cpp:
        (WebCore::MediaStream::MediaStream):
        (WebCore::MediaStream::addTrack):
        * Modules/mediastream/MediaStreamTrack.cpp:
        (WebCore::MediaStreamTrack::create):
        (WebCore::MediaStreamTrack::MediaStreamTrack):
        (WebCore::MediaStreamTrack::~MediaStreamTrack):
        (WebCore::MediaStreamTrack::setEnabled):
        * Modules/mediastream/MediaStreamTrack.h:
        (MediaStreamTrack):
        * Modules/mediastream/MediaStreamTrack.idl:
        * WebCore.gypi:
        * dom/EventNames.h:
        (WebCore):
        * dom/EventTargetFactory.in:
        * platform/chromium/support/WebMediaStreamDescriptor.cpp:
        (WebKit):
        (WebKit::WebMediaStreamDescriptor::sources):
        * platform/chromium/support/WebMediaStreamSource.cpp:
        * platform/mediastream/MediaStreamSource.cpp: Removed.
        * platform/mediastream/MediaStreamSource.h:
        (WebCore::MediaStreamSource::create):
        (WebCore::MediaStreamSource::muted):
        (WebCore::MediaStreamSource::setMuted):
        (WebCore::MediaStreamSource::MediaStreamSource):
        (MediaStreamSource):
        * platform/mediastream/chromium/MediaStreamCenterChromium.cpp:
        (WebCore::MediaStreamCenterChromium::queryMediaStreamSources):
        (WebCore::MediaStreamCenterChromium::didCreateMediaStream):

2012-07-24  Julien Chaffraix  <jchaffraix@webkit.org>

        Crash in RenderTableSection::layoutRows
        https://bugs.webkit.org/show_bug.cgi?id=92145

        Reviewed by Abhishek Arya.

        The crash came from the insertChildNode logic being confused and choosing the wrong
        renderer for insertion. This is because after r123159, table anonymous wrappers can
        be created as 'inline-table' and wouldn't pass the isAnonymousBlock() check.

        This change also aligns the ancestor iteration with RenderBlock::addChildToAnonymousColumnBlocks.

        Test: fast/table/crash-table-section-layoutRows.html

        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::insertChildNode):
        Changed the code to always get the right child. There is no justification to not
        walking up to the |owner|'s direct child in all cases.

2012-07-24  Tony Chang  <tony@chromium.org>

        Make RenderBlock::paintChildren virtual so sub classes can change the paint order
        https://bugs.webkit.org/show_bug.cgi?id=92042

        Reviewed by Ojan Vafai.

        The flexbox spec says that the order property should change the paint order of flex children.
        To make that possible, make paintChildren virtual so RenderFlexibleBox can override it.

        No new tests, this is just a refactoring.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::paintContents): Move some code out of paintChildren into paintContents.
        (WebCore::RenderBlock::paintChildren): Make virtual and just have it be a simple for loop.
        (WebCore::RenderBlock::paintChild): Move code out of paintChildren so subclasses can reuse.
        * rendering/RenderBlock.h:
        (RenderBlock): Make paintChildren virtual and protected so sub classes can call paintChild.

2012-07-24  Anna Cavender  <annacc@chromium.org>

        Create SourceBuffer and SourceBufferList objects
        https://bugs.webkit.org/show_bug.cgi?id=91771

        Reviewed by Eric Carlson.

        SourceBuffer and SourceBufferList objects are needed in order to
        implement the new object-oriented MediaSource API:
        http://dvcs.w3.org/hg/html-media/raw-file/tip/media-source/media-source.html

        No new tests - will be able to test after landing BUGWK91775

        Adding new files to build files:
        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.am:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.vcproj/WebCoreCommon.vsprops:
        * WebCore.vcproj/copyForwardingHeaders.cmd:
        * WebCore.xcodeproj/project.pbxproj:

        New objects:
        * Modules/mediasource/SourceBuffer.cpp: Added.
        * Modules/mediasource/SourceBuffer.h: Added.
        * Modules/mediasource/SourceBuffer.idl: Added.
        * Modules/mediasource/SourceBufferList.cpp: Added.
        * Modules/mediasource/SourceBufferList.h: Added.
        * Modules/mediasource/SourceBufferList.idl: Added.

        New events:
        * dom/EventNames.h:
        (WebCore):
        * dom/EventTarget.h:
        (WebCore):
        * dom/EventTargetFactory.in:

        Object constructors:
        * page/DOMWindow.idl:

2012-07-24  Patrick Gansterer  <paroga@webkit.org>

        Store the full year in GregorianDateTime
        https://bugs.webkit.org/show_bug.cgi?id=92067

        Reviewed by Geoffrey Garen.

        Use the full year instead of the offset from year 1900 
        for the year member variable of GregorianDateTime.

        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::convertValueToQVariant):
        (JSC::Bindings::convertQVariantToValue):
        * bridge/qt/qt_runtime_qt4.cpp:
        (JSC::Bindings::convertValueToQVariant):
        (JSC::Bindings::convertQVariantToValue):

2012-07-24  Benjamin Poulain  <bpoulain@apple.com>

        Do not perform 8 to 16bits characters conversion when converting a WTFString to NSString/CFString
        https://bugs.webkit.org/show_bug.cgi?id=90720

        Reviewed by Geoffrey Garen.

        In most String to CFString conversion, we should be able to use the "NoCopy" constructor and have
        a relatively cheap conversion from WTF::String to CFString.

        When the String is 8 bits, it was converted to 16 bits by getData16SlowCase() because of the call
        to String::characters().

        This patch adds a path for creating a CFString from a 8bits string using CFStringCreateWithBytes.

        This is covered by existing tests.

        * platform/text/cf/StringCF.cpp:
        (WTF::String::createCFString): CFSTR() create static CFString, it is unecessary to retain it.
        * platform/text/cf/StringImplCF.cpp:
        (WTF::StringImpl::createCFString): The logic to avoid the StringWrapperCFAllocator has also been simplified.
        The allocator creation is now closer to where it is useful.

2012-07-24  Kentaro Hara  <haraken@chromium.org>

        [V8] String wrappers should be marked Independent
        https://bugs.webkit.org/show_bug.cgi?id=91251

        Reviewed by Adam Barth.

        Currently V8 String wrappers are not marked Independent.
        By marking them Independent, they can be reclaimed by the scavenger GC.
        Although I couldn't find a case where this change reduces memory usage,
        this change would be important for upcoming changes in string conversion
        between V8 and WebKit (https://bugs.webkit.org/show_bug.cgi?id=91850).

        'm_lastStringImpl = 0' in StringCache::remove() is important.
        Look at the following code:

            static void cachedStringCallback(v8::Persistent<v8::Value> wrapper, void* parameter)
            {
                ...;
                stringCache()->remove(stringImpl);
                wrapper.Dispose();
            }

            void StringCache::remove(StringImpl* stringImpl)
            {
                ...
                if (m_lastStringImpl.get() == stringImpl)
                    m_lastStringImpl = 0;
            }

            v8::Local<v8::String> v8ExternalString(StringImpl* stringImpl, v8::Isolate* isolate)
            {
                if (m_lastStringImpl.get() == stringImpl) {
                    return v8::Local<v8::String>::New(m_lastV8String); // m_lastV8String points to a wrapper object that was accessed most recently.
                }
                return v8ExternalStringSlow(stringImpl, isolate);
            }

        Without 'm_lastStringImpl = 0', already disposed m_lastV8String can be used
        in v8ExternalString(). This was a cause of the crashes of r122614.

        Tests: At the initial commit of this patch (r122614),
               the following tests had been broken due to missing 'm_lastStringImpl = 0'.
               fast/workers/worker-location.html
               Dromaeo/cssquery-jquery.html
               Dromaeo/jslib-event-jquery.html
               Dromaeo/jslib-style-jquery.html
               Dromaeo/jslib-style-prototype.html

        * bindings/v8/V8Binding.cpp:
        (WebCore::StringCache::remove):
        (WebCore::StringCache::v8ExternalStringSlow):

2012-07-24  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: Update MediaStreamTrack to match the specification
        https://bugs.webkit.org/show_bug.cgi?id=90180

        Reviewed by Adam Barth.

        MediaStreamTracks are now required to show the status of the underlying source,
        and trigger events when that status changes.

        Test: fast/mediastream/MediaStreamTrack.html

        * GNUmakefile.list.am:
        * Modules/mediastream/MediaStream.cpp:
        (WebCore::MediaStream::MediaStream):
        (WebCore::MediaStream::addTrack):
        * Modules/mediastream/MediaStreamTrack.cpp:
        (WebCore::MediaStreamTrack::create):
        (WebCore::MediaStreamTrack::MediaStreamTrack):
        (WebCore::MediaStreamTrack::~MediaStreamTrack):
        (WebCore::MediaStreamTrack::setEnabled):
        (WebCore::MediaStreamTrack::readyState):
        (WebCore):
        (WebCore::MediaStreamTrack::sourceChangedState):
        (WebCore::MediaStreamTrack::stop):
        (WebCore::MediaStreamTrack::interfaceName):
        (WebCore::MediaStreamTrack::scriptExecutionContext):
        (WebCore::MediaStreamTrack::eventTargetData):
        (WebCore::MediaStreamTrack::ensureEventTargetData):
        * Modules/mediastream/MediaStreamTrack.h:
        * Modules/mediastream/MediaStreamTrack.idl:
        * WebCore.gypi:
        * dom/EventNames.h:
        (WebCore):
        * dom/EventTargetFactory.in:
        * platform/chromium/support/WebMediaStreamDescriptor.cpp:
        * platform/chromium/support/WebMediaStreamSource.cpp:
        (WebKit::WebMediaStreamSource::setReadyState):
        (WebKit):
        (WebKit::WebMediaStreamSource::readyState):
        * platform/mediastream/MediaStreamSource.cpp: Copied from Source/WebCore/platform/mediastream/MediaStreamSource.h.
        (WebCore):
        (WebCore::MediaStreamSource::create):
        (WebCore::MediaStreamSource::MediaStreamSource):
        (WebCore::MediaStreamSource::setReadyState):
        (WebCore::MediaStreamSource::addObserver):
        (WebCore::MediaStreamSource::removeObserver):
        * platform/mediastream/MediaStreamSource.h:
        (Observer):
        (WebCore::MediaStreamSource::Observer::~Observer):
        (MediaStreamSource):
        (WebCore::MediaStreamSource::readyState):
        * platform/mediastream/chromium/MediaStreamCenterChromium.cpp:
        (WebCore::MediaStreamCenterChromium::queryMediaStreamSources):
        (WebCore::MediaStreamCenterChromium::didCreateMediaStream):

2012-07-24  Scott Graham  <scottmg@chromium.org>

        Use native (non-cygwin) binaries for perl, gperf, and bison in Chromium
        https://bugs.webkit.org/show_bug.cgi?id=91667

        Reviewed by Tony Chang.

        Using native tools instead of cygwin version improves build time
        performance by roughly 50% (on top of previous cl-instead-of-gcc
        change).

        Also, use - instead of / for cl flags, otherwise preprocessing fails
        very slowly (due to retry loop). And, replace \ with / in gperf
        command line. Without this, gperf emits the filename literally in
        #line directives which causes VS to error with "unescaped \ in
        string". Bizarrely, building ColorData.cpp with those \ in place
        causes the IDE to exit with no error message, which was the cause of
        the previous canary failures.

        No new tests.

        * WebCore.gyp/WebCore.gyp:
        * WebCore.gyp/scripts/rule_bison.py:
        * bindings/scripts/preprocessor.pm:
        (applyPreprocessor):
        * make-hash-tools.pl:

2012-07-24  Daniel Cheng  <dcheng@chromium.org>

        Files from drag and file <input> should use getMIMETypeForExtension to determine content type.
        https://bugs.webkit.org/show_bug.cgi?id=91702

        Reviewed by Jian Li.

        Awhile back, we changed File to only use getWellKnownMIMETypeForExtension to prevent web
        pages from being able to detect what applications a user has installed indirectly through
        the MIME types. However, some sites like YouTube's drag and drop uploader use MIME types
        that aren't in WebKit's internal list, so we relax the restriction for Files that originate
        from an user action.

        * fileapi/File.cpp:
        (WebCore::getContentTypeFromFileName):
        (WebCore::createBlobDataForFile):
        (WebCore::createBlobDataForFileWithName):
        (WebCore::createBlobDataForFileWithMetadata):
        (WebCore::File::createWithRelativePath):
        (WebCore::File::File):
        * fileapi/File.h:
        (File):
        (WebCore::File::create):
        (WebCore::File::createWithName):
        * html/FileInputType.cpp:
        (WebCore::FileInputType::createFileList):
        * platform/chromium/ChromiumDataObject.cpp:
        (WebCore::ChromiumDataObject::addFilename):
        * platform/gtk/ClipboardGtk.cpp:
        (WebCore::ClipboardGtk::files):
        * platform/mac/ClipboardMac.mm:
        (WebCore::ClipboardMac::files):
        * platform/qt/ClipboardQt.cpp:
        (WebCore::ClipboardQt::files):
        * platform/win/ClipboardWin.cpp:
        (WebCore::ClipboardWin::files):

2012-07-24  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Snippets UI polish
        https://bugs.webkit.org/show_bug.cgi?id=92142

        Reviewed by Pavel Feldman.

        Changed snippets context menu items.
        Added run snippet status bar button.
        Removed unused edit source button.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/Images/statusbarButtonGlyphs.png:
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.SnippetJavaScriptSourceFrame):
        (WebInspector.SnippetJavaScriptSourceFrame.prototype.statusBarItems):
        (WebInspector.SnippetJavaScriptSourceFrame.prototype._runButtonClicked):
        * inspector/front-end/ScriptsNavigator.js:
        (WebInspector.SnippetsNavigatorView.prototype.getOrCreateFolderTreeElement):
        (WebInspector.SnippetsNavigatorView.prototype.handleContextMenu):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._updateScriptViewStatusBarItems):
        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame.prototype.statusBarItems):
        * inspector/front-end/inspector.css:
        * inspector/front-end/scriptsPanel.css:
        (.evaluate-snippet-status-bar-item .glyph):
        (.evaluate-snippet-status-bar-item.toggled .glyph):

2012-07-24  Nico Weber  <thakis@chromium.org>

        [chromium/mac] Remove webcore_resource_files from WebCore.gypi
        https://bugs.webkit.org/show_bug.cgi?id=92129

        Reviewed by Adam Barth.

        It was added in http://trac.webkit.org/changeset/81706/trunk/Source/WebCore/WebCore.gypi .
        The changes in that revision were mostly reverted in http://trac.webkit.org/changeset/119921 ,
        but this block was forgotten. Since it just confused me for a bit, remove it.

        * WebCore.gyp/WebCore.gyp:

2012-07-24  Julien Chaffraix  <jchaffraix@webkit.org>

        inline-table wrapper should be generated for display: inline element only
        https://bugs.webkit.org/show_bug.cgi?id=92054

        Reviewed by Abhishek Arya.

        CSS 2.1 only takes into account the display when determining if we should generate
        an inline-table. My misreading of the spec would make us generate an inline-table
        wrapper for any inline formatting context.

        Test: fast/table/inline-block-generates-table-wrapper.html

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::createAnonymousWithParentRenderer):
        Changed to use display instead of isInline to properly match the spec.

2012-07-24  Alec Flett  <alecflett@chromium.org>

        IndexedDB: Temporarily continue generating backend keys for empty key lists
        https://bugs.webkit.org/show_bug.cgi?id=92012

        Reviewed by Tony Chang.

        Temporarily change key behavior to allow chromium in_process_webkit
        to call putWithIndexKeys without inadvertently preventing index
        key generation. Note this is temporary until frontend key generation
        patch lands.

        No new tests, this is part of a refactor that doesn't change behavior.

        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::putInternal):

2012-07-24  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: introduce UISourceCodeFrame.
        https://bugs.webkit.org/show_bug.cgi?id=92124

        Reviewed by Vsevolod Vlasov.

        Generic implementation of SourceFrame over UISourceCode added.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
        * inspector/front-end/StylesPanel.js:
        * inspector/front-end/UISourceCodeFrame.js: Added.
        (WebInspector.UISourceCodeFrame):
        (WebInspector.UISourceCodeFrame.prototype.canEditSource):
        (WebInspector.UISourceCodeFrame.prototype.commitEditing):
        (WebInspector.UISourceCodeFrame.prototype.afterTextChanged):
        (WebInspector.UISourceCodeFrame.prototype._didEditContent):
        (WebInspector.UISourceCodeFrame.prototype._onContentChanged):
        (WebInspector.UISourceCodeFrame.prototype.populateTextAreaContextMenu):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:

2012-07-24  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/11945102> REGRESSION (r109451): Overlay scrollbars always use the default style, regardless of background color
        https://bugs.webkit.org/show_bug.cgi?id=92115

        Reviewed by Mark Rowe.

        * platform/Scrollbar.cpp:
        (WebCore::Scrollbar::scrollbarOverlayStyle): Reversed an incorrect null check.

2012-07-24  Andrew Wilson  <atwilson@chromium.org>

        Another prospective build fix for Chromium. Unreviewed.

        * platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h:

2012-07-24  Andrew Wilson  <atwilson@chromium.org>

        Unreviewed prospective build fix for Chromium. Changed include of hb.h in HarfBuzzNGFace.h

        * platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h:

2012-07-24  Dominik Röttsches  <dominik.rottsches@intel.com>

        HarfBuzzFaceNG.h forward declarations conflict with newer versions of Harfbuzz
        https://bugs.webkit.org/show_bug.cgi?id=92103

        Reviewed by Philippe Normand.

        As preparation for enabling harfbuzz-ng for EFL, I would like to include the header
        here since the forward declarations are conflicting with the harfbuzz version
        we will use for EFL.

        No new tests, no change in behavior.

        * platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h:

2012-07-24  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Fix blend filter for autovectorizing
        https://bugs.webkit.org/show_bug.cgi?id=91398

        Reviewed by Nikolas Zimmermann.

        To support auto-vectorizing, the loop had to be unswitched, and regular arrays used that 
        did not do boundary-checks in the inner loop. Finally the integer division by 255
        was optimized not use integer division intrinsics.

        On a X86-64 architechture using GCC -O3 on the file, this gives a speed-up of 2.9x.

        * platform/graphics/filters/FEBlend.cpp:
        (WebCore::fastDivideBy255):
        (BlendNormal):
        (WebCore::BlendNormal::apply):
        (BlendMultiply):
        (WebCore::BlendMultiply::apply):
        (BlendScreen):
        (WebCore::BlendScreen::apply):
        (BlendDarken):
        (WebCore::BlendDarken::apply):
        (BlendLighten):
        (WebCore::BlendLighten::apply):
        (BlendUnknown):
        (WebCore::BlendUnknown::apply):
        (WebCore::platformApply):
        (WebCore::FEBlend::platformApplyGeneric):
        (WebCore::FEBlend::platformApplySoftware):
        * platform/graphics/filters/FEBlend.h:
        (FEBlend):

2012-07-23  Hans Wennborg  <hans@chromium.org>

        Speech JavaScript API: Add the SpeechRecognitionResult.emma attribute
        https://bugs.webkit.org/show_bug.cgi?id=91743

        Reviewed by Adam Barth.

        Implement the 'emma' attribute as described in the spec draft at
        http://dvcs.w3.org/hg/speech-api/raw-file/tip/speechapi.html

        Test: fast/speech/scripted/emma.html

        * Modules/speech/SpeechRecognitionResult.cpp:
        (WebCore::SpeechRecognitionResult::~SpeechRecognitionResult):
        (WebCore):
        (WebCore::SpeechRecognitionResult::emma):
        * Modules/speech/SpeechRecognitionResult.h:
        (WebCore):
        (SpeechRecognitionResult):
        * Modules/speech/SpeechRecognitionResult.idl:
        * WebCore.gypi:
        * bindings/v8/custom/V8SpeechRecognitionResultCustom.cpp:
        (WebCore):
        (WebCore::V8SpeechRecognitionResult::visitDOMWrapper):
          We need to add an implicit reference from the result object to the
          emma object to keep the latters DOM tree alive across
          garbage-collection.

2012-07-24  Andrei Poenaru  <poenaru@adobe.com>

        Web Inspector: Protocol Extension: add getFlowByName command
        https://bugs.webkit.org/show_bug.cgi?id=91855

        Reviewed by Pavel Feldman.

        The "getFlowByName" command should return a NamedFlow for a given document and name.

        Test: inspector/styles/protocol-css-regions-commands.html

        * inspector/Inspector.json:
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::getFlowByName):
        (WebCore):
        * inspector/InspectorCSSAgent.h:
        (InspectorCSSAgent):
        * inspector/front-end/CSSStyleModel.js:
        (WebInspector.CSSStyleModel.prototype.getNamedFlowCollectionAsync):
        (WebInspector.CSSStyleModel.prototype.getFlowByNameAsync):
        (WebInspector.NamedFlow):
        (WebInspector.NamedFlow.parsePayload):

2012-07-23  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>

        [Qt] Fix compilation against namespaced Qt

        Reviewed by Simon Hausmann.

        * platform/graphics/Font.h:
        * platform/network/ResourceHandleInternal.h:
        * platform/qt/ThirdPartyCookiesQt.h:

2012-07-24  Anthony Scian  <ascian@rim.com>

        Web Inspector [JSC]: Enable initiator column in network panel.
        https://bugs.webkit.org/show_bug.cgi?id=65533

        Reviewed by Vsevolod Vlasov.

        With 40118 fixed for webkit, Preferences.displayInitiator should be set to true.
        Removed references to it since the optionality is no longer required.

        Test: http/tests/inspector/network/network-initiator.html

        * inspector/front-end/NetworkPanel.js:
        (WebInspector.NetworkLogView.prototype._createTable):
        (WebInspector.NetworkLogView.prototype.switchToDetailedView):
        (WebInspector.NetworkLogView.prototype.switchToBriefView):
        (WebInspector.NetworkDataGridNode.prototype.createCells):
        (WebInspector.NetworkDataGridNode.prototype.refreshRequest):
        * inspector/front-end/Settings.js:

2012-07-24  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Missing *explicit* keyword in dom and page.
        https://bugs.webkit.org/show_bug.cgi?id=92074

        Reviewed by Kentaro Hara.

        Some constructors missed to use *explicit* keyword. They need to be added
        *explicit* keyword to contructor which has a parameter in order to avoid
        implicit type conversion.

        Some files in dom directory can't use explicit keyword because of build breaks.

        No new tests. Covered by existing tests.

        * dom/BeforeLoadEvent.h:
        (WebCore::BeforeLoadEvent::BeforeLoadEvent):
        * dom/BeforeTextInsertedEvent.h:
        (BeforeTextInsertedEvent):
        * dom/ChildListMutationScope.h:
        (WebCore::ChildListMutationScope::ChildListMutationScope):
        * dom/ChildNodeList.h:
        (ChildNodeList):
        * dom/ClientRect.h:
        (ClientRect):
        * dom/ClientRectList.h:
        (ClientRectList):
        * dom/ComposedShadowTreeWalker.h:
        (ComposedShadowTreeParentWalker):
        * dom/DOMCoreException.h:
        (WebCore::DOMCoreException::DOMCoreException):
        * dom/DOMImplementation.h:
        (DOMImplementation):
        * dom/DatasetDOMStringMap.h:
        (WebCore::DatasetDOMStringMap::DatasetDOMStringMap):
        * dom/DeviceMotionController.h:
        (DeviceMotionController):
        * dom/DeviceOrientationController.h:
        (DeviceOrientationController):
        * dom/DocumentParser.h:
        (DocumentParser):
        * dom/EventException.h:
        (WebCore::EventException::EventException):
        * dom/EventListener.h:
        (WebCore::EventListener::EventListener):
        * dom/ExceptionBase.h:
        (ExceptionBase):
        * dom/GenericEventQueue.h:
        (GenericEventQueue):
        * dom/KeyboardEvent.h:
        (WebCore::KeypressCommand::KeypressCommand):
        * dom/MemoryInstrumentation.h:
        (WebCore::MemoryObjectInfo::MemoryObjectInfo):
        * dom/MessageChannel.h:
        (MessageChannel):
        * dom/MessagePort.h:
        (MessagePort):
        * dom/MessagePortChannel.h:
        (MessagePortChannel):
        * dom/MutationObserver.h:
        * dom/NamedNodeMap.h:
        (WebCore::NamedNodeMap::NamedNodeMap):
        * dom/NodeFilter.h:
        (WebCore::NodeFilter::NodeFilter):
        * dom/NodeWithIndex.h:
        (WebCore::NodeWithIndex::NodeWithIndex):
        * dom/Range.h:
        * dom/RangeException.h:
        (WebCore::RangeException::RangeException):
        * dom/RawDataDocumentParser.h:
        (WebCore::RawDataDocumentParser::RawDataDocumentParser):
        * dom/ScriptRunner.h:
        (ScriptRunner):
        * dom/SelectorQuery.h:
        (SelectorQuery):
        * dom/ShadowRoot.h:
        (ShadowRoot):
        * dom/SpaceSplitString.h:
        (SpaceSplitStringData):
        * dom/StaticHashSetNodeList.h:
        (StaticHashSetNodeList):
        * dom/StaticNodeList.h:
        (WebCore::StaticNodeList::StaticNodeList):
        * dom/TransformSource.h:
        (TransformSource):
        * dom/TreeScope.h:
        (TreeScope):
        * dom/WebKitNamedFlowCollection.h:
        (WebKitNamedFlowCollection):
        * page/EventHandler.h:
        (EventHandler):
        * page/FocusController.h:
        (FocusController):
        * page/FrameView.h:
        (FrameView):
        * page/MemoryInfo.h:
        (MemoryInfo):
        * page/Page.h:
        (Page):
        * page/PageGroup.h:
        (PageGroup):
        * page/PrintContext.h:
        (PrintContext):
        * page/Settings.h:
        (Settings):
        * page/SpeechInput.h:
        (SpeechInput):
        * page/SpeechInputResultList.h:
        (SpeechInputResultList):
        * page/WebKitAnimation.h:
        * page/WindowFeatures.h:
        (WindowFeatures):
        * page/WorkerNavigator.h:
        (WorkerNavigator):

2012-07-24  Kent Tamura  <tkent@chromium.org>

        Replace some callsites of shadowAncestorNode() with shadowHost()
        https://bugs.webkit.org/show_bug.cgi?id=92060

        Reviewed by Hajime Morita.

        shadowAncestorNode() is deprecated.

        No new tests. This shouldn't change behaviors.

        * html/shadow/MediaControlElements.cpp:
        (WebCore::toParentMediaElement):
        * html/shadow/TextControlInnerElements.h:
        (WebCore::SpinButtonElement::isEnabledFormControl):
        (WebCore::SpinButtonElement::isReadOnlyFormControl):
        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::paintMediaFullscreenButton):
        (WebCore::RenderThemeEfl::paintMediaMuteButton):
        * platform/gtk/RenderThemeGtk.cpp:
        (WebCore::getMediaElementFromRenderObject):
        (WebCore::centerRectVerticallyInParentInputElement):
        * platform/qt/RenderThemeQt.cpp:
        (WebCore::RenderThemeQt::paintSearchFieldCancelButton):
        (WebCore::RenderThemeQt::paintMediaSliderThumb):
        Removed an ASSERT() because nullness of o->node() is already asserted.
        * rendering/RenderInputSpeech.cpp:
        (WebCore::RenderInputSpeech::paintInputFieldSpeechButton):
        * rendering/RenderMediaControlsChromium.cpp:
        (WebCore::paintMediaSliderThumb):
        Passing shadowHost() to toParentMediaElement(), which accepts 0 and will return 0.
        (WebCore::paintMediaVolumeSliderThumb): ditto.
        * rendering/RenderThemeChromiumSkia.cpp:
        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
        Remove an ASSERT(input) because input never be null unless o->node() is
        null. If o->node() is null, this function crashes.
        (WebCore::RenderThemeMac::paintSearchFieldResultsDecoration):
        (WebCore::RenderThemeMac::paintSearchFieldResultsButton):
        (WebCore::RenderThemeMac::paintMediaMuteButton):
        It's ok to ignore "node is a media element" case because this function
        works only if node->isMediaControlElement().
        (WebCore::RenderThemeMac::paintMediaPlayButton): ditto.
        (WebCore::RenderThemeMac::paintMediaSliderTrack): ditto.
        * rendering/RenderThemeSafari.cpp:
        (WebCore::RenderThemeSafari::paintSearchFieldCancelButton):
        Remove an ASSERT(input) because input never be null unless o->node() is
        null. If o->node() is null, this function crashes.
        (WebCore::RenderThemeSafari::paintSearchFieldResultsDecoration): ditto.
        (WebCore::RenderThemeSafari::paintSearchFieldResultsButton): ditto.
        * rendering/RenderThemeWinCE.cpp:
        (WebCore::mediaElementParent):

2012-07-24  Peter Beverloo  <peter@chromium.org>

        [Chromium] Build fix for Android after r123424
        https://bugs.webkit.org/show_bug.cgi?id=92082

        Unreviewed build fix.

        Mark removed the PlatformSupport.h header from ScrollbarThemeChromiumAndroid.cpp
        in r123424, while there still are two references left to another method and a
        constant. Re-add the include directive.

        * platform/chromium/ScrollbarThemeChromiumAndroid.cpp:

2012-07-24  Kentaro Hara  <haraken@chromium.org>

        [JSC] REGRESSION(r122912): CodeGeneratorJS.pm generates wrong code
        for static attributes in supplemental IDL files
        https://bugs.webkit.org/show_bug.cgi?id=91925

        Reviewed by Adam Barth.

        r122912 implemented static attributes in CodeGeneratorJS.pm.
        However, it generates wrong code for static attributes in supplemental
        IDL files. This patch fixes it as shown in JSTestInterface.cpp.
        This fix aligns with the fix in CodeGeneratorV8.pm (r123308).

        Test: bindings/scripts/test/TestSupplemental.idl

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr):
        (WebCore::jsTestInterfaceConstructorSupplementalStaticAttr):
        (WebCore::setJSTestInterfaceConstructorSupplementalStaticAttr):

2012-07-24  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Add *explicit* keyword to constructor which has a parameter in bridge, history, loader and plugins.
        https://bugs.webkit.org/show_bug.cgi?id=92064

        Reviewed by Kentaro Hara.

        Some constructors missed to use *explicit* keyword. They need to be added
        *explicit* keyword to contructor which has a parameter in order to avoid
        implicit type conversion.

        No new tests. Covered by existing tests.

        * bridge/IdentifierRep.h:
        (WebCore::IdentifierRep::IdentifierRep):
        * history/BackForwardListImpl.h:
        (BackForwardListImpl):
        * history/CachedFrame.h:
        (CachedFrame):
        * history/HistoryItem.h:
        (HistoryItem):
        * loader/DocumentWriter.h:
        (DocumentWriter):
        * loader/FrameNetworkingContext.h:
        (WebCore::FrameNetworkingContext::FrameNetworkingContext):
        * loader/HistoryController.h:
        * loader/ImageLoader.h:
        (ImageLoader):
        * loader/LinkLoader.h:
        (LinkLoader):
        * loader/MainResourceLoader.h:
        (MainResourceLoader):
        * loader/NavigationAction.h:
        (NavigationAction):
        * loader/NavigationScheduler.h:
        (NavigationScheduler):
        * loader/PolicyChecker.h:
        (PolicyChecker):
        * loader/SubframeLoader.h:
        (SubframeLoader):
        * loader/ThreadableLoaderClientWrapper.h:
        (WebCore::ThreadableLoaderClientWrapper::ThreadableLoaderClientWrapper):
        * plugins/PluginData.h:
        (PluginData):
        * plugins/PluginViewBase.h:
        (WebCore::PluginViewBase::PluginViewBase):

2012-07-24  Patrick Gansterer  <paroga@webkit.org>

        [Qt] Fix conversion from GregorianDateTime to QTime
        https://bugs.webkit.org/show_bug.cgi?id=92068

        Reviewed by Simon Hausmann.

        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::convertValueToQVariant):
        * bridge/qt/qt_runtime_qt4.cpp:
        (JSC::Bindings::convertValueToQVariant):

2012-07-24  Arko Saha  <arko@motorola.com>

        Microdata: Implement PropertyNodeList interface.
        https://bugs.webkit.org/show_bug.cgi?id=80269

        Reviewed by Ryosuke Niwa.

        Added support for PropertyNodeList interface. Currently HTMLPropertiesCollection.namedItem(name)
        returns NodeList object. Made changes so that it will return PropertyNodeList object.

        Implemented propertyNodeList.getValues() method. It returns an array of various values. Its
        values are obtained from the "itemValue" DOM property of each of the elements represented by
        the object, in tree order.

        Spec: http://www.whatwg.org/specs/web-apps/current-work/multipage/common-dom-interfaces.html#propertynodelist

        Tests: fast/dom/MicroData/nameditem-returns-propertynodelist.html
               fast/dom/MicroData/propertynodelist-getvalues-array-values-obtained-from-itemvalue-of-each-element.html
               fast/dom/MicroData/propertynodelist-getvalues-test.html
               fast/dom/MicroData/propertynodelist-test-add-remove-element.html

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * Target.pri:
        * UseJSC.cmake:
        * UseV8.cmake:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/gobject/GNUmakefile.am:
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSMicroDataItemValueCustom.cpp: Added.
        (WebCore):
        (WebCore::toJS): Added toJS() custom method. Returns Node if itemValue is node else returns String.
        * bindings/v8/custom/V8MicroDataItemValueCustom.cpp: Added.
        (WebCore):
        (WebCore::toV8): Added toV8 custom code.
        * dom/DynamicNodeList.cpp:
        (WebCore::DynamicNodeListCacheBase::rootNode): Return document if owner node has itemref attribute specified.
        (WebCore):
        (WebCore::DynamicNodeListCacheBase::ownerNodeHasItemRefAttribute): Returns true if owner node has itemref attribute
        specified with root type NodeListRootedAtDocumentIfOwnerHasItemrefAttr.
        (WebCore::DynamicNodeListCacheBase::invalidateCache):
        (WebCore::DynamicNodeList::itemWithName): Update itemrefElements cache if root type is
        NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr.
        * dom/DynamicNodeList.h: Added m_hasItemRefElements in DynamicNodeListCacheBase to check if itemRefElmenets cache
        is valid.
        (WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase):
        (WebCore::DynamicNodeListCacheBase::isRootedAtDocument):
        (DynamicNodeListCacheBase):
        (WebCore::DynamicNodeListCacheBase::isItemRefElementsCacheValid):
        (WebCore::DynamicNodeListCacheBase::setItemRefElementsCacheValid):
        (WebCore::DynamicNodeListCacheBase::rootType): Returns cached root type.
        (WebCore::DynamicNodeListCacheBase::shouldInvalidateTypeOnAttributeChange): Invalidate NodeListCache on itemref
        attribute change.
        * dom/Node.cpp:
        (WebCore::Node::propertyNodeList):
        * dom/Node.h:
        (WebCore):
        (Node):
        * dom/PropertyNodeList.cpp: Added.
        (WebCore):
        (WebCore::PropertyNodeList::PropertyNodeList):
        (WebCore::PropertyNodeList::~PropertyNodeList):
        (WebCore::PropertyNodeList::elementIsPropertyOfRefElement): Checks if the testElement is a property of Microdata
        item.
        (WebCore::PropertyNodeList::updateRefElements):
        (WebCore::PropertyNodeList::nodeMatches):
        (WebCore::PropertyNodeList::getValues): Returns PropertyValueArray whose values are obtained from the
        itemValue DOM property of each of the elements represented by the object, in tree order.
        * dom/PropertyNodeList.h: Added.
        (WebCore):
        (PropertyNodeList):
        (WebCore::PropertyNodeList::create):
        * dom/PropertyNodeList.idl: Added.
        * html/HTMLCollection.cpp:
        (WebCore::DynamicNodeListCacheBase::itemCommon): Update itemrefElements cache if its a NodeListCollectionType with
        root type NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr.
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::properties):
        (WebCore):
        (WebCore::HTMLElement::getItemRefElements): Returns the ItemRefElements list of given element. Added this
        method to share the code between HTMLPropertiesCollection and PropertyNodeList to update itemRefElements.
        * html/HTMLElement.h:
        (HTMLElement):
        * html/HTMLPropertiesCollection.cpp:
        (WebCore::HTMLPropertiesCollection::HTMLPropertiesCollection):
        (WebCore::HTMLPropertiesCollection::updateRefElements):
        (WebCore::HTMLPropertiesCollection::updateNameCache):
        (WebCore::HTMLPropertiesCollection::namedItem): Return PropertyNodeList object instead of NodeList.
        (WebCore::HTMLPropertiesCollection::hasNamedItem): Return true if it finds an item with given
        name in the properties collection.
        * html/HTMLPropertiesCollection.h: Removed m_hasItemRefElements member variable, now DynamicNodeListCacheBase
        has isItemRefElementsCacheValid. Also removed m_hasPropertyNameCache, as DynamicNodeListCacheBase already has
        hasNameCache() and setHasNameCache().
        (WebCore):
        (HTMLPropertiesCollection):
        (WebCore::HTMLPropertiesCollection::invalidateCache):
        (WebCore::HTMLPropertiesCollection::updatePropertyCache):
        * html/HTMLPropertiesCollection.idl:
        * html/MicroDataItemValue.idl: Added.
        * page/DOMWindow.idl:

2012-07-24  Kentaro Hara  <haraken@chromium.org>

        [JSC] REGRESSION(r122912): CodeGeneratorJS.pm should not
        implicitly assume ScriptExecutionContext for static attributes
        https://bugs.webkit.org/show_bug.cgi?id=91924

        Reviewed by Adam Barth.

        r122912 implemented static attributes in CodeGeneratorJS.pm.
        However, the generated code assumes that static attributes
        always require ScriptExecutionContext, which is wrong.
        If we need a ScriptExecutionContext, we should specify
        [CallWith=ScriptExecutionContext].

        This patch fixes CodeGeneratorJS.pm so that static attributes
        do not assume ScriptExecutionContext. This fix aligns with
        the fix in CodeGeneratorV8.pm in r123308.

        Test: bindings/scripts/test/TestObj.idl

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr):
        (WebCore::jsTestInterfaceConstructorSupplementalStaticAttr):
        (WebCore::setJSTestInterfaceConstructorSupplementalStaticAttr):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjConstructorStaticReadOnlyIntAttr):
        (WebCore::jsTestObjConstructorStaticStringAttr):
        (WebCore::setJSTestObjConstructorStaticStringAttr):

2012-07-23  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Missing *explicit* keyword in editing.
        https://bugs.webkit.org/show_bug.cgi?id=92055

        Reviewed by Ryosuke Niwa.

        Some constructors missed to use *explicit* keyword. They need to be added
        *explicit* keyword to contructor which has a parameter in order to avoid
        implicit type conversion.

        No new tests. Covered by existing tests.

        * editing/AlternativeTextController.h:
        (WebCore::AlternativeTextController::UNLESS_ENABLED):
        * editing/BreakBlockquoteCommand.h:
        (BreakBlockquoteCommand):
        * editing/DeleteButton.h:
        (DeleteButton):
        * editing/DeleteButtonController.h:
        (DeleteButtonController):
        * editing/EditCommand.h:
        (EditCommand):
        (WebCore::SimpleEditCommand::SimpleEditCommand):
        * editing/EditingBehavior.h:
        (WebCore::EditingBehavior::EditingBehavior):
        * editing/EditingStyle.h:
        (EditingStyle):
        * editing/Editor.h:
        (Editor):
        * editing/FrameSelection.h:
        (FrameSelection):
        * editing/InsertLineBreakCommand.h:
        (InsertLineBreakCommand):
        * editing/ModifySelectionListLevel.h:
        (ModifySelectionListLevelCommand):
        (DecreaseSelectionListLevelCommand):
        * editing/RemoveFormatCommand.h:
        (RemoveFormatCommand):
        * editing/RemoveNodeCommand.h:
        (RemoveNodeCommand):
        * editing/RemoveNodePreservingChildrenCommand.h:
        (RemoveNodePreservingChildrenCommand):
        * editing/ReplaceNodeWithSpanCommand.h:
        (ReplaceNodeWithSpanCommand):
        * editing/TextInsertionBaseCommand.h:
        (TextInsertionBaseCommand):
        * editing/UndoManager.h:
        (UndoManager):
        * editing/UnlinkCommand.h:
        (UnlinkCommand):
        * editing/WrapContentsInDummySpanCommand.h:
        (WrapContentsInDummySpanCommand):

2012-07-23  Dominic Mazzoni  <dmazzoni@google.com>

        AX: Need AccessibilityObjects for nodes without renderers in canvas subtree
        https://bugs.webkit.org/show_bug.cgi?id=87899

        Reviewed by Chris Fleizach.

        Refactors AccessibilityRenderObject so that it inherits from a new class,
        AccessibilityNodeObject, that can be constructed from a Node without a
        renderer. Modifies AXObjectCache so that it automatically creates an
        AccessibilityNodeObject for elements in a canvas subtree but not otherwise.
        A new layout test verifies that this correctly exposes an accessibility
        tree with appropriate roles for elements in a canvas subtree.

        This patch does not try to complete the implementation of
        AccessibilityNodeObject. Most AX methods are still unimplemented and need
        to be migrated from AccessibilityRenderObject to AccessibilityNodeObject
        in a future patch.
        
        This patch also doesn't change anything outside of WebCore/accessibility, so
        the rest of WebCore only calls AXObjectCache when there are changes to a
        RenderObject, not to a Node. Accessible notifications on nodes without
        renderers need to be implemented in a future patch.

        Test: accessibility/canvas-accessibilitynodeobject.html

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::get):
        (WebCore):
        (WebCore::createFromNode):
        (WebCore::AXObjectCache::getOrCreate):
        (WebCore::AXObjectCache::remove):
        * accessibility/AXObjectCache.h:
        (AXObjectCache):
        (WebCore::AXObjectCache::get):
        (WebCore::AXObjectCache::getOrCreate):
        (WebCore::AXObjectCache::remove):
        * accessibility/AccessibilityARIAGrid.cpp:
        (WebCore::AccessibilityARIAGrid::AccessibilityARIAGrid):
        (WebCore):
        (WebCore::AccessibilityARIAGrid::~AccessibilityARIAGrid):
        (WebCore::AccessibilityARIAGrid::init):
        (WebCore::AccessibilityARIAGrid::create):
        * accessibility/AccessibilityARIAGrid.h:
        (AccessibilityARIAGrid):
        * accessibility/AccessibilityARIAGridCell.cpp:
        (WebCore::AccessibilityARIAGridCell::create):
        * accessibility/AccessibilityARIAGridRow.cpp:
        (WebCore::AccessibilityARIAGridRow::create):
        * accessibility/AccessibilityAllInOne.cpp:
        * accessibility/AccessibilityList.cpp:
        (WebCore::AccessibilityList::create):
        * accessibility/AccessibilityListBox.cpp:
        (WebCore::AccessibilityListBox::create):
        * accessibility/AccessibilityMediaControls.cpp:
        (WebCore::AccessibilityMediaControl::create):
        (WebCore::AccessibilityMediaControlsContainer::create):
        (WebCore::AccessibilityMediaTimeline::create):
        (WebCore::AccessibilityMediaTimeDisplay::create):
        * accessibility/AccessibilityMenuList.cpp:
        (WebCore::AccessibilityMenuList::create):
        (WebCore):
        * accessibility/AccessibilityMenuList.h:
        (AccessibilityMenuList):
        * accessibility/AccessibilityNodeObject.cpp: Added.
        (WebCore):
        (WebCore::AccessibilityNodeObject::AccessibilityNodeObject):
        (WebCore::AccessibilityNodeObject::~AccessibilityNodeObject):
        (WebCore::AccessibilityNodeObject::init):
        (WebCore::AccessibilityNodeObject::create):
        (WebCore::AccessibilityNodeObject::detach):
        (WebCore::AccessibilityNodeObject::childrenChanged):
        (WebCore::AccessibilityNodeObject::updateAccessibilityRole):
        (WebCore::AccessibilityNodeObject::firstChild):
        (WebCore::AccessibilityNodeObject::lastChild):
        (WebCore::AccessibilityNodeObject::previousSibling):
        (WebCore::AccessibilityNodeObject::nextSibling):
        (WebCore::AccessibilityNodeObject::parentObjectIfExists):
        (WebCore::AccessibilityNodeObject::parentObject):
        (WebCore::AccessibilityNodeObject::elementRect):
        (WebCore::AccessibilityNodeObject::setNode):
        (WebCore::AccessibilityNodeObject::document):
        (WebCore::AccessibilityNodeObject::determineAccessibilityRole):
        (WebCore::AccessibilityNodeObject::addChildren):
        (WebCore::AccessibilityNodeObject::accessibilityIsIgnored):
        (WebCore::AccessibilityNodeObject::canSetFocusAttribute):
        (WebCore::AccessibilityNodeObject::determineAriaRoleAttribute):
        (WebCore::AccessibilityNodeObject::ariaRoleAttribute):
        (WebCore::AccessibilityNodeObject::remapAriaRoleDueToParent):
        * accessibility/AccessibilityNodeObject.h: Added.
        (WebCore):
        (AccessibilityNodeObject):
        (WebCore::AccessibilityNodeObject::isAccessibilityNodeObject):
        (WebCore::AccessibilityNodeObject::node):
        (WebCore::AccessibilityNodeObject::isDetached):
        (WebCore::toAccessibilityNodeObject):
        * accessibility/AccessibilityObject.h:
        (WebCore::AccessibilityObject::isAccessibilityNodeObject):
        * accessibility/AccessibilityProgressIndicator.cpp:
        (WebCore::AccessibilityProgressIndicator::create):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
        (WebCore::AccessibilityRenderObject::init):
        (WebCore):
        (WebCore::AccessibilityRenderObject::create):
        (WebCore::AccessibilityRenderObject::detach):
        (WebCore::AccessibilityRenderObject::setRenderer):
        (WebCore::AccessibilityRenderObject::canHaveChildren):
        (WebCore::AccessibilityRenderObject::addCanvasChildren):
        (WebCore::AccessibilityRenderObject::addChildren):
        * accessibility/AccessibilityRenderObject.h:
        (AccessibilityRenderObject):
        * accessibility/AccessibilitySlider.cpp:
        (WebCore::AccessibilitySlider::create):
        * accessibility/AccessibilityTable.cpp:
        (WebCore::AccessibilityTable::AccessibilityTable):
        (WebCore):
        (WebCore::AccessibilityTable::~AccessibilityTable):
        (WebCore::AccessibilityTable::init):
        (WebCore::AccessibilityTable::create):
        * accessibility/AccessibilityTable.h:
        (AccessibilityTable):
        * accessibility/AccessibilityTableCell.cpp:
        (WebCore::AccessibilityTableCell::create):
        * accessibility/AccessibilityTableRow.cpp:
        (WebCore::AccessibilityTableRow::create):

2012-07-23  David Barr  <davidbarr@chromium.org>

        Fix ENABLE_CSS_IMAGE_ORIENTATION compile flag
        https://bugs.webkit.org/show_bug.cgi?id=91961

        Reviewed by Tony Chang.

        https://bugs.webkit.org/show_bug.cgi?id=89055
        A rule was missed implementing the ENABLE_CSS_IMAGE_ORIENTATION compile flag.

        https://bugs.webkit.org/show_bug.cgi?id=90046
        Half of the missing rule was inadvertently added together with ENABLE_CSS_STICKY_POSITION.

        No new tests; build configuration fix.

        * Configurations/FeatureDefines.xcconfig:

2012-07-23  Douglas Stockwell  <dstockwell@chromium.org>

        Null-pointer crash when a derived color like -webkit-activelink is set in a gradient stop
        https://bugs.webkit.org/show_bug.cgi?id=89148

        Reviewed by Simon Fraser.

        CSSGradientValue attempted to resolve colors during paint, this crashed
        when a derived color like -webkit-activelink was encountered because the
        corresponding element was no longer available in the StyleResolver.
        Instead, by adding a field to CSSGradientColorStop we can resolve and
        then cache the resolved colors at the correct time. To avoid sharing
        cached derived colors between elements we clone the gradient values when
        needed.

        Test: fast/css/crash-on-gradient-with-derived-color.html

        * css/CSSGradientValue.cpp:
        (WebCore::CSSGradientValue::gradientWithStylesResolved): Added. Resolve and cache
        resolved colors, clone if colors are derived from the element.
        (WebCore):
        (WebCore::CSSGradientValue::addStops):
        (WebCore::CSSGradientValue::isCacheable): Defer to new logic in
        StyleResolver.
        * css/CSSGradientValue.h:
        (CSSGradientColorStop): Added cache of resolved color.
        (CSSGradientValue):
        (CSSLinearGradientValue):
        (CSSRadialGradientValue):
        * css/CSSImageGeneratorValue.h:
        (WebCore):
        * css/CSSValue.h:
        (WebCore::CSSValue::isGradientValue):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleResolver.h:
        (StyleResolver):
        * rendering/style/StyleGeneratedImage.cpp:
        (WebCore::StyleGeneratedImage::image): Revert change from r96449. This
        is no longer necessary as the gradient colors are now resolved at a
        time when the style is set on StyleResolver.

2012-07-23  Patrick Gansterer  <paroga@webkit.org>

        Move GregorianDateTime from JSC to WTF namespace
        https://bugs.webkit.org/show_bug.cgi?id=91948

        Reviewed by Geoffrey Garen.

        Moving GregorianDateTime into the WTF namespace allows us to us to
        use it in WebCore too. The new class has the same behaviour as the
        old struct. Only the unused timeZone member has been removed.

        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::convertValueToQVariant):
        (JSC::Bindings::convertQVariantToValue):
        * bridge/qt/qt_runtime_qt4.cpp:
        (JSC::Bindings::convertValueToQVariant):
        (JSC::Bindings::convertQVariantToValue):

2012-07-23  Mark Pilgrim  <pilgrim@chromium.org>

        [Chromium] Move layoutTestMode to WebCore
        https://bugs.webkit.org/show_bug.cgi?id=92010

        Reviewed by Adam Barth.

        Part of a refactoring series. See tracking bug 82948.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/generic/RuntimeEnabledFeatures.h:
        (RuntimeEnabledFeatures):
        * platform/LayoutTestSupport.cpp: Added.
        (WebCore):
        (WebCore::isRunningLayoutTest):
        (WebCore::setIsRunningLayoutTest):
        * platform/LayoutTestSupport.h: Added.
        (WebCore):
        * platform/chromium/PlatformSupport.h:
        (PlatformSupport):
        * platform/chromium/ScrollbarThemeChromiumAndroid.cpp:
        (WebCore::ScrollbarThemeChromiumAndroid::scrollbarThickness):
        (WebCore::ScrollbarThemeChromiumAndroid::paintScrollbarBackground):
        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
        (WebCore::ScrollbarThemeChromiumWin::scrollbarThickness):
        (WebCore::ScrollbarThemeChromiumWin::buttonSize):
        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
        (WebCore):
        (WebCore::LookupAltName):
        (WebCore::fontContainsCharacter):
        (WebCore::FillLogFont):
        (WebCore::FontCache::getFontDataForCharacters):
        (WebCore::FontCache::createFontPlatformData):
        * platform/graphics/skia/FontCustomPlatformData.cpp:
        (WebCore::FontCustomPlatformData::fontPlatformData):
        * platform/graphics/skia/FontSkia.cpp:
        (WebCore::Font::drawGlyphs):
        * rendering/RenderThemeChromiumAndroid.cpp:
        (WebCore::RenderThemeChromiumAndroid::systemColor):
        (WebCore::RenderThemeChromiumAndroid::adjustInnerSpinButtonStyle):
        * rendering/RenderThemeChromiumMac.mm:
        (WebCore::RenderThemeChromiumMac::usesTestModeFocusRingColor):
        * rendering/RenderThemeChromiumSkia.cpp:
        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
        * rendering/RenderThemeChromiumWin.cpp:
        (WebCore):
        (WebCore::RenderThemeChromiumWin::platformActiveSelectionBackgroundColor):
        (WebCore::RenderThemeChromiumWin::platformInactiveSelectionBackgroundColor):
        (WebCore::RenderThemeChromiumWin::platformActiveSelectionForegroundColor):
        (WebCore::RenderThemeChromiumWin::systemColor):
        (WebCore::menuListButtonWidth):
        (WebCore::RenderThemeChromiumWin::determineClassicState):

2012-07-23  Dave Tu  <dtu@chromium.org>

        [chromium] Add droppedFrameCount to renderingStats.
        https://bugs.webkit.org/show_bug.cgi?id=91694

        Reviewed by Adrienne Walker.

        * platform/graphics/chromium/cc/CCFrameRateCounter.cpp:
        (WebCore):
        (WebCore::CCFrameRateCounter::frameInterval):
        (WebCore::CCFrameRateCounter::frameIndex):
        (WebCore::CCFrameRateCounter::CCFrameRateCounter):
        (WebCore::CCFrameRateCounter::markBeginningOfFrame):
        (WebCore::CCFrameRateCounter::isBadFrame):
        * platform/graphics/chromium/cc/CCFrameRateCounter.h:
        (WebCore::CCFrameRateCounter::droppedFrameCount):
        (CCFrameRateCounter):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::renderingStats):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::drawLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCRenderingStats.h:
        (CCRenderingStats):
        (WebCore::CCRenderingStats::CCRenderingStats):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::implSideRenderingStats):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::implSideRenderingStatsOnImplThread):

2012-07-23  Dan Bernstein  <mitz@apple.com>

        Fixed the build after r123418.

        * WebCore.exp.in: Added DocumentMarkerController::addTextMatchMarker.

2012-07-23  Mike Lawther  <mikelawther@chromium.org>

        CSS3 calc: optimise blending expression
        https://bugs.webkit.org/show_bug.cgi?id=90037

        Reviewed by Tony Chang.

        Introduce a new calc expression node - a BlendLength node. Given two Lengths and a progress
        this blends them together when evaluated.

        An alternative and more general approach of being able to blend two CalcExpressionNodes was
        tested, but involves more memory allocations, was measurably slower, and nothing currently
        would make use of the generality. 

        No functional change. Covered by existing tests.

        * platform/CalculationValue.h:
        (CalcExpressionBlendLength):
        (WebCore::CalcExpressionBlendLength::CalcExpressionBlendLength):
        (WebCore::CalcExpressionBlendLength::operator==):
        (WebCore::CalcExpressionBlendLength::evaluate):
        (WebCore):
        * platform/Length.cpp:
        (WebCore::Length::blendCalculation):

2012-07-23  Nico Weber  <thakis@chromium.org>

        [chromium] Show search tickmarks on css-styled scrollbars
        https://bugs.webkit.org/show_bug.cgi?id=91949

        Reviewed by Adrienne Walker.

        This is done by letting RenderScrollbarTheme::paintTickmarks()
        delegate to the native ScrollbarTheme. To make this possible,
        move paintTickmarks() from ScrollbarThemeComposite to the
        superclass ScrollbarTheme.

        For testing, add internals.addTextMatchMarker() and add a pixel test.

        * platform/ScrollbarTheme.h:
        (WebCore::ScrollbarTheme::paintTickmarks):
        Moved paintTickmarks() from ScrollbarThemeComposite to here.
        * platform/ScrollbarThemeComposite.h:
        Remove paintTickmarks().
        * platform/chromium/ScrollbarThemeChromium.cpp:
        (WebCore::ScrollbarThemeChromium::paintTickmarks):
        Switch to drawing tickmarks as vectors, so they can be arbitrarily wide.
        * platform/chromium/ScrollbarThemeChromiumMac.h:
        (ScrollbarThemeChromiumMac):
        Implement paintTickmarks(), so that css-styled scrollbars get tickmarks on mac.
        * platform/chromium/ScrollbarThemeChromiumMac.mm:
        (WebCore::ScrollbarThemeChromiumMac::paint):
        (WebCore::ScrollbarThemeChromiumMac::paintTickmarks):
        Implement paintTickmarks(), so that css-styled scrollbars get tickmarks on mac.
        * rendering/RenderScrollbarTheme.cpp:
        (WebCore::RenderScrollbarTheme::paintTickmarks):
        Delegate to the native ScrollbarTheme for tickmark drawing.
        (WebCore):
        * rendering/RenderScrollbarTheme.h:
        (RenderScrollbarTheme):
        Override paintTickmarks().

2012-07-23  Brian Anderson  <brianderson@chromium.org>

        [chromium] Use shallow flushes that don't glFlush
        https://bugs.webkit.org/show_bug.cgi?id=90325

        Reviewed by Kenneth Russell.

        Adds plumbing for the shallowFlushCHROMIUM extension and uses
        shallow flushes instead of normal flushes when uploading textures.
        Shallow flushes allow us to initiate command buffer flushes to
        the GPU thread/process without the overhead of a true glFlush.

        CCTextureUpdaterTest updated to recognize shallow flushes.

        * platform/chromium/support/Extensions3DChromium.cpp:
        (WebCore::Extensions3DChromium::shallowFlushCHROMIUM):
        (WebCore):
        * platform/graphics/chromium/Extensions3DChromium.h:
        (Extensions3DChromium):
        * platform/graphics/chromium/cc/CCGraphicsContext.h:
        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
        (WebCore::CCResourceProvider::shallowFlushIfSupported):
        (WebCore):
        (WebCore::CCResourceProvider::CCResourceProvider):
        (WebCore::CCResourceProvider::initialize):
        * platform/graphics/chromium/cc/CCResourceProvider.h:
        (CCResourceProvider):
        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:
        (WebCore::CCTextureUpdater::update):

2012-07-23  Hanyee Kim  <choco@company100.net>

        When using TextureMapper, WebKit does not retain final value of opacity in animations, unless it is specified on the last key frame.
        https://bugs.webkit.org/show_bug.cgi?id=91322

        Reviewed by Noam Rosenthal.

        When -webkit-fill-mode is forwards, GraphicsLayerAnimation::apply does not apply
        the property values defined in the last executing keyframe after the final iteration of animation.

        This patch does not return right after the end of animation, but it keeps applying
        the property values defined in the last executing keyframe.
        Add normalizedAnimationValueForFillsForwards function that returns a normalized value of the
        last executing keyframe.

        Link to CSS Animations spec: http://www.w3.org/TR/css3-animations/#animation-fill-mode-property

        Test: animations/fill-mode-forwards2.html

        * platform/graphics/GraphicsLayerAnimation.cpp:
        (WebCore::normalizedAnimationValueForFillsForwards):
        (WebCore):
        (WebCore::GraphicsLayerAnimation::apply):

2012-07-23  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r123184, r123195, and r123197.
        http://trac.webkit.org/changeset/123184
        http://trac.webkit.org/changeset/123195
        http://trac.webkit.org/changeset/123197
        https://bugs.webkit.org/show_bug.cgi?id=92049

        pagecycler regression (Requested by morrita on #webkit).

        * WebCore.exp.in:
        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore::Document::~Document):
        (WebCore::Document::suggestedMIMEType):
        * dom/Document.h:
        (WebCore):
        (WebCore::Node::isDocumentNode):
        (WebCore::Node::Node):
        * dom/Node.cpp:
        (WebCore::Node::~Node):
        (WebCore::Node::setDocument):
        (WebCore):
        (WebCore::Node::setTreeScope):
        (WebCore::Node::treeScope):
        (WebCore::Node::isInShadowTree):
        (WebCore::Node::reportMemoryUsage):
        * dom/Node.h:
        (Node):
        (WebCore::Node::document):
        (WebCore::Node::inDocument):
        * dom/NodeRareData.h:
        (WebCore::NodeRareData::NodeRareData):
        (WebCore::NodeRareData::treeScope):
        (WebCore::NodeRareData::setTreeScope):
        (NodeRareData):
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::ShadowRoot):
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::TreeScope):
        (WebCore::TreeScope::setParentTreeScope):
        * dom/TreeScope.h:
        (WebCore):
        (WebCore::TreeScope::idTargetObserverRegistry):
        (TreeScope):
        * dom/TreeScopeAdopter.cpp:
        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
        (WebCore::TreeScopeAdopter::moveNodeToNewDocument):
        * editing/MoveSelectionCommand.cpp:
        * editing/RemoveNodeCommand.cpp:
        * editing/RemoveNodePreservingChildrenCommand.cpp:
        * inspector/PageConsoleAgent.cpp:

2012-07-23  Roger Fong  <roger_fong@apple.com>

        On Windows, if select element is off screen horizontally, 
        menu is either inappropriately resized or positioned offscreen.
        https://bugs.webkit.org/show_bug.cgi?id=91913
        <rdar://problem/7611229>

        Reviewed by Tim Horton.

        If the select element is positioned off the edge of the screen to the left, 
        the menu is resized. It should not be resized, just shifted to remain on the screen.
        If the select element is positioned off the edge of the screen to the right, 
        the menu goes off screen instead of being shifted over to appear on screen.
        This problem only occurs on Windows.
        
        Test: ManualTests/win/select-menu-off-screen.html

        * platform/win/PopupMenuWin.cpp:
        (WebCore::PopupMenuWin::calculatePositionAndSize):
        Modified final horizontal position calculation code to position
        popup menu on screen if it would otherwise go off.
        
2012-07-23  David Dorwin  <ddorwin@chromium.org>

        Fixed crash in webkitAddKey() when key parameter is null.
        https://bugs.webkit.org/show_bug.cgi?id=85444

        Reviewed by Kentaro Hara.

        Reference: Step 1 of http://dvcs.w3.org/hg/html-media/raw-file/5f76a0b43836/encrypted-media/encrypted-media.html#dom-addkey

        Tests: media/encrypted-media/encrypted-media-syntax.html 

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::webkitAddKey):

2012-07-23  Hayato Ito  <hayato@chromium.org>

        A FocusScope for a distributed node should not be its TreeScope.
        https://bugs.webkit.org/show_bug.cgi?id=91829

        Reviewed by Dimitri Glazkov.

        Current implementation of FocusScope::focusScopeOf(Node*) returns
        the given node's treeScope().  That does not apply if the node is
        a distributed node.  We should calculate a FocusScope for a
        distributed node by traversing ancestor nodes in Composed Shadow
        Tree.

        Test: fast/dom/shadow/focus-navigation-with-distributed-nodes.html

        * page/FocusController.cpp:
        (WebCore::FocusScope::focusScopeOf):

2012-07-23  Douglas Stockwell  <dstockwell@google.com>

        Null-pointer crash when parsing border-image
        https://bugs.webkit.org/show_bug.cgi?id=91963

        Reviewed by Darin Adler.

        Test: fast/css/border-image-fill-crash.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseBorderImageRepeat): Handle the case where
        parseBorderImageRepeat is called when the value list is empty.

2012-07-23  Bem Jones-Bey  <bjonesbe@adobe.com>

        [CSS Exclusions] SVG shape errors should invalidate exclusion shapes
        https://bugs.webkit.org/show_bug.cgi?id=91761

        Reviewed by Andreas Kling.

        CSS exclusion shapes that are specified with negative radiuses or
        height/width are now considered invalid and ignored.

        Tests added to
        LayoutTests/fast/exclusions/parsing-wrap-shape-lengths.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseExclusionShapeRectangle):
        (WebCore::CSSParser::parseExclusionShapeCircle):
        (WebCore::CSSParser::parseExclusionShapeEllipse):

2012-07-23  Tien-Ren Chen  <trchen@chromium.org>

        [chromium] Implement scrollbar theme for Android
        https://bugs.webkit.org/show_bug.cgi?id=91674

        Reviewed by Adam Barth.

        Previously the scrollbar for Android was implemented as an extra
        drawing pass in the compositor. Now we switch to use the standard
        ScrollbarTheme mechanism.

        No new tests. We use mock scrollbars during layout test to share
        pixel results with Linux.

        * platform/chromium/ScrollbarThemeChromiumAndroid.cpp:
        (WebCore::ScrollbarThemeChromiumAndroid::scrollbarThickness):
        (WebCore::ScrollbarThemeChromiumAndroid::thumbPosition):
        (WebCore::ScrollbarThemeChromiumAndroid::thumbLength):
        (WebCore::ScrollbarThemeChromiumAndroid::backButtonRect):
        (WebCore::ScrollbarThemeChromiumAndroid::forwardButtonRect):
        (WebCore::ScrollbarThemeChromiumAndroid::trackRect):
        (WebCore):
        (WebCore::ScrollbarThemeChromiumAndroid::paintThumb):
        (WebCore::ScrollbarThemeChromiumAndroid::paintScrollbarBackground):
        * platform/chromium/ScrollbarThemeChromiumAndroid.h:
        (WebCore::ScrollbarThemeChromiumAndroid::usesOverlayScrollbars):
        (ScrollbarThemeChromiumAndroid):
        (WebCore::ScrollbarThemeChromiumAndroid::hasButtons):
        (WebCore::ScrollbarThemeChromiumAndroid::hasThumb):

2012-07-23  Kwang Yul Seo  <skyul@company100.net>

        Use the original token to create an element in "reconstruct the active formatting elements" and "call the adoption agency"
        https://bugs.webkit.org/show_bug.cgi?id=91703

        Reviewed by Adam Barth.

        The current WebKit HTML5 parser implementation does not hold the original token
        in the stack of open elements and the active formatting elements. This is
        problematic because the original token is used to create an element in
        "reconstruct the active formatting elements" and "call the adoption agency".

        As a workaround, WebKit uses the saved element instead of the original token
        to create an element. But this causes us to fail examples like this:
        <b id="1"><p><script>document.getElementById("1").id = "2"</script></p>TEXT</b>
        reconstructTheActiveFormattingElements calls this method to open a second <b>
        tag to wrap TEXT, it will have id "2", even though the HTML5 spec implies it
        should be "1".

        Created a ref-counted container class, HTMLStackItem to hold the original token
        and the namespace URI as well as the element. Changed HTMLElementStack and
        HTMLFormattingElementList to use HTMLStackItem.
        Changed HTMLConstructionSite::reconstructTheActiveFormattingElements and
        HTMLTreeBuilder::callTheAdoptionAgency to create an element from the saved token
        instead of the saved element.

        Updated test expectation for html5lib/runner-expected.txt
        because now resources/scripted/adoption01.dat passes.

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML):
        (WebCore::HTMLConstructionSite::insertHTMLHeadElement):
        (WebCore::HTMLConstructionSite::insertHTMLBodyElement):
        (WebCore::HTMLConstructionSite::insertHTMLFormElement):
        (WebCore::HTMLConstructionSite::insertHTMLElement):
        (WebCore::HTMLConstructionSite::insertFormattingElement):
        (WebCore::HTMLConstructionSite::insertScriptElement):
        (WebCore::HTMLConstructionSite::insertForeignElement):
        (WebCore::HTMLConstructionSite::createElementFromSavedToken):
        (WebCore::HTMLConstructionSite::reconstructTheActiveFormattingElements):
        * html/parser/HTMLConstructionSite.h:
        (HTMLConstructionSite):
        (WebCore::HTMLConstructionSite::currentElementRecord):
        * html/parser/HTMLElementStack.cpp:
        (WebCore::HTMLElementStack::ElementRecord::ElementRecord):
        (WebCore::HTMLElementStack::ElementRecord::replaceElement):
        (WebCore::HTMLElementStack::pushRootNode):
        (WebCore::HTMLElementStack::pushHTMLHtmlElement):
        (WebCore::HTMLElementStack::pushRootNodeCommon):
        (WebCore::HTMLElementStack::pushHTMLHeadElement):
        (WebCore::HTMLElementStack::pushHTMLBodyElement):
        (WebCore::HTMLElementStack::push):
        (WebCore::HTMLElementStack::insertAbove):
        (WebCore::HTMLElementStack::pushCommon):
        * html/parser/HTMLElementStack.h:
        (WebCore::HTMLElementStack::ElementRecord::element):
        (WebCore::HTMLElementStack::ElementRecord::node):
        (WebCore::HTMLElementStack::ElementRecord::stackItem):
        (ElementRecord):
        (HTMLElementStack):
        * html/parser/HTMLFormattingElementList.cpp:
        (WebCore::HTMLFormattingElementList::swapTo):
        (WebCore::HTMLFormattingElementList::append):
        * html/parser/HTMLFormattingElementList.h:
        (WebCore::HTMLFormattingElementList::Entry::Entry):
        (WebCore::HTMLFormattingElementList::Entry::isMarker):
        (WebCore::HTMLFormattingElementList::Entry::stackItem):
        (WebCore::HTMLFormattingElementList::Entry::element):
        (WebCore::HTMLFormattingElementList::Entry::replaceElement):
        (WebCore::HTMLFormattingElementList::Entry::operator==):
        (WebCore::HTMLFormattingElementList::Entry::operator!=):
        (Entry):
        (HTMLFormattingElementList):
        * html/parser/HTMLStackItem.h: Added.
        (WebCore):
        (HTMLStackItem):
        (WebCore::HTMLStackItem::create):
        (WebCore::HTMLStackItem::element):
        (WebCore::HTMLStackItem::node):
        (WebCore::HTMLStackItem::token):
        (WebCore::HTMLStackItem::namespaceURI):
        (WebCore::HTMLStackItem::HTMLStackItem):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
        (WebCore::HTMLTreeBuilder::processStartTag):
        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):

2012-07-23  Andreas Kling  <kling@webkit.org>

        Report the extra memory used by immutable StylePropertySet objects.
        <http://webkit.org/b/92032>

        Reviewed by Anders Carlsson.

        Add an optional parameter to the MemoryClassInfo constructor for passing in additional base object
        size on top of sizeof(T).

        Use this in StylePropertySet::reportMemoryUsage() to properly account for the CSSProperty array
        tacked onto the end of the object when m_isMutable == false.

        * css/StylePropertySet.h:
        (WebCore::StylePropertySet::reportMemoryUsage):
        * dom/MemoryInstrumentation.h:
        (WebCore::MemoryObjectInfo::reportObjectInfo):
        (WebCore::MemoryClassInfo::MemoryClassInfo):

2012-07-23  Gregg Tavares  <gman@google.com>

        Fix WebGL texSubImage2D for cube maps
        https://bugs.webkit.org/show_bug.cgi?id=91927

        Reviewed by Kenneth Russell.

        Fixes texSubImage2D so any size rectangle can be passed in
        for cube maps.

        Test: fast/canvas/webgl/tex-sub-image-cube-maps.html

        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore):
        (WebCore::WebGLRenderingContext::copyTexImage2D):
        (WebCore::WebGLRenderingContext::texImage2DBase):
        (WebCore::WebGLRenderingContext::texSubImage2DBase):
        (WebCore::WebGLRenderingContext::validateTexFuncParameters):
        * html/canvas/WebGLRenderingContext.h:
        (WebGLRenderingContext):

2012-07-23  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r123387.
        http://trac.webkit.org/changeset/123387
        https://bugs.webkit.org/show_bug.cgi?id=92036

        Broke chromium win build (Requested by tony^work on #webkit).

        * WebCore.gyp/WebCore.gyp:
        * WebCore.gyp/scripts/rule_bison.py:
        * bindings/scripts/preprocessor.pm:
        (applyPreprocessor):
        * make-hash-tools.pl:

2012-07-23  Kwang Yul Seo  <skyul@company100.net>

        Ref-count AtomicHTMLToken
        https://bugs.webkit.org/show_bug.cgi?id=91981

        Reviewed by Adam Barth.

        Ref-count AtomicHTMLToken to avoid copying AtomicHTMLToken in Bug 91703.

        No new tests - no functional changes.

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML):
        (WebCore::HTMLConstructionSite::mergeAttributesFromTokenIntoElement):
        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagInBody):
        (WebCore::HTMLConstructionSite::insertHTMLBodyStartTagInBody):
        (WebCore::HTMLConstructionSite::insertDoctype):
        (WebCore::HTMLConstructionSite::insertComment):
        (WebCore::HTMLConstructionSite::insertCommentOnDocument):
        (WebCore::HTMLConstructionSite::insertCommentOnHTMLHtmlElement):
        (WebCore::HTMLConstructionSite::insertHTMLHeadElement):
        (WebCore::HTMLConstructionSite::insertHTMLBodyElement):
        (WebCore::HTMLConstructionSite::insertHTMLFormElement):
        (WebCore::HTMLConstructionSite::insertHTMLElement):
        (WebCore::HTMLConstructionSite::insertSelfClosingHTMLElement):
        (WebCore::HTMLConstructionSite::insertFormattingElement):
        (WebCore::HTMLConstructionSite::insertScriptElement):
        (WebCore::HTMLConstructionSite::insertForeignElement):
        (WebCore::HTMLConstructionSite::createElement):
        (WebCore::HTMLConstructionSite::createHTMLElement):
        (WebCore::HTMLConstructionSite::createHTMLElementFromSavedElement):
        * html/parser/HTMLConstructionSite.h:
        (HTMLConstructionSite):
        * html/parser/HTMLToken.h:
        (WebCore::AtomicHTMLToken::create):
        (AtomicHTMLToken):
        (WebCore::AtomicHTMLToken::AtomicHTMLToken):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::ExternalCharacterTokenBuffer::ExternalCharacterTokenBuffer):
        (WebCore::HTMLTreeBuilder::constructTreeFromToken):
        (WebCore::HTMLTreeBuilder::constructTreeFromAtomicToken):
        (WebCore::HTMLTreeBuilder::processToken):
        (WebCore::HTMLTreeBuilder::processDoctypeToken):
        (WebCore::HTMLTreeBuilder::processFakeStartTag):
        (WebCore::HTMLTreeBuilder::processFakeEndTag):
        (WebCore::HTMLTreeBuilder::processFakePEndTagIfPInButtonScope):
        (WebCore::HTMLTreeBuilder::attributesForIsindexInput):
        (WebCore::HTMLTreeBuilder::processIsindexStartTagForInBody):
        (WebCore):
        (WebCore::HTMLTreeBuilder::processCloseWhenNestedTag):
        (WebCore::HTMLTreeBuilder::processStartTagForInBody):
        (WebCore::HTMLTreeBuilder::processStartTagForInTable):
        (WebCore::HTMLTreeBuilder::processStartTag):
        (WebCore::HTMLTreeBuilder::processHtmlStartTagForInBody):
        (WebCore::HTMLTreeBuilder::processBodyEndTagForInBody):
        (WebCore::HTMLTreeBuilder::processAnyOtherEndTagForInBody):
        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
        (WebCore::HTMLTreeBuilder::processEndTagForInTableBody):
        (WebCore::HTMLTreeBuilder::processEndTagForInRow):
        (WebCore::HTMLTreeBuilder::processEndTagForInCell):
        (WebCore::HTMLTreeBuilder::processEndTagForInBody):
        (WebCore::HTMLTreeBuilder::processEndTagForInTable):
        (WebCore::HTMLTreeBuilder::processEndTag):
        (WebCore::HTMLTreeBuilder::processComment):
        (WebCore::HTMLTreeBuilder::processCharacter):
        (WebCore::HTMLTreeBuilder::processEndOfFile):
        (WebCore::HTMLTreeBuilder::defaultForBeforeHTML):
        (WebCore::HTMLTreeBuilder::defaultForBeforeHead):
        (WebCore::HTMLTreeBuilder::defaultForInHead):
        (WebCore::HTMLTreeBuilder::defaultForInHeadNoscript):
        (WebCore::HTMLTreeBuilder::defaultForAfterHead):
        (WebCore::HTMLTreeBuilder::processStartTagForInHead):
        (WebCore::HTMLTreeBuilder::processGenericRCDATAStartTag):
        (WebCore::HTMLTreeBuilder::processGenericRawTextStartTag):
        (WebCore::HTMLTreeBuilder::processScriptStartTag):
        (WebCore::HTMLTreeBuilder::shouldProcessTokenInForeignContent):
        (WebCore::HTMLTreeBuilder::processTokenInForeignContent):
        (WebCore::HTMLTreeBuilder::parseError):
        * html/parser/HTMLTreeBuilder.h:
        (HTMLTreeBuilder):
        * html/parser/TextDocumentParser.cpp:
        (WebCore::TextDocumentParser::insertFakePreElement):

2012-07-23  Scott Graham  <scottmg@google.com>

        Use native (non-cygwin) binaries for perl, gperf, and bison in Chromium
        https://bugs.webkit.org/show_bug.cgi?id=91667

        Reviewed by Tony Chang.

        Using native tools instead of cygwin version improves build time
        performance by roughly 50% (on top of previous cl-instead-of-gcc
        change).

        Also, use - instead of / for cl flags because a layer of project
        generator converts them to \ otherwise, which causes the preprocessing
        to fail (very slowly because of the cygwin-loop with a sleep 1).

        No new tests.

        * WebCore.gyp/WebCore.gyp:
        * WebCore.gyp/scripts/rule_bison.py:
        * bindings/scripts/preprocessor.pm:
        (applyPreprocessor):
        * make-hash-tools.pl:

2012-06-12  Jer Noble  <jer.noble@apple.com>

        MediaController.currentTime should be kept stable during script execution.
        https://bugs.webkit.org/show_bug.cgi?id=88555

        Reviewed by Eric Carlson.

        Test: media/media-controller-time-constant.html

        To keep MediaController.currentTime stable, add a new m_position variable and 
        a new m_clearPositionTimer timer.  Both must be mutable variables as they will
        be updated from within const functions.  Calls to currentTime() will result in
        stable values until the next runloop iteration.

        * html/MediaController.cpp:
        (MediaController::MediaController):
        (MediaController::currentTime):
        (MediaController::setCurrentTime):
        (MediaController::clearPositionTimerFired):
        * html/MediaController.h:

2012-07-23  Huang Dongsung  <luxtella@company100.net>

        Destroy CSS decoded data more eagerly once they become dead caches.
        https://bugs.webkit.org/show_bug.cgi?id=91733

        Reviewed by Geoffrey Garen.

        Internal review by Kwang Yul Seo.

        There are three CachedResources with decoded data: CachedImage, CachedScript
        and CachedCSSStyleSheet. In the cases of CachedImage and CachedScript, we
        eagerly destroy the decoded data using Timer in CacehdResource::allClientsRemoved().
        We must apply the same policy here in CachedCSSStyleSheet because priority
        inversion can occur. For example, we can't destroy the decoded data of CachedImages
        when they are referenced by CachedCSSStyleSheet as background, mask or border
        images.

        No new tests - no new testable functionality.

        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::CachedCSSStyleSheet):
        (WebCore::CachedCSSStyleSheet::didAddClient):
        (WebCore::CachedCSSStyleSheet::allClientsRemoved):
        (WebCore::CachedCSSStyleSheet::destroyDecodedData):
        (WebCore):
        (WebCore::CachedCSSStyleSheet::decodedDataDeletionTimerFired):
        * loader/cache/CachedCSSStyleSheet.h:
        (CachedCSSStyleSheet):

2012-07-23  Simon Fraser  <simon.fraser@apple.com>

        Part 2 of: Implement sticky positioning
        https://bugs.webkit.org/show_bug.cgi?id=90046

        Reviewed by Ojan Vafai.

        Turn on ENABLE_CSS_STICKY_POSITION. Add support for parsing the new '-webkit-sticky'
        value for position, returning it from getComputedStyle(), and storing it in RenderStyle.

        Test: fast/css/sticky/parsing-position-sticky.html

        * Configurations/FeatureDefines.xcconfig:
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::getPositionOffsetValue):
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator EPosition):
        * css/CSSValueKeywords.in:
        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyleConstants.h:

2012-07-23  Stephen Chenney  <schenney@chromium.org>

        Crash when setting empty class name on a new element
        https://bugs.webkit.org/show_bug.cgi?id=92024

        Reviewed by Andreas Kling.

        Add a check for null attributeData() when setting the className to an
        empty string on a newly created element. New SVG elements have null
        attributeData() on baseVal upon creation.

        Test: svg/custom/empty-className-baseVal-crash.html

        * dom/StyledElement.cpp:
        (WebCore::StyledElement::classAttributeChanged): Add check for null attributeData()

2012-07-23  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Refactor CCLayerTreeHostCommon: clean up clipRect and drawableContentRect design
        https://bugs.webkit.org/show_bug.cgi?id=80622

        Reviewed by Adrienne Walker.

        clipRect(), usesLayerClipping(), and drawableContentRect() have been
        very confusing in CCLayerTreeHostCommon for a while. This patch
        refactors it so that (1) clipping is only done locally in
        calcDrawTransforms, and (2) the layer's drawableContentRect value
        is now meaningful value outside of calcDrawTransforms.
        Additionally, the layer is now always clipped to the root
        surface's contentBounds (which are set to the viewport bounds).
        This refactor not only makes calcDrawTransforms far more readable and intuitive, but
        this patch enables more upcoming beneficial refactors, including
        the pending refactor in https://bugs.webkit.org/show_bug.cgi?id=88953.

        Tests are also significantly updated to keep up with this refactoring change.

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::LayerChromium):
        * platform/graphics/chromium/LayerChromium.h:
        (LayerChromium):
        Removed m_usesLayerClipping and m_clipRect and associated accessors.

        * platform/graphics/chromium/RenderSurfaceChromium.h:
        (RenderSurfaceChromium):
        Updated comment

        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):
        Removed m_usesLayerClipping and m_clipRect and associated accessors.

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::updateLayers):
        removed setClipRect code that no longer applies

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateLayerScissorRect):
        scissor rect is now a little bit tighter, the intersection between damage and layer's new drawableContentRect.

        (WebCore::calculateSurfaceScissorRect):
        scissor rect is now a little bit tighter, except when filters are involved.

        (WebCore::layerClipsSubtree):
        new helper function

        (WebCore):
        (WebCore::calculateVisibleContentRect):
        (WebCore::subtreeShouldRenderToSeparateSurface):
        (WebCore::calculateDrawTransformsInternal):
           - added drawableContentRectOfSubtree to the function args, it is valid only after recursion returns,
           - added clipRectFromAncestor and bool ancestorClipsSubtree to function args, this replaces the layer's clipRect and usesLayerClipping.
           - removed the boolean return value, which was redundant with drawableContentRectOfSubtree.
           - replaced all the "setDrawableContentRect" logic with more intuitive, clear logic.
           - now, layer's drawableContentRect represents the clipped bounds of the layer expressed in the target surface space.

        (WebCore::CCLayerTreeHostCommon::calculateDrawTransforms):
        (WebCore::pointIsClippedBySurfaceOrClipRect):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::::layerScissorRectInTargetSurface):
        Updated this accessor.  It could be removed in the future, but not appropriate for this patch.

        * platform/graphics/chromium/cc/CCRenderSurface.h:

2012-07-23  Patrick Gansterer  <paroga@webkit.org>

        [CMAKE] Added missing RenderLayerFilterInfo.cpp to build system.

        * CMakeLists.txt:

2012-07-23  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r123281): childNodes sometimes returns wrong nodes
        https://bugs.webkit.org/show_bug.cgi?id=92014

        Reviewed by Anders Carlsson.

        The bug was caused by a typo in itemBeforeOrAfter. Namely, it should have been calling firstNode as
        firstNode(forward, rootNode(), shouldOnlyIncludeDirectChildren()),
        NOT firstNode(forward, rootNode(), previous)
        as evident from the argument list of the function.

        Test: fast/dom/NodeList/childNodes-reverse-iteration.html

        * html/HTMLCollection.cpp:
        (WebCore::DynamicNodeListCacheBase::itemBeforeOrAfter):

2012-07-23  Steve VanDeBogart  <vandebo@chromium.org>

        Chrome/Skia: PDF print output does not have clickable links.
        https://bugs.webkit.org/show_bug.cgi?id=91171

        Reviewed by Stephen White.

        Connect GraphicsContext::setURLForRect to Skia's new API for annotations.

        Printing is not generally testable.

        * platform/graphics/skia/GraphicsContextSkia.cpp:
        (WebCore::GraphicsContext::setURLForRect):

2012-07-23  Pierre Rossi  <pierre.rossi@gmail.com>

        Unify numTouchEventHandlersChanged and needTouchEvents in the chrome client
        https://bugs.webkit.org/show_bug.cgi?id=91006

        Reviewed by Ryosuke Niwa.

        The rationale here is that the client doesn't need to know about the touch
        event handler count. needTouchEvents was already used for that purpose.

        Test: fast/events/touch/touch-handler-count.html

        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore::Document::didAddTouchEventHandler): Only notify the client if needed.
        (WebCore::Document::didRemoveTouchEventHandler): Ditto. Also unset the TOUCH_LISTENER
        flag for the document if we reach a count of zero. The rationale being that
        hasListenerType() is relied upon in other places in combination with TOUCH_LISTENER for
        the same purpose.
        * dom/Document.h:
        (Document):
        (WebCore::Document::touchEventHandlerCount):
        * loader/EmptyClients.h:
        * page/ChromeClient.h:
        (ChromeClient):
        * page/Frame.cpp: Removed notifyChromeClientTouchEventHandlerCountChanged.
        (WebCore::Frame::setDocument): call needsTouchEvents directly.
        * page/Frame.h: Ditto.
        (Frame):
        * testing/Internals.cpp:
        (WebCore::Internals::hasTouchEventListener): expose Document::hasListenerType indirectly
        for additional testing.
        (WebCore):
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-07-23  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>

        [Qt] RenderThemeQtMobile highlight colors are not being used
        https://bugs.webkit.org/show_bug.cgi?id=92004

        Reviewed by Noam Rosenthal.

        The issue here is that setPaletteFromPageClientIfExists() is being used as a
        virtual function, but it isn't, so when platformActiveSelectionBackgroundColor()
        runs, it doesn't pick the right palette.

        Besides fixing this virtual behavior, the patch changes the structure a bit,
        because setPaletteFromPageClientIfExists() was being "overriden" in mobile theme
        to set the palette, which isn't exactly what the function name says.

        * platform/qt/RenderThemeQt.cpp:
        (WebCore::RenderThemeQt::platformActiveSelectionBackgroundColor):
        (WebCore::RenderThemeQt::platformInactiveSelectionBackgroundColor):
        (WebCore::RenderThemeQt::platformActiveSelectionForegroundColor):
        (WebCore::RenderThemeQt::platformInactiveSelectionForegroundColor):
        (WebCore::RenderThemeQt::platformFocusRingColor):
        (WebCore::RenderThemeQt::systemColor):
        (WebCore::RenderThemeQt::getMediaControlForegroundColor):
        (WebCore::RenderThemeQt::paintMediaVolumeSliderTrack):
        Use the virtual colorPalette() to get the palette.

        (WebCore::RenderThemeQt::colorPalette):
        (WebCore): Removed the code for getting the page client from here since it is
        used only by the QStyle variant.

        * platform/qt/RenderThemeQt.h:
        (RenderThemeQt):
        * platform/qt/RenderThemeQtMobile.cpp:
        (WebCore::RenderThemeQtMobile::colorPalette):
        (WebCore):
        * platform/qt/RenderThemeQtMobile.h:
        (RenderThemeQtMobile):

2012-07-23  Simon Fraser  <simon.fraser@apple.com>

        Part 1 of: Implement sticky positioning
        https://bugs.webkit.org/show_bug.cgi?id=90046

        Reviewed by Ojan Vafai.

        Add ENABLE_CSS_STICKY_POSITION, defaulting to off initially.
        
        Sort the ENABLE_CSS lines in the file. Make sure all the flags
        are in FEATURE_DEFINES.

        * Configurations/FeatureDefines.xcconfig:

2012-07-23  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r123339.
        http://trac.webkit.org/changeset/123339
        https://bugs.webkit.org/show_bug.cgi?id=92006

        massive media tests failure (Requested by philn on #webkit).

        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
        (WTF::adoptGRef):
        * platform/graphics/gstreamer/GStreamerVersioning.cpp:
        (setGstElementClassMetadata):
        * platform/graphics/gstreamer/GStreamerVersioning.h:

2012-07-21  Vincent Scheib  <scheib@chromium.org>

        webkitFullscreenElement, webkitCurrentFullScreenElement, webkitPointerLockElement block cross origin access.
        https://bugs.webkit.org/show_bug.cgi?id=91892

        Reviewed by Adam Barth.

        PointerLockElement only returned when requested from the document that owns it.

        Tests: http/tests/fullscreen/fullscreenelement-different-origin.html
               http/tests/fullscreen/fullscreenelement-same-origin.html
               http/tests/pointer-lock/pointerlockelement-different-origin.html
               http/tests/pointer-lock/pointerlockelement-same-origin.html

        * dom/Document.cpp:
        (WebCore::Document::webkitPointerLockElement):

2012-07-23  Philippe Normand  <pnormand@igalia.com>

        [GTK][jhbuild] Switch to GStreamer 0.11 build
        https://bugs.webkit.org/show_bug.cgi?id=91727

        Reviewed by Gustavo Noronha Silva.

        Add a new function to encapsulate the GStreamer API removal of
        GST_OBJECT_IS_FLOATING in the upcoming 1.0 release. Use of this
        macro can now be replaced by calling the g_object_is_floating
        function.

        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
        (WTF::adoptGRef):
        * platform/graphics/gstreamer/GStreamerVersioning.cpp:
        (gstObjectIsFloating):
        * platform/graphics/gstreamer/GStreamerVersioning.h:

2012-07-23  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] media/controls-styling.html is failing
        https://bugs.webkit.org/show_bug.cgi?id=91984

        Reviewed by Eric Carlson.

        Make sure that the CSS properties letter-spacing, word-spacing,
        line-height, text-transform, text-indent, text-shadow,
        text-decoration and color do not affect the media element controls,
        that display text.

        No new tests. Already tested by media/controls-styling.html and
        media/controls-styling-strict.html

        * css/mediaControlsEfl.css:
        (audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display):

2012-07-23  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix make distcheck.

        * GNUmakefile.list.am: Add missing header files.

2012-07-23  Kent Tamura  <tkent@chromium.org>

        Replace some instances of shadowAncestorNode() with shadowHost()
        https://bugs.webkit.org/show_bug.cgi?id=91966

        Reviewed by Hajime Morita.

        shadowAncestorNode() is deprecated. We should use shadowHost().
        No new tests. This doesn't change any behavior.

        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkSelector):
        * dom/TreeScope.cpp:
        (WebCore::listTreeScopes):
        * html/HTMLSummaryElement.cpp:
        (WebCore::isClickableControl):
        * html/shadow/DetailsMarkerControl.cpp:
        (WebCore::DetailsMarkerControl::summaryElement):
        * html/shadow/MeterShadowElement.cpp:
        (WebCore::MeterShadowElement::meterElement):
        * html/shadow/ProgressShadowElement.cpp:
        (WebCore::ProgressShadowElement::progressElement):
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::RenderSliderThumb::layout):
        (WebCore::RenderSliderContainer::layout):
        (WebCore::SliderThumbElement::hostInput):
        (WebCore::TrackLimiterElement::shadowPseudoId):
        (WebCore::SliderContainerElement::shadowPseudoId):
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::TextControlInnerElement::customStyleForRenderer):
        (WebCore::TextControlInnerTextElement::defaultEventHandler):
        (WebCore::TextControlInnerTextElement::createRenderer):
        (WebCore::TextControlInnerTextElement::customStyleForRenderer):
        (WebCore::SearchFieldResultsButtonElement::shadowPseudoId):
        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
        (WebCore::SearchFieldCancelButtonElement::defaultEventHandler):
        (WebCore::SpinButtonElement::defaultEventHandler):
        (WebCore::SpinButtonElement::step):
        (WebCore::InputFieldSpeechButtonElement::defaultEventHandler):
        (WebCore::InputFieldSpeechButtonElement::setState):
        (WebCore::InputFieldSpeechButtonElement::setRecognitionResult):
        (WebCore::InputFieldSpeechButtonElement::startSpeechInput):
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlInnerBlock::positionForPoint):

2012-07-23  Pavel Feldman  <pfeldman@chromium.org>

        [WK2] REGRESSION r122966: Crash when closing tab with Web Inspector open in WebKit::PageOverlay
        https://bugs.webkit.org/show_bug.cgi?id=91782

        Reviewed by Yury Semikhatsky.

        hideHighlight was never called once user hovered over a node.

        * inspector/DOMNodeHighlighter.cpp:
        (WebCore::InspectorOverlay::update):

2012-07-23  Peter Beverloo  <peter@chromium.org>

        [Chromium] Build fix for the Windows builder following r123311
        https://bugs.webkit.org/show_bug.cgi?id=91979

        Unreviewed build fix.

        Changeset r123311 moved the TextCodecWinCE.{cpp,h} files to the Windows
        directory. Update Chromium's references to these files to fix the build.

        * WebCore.gypi:

2012-07-23  Patrick Gansterer  <paroga@webkit.org>

        [WIN] Remove ICU dependencies from UniscribeController
        https://bugs.webkit.org/show_bug.cgi?id=91921

        Reviewed by Ryosuke Niwa.

        Replace ICU specific functions and macros with the corresponding code from WTF::Unicode.
        This allows us to use UniscribeController with an other Unicode implementation too.

        * platform/graphics/win/UniscribeController.cpp:
        (WebCore::UniscribeController::advance):

2012-07-23  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] media/controls-styling-strict.html is failing
        https://bugs.webkit.org/show_bug.cgi?id=91960

        Reviewed by Kenneth Rohde Christiansen.

        Use "display: -webkit-box;" instead of inline-block
        for current-time control. This is needed because
        inline-block behaves differently in strict mode.

        No new test, already tested by media/controls-styling-strict.html

        * css/mediaControlsEfl.css:
        (audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display):

2012-07-23  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix GTK+ build with ENABLE_DATALIST_ELEMENT.

        Add an implementation for virtual pure methods sliderTickSize()
        and sliderTickOffsetFromTrackCenter() when HTML5 datalist element
        is enabled.

        * platform/gtk/RenderThemeGtk.cpp:
        (WebCore):
        (WebCore::RenderThemeGtk::sliderTickSize):
        (WebCore::RenderThemeGtk::sliderTickOffsetFromTrackCenter):
        * platform/gtk/RenderThemeGtk.h:

2012-07-23  Patrick Gansterer  <paroga@webkit.org>

        Replace getCurrentLocalTime() with GetLocalTime() in LocaleWin.cpp
        https://bugs.webkit.org/show_bug.cgi?id=91937

        Reviewed by Ryosuke Niwa.

        The windows function returns the required year directly and
        removes one additonal dependecy on getCurrentLocalTime().

        * platform/text/LocaleWin.cpp:
        (WebCore::LocaleWin::LocaleWin):

2012-07-23  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Drag and drop should not be started on right mouse click.
        https://bugs.webkit.org/show_bug.cgi?id=91728

        Reviewed by Pavel Feldman.

        Introduced WebInspector.installDragHandle method to control drag and drop support, checking whichg mouse button is pressed.
        Simplified WebInspector._elementDragStart, removed "element" parameter.
        Simplified tab moving support in TabbedPane, removed "mousemove" handler.
        Removed while loop determining which element was dragged in TimelineOverviewPane, each drag support is now installed independently.
        Drive-by: fixed TimelineOverviewPane window moving on resources-dividers-label-bar drang-and-drop.
        Drive-by: fixed CSSStyleModel compilation.

        * inspector/front-end/CSSStyleModel.js:
        (WebInspector.CSSStyleModel.prototype.getNamedFlowCollectionAsync):
        * inspector/front-end/DataGrid.js:
        (WebInspector.DataGrid.prototype._positionResizers):
        (WebInspector.DataGrid.prototype._startResizerDragging):
        (WebInspector.DataGrid.prototype._endResizerDragging):
        * inspector/front-end/Drawer.js:
        (WebInspector.Drawer):
        (WebInspector.Drawer.prototype._animationDuration):
        (WebInspector.Drawer.prototype._startStatusBarDragging):
        (WebInspector.Drawer.prototype._endStatusBarDragging):
        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapSnapshotView.prototype._startRetainersHeaderDragging):
        (WebInspector.HeapSnapshotView.prototype._endRetainersHeaderDragging):
        * inspector/front-end/SidebarOverlay.js:
        (WebInspector.SidebarOverlay.prototype.set _startResizerDragging):
        (WebInspector.SidebarOverlay.prototype._endResizerDragging):
        (WebInspector.SidebarOverlay.prototype._installResizer):
        * inspector/front-end/Spectrum.js:
        * inspector/front-end/SplitView.js:
        (WebInspector.SplitView.prototype._startResizerDragging):
        (WebInspector.SplitView.prototype._endResizerDragging):
        (WebInspector.SplitView.prototype.installResizer):
        * inspector/front-end/TabbedPane.js:
        (WebInspector.TabbedPaneTab.prototype._createTabElement):
        (WebInspector.TabbedPaneTab.prototype._tabMouseDown):
        (WebInspector.TabbedPaneTab.prototype._startTabDragging):
        (WebInspector.TabbedPaneTab.prototype._endTabDragging):
        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineOverviewPane):
        (WebInspector.TimelineOverviewWindow):
        (WebInspector.TimelineOverviewWindow.prototype._leftResizeElementDragging):
        (WebInspector.TimelineOverviewWindow.prototype._rightResizeElementDragging):
        (WebInspector.TimelineOverviewWindow.prototype._startWindowSelectorDragging):
        (WebInspector.TimelineOverviewWindow.prototype._endWindowSelectorDragging):
        (WebInspector.TimelineOverviewWindow.prototype._startWindowDragging):
        (WebInspector.TimelineOverviewWindow.prototype._windowDragging):
        (WebInspector.TimelineOverviewWindow.prototype._endWindowDragging):
        (WebInspector.TimelineOverviewWindow.prototype._moveWindow):
        (WebInspector.TimelineOverviewWindow.prototype._onMouseWheel):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel):
        (WebInspector.TimelinePanel.prototype._startSplitterDragging):
        (WebInspector.TimelinePanel.prototype._endSplitterDragging):
        * inspector/front-end/Toolbar.js:
        (WebInspector.Toolbar):
        (WebInspector.Toolbar.prototype._toolbarDragStart):
        (WebInspector.Toolbar.prototype._toolbarDragEnd):
        * inspector/front-end/UIUtils.js:
        (WebInspector.installDragHandle):
        (WebInspector._elementDragStart):
        (WebInspector._elementDragEnd):
        * inspector/front-end/timelinePanel.css:
        (#timeline-overview-grid .resources-dividers-label-bar):

2012-07-23  Hayato Ito  <hayato@chromium.org>

        ComposedShadowTreeWalker should skip an empty insertion points.
        https://bugs.webkit.org/show_bug.cgi?id=91826

        Reviewed by Hajime Morita.

        ComposedShadowTreeWalker wrongly returns 'null' if it encounters
        an insertion point into where no nodes are distributed.  We should
        skip such an insertion point and continue walking using the next
        possible node, which might be a next sibling or a next distributed
        node, and resolve the next node recursively.

        Test: fast/dom/shadow/composed-shadow-tree-walker.html

        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::ComposedShadowTreeWalker::traverseLightChildren):
        (WebCore):
        (WebCore::ComposedShadowTreeWalker::traverseSiblings):
        (WebCore::ComposedShadowTreeWalker::traverseNode):
        (WebCore::ComposedShadowTreeWalker::traverseDistributedeNodes):
        (WebCore::ComposedShadowTreeWalker::traverseSiblingOrBackToInsertionPoint):
        (WebCore::ComposedShadowTreeWalker::traverseSiblingInCurrentTree):
        (WebCore::ComposedShadowTreeWalker::traverseBackToYoungerShadowRoot):
        * dom/ComposedShadowTreeWalker.h:
        (ComposedShadowTreeWalker):

2012-07-23  Patrick Gansterer  <paroga@webkit.org>

        Rename TextCodecWinCE to TextCodecWin
        https://bugs.webkit.org/show_bug.cgi?id=91947

        Reviewed by Ryosuke Niwa.

        Since TextCodecWinCE is used by other (non-upstreamed) windows ports too,
        TextCodecWin is a better name for the implementation.
        Also remove the dependency on WinCE FontCache to make it more usable.

        * PlatformWinCE.cmake:
        * platform/text/TextEncodingRegistry.cpp:
        (WebCore::extendTextCodecMaps):
        * platform/text/win/TextCodecWin.cpp: Renamed from Source/WebCore/platform/text/wince/TextCodecWinCE.cpp.
        * platform/text/win/TextCodecWin.h: Renamed from Source/WebCore/platform/text/wince/TextCodecWinCE.h.

2012-07-22  Kentaro Hara  <haraken@chromium.org>

        [V8] CodeGeneratorV8.pm should support static attributes
        https://bugs.webkit.org/show_bug.cgi?id=91764

        Reviewed by Adam Barth.

        CodeGeneratorJS.pm already supports static attributes.
        CodeGeneratorV8.pm should also support them.

        Tests: bindings/scripts/test/TestObj.idl
               bindings/scripts/test/TestSupplemental.idl

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrGetter):
        (GenerateNormalAttrSetter):

        * bindings/scripts/test/TestObj.idl: Added defined(TESTING_V8).
        * bindings/scripts/test/TestSupplemental.idl: Added test cases for static attributes in supplemental IDL files.

        * bindings/scripts/test/JS/JSTestInterface.cpp: Updated run-bindings-tests results.
        (WebCore):
        (WebCore::jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr):
        The generated code is wrong since CodeGeneratorJS.pm does not support static attributes for
        supplemental IDL files. I will fix it in a follow-up patch.
        (WebCore::jsTestInterfaceConstructorSupplementalStaticAttr):
        (WebCore::setJSTestInterfaceConstructorSupplementalStaticAttr):
        * bindings/scripts/test/JS/JSTestInterface.h:
        (WebCore):
        * bindings/scripts/test/V8/V8TestInterface.cpp: Updated run-bindings-tests results.
        (WebCore::TestInterfaceV8Internal::supplementalStaticReadOnlyAttrAttrGetter):
        (TestInterfaceV8Internal):
        (WebCore::TestInterfaceV8Internal::supplementalStaticAttrAttrGetter):
        (WebCore::TestInterfaceV8Internal::supplementalStaticAttrAttrSetter):
        (WebCore):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::staticReadOnlyIntAttrAttrGetter):
        (TestObjV8Internal):
        (WebCore::TestObjV8Internal::staticStringAttrAttrGetter):
        (WebCore::TestObjV8Internal::staticStringAttrAttrSetter):
        (WebCore):

2012-07-22  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Missing *explicit* keyword in storage and workers.
        https://bugs.webkit.org/show_bug.cgi?id=91934

        Reviewed by Kentaro Hara.

        Some constructors missed to use *explicit* keyword. They need to be added
        *explicit* keyword to contructor which has a parameter in order to avoid
        implicit type conversion.

        No new tests. Convered by existing tests.

        * storage/StorageAreaImpl.h:
        (StorageAreaImpl):
        * storage/StorageMap.h:
        (StorageMap):
        * storage/StorageSyncManager.h:
        (StorageSyncManager):
        * storage/StorageTask.h:
        (StorageTask):
        * storage/StorageTracker.h:
        (StorageTracker):
        * workers/SharedWorker.h:
        (SharedWorker):
        * workers/Worker.h:
        (Worker):
        * workers/WorkerLocation.h:
        (WebCore::WorkerLocation::WorkerLocation):
        * workers/WorkerMessagingProxy.h:
        (WorkerMessagingProxy):

2012-07-23  Kent Tamura  <tkent@chromium.org>

        Rename ENABLE_METER_TAG and ENABLE_PROGRESS_TAG to ENABLE_METER_ELEMENT and ENABLE_PROGRESS_ELEMENT respectively
        https://bugs.webkit.org/show_bug.cgi?id=91941

        Reviewed by Kentaro Hara.

        A flag name for an elmement should be ENABLE_*_ELEMENT.

        * Configurations/FeatureDefines.xcconfig:
        * DerivedSources.make:
        * GNUmakefile.am:
        * accessibility/AXObjectCache.cpp:
        (WebCore::createFromRenderer):
        * accessibility/AccessibilityProgressIndicator.cpp:
        * accessibility/AccessibilityProgressIndicator.h:
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOneSelector):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/html.css:
        * html/HTMLMeterElement.cpp:
        * html/HTMLMeterElement.h:
        * html/HTMLMeterElement.idl:
        * html/HTMLProgressElement.cpp:
        * html/HTMLProgressElement.h:
        * html/HTMLProgressElement.idl:
        * html/HTMLTagNames.in:
        * html/shadow/MeterShadowElement.cpp:
        * html/shadow/MeterShadowElement.h: Wrap with #if ENABLE(METER_ELEMENT).
        * html/shadow/ProgressShadowElement.cpp:
        * html/shadow/ProgressShadowElement.h: Wrap with #if ENABLE(PROGRESS_ELEMENT).
        * page/DOMWindow.idl:
        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::paintThemePart):
        (WebCore::RenderThemeEfl::edjeGroupFromFormType):
        (WebCore):
        * platform/efl/RenderThemeEfl.h:
        (RenderThemeEfl):
        * platform/gtk/RenderThemeGtk.cpp:
        (WebCore):
        * platform/gtk/RenderThemeGtk.h:
        (RenderThemeGtk):
        * platform/gtk/RenderThemeGtk2.cpp:
        (WebCore):
        * platform/gtk/RenderThemeGtk3.cpp:
        (WebCore):
        * platform/qt/RenderThemeQt.cpp:
        (WebCore):
        * platform/qt/RenderThemeQt.h:
        (WebCore):
        (RenderThemeQt):
        * platform/qt/RenderThemeQtMobile.cpp:
        (WebCore):
        * platform/qt/RenderThemeQtMobile.h:
        (RenderThemeQtMobile):
        * rendering/RenderMeter.cpp:
        * rendering/RenderMeter.h:
        * rendering/RenderObject.h:
        (RenderObject):
        * rendering/RenderProgress.cpp:
        * rendering/RenderProgress.h:
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::adjustStyle):
        (WebCore::RenderTheme::paint):
        (WebCore::RenderTheme::paintBorderOnly):
        (WebCore::RenderTheme::paintDecorations):
        (WebCore):
        * rendering/RenderTheme.h:
        (WebCore):
        (RenderTheme):
        * rendering/RenderThemeChromiumLinux.cpp:
        (WebCore):
        * rendering/RenderThemeChromiumLinux.h:
        * rendering/RenderThemeChromiumSkia.cpp:
        (WebCore):
        * rendering/RenderThemeChromiumSkia.h:
        (RenderThemeChromiumSkia):
        * rendering/RenderThemeChromiumWin.cpp:
        (WebCore):
        * rendering/RenderThemeChromiumWin.h:
        (RenderThemeChromiumWin):
        * rendering/RenderThemeMac.h:
        (RenderThemeMac):
        * rendering/RenderThemeMac.mm:
        (WebCore):

2012-07-22  Kent Tamura  <tkent@chromium.org>

        Rename ENABLE_DETAILS to ENABLE_DETAILS_ELEMENT
        https://bugs.webkit.org/show_bug.cgi?id=91928

        Reviewed by Kentaro Hara.

        A flag name for an elmement should be ENABLE_*_ELEMENT.

        * Configurations/FeatureDefines.xcconfig:
        * DerivedSources.make:
        * GNUmakefile.am:
        * html/HTMLDetailsElement.cpp:
        * html/HTMLDetailsElement.idl:
        * html/HTMLSummaryElement.cpp:
        * html/HTMLTagNames.in:
        * html/shadow/DetailsMarkerControl.cpp:
        * rendering/RenderDetailsMarker.cpp:
        * rendering/RenderDetailsMarker.h:
        * rendering/RenderObject.h:
        (RenderObject):
        * rendering/RenderTreeAsText.cpp:
        (WebCore::RenderTreeAsText::writeRenderObject):

2012-07-21  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/11928576> SVG-as-image (constrained) intrinsic size calculation is wrong in vertical writing modes
        https://bugs.webkit.org/show_bug.cgi?id=91918

        Reviewed by Anders Carlsson.

        Test: svg/as-image/svg-intrinsic-size-rectangular-vertical.html

        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::computeAspectRatioInformationForRenderBox): When there is a content
        renderer, it returns a physical intrinsic size and aspect ratio. The code was already
        accounting for this by taking the reciprocal of the aspect ratio in the vertical case. Made
        it also transpose the size itself, turning it from physical to logical. Moved this code
        after setting m_intrinsicSize, since that member variable is always physical.

2012-07-21  Patrick Gansterer  <paroga@webkit.org>

        Cleanup TextEncoding USE(XXX_UNICODE) macros
        https://bugs.webkit.org/show_bug.cgi?id=91923

        Reviewed by Andreas Kling.

        Replace PLATFORM(QT) with USE(QT4_UNICODE) and OS(WINCE) with USE(WINCE_UNICODE).
        This gives us more flexibility in choosing the unicode backend for a port.

        * platform/text/TextEncoding.cpp:
        (WebCore::TextEncoding::encode):
        * platform/text/TextEncodingRegistry.cpp:
        (WebCore::extendTextCodecMaps):

2012-07-21  Patrick Gansterer  <paroga@webkit.org>

        Remove unnecessary ICU header includes from SimpleFontDataWin.cpp
        https://bugs.webkit.org/show_bug.cgi?id=91922

        Reviewed by Kentaro Hara.

        This allows us to use SimpleFontDataWin with an other Unicode implementation too.

        * platform/graphics/win/SimpleFontDataWin.cpp:

2012-07-21  Kwang Yul Seo  <skyul@company100.net>

        A start tag whose tag name is "html" in the "in body" insertion mode is a parse error
        https://bugs.webkit.org/show_bug.cgi?id=91916

        Reviewed by Eric Seidel.

        According to the HTML5 spec, a start tag whose tag name is "html" in the "in body"
        insertion mode is a parse error.

        Added HTMLTreeBuilder::processHtmlStartTagForInBody(AtomicHTMLToken&) to call parseError(token).
        Removed "FIXME: parse error" from HTMLConstructionSite::insertHTMLHtmlStartTagInBody and
        HTMLConstructionSite::insertHTMLBodyStartTagInBody because we already marked the call sites
        of these two methods with parseError(token).

        No behavior change because parseError(token) is just a marker.

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagInBody):
        (WebCore::HTMLConstructionSite::insertHTMLBodyStartTagInBody):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::processStartTagForInBody):
        (WebCore::HTMLTreeBuilder::processStartTag):
        (WebCore::HTMLTreeBuilder::processHtmlStartTagForInBody):
        (WebCore):
        (WebCore::HTMLTreeBuilder::processStartTagForInHead):
        * html/parser/HTMLTreeBuilder.h:

2012-07-20  Czene Tamás  <tczene@inf.u-szeged.hu>

        double data type shoud be changed to float in ColorMatrix
        https://bugs.webkit.org/show_bug.cgi?id=91499

        Reviewed by Nikolas Zimmermann.

        * platform/graphics/filters/FEColorMatrix.cpp:
        (WebCore::matrix):
        (WebCore::saturate):
        (WebCore::huerotate):
        (WebCore::luminance):
        (WebCore::effectType):

2012-07-20  Stephen White  <senorblanco@chromium.org>

        [chromium] Take current transformation matrix into account when
        deciding on resize algorithm for drawPattern.
        https://bugs.webkit.org/show_bug.cgi?id=90624

        Reviewed by Adrienne Walker.

        Since the pattern shader uses both the current transformation matrix
        and the pattern matrix when transforming pixels, we need to
        do the same when computing the resampling mode.  Also removed the
        resampling hint code, added in r60658, since it appears to be dead
        (caller was removed in r76379).

        Covered by existing tests, such as
        fast/borders/border-image-scale-transform.html.

        * platform/graphics/skia/ImageSkia.cpp:
        (WebCore::computeResamplingMode):
        Pass in the matrix to be used for computing the destination width and
        height (for awesome resampling).  Remove the image resampling hint code.
        (WebCore::paintSkBitmap):
        Pass in the CTM to computeResamplingMode().
        (WebCore::Image::drawPattern):
        Concatenate the CTM and the pattern matrix, and pass that to 
        computeResamplingMode() and TransformDimensions().  Invert the
        CTM's scale and apply it to the pattern transform, so their
        concatenation gives identity scale.
        * platform/graphics/skia/PlatformContextSkia.cpp:
        * platform/graphics/skia/PlatformContextSkia.h:
        Remove the image resampling hint (dead code).

2012-07-20  Kwang Yul Seo  <skyul@company100.net>

        Anything else in the "in table" insertion mode is a parse error
        https://bugs.webkit.org/show_bug.cgi?id=91915

        Reviewed by Adam Barth.

        According to the HTML5 spec, anything else in the "in table" insertion mode is a parse error.

        No behavior change because parseError(token) is just a marker.

        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::processEndTagForInTable):

2012-07-20  Kent Tamura  <tkent@chromium.org>

        Rename ENABLE_DATALIST to ENABLE_DATALIST_ELEMENT
        https://bugs.webkit.org/show_bug.cgi?id=91846

        Reviewed by Kentaro Hara.

        A flag name for an elmement should be ENABLE_*_ELEMENT.

        * Configurations/FeatureDefines.xcconfig:
        * DerivedSources.make:
        * GNUmakefile.am:
        * css/html.css:
        * html/HTMLDataListElement.cpp:
        * html/HTMLDataListElement.h:
        * html/HTMLDataListElement.idl:
        * html/HTMLInputElement.cpp:
        (WebCore):
        (WebCore::HTMLInputElement::parseAttribute):
        (WebCore::HTMLInputElement::insertedInto):
        (WebCore::HTMLInputElement::removedFrom):
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/HTMLInputElement.idl:
        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::parseAttribute):
        (WebCore::HTMLOptionElement::childrenChanged):
        (WebCore):
        * html/HTMLOptionElement.h:
        (HTMLOptionElement):
        * html/HTMLTagNames.in:
        * html/InputType.cpp:
        (WebCore):
        * html/InputType.h:
        (InputType):
        * html/RangeInputType.cpp:
        (WebCore):
        * html/RangeInputType.h:
        (RangeInputType):
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::RenderSliderContainer::layout):
        * page/DOMWindow.idl:
        * platform/efl/RenderThemeEfl.cpp:
        (WebCore):
        * platform/efl/RenderThemeEfl.h:
        (RenderThemeEfl):
        * platform/qt/RenderThemeQt.cpp:
        (WebCore):
        * platform/qt/RenderThemeQt.h:
        (RenderThemeQt):
        * rendering/RenderTheme.cpp:
        (WebCore):
        * rendering/RenderTheme.h:
        (RenderTheme):
        * rendering/RenderThemeChromiumLinux.cpp:
        (WebCore):
        (WebCore::RenderThemeChromiumLinux::paintSliderTrack):
        * rendering/RenderThemeChromiumLinux.h:
        (RenderThemeChromiumLinux):
        * rendering/RenderThemeChromiumWin.cpp:
        (WebCore):
        (WebCore::RenderThemeChromiumWin::paintSliderTrack):
        * rendering/RenderThemeChromiumWin.h:
        (RenderThemeChromiumWin):
        * rendering/RenderThemeMac.h:
        (RenderThemeMac):
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintSliderTrack):
        (WebCore):

2012-07-18  Ryosuke Niwa  <rniwa@webkit.org>

        Unify HTMLCollection and DynamicNodeList
        https://bugs.webkit.org/show_bug.cgi?id=91335

        Reviewed by Anders Carlsson.

        This is the grand unification of HTMLCollection and DynamicNodeList.

        It merges implementations of item() and length() in ChildNodeList, DynamicNodeList,
        and HTMLCollection. The unified implementation is based on the one used for HTMLCollection,
        that has been improved over the last few days; see r122660 and r122672 for examples.

        There are five key changes:
        1. Made itemBeforeOrAfter aware of DynamicNodeList.
        2. itemBeforeOrAfter and related functions take and return Node* to support ChildNodeList.
        3. Renamed InvalidCollectionType to NodeListCollectionType since DynamicNodeLists need to be
        identified itemBeforeOrAfter.
        4. Renamed itemAfter to virtualItemAfter in subclasses of HTMLCollection, and devirtualized
        itemAfter used in common cases to avoid performance regressions. To make this intent clear,
        SupportItemBefore and DoNotSupportItemBefore have been renamed to DoesNotOverrideItemAfter
        and OverridesItemAfter. This change also help us detect a subclass of HTMLCollection that
        passes in a wrong value to ItemBeforeSupportType by making forward iterations fail (hit an
        assertion or doesn't iterate at all) as well as backward iterations.
        5. Restricted the use of elementsArrayOffset to subclasses that provide virtualItemAfter.

        This patch completes my effort to share code between HTMLCollection and DynamicNodeList.

        * dom/ChildNodeList.cpp:
        (WebCore::ChildNodeList::ChildNodeList):
        (WebCore): Removed length() and item().
        (WebCore::ChildNodeList::nodeMatches):
        * dom/ChildNodeList.h:
        (ChildNodeList):
        * dom/ClassNodeList.cpp:
        (WebCore::ClassNodeList::ClassNodeList):
        * dom/Document.cpp:
        (WebCore::Document::registerNodeListCache):
        (WebCore::Document::unregisterNodeListCache):
        * dom/DynamicNodeList.cpp:
        (WebCore::DynamicNodeListCacheBase::invalidateCache):
        (WebCore::DynamicNodeList::length):
        (WebCore::DynamicNodeList::item):
        * dom/DynamicNodeList.h:
        (WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase): Takes new boolean argument
        shouldOnlyIncludeDirectChildren indicating whether the non-child descendents should be
        included or not. This is necessary to identify ChildNodeList in itemBeforeOrAfter.
        (WebCore::DynamicNodeListCacheBase::ownerNode): Moved from DynamicNodeListCacheBase and
        HTMLCollectionCacheBase.
        (WebCore::DynamicNodeListCacheBase::document): Moved from DynamicNodeListCacheBase.
        (WebCore::DynamicNodeListCacheBase::rootNode): Ditto.
        (WebCore::DynamicNodeListCacheBase::overridesItemAfter): Renamed from supportsItemBefore
        and the return value has been negated.
        (WebCore::DynamicNodeListCacheBase::shouldOnlyIncludeDirectChildren): Added.
        (WebCore::DynamicNodeListCacheBase):
        (WebCore::DynamicNodeList::DynamicNodeList): Takes NodeListType to determine the value of
        shouldOnlyIncludeDirectChildren.
        (DynamicNodeList):
        (WebCore::DynamicSubtreeNodeList::~DynamicSubtreeNodeList):
        (WebCore::DynamicSubtreeNodeList::DynamicSubtreeNodeList):
        * dom/MicroDataItemList.cpp:
        (WebCore::MicroDataItemList::MicroDataItemList):
        * dom/NameNodeList.cpp:
        (WebCore::NameNodeList::NameNodeList):
        * dom/TagNodeList.cpp:
        (WebCore::TagNodeList::TagNodeList):
        * html/CollectionType.h:
        * html/HTMLAllCollection.cpp:
        (WebCore::HTMLAllCollection::HTMLAllCollection):
        * html/HTMLCollection.cpp:
        (WebCore::shouldOnlyIncludeDirectChildren):
        (WebCore::rootTypeFromCollectionType):
        (WebCore::invalidationTypeExcludingIdAndNameAttributes):
        (WebCore::HTMLCollection::HTMLCollection):
        (WebCore::HTMLCollection::create):
        (WebCore::HTMLCollection::~HTMLCollection):
        (WebCore::isAcceptableElement):
        (WebCore::firstNode): Extracted from itemBeforeOrAfter.
        (WebCore::DynamicNodeListCacheBase::iterateForNextNode): Ditto.
        (WebCore::DynamicNodeListCacheBase::itemBeforeOrAfter): Takes and returns Node*.
        Special case ChildNodeList since there is no need to skip any node. When "this" is a
        node list, call nodeMatches instead of isAcceptableElement.
        (WebCore::DynamicNodeListCacheBase::itemBefore): No longer takes offsetInArray since
        the use of elementsArrayOffset has been restricted to HTMLCollections that provides
        virtualItemAfter.
        (WebCore::DynamicNodeListCacheBase::itemAfter): Calls virtualItemAfter if necessary.
        Otherwise assert offsetInArray is zero since we should never be using this variable
        when virtualItemAfter is not provided.
        (WebCore::DynamicNodeListCacheBase::isLastItemCloserThanLastOrCachedItem):
        (WebCore::DynamicNodeListCacheBase::isFirstItemCloserThanCachedItem):
        (WebCore::DynamicNodeListCacheBase::setItemCache): Updates m_cachedElementsArrayOffset
        in HTMLCollection if and only if virtualItemAfter is provided. This is safe because
        node lists never provide virtualItemAfter.
        (WebCore::DynamicNodeListCacheBase::cachedElementsArrayOffset): Similarly, returns
        m_cachedElementsArrayOffset if virtualItemAfter is provided.
        (WebCore::DynamicNodeListCacheBase::lengthCommon):
        (WebCore::DynamicNodeListCacheBase::itemCommon): Note that supportsItemBefore() is
        equivalent to !overridesItemAfter() here.
        (WebCore::DynamicNodeListCacheBase::itemBeforeOrAfterCachedItem): Uses Node* through
        out the function. Since itemBefore never uses offsetInArray, always sets 0 for that.
        Note that we never call itemBefore and virtualItemAfter on the same object.
        (WebCore::HTMLCollection::virtualItemAfter): Added only to make the class "concrete".
        (WebCore::HTMLCollection::namedItem):
        (WebCore::HTMLCollection::updateNameCache):
        (WebCore::HTMLCollection::tags):
        * html/HTMLCollection.h:
        (WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase):
        (HTMLCollectionCacheBase):
        (WebCore::HTMLCollection::length):
        (WebCore::HTMLCollection::item):
        (WebCore::HTMLCollection::base):
        (HTMLCollection):
        * html/HTMLFormCollection.cpp:
        (WebCore::HTMLFormCollection::HTMLFormCollection):
        (WebCore::HTMLFormCollection::virtualItemAfter):
        * html/HTMLFormCollection.h:
        (HTMLFormCollection):
        * html/HTMLNameCollection.cpp:
        (WebCore::HTMLNameCollection::HTMLNameCollection):
        (WebCore::HTMLNameCollection::virtualItemAfter):
        * html/HTMLNameCollection.h:
        (HTMLNameCollection):
        * html/HTMLOptionsCollection.cpp:
        (WebCore::HTMLOptionsCollection::HTMLOptionsCollection):
        * html/HTMLPropertiesCollection.cpp:
        (WebCore::HTMLPropertiesCollection::HTMLPropertiesCollection):
        (WebCore::HTMLPropertiesCollection::virtualItemAfter):
        (WebCore::HTMLPropertiesCollection::updateNameCache):
        * html/HTMLPropertiesCollection.h:
        (HTMLPropertiesCollection):
        * html/HTMLTableRowsCollection.cpp:
        (WebCore::HTMLTableRowsCollection::HTMLTableRowsCollection):
        (WebCore::HTMLTableRowsCollection::virtualItemAfter):
        * html/HTMLTableRowsCollection.h:
        (HTMLTableRowsCollection):
        * html/LabelsNodeList.cpp:
        (WebCore::LabelsNodeList::LabelsNodeList):
        * html/RadioNodeList.cpp:
        (WebCore::RadioNodeList::RadioNodeList):

2012-07-20  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Simplify backend interface classes
        https://bugs.webkit.org/show_bug.cgi?id=91901

        Reviewed by Tony Chang.

        The IDBTransactionBackendInterface included several methods only used by the
        real implementation objects, not via the interfaces. Expose a static Impl::from(Interface)
        method for transaction, and migrate all of the backend-internal uses from Interface to Impl.

        No new tests - no functional changes.

        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
        (WebCore::IDBCursorBackendImpl::IDBCursorBackendImpl):
        * Modules/indexeddb/IDBCursorBackendImpl.h:
        (WebCore):
        (WebCore::IDBCursorBackendImpl::create):
        (IDBCursorBackendImpl):
        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
        (WebCore::IDBDatabaseBackendImpl::createObjectStoreInternal):
        (WebCore::IDBDatabaseBackendImpl::objectStore):
        (WebCore::IDBDatabaseBackendImpl::deleteObjectStore):
        (WebCore::IDBDatabaseBackendImpl::deleteObjectStoreInternal):
        (WebCore::IDBDatabaseBackendImpl::setVersion):
        (WebCore::IDBDatabaseBackendImpl::setVersionInternal):
        (WebCore::IDBDatabaseBackendImpl::transactionStarted):
        (WebCore::IDBDatabaseBackendImpl::transactionFinished):
        (WebCore::IDBDatabaseBackendImpl::transaction):
        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
        (WebCore):
        (IDBDatabaseBackendImpl):
        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
        (WebCore::IDBIndexBackendImpl::openCursorInternal):
        (WebCore::IDBIndexBackendImpl::openCursor):
        (WebCore::IDBIndexBackendImpl::openKeyCursor):
        (WebCore::IDBIndexBackendImpl::countInternal): Drop unused transaction argument.
        (WebCore::IDBIndexBackendImpl::count):
        (WebCore::IDBIndexBackendImpl::get):
        (WebCore::IDBIndexBackendImpl::getKey):
        * Modules/indexeddb/IDBIndexBackendImpl.h:
        (IDBIndexBackendImpl):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::get):
        (WebCore::IDBObjectStoreBackendImpl::put):
        (WebCore::IDBObjectStoreBackendImpl::putWithIndexKeys):
        (WebCore):
        (WebCore::IDBObjectStoreBackendImpl::putInternal):
        (WebCore::IDBObjectStoreBackendImpl::deleteFunction):
        (WebCore::IDBObjectStoreBackendImpl::clear):
        (WebCore::IDBObjectStoreBackendImpl::createIndex):
        (WebCore::IDBObjectStoreBackendImpl::createIndexInternal):
        (WebCore::IDBObjectStoreBackendImpl::deleteIndex):
        (WebCore::IDBObjectStoreBackendImpl::deleteIndexInternal):
        (WebCore::IDBObjectStoreBackendImpl::openCursor):
        (WebCore::IDBObjectStoreBackendImpl::openCursorInternal):
        (WebCore::IDBObjectStoreBackendImpl::count):
        (WebCore::IDBObjectStoreBackendImpl::countInternal): Drop unused transaction argument.
        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
        (WebCore):
        (IDBObjectStoreBackendImpl):
        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
        (WebCore::IDBTransactionBackendImpl::objectStore):
        * Modules/indexeddb/IDBTransactionBackendImpl.h:
        (WebCore::IDBTransactionBackendImpl::from):
        (IDBTransactionBackendImpl):
        (WebCore::IDBTransactionBackendImpl::mode):
        * Modules/indexeddb/IDBTransactionBackendInterface.h:
        (IDBTransactionBackendInterface):

2012-07-20  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: "ASSERTION FAILED: !m_requestFinished" hit in IDBRequest::dispatchEvent
        https://bugs.webkit.org/show_bug.cgi?id=86911

        Reviewed by Tony Chang.

        Clean up the IDBRequest/IDBCursor relationship and the IDBRequest lifecycle.

        The IDBRequest's m_cursor/setCursor() calls are renamed to m_pendingCursor/setPendingCursor() to
        clarify that the request will move between two states - either there's a cursor request in-flight
        c/o a continue() or advance() call, or the result has come in (cursor, null-for-done, or error).
        Since they were only ever used together, resetReadyState() is merged into setResultCursor(). The
        m_requestFinished flag becomes redundant and is dropped - the ASSERT reported in the bug
        becomes an ASSERT(m_readyState == PENDING) and m_readyState tracking is already correct.

        Test: storage/indexeddb/request-continue-abort.html

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::advance): Unreachable code path now dead and gone.
        (WebCore::IDBCursor::continueFunction): Ditto.
        * Modules/indexeddb/IDBRequest.cpp: Most functions just add state assertions.
        (WebCore::IDBRequest::IDBRequest):
        (WebCore::IDBRequest::abort):
        (WebCore::IDBRequest::setCursorDetails):
        (WebCore::IDBRequest::setPendingCursor): Merge with old resetReadyState().
        (WebCore):
        (WebCore::IDBRequest::getResultCursor): Helper, since digging cursor out of IDBAny is pesky.
        (WebCore::IDBRequest::setResultCursor): Just moved in the file to be with its friends.
        (WebCore::IDBRequest::finishCursor):
        (WebCore::IDBRequest::onError): Just assertions, re-ordering, re-naming.
        (WebCore::IDBRequest::onSuccess):
        (WebCore::IDBRequest::onSuccessWithContinuation):
        (WebCore::IDBRequest::hasPendingActivity):
        (WebCore::IDBRequest::dispatchEvent): Simplify!
        (WebCore::IDBRequest::enqueueEvent):
        * Modules/indexeddb/IDBRequest.h:
        (IDBRequest):

2012-07-20  Andrew Scherkus  <scherkus@chromium.org>

        [chromium] Don't display fullscreen button for video elements not containing video
        https://bugs.webkit.org/show_bug.cgi?id=91811

        Reviewed by Eric Carlson.

        Covered by media/media-document-audio-repaint.html

        * html/shadow/MediaControlRootElementChromium.cpp:
        (WebCore::MediaControlRootElementChromium::reset):

2012-07-20  Dmitry Titov  <dimich@chromium.org>

        [Chromium] Out of Memory is observed when a large object is passed to a Web Worker.
        https://bugs.webkit.org/show_bug.cgi?id=91535.

        Reviewed by David Levin.

        No new tests because of no new behavior and lack of mechanism to monitor used memory.

        * bindings/v8/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::SerializedScriptValue):
        (WebCore::SerializedScriptValue::registerMemoryAllocatedWithCurrentScriptContext):
        (WebCore):
        (WebCore::SerializedScriptValue::~SerializedScriptValue):
        * bindings/v8/SerializedScriptValue.h:
        (SerializedScriptValue):
        Added a method to SerializedScriptValue to add memory pressure on GC proportional to the size of memory allocated in serialized data.
        
        * dom/MessageEvent.cpp:
        (WebCore::MessageEvent::MessageEvent):
        (WebCore::MessageEvent::initMessageEvent):
        Call the new method of SerializedScriptValue during creation of MessageEvent (presumably in the thread which contains the right V8 context).

2012-07-20  David Grogan  <dgrogan@chromium.org>

        IndexedDB: Include intVersion when converting between WebCore and WebKit IDBMetadata types
        https://bugs.webkit.org/show_bug.cgi?id=91414

        Reviewed by Adam Barth.

        No new tests because no new behavior.

        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::metadata):
        No behavior change, this just needs a dummy parameter to match the
        modified API.

        * Modules/indexeddb/IDBMetadata.h:
        (WebCore::IDBDatabaseMetadata::IDBDatabaseMetadata):
        (IDBDatabaseMetadata):

2012-07-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.com>

        [Soup] Unnecessary RefPtr usage and null check
        https://bugs.webkit.org/show_bug.cgi?id=91636

        Reviewed by Martin Robinson.

        Small clean up of code that is not necessary; no change in functionality.

        * platform/network/soup/SocketStreamHandleSoup.cpp:
        (WebCore::SocketStreamHandle::connected):

2012-07-20  Mark Salisbury  <mark.salisbury@hp.com>

        Typo in FontCacheWin.cpp causes return value from getCachedFontData() in getLastResortFallbackFont() to be ignored
        https://bugs.webkit.org/show_bug.cgi?id=91506

        Reviewed by Joseph Pecoraro.

        No new test.  The "fallback fallback" code ends up creating a font, so you always
        get a fallback font even with this code bug.  A test would be buggy, being highly
        platform dependent on what the "fallback fallback" font is on the particular
        windows machine the test runs on.

        * platform/graphics/win/FontCacheWin.cpp:
        (WebCore::FontCache::getLastResortFallbackFont):

2012-07-20  Stephen White  <senorblanco@chromium.org>

        [chromium] Clean up scratch texture usage in Chromium's implementation
        of GPU-accelerated filters.
        https://bugs.webkit.org/show_bug.cgi?id=83370

        Reviewed by Adrienne Walker.

        There didn't used to be a safe way to allocate a scratch texture, and
        hold into it beyond the lifetime of GrAutoScratchTexture.  Now there is:
        detach().

        Covered by existing tests in css3/filters.

        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:
        (WebCore::CCRenderSurfaceFilters::apply):
        Use a GrAutoScratchTexture to allocate the destination texture, and 
        detach() to detach it from the cache before placing it in an
        SkGrTexturePixelRef.  This means we no longer need to do any lock/
        unlock trickery with the TextureCacheEntry, since the refcount is
        enough to keep the texture away from the cache's prying hands.

2012-07-20  Stephen White  <senorblanco@chromium.org>

        [chromium] Clean up scratch texture usage in Chromium's implementation
        of GPU-accelerated filters.
        https://bugs.webkit.org/show_bug.cgi?id=83370

        Reviewed by Adrienne Walker.

        There didn't used to be a safe way to allocate a scratch texture, and
        hold into it beyond the lifetime of GrAutoScratchTexture.  Now there is:
        detach().

        Covered by existing tests in css3/filters.

        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:
        (WebCore::CCRenderSurfaceFilters::apply):
        Use a GrAutoScratchTexture to allocate the destination texture, and 
        detach() to detach it from the cache before placing it in an
        SkGrTexturePixelRef.  This means we no longer need to do any lock/
        unlock trickery with the TextureCacheEntry, since the refcount is
        enough to keep the texture away from the cache's prying hands.

2012-07-19  Andrew Scherkus  <scherkus@chromium.org>

        [chromium] CSS tweaks to media controls to prevent styles from being overridden
        https://bugs.webkit.org/show_bug.cgi?id=91802

        Reviewed by Eric Carlson.

        Having the buttons declared as inline caused them to not be included in the box layout,
        resulting in styles set outside the media element to affect the position of the buttons.

        In a similar vein, it was also possible to override the font-style attribute for the time
        display.

        Test: media/controls-styling-strict.html

        * css/mediaControlsChromium.css:
        (audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button):
        (audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button):
        (audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display):
        (audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button):

2012-07-20  Han Shen  <shenhan@google.com>

        [Chromium] Compilation fails under gcc 4.7
        https://bugs.webkit.org/show_bug.cgi?id=90227

        Reviewed by Tony Chang.

        Disable warnings about c++0x compatibility in gcc newer than 4.6.

        * WebCore.gyp/WebCore.gyp:

2012-07-20  Vincent Scheib  <scheib@chromium.org>

        Unreviewed compile fix, r123247 included unintended changes to Document.cpp.

        See http://trac.webkit.org/changeset/123247.

        * dom/Document.cpp:
        (WebCore::Document::webkitExitPointerLock):

2012-07-20  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r122873): 15% regression on Dromaeo/dom-attr
        https://bugs.webkit.org/show_bug.cgi?id=91827

        Reviewed by Anders Carlsson.

        Move shouldInvalidateNodeListCaches from Document.cpp to Node.cpp since it's only called
        in Node::invalidateNodeListCachesInAncestors.

        Test: PerformanceTests/Dromaeo/dom-attr.html.

        * dom/Document.cpp:
        (WebCore):
        * dom/Node.cpp:
        (WebCore::shouldInvalidateNodeListCachesForAttr): Extracted from shouldInvalidateNodeListCaches
        to unroll the loop in shouldInvalidateNodeListCaches. Apparently gcc wasn't doing the right thing.
        (WebCore::Document::shouldInvalidateNodeListCaches):
        (WebCore::Document::invalidateNodeListCaches):
        (WebCore::Node::invalidateNodeListCachesInAncestors):

2012-07-20  Nico Weber  <thakis@chromium.org>

        Fix more -Wunused-private-field violations
        https://bugs.webkit.org/show_bug.cgi?id=91876

        Reviewed by Adam Barth.

        As of http://lists.cs.uiuc.edu/pipermail/cfe-commits/Week-of-Mon-20120716/061102.html
        the warning finds more bugs. Fix them.

        * html/FTPDirectoryDocument.cpp:
        (FTPDirectoryDocumentParser):
        (WebCore::FTPDirectoryDocumentParser::FTPDirectoryDocumentParser):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
        * html/parser/HTMLTreeBuilder.h:
        (HTMLTreeBuilder):
        * html/shadow/MediaControlRootElementChromium.cpp:
        (WebCore::MediaControlRootElementChromium::MediaControlRootElementChromium):
        * html/shadow/MediaControlRootElementChromium.h:
        (MediaControlRootElementChromium):
        * inspector/InspectorDOMStorageResource.cpp:
        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
        * inspector/InspectorDOMStorageResource.h:
        (InspectorDOMStorageResource):
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (Settings):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::CCThreadProxy):
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (CCThreadProxy):
        * rendering/svg/RenderSVGTextPath.cpp:
        (WebCore::RenderSVGTextPath::RenderSVGTextPath):
        * rendering/svg/RenderSVGTextPath.h:

2012-07-20  Adam Klein  <adamk@chromium.org>

        CodeGeneratorInspector.py is unnecessarily chatty
        https://bugs.webkit.org/show_bug.cgi?id=91758

        Reviewed by Vsevolod Vlasov.

        The code aded in r123091 included a "print" statement for each written
        file. This makes for noisy build output, especially noticeable in the
        Chromium ninja build (where build output takes up a single line of the
        console).

        If this print statement is generally useful, it should be
        hidden behind a --verbose commandline option, as we do for the binding
        generators.

        * inspector/CodeGeneratorInspector.py:
        (SmartOutput.close): Remove print statement.

2012-07-20  Stephen White  <senorblanco@chromium.org>

        [chromium] Enable GPU-accelerated skia implementation of
        feDiffuseLighting, feSpecularLighting.
        https://bugs.webkit.org/show_bug.cgi?id=91865

        Reviewed by Dirk Schulze.

        Translate the light parameters into the appropriate
        SkLightingImageFilter calls.  This path is only enabled when
        the filters are created with the Accelerated flag set.

        This will be covered by tests in svg/filters/* when they are
        added to the virtual GPU tests.

        * WebCore.gypi:
        * platform/graphics/filters/FELighting.h:
        (FELighting):
        * platform/graphics/filters/skia/FELightingSkia.cpp: Added.
        (WebCore):
        (WebCore::FELighting::platformApplySkia):

2012-07-20  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: disable fake workers inspection.
        https://bugs.webkit.org/show_bug.cgi?id=91867

        Reviewed by Vsevolod Vlasov.

        'Fake workers' is unreliable error-prone way to debug workers. There are a
        lot of frameworks supporting it. Inspector should not do that since it has a more
        powerful native worker inspection capabilities. Port owners should enable it
        in case they want to provide workers debugging.

        * English.lproj/localizedStrings.js:
        * WebCore.gypi:
        * WebCore.order:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/InjectedScriptHost.cpp:
        (WebCore::InjectedScriptHost::InjectedScriptHost):
        * inspector/InjectedScriptHost.h:
        (InjectedScriptHost):
        * inspector/InjectedScriptHost.idl:
        * inspector/Inspector.json:
        * inspector/InspectorAgent.cpp:
        (WebCore::InspectorAgent::didCommitLoad):
        (WebCore::InspectorAgent::enable):
        * inspector/InspectorAgent.h:
        (WebCore):
        (InspectorAgent):
        * inspector/InspectorInstrumentation.cpp:
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        * inspector/front-end/InjectedFakeWorker.js: Removed.
        * inspector/front-end/ScriptsPanel.js:
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/WorkersSidebarPane.js:
        (WebInspector.WorkersSidebarPane):
        * inspector/front-end/externs.js:
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:
        * workers/AbstractWorker.cpp:
        (WebCore::AbstractWorker::contextDestroyed):
        * workers/AbstractWorker.h:
        (AbstractWorker):
        * workers/SharedWorker.cpp:
        (WebCore::SharedWorker::create):
        * workers/Worker.cpp:
        (WebCore::Worker::create):

2012-07-20  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r123182.
        http://trac.webkit.org/changeset/123182
        https://bugs.webkit.org/show_bug.cgi?id=91863

        Causing ASSERT crashes in tests accessibility/canvas.html and
        accessibility/canvas-accessibilitynodeobject.html (Requested
        by jernoble on #webkit).

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * accessibility/AXObjectCache.cpp:
        (WebCore):
        * accessibility/AXObjectCache.h:
        (AXObjectCache):
        * accessibility/AccessibilityARIAGrid.cpp:
        (WebCore::AccessibilityARIAGrid::AccessibilityARIAGrid):
        (WebCore::AccessibilityARIAGrid::~AccessibilityARIAGrid):
        (WebCore):
        (WebCore::AccessibilityARIAGrid::create):
        * accessibility/AccessibilityARIAGrid.h:
        (AccessibilityARIAGrid):
        * accessibility/AccessibilityARIAGridCell.cpp:
        (WebCore::AccessibilityARIAGridCell::create):
        * accessibility/AccessibilityARIAGridRow.cpp:
        (WebCore::AccessibilityARIAGridRow::create):
        * accessibility/AccessibilityAllInOne.cpp:
        * accessibility/AccessibilityList.cpp:
        (WebCore::AccessibilityList::create):
        * accessibility/AccessibilityListBox.cpp:
        (WebCore::AccessibilityListBox::create):
        * accessibility/AccessibilityMediaControls.cpp:
        (WebCore::AccessibilityMediaControl::create):
        (WebCore::AccessibilityMediaControlsContainer::create):
        (WebCore::AccessibilityMediaTimeline::create):
        (WebCore::AccessibilityMediaTimeDisplay::create):
        * accessibility/AccessibilityMenuList.cpp:
        * accessibility/AccessibilityMenuList.h:
        (WebCore::AccessibilityMenuList::create):
        * accessibility/AccessibilityNodeObject.cpp: Removed.
        * accessibility/AccessibilityNodeObject.h: Removed.
        * accessibility/AccessibilityObject.h:
        (AccessibilityObject):
        * accessibility/AccessibilityProgressIndicator.cpp:
        (WebCore::AccessibilityProgressIndicator::create):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
        (WebCore::AccessibilityRenderObject::create):
        (WebCore::AccessibilityRenderObject::detach):
        (WebCore::AccessibilityRenderObject::remapAriaRoleDueToParent):
        (WebCore):
        (WebCore::AccessibilityRenderObject::determineAriaRoleAttribute):
        (WebCore::AccessibilityRenderObject::ariaRoleAttribute):
        (WebCore::AccessibilityRenderObject::updateAccessibilityRole):
        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
        (WebCore::AccessibilityRenderObject::childrenChanged):
        (WebCore::AccessibilityRenderObject::canHaveChildren):
        (WebCore::AccessibilityRenderObject::addChildren):
        * accessibility/AccessibilityRenderObject.h:
        (AccessibilityRenderObject):
        (WebCore::AccessibilityRenderObject::setRenderer):
        * accessibility/AccessibilitySlider.cpp:
        (WebCore::AccessibilitySlider::create):
        * accessibility/AccessibilityTable.cpp:
        (WebCore::AccessibilityTable::AccessibilityTable):
        (WebCore::AccessibilityTable::~AccessibilityTable):
        (WebCore):
        (WebCore::AccessibilityTable::create):
        * accessibility/AccessibilityTable.h:
        (AccessibilityTable):
        * accessibility/AccessibilityTableCell.cpp:
        (WebCore::AccessibilityTableCell::create):
        * accessibility/AccessibilityTableRow.cpp:
        (WebCore::AccessibilityTableRow::create):

2012-07-20  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] Proxy configuration should honor the no_proxy environment variable
        https://bugs.webkit.org/show_bug.cgi?id=91747

        Reviewed by Kenneth Rohde Christiansen.

        Implement a custom Proxy URI Resolver for libsoup
        so that we can use it in EFL port. This custom
        proxy resolver brings support for setting
        exceptions so that the proxy is not used for the
        specified hosts.

        By default, the proxy is not used for localhost and
        127.0.0.1.

        No new tests, no behavior change for layout tests.

        * PlatformEfl.cmake:
        * platform/network/soup/ProxyResolverSoup.cpp: Added.
        (soup_proxy_resolver_wk_init):
        (soupProxyResolverWkFinalize):
        (soupProxyResolverWkSetProperty):
        (soupProxyResolverWkGetProperty):
        (shouldBypassProxy):
        (idle_return_proxy_uri):
        (soupProxyResolverWkGetProxyURIAsync):
        (soupProxyResolverWkGetProxyURISync):
        (soup_proxy_resolver_wk_class_init):
        (soup_proxy_resolver_wk_interface_init):
        (soupProxyResolverWkNew):
        * platform/network/soup/ProxyResolverSoup.h: Added.

2012-07-20  Pierre Rossi  <pierre.rossi@gmail.com>

        ColorChooserClient should expose the element's location
        https://bugs.webkit.org/show_bug.cgi?id=91767

        Reviewed by Kent Tamura.

        The rationale is that the chrome client could have an interest in placing the picker next to
        the element for usability reasons.

        No new tests as there is not much logic here: Just exposing a geometry information to WebKit.

        * html/ColorInputType.cpp:
        (WebCore::ColorInputType::elementRectRelativeToWindow):
        (WebCore):
        * html/ColorInputType.h:
        (ColorInputType):
        * platform/ColorChooserClient.h:
        (ColorChooserClient):

2012-07-20  Thiago Marcos P. Santos  <thiago.santos@intel.com>

        [WK2] WebIntents doesn't build if mutation observers is disabled
        https://bugs.webkit.org/show_bug.cgi?id=91839

        Reviewed by Kenneth Rohde Christiansen.

        WebIntents was depending on a code protected by ENABLE(MUTATION_OBSERVERS).
        Now the code is also enabled by ENABLE(WEB_INTENTS).

        * bindings/js/JSDictionary.cpp:
        (WebCore):
        * bindings/js/JSDictionary.h:

2012-07-20  Mihnea Ovidenie  <mihnea@adobe.com>

        [CSSRegions]Assert failure when layout positioned objects in regions
        https://bugs.webkit.org/show_bug.cgi?id=90792

        Reviewed by Andreas Kling.

        Before clamping the containing block (for an out-of-flow positioned element
        inside a named flow) to the region, we have to test whether the region is not
        null, which can happen when the named flow does not have attached regions.

        Tests: fast/regions/positioned-vrl-in-named-flow.html
               fast/regions/positioned-vrl-in-parent-named-flow.html
               fast/regions/positioned-with-vrl-parent-in-named-flow.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::containingBlockLogicalWidthForPositioned):
        (WebCore::RenderBox::computePositionedLogicalWidth):
        (WebCore::RenderBox::computePositionedLogicalHeight):

2012-07-20  Stephen Chenney  <schenney@chromium.org>

        SVG Filter Effect sub-region not applied for some filters
        https://bugs.webkit.org/show_bug.cgi?id=89767

        Reviewed by Dirk Schulze.

        The filter effect region for SVG feGaussian and feDropShadow filters
        was incorrectly set, failing to account for the radius of the blur.
        This patch fixes the problem and removes an unneccessary clip
        operation when the filter result is blitted into the target. That clip
        was clipping the shadow from webkit-shadow.

        Tests: svg/filters/feDropShadow-subregion.svg
               svg/filters/feGaussianBlur-subregion.svg

        * platform/graphics/filters/FEDropShadow.cpp:
        (WebCore::FEDropShadow::determineAbsolutePaintRect): Moved the code
        that clips the paint rect by the filter effect subregion to come after
        the paint is modified by the filter radius.
        * platform/graphics/filters/FEGaussianBlur.cpp:
        (WebCore::FEGaussianBlur::determineAbsolutePaintRect):
        Moved the code that clips the paint rect by the filter effect subregion to
        come after the paint is modified by the filter radius.
        * rendering/svg/RenderSVGResourceFilter.cpp:
        (WebCore::RenderSVGResourceFilter::postApplyResource):
        Removed a clip that is unnecessary and that was incorrectly clipping drop shadows.

2012-07-19  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: Status bar icons are misaligned by 1px to the right
        https://bugs.webkit.org/show_bug.cgi?id=91757

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/inspector.css:
        (.glyph):
        (.glyph.shadow):

2012-07-20  Andrei Poenaru  <poenaru@adobe.com>

        Web Inspector: Protocol Extension: add getNamedFlowCollection command
        https://bugs.webkit.org/show_bug.cgi?id=91607

        Reviewed by Pavel Feldman.

        Extended the protocol with "getNamedFlowCollection" command.
        This command returns the CSS Named Flows from the document.

        Test: inspector/styles/protocol-getNamedFlowCollection-command.html

        * dom/WebKitNamedFlowCollection.cpp:
        (WebCore::WebKitNamedFlowCollection::namedFlowsNames):
        (WebCore):
        * dom/WebKitNamedFlowCollection.h:
        (WebKitNamedFlowCollection):
        * inspector/Inspector.json:
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::getNamedFlowCollection):
        (WebCore):
        * inspector/InspectorCSSAgent.h:
        (InspectorCSSAgent):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::assertDocument):
        (WebCore):
        * inspector/InspectorDOMAgent.h:
        (InspectorDOMAgent):
        * inspector/front-end/CSSStyleModel.js:
        (WebInspector.CSSStyleModel.prototype.getNamedFlowCollectionAsync):

2012-07-20  Eugene Klyuchnikov  <eustas.big@gmail.com>

        Web Inspector: Timeline: forward compatibility for load.
        https://bugs.webkit.org/show_bug.cgi?id=91714

        Reviewed by Pavel Feldman.

        Accept records of unrecognized types and render them as "unknown".

        Test: inspector/timeline/timeline-load-incompatible.html

        * English.lproj/localizedStrings.js: Added UI string.
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.recordStyle): Add missing record
        styles at runtime.
        (WebInspector.TimelinePresentationModel.Record.prototype._getRecordDetails):
        Add some common information for default case.

2012-07-20  MORITA Hajime  <morrita@google.com>

        Another unreviewed Mac build fix against r123184.

        * WebCore.exp.in:

2012-07-20  Mihnea Ovidenie  <mihnea@adobe.com>

        [CSSRegions]Crash when flowing a region into itself
        https://bugs.webkit.org/show_bug.cgi?id=90289

        Reviewed by Andreas Kling.

        If a region is designed to receive itself as content through a named flow, we avoid
        a circular dependency by not attaching the region to the desired named flow.
        In such occasions, the region's attached flow thread object is null and
        we have to check this pointer before using it in RenderRegion::styleDidChange.

        Test: fast/regions/flow-region-into-itself-crash.html

        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::styleDidChange):

2012-07-20  MORITA Hajime  <morrita@google.com>

        Unreviewed Mac build fix against r123184.

        * WebCore.exp.in:

2012-07-17  Kinuko Yasuda  <kinuko@chromium.org>

        If value for responseType defined as type that not supported, it should not throw an exception in XHR 2
        https://bugs.webkit.org/show_bug.cgi?id=90976

        Reviewed by Alexey Proskuryakov.

        http://www.w3.org/TR/XMLHttpRequest2/#the-responsetype-attribute
        The spec does not say it should throw an exception when a non-supported
        type is set, and other browsers do not throw it either.

        Test: fast/xmlhttprequest/xmlhttprequest-responsetype-set-type.html

        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::setResponseType): Stop throwing an exception when non-supported type is given.

2012-07-20  Matt Falkenhagen  <falken@chromium.org>

        Show or hide <dialog> depending on the open attribute
        https://bugs.webkit.org/show_bug.cgi?id=90931

        Reviewed by Kent Tamura.

        Test: fast/dom/HTMLDialogElement/dialog-open.html

        * css/html.css: Add CSS for dialog. This is copied verbatim from the HTML5 spec: http://www.whatwg.org/specs/web-apps/current-work/#flow-content-1
        (dialog:not([open])):
        (dialog):
        * html/HTMLDialogElement.cpp:
        (WebCore::HTMLDialogElement::close): Set open to false, to hide the dialog.
        (WebCore::HTMLDialogElement::show): Set open to true, to show the dialog.
        (WebCore):
        (WebCore::HTMLDialogElement::isPresentationAttribute): Make openAttr a presentation attribute, to work around bug 91058
        * html/HTMLDialogElement.h:
        (HTMLDialogElement):
        * html/HTMLDialogElement.idl:

2012-07-20  Shinya Kawanaka  <shinyak@chromium.org>

        Needs pseudo id to point the inner element of an img elemnet for styling
        https://bugs.webkit.org/show_bug.cgi?id=91590

        Reviewed by Hajime Morita.

        We introduce pseudo id to point the element in UserAgentShadowDOM.
        This enables us to style the inner element of an img element shadow.
        Please see also http://trac.webkit.org/wiki/ShadowDOMForReplacedElements

        Test: fast/dom/shadow/shadowdom-for-image-with-pseudo-id.html

        * html/shadow/ImageInnerElement.cpp:
        (WebCore::ImageInnerElement::shadowPseudoId):
        (WebCore):
        * html/shadow/ImageInnerElement.h:
        (ImageInnerElement):

2012-07-20  Kent Tamura  <tkent@chromium.org>

        REGRESSION(r121420): Performance regression of form state saving for pages with multiple forms
        https://bugs.webkit.org/show_bug.cgi?id=91804

        Reviewed by Hajime Morita.

        The complexity of FormKeyGenerator::formKey() was O(N) where N is the
        number of form elements with an identical action URL, and formKey() is
        called for every form. So, it's O(N^2). A page in www.reddit.com
        contains hundreds of form elements with action="#". So FormController::
        formElementsState() took a few seconds on a slow machine.

        In order to avoid O(N^2) operation, storing a map from form signatures
        to next index numbers, instead of storing existing formKey strings.

        No new tests. Just a performance improvement.

        * html/FormController.cpp:
        (FormKeyGenerator): Remove m_existingKeys. Add a map from a form
        signature string to the next index number.
        (WebCore::formSignature): Returns a signature string for a form, without
        an index number. This is like "actionURL [name1 name2 ]"
        (WebCore::FormKeyGenerator::formKey):
        Creates a formKey string by concatenating a formSignature and #n. N is
        obtained from m_formSignatureToNextIndexMap in O(1).
        (WebCore::FormKeyGenerator::willDeleteForm):
        Remove the code for m_existingKeys.

2012-07-20  Keishi Hattori  <keishi@webkit.org>

        Fix crash in WebCore::HTMLInputElement::dataList
        https://bugs.webkit.org/show_bug.cgi?id=91818

        Reviewed by Kent Tamura.

        Fix crash that occurs when setting slider appearance on a regular node.

        Test: fast/forms/range/slider-appearance-crash.html

        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::paintSliderTicks): Check if node is an input element.

2012-07-20  Kent Tamura  <tkent@chromium.org>

        [Chromium] Fix an assertion failure in TextFieldDecorationElement::hostInput()
        https://bugs.webkit.org/show_bug.cgi?id=91824

        Reviewed by Hajime Morita.

        No new tests. This code is used only in Chromium browser.

        * html/shadow/TextFieldDecorationElement.cpp:
        (WebCore::TextFieldDecorationElement::hostInput):
        Use shadowHost(), and allow to return 0.
        (WebCore::TextFieldDecorationElement::defaultEventHandler):
        Check 0.

2012-07-19  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] Compile WebCore without QtWidgets
        https://bugs.webkit.org/show_bug.cgi?id=91819

        Reviewed by Kenneth Rohde Christiansen.

        * WebCore.pri: QT += opengl is not needed for Qt 5, given that QtGui has OpenGL
        support built in with the QOpenGL* classes.

2012-07-19  MORITA Hajime  <morrita@google.com>

        [Refactoring] Replace Node's Document pointer with a TreeScope pointer
        https://bugs.webkit.org/show_bug.cgi?id=59816

        Reviewed by Ryosuke Niwa.

        Before this change, Node::treeScope() fetches the TreeScope object
        from ElementRareData. This approach has several shortcomings:

        - rareData() call is slow due to a hashtable lookup.
        - In shadow tree, each node has its tree scope in ElementRareData,
          that means the rare-data is no longer rare in that case.

        This change gets rid of ElementRareData::m_treeScope by replacing
        Node::m_document with Node::m_treeScope. And retrieves the
        document of Node through m_treeScope.

        Note that Node::document() is a hot function and naive
        replacemennt of m_document with m_treeScope can hurt the
        speed. This change employs some tricks to address it.

        - This change introduces Node::InShadowTree flag, if the flag is off,
          that means m_treeScope is actually a document an can be returned as the result.
          this eliminates an extract dereference.
        - Node::m_treeScope can be null. But we don't want to issue any extra
          conditional statement. So this change represents a null
          TreeScope as TreeScope::nullInstance(), which saves one conditional
          statement.

        With these changes, the Node::document() slowdown is minimized to
        unnoticeable size.

        No new tests. Covered by existing tests.

        * dom/Document.cpp: Took care of connectio betwen TreeScope.
        (WebCore::Document::Document):
        (WebCore::Document::~Document):
        (WebCore::Document::suggestedMIMEType):
        * dom/Document.h:
        (WebCore::Node::treeScope): Now just return m_treeScope, taking care of nullInstance() case.
        (WebCore):
        (WebCore::Node::setTreeScope): Now just sets m_treeScope.
        (WebCore::Node::documentInternal): Extracted from document() to have ASSERT-free version.
        (WebCore::Node::document): Re-implemented over treeScope() and the flag.
        (WebCore::Node::isDocumentNode): Re-implemented using treeScope()
        (WebCore::Node::Node):
        * dom/Node.cpp:
        (WebCore::Node::~Node):
        (WebCore::Node::reportMemoryUsage):
        * dom/Node.h:
        (Node):
        (WebCore::Node::inDocument):
        (WebCore::Node::isInShadowTree): Rewrote to use InShadowTree flag.
        * dom/NodeRareData.h:
        (WebCore::NodeRareData::NodeRareData): Eliminated m_treeScope.
        (NodeRareData):
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::ShadowRoot):
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::TreeScope):
        (WebCore):
        (WebCore::TreeScope::setParentTreeScope): Added.
        (WebCore::TreeScope::isDocumentScope): Added.
        (WebCore::TreeScope::nullInstance): Added.
        * dom/TreeScope.h: Added m_parentTreeScope.
        (WebCore):
        (WebCore::TreeScope::rootDocument): Added.
        (TreeScope):
        * dom/TreeScopeAdopter.cpp: No longer calls setDocument()
        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
        (WebCore::TreeScopeAdopter::moveNodeToNewDocument):
        * editing/MoveSelectionCommand.cpp: Includes Document.h to find inlined Node functions
        * editing/RemoveNodeCommand.cpp: Includes Document.h to find inlined Node functions
        * editing/RemoveNodePreservingChildrenCommand.cpp: Includes Document.h to find inlined Node functions
        * inspector/PageConsoleAgent.cpp: Includes Document.h to find inlined Node functions

2012-07-19  David Hyatt  <hyatt@apple.com>

        SVG not properly respecting max-width.
        https://bugs.webkit.org/show_bug.cgi?id=91474

        My previous checkin for 91474 accidentally inverted width and height in the division case for
        the computation of height. When I fixed this inversion, I discovered that <object> elements
        are in fact also broken with max-width handling, and that furthermore, trying to apply the same
        max-width fix by calling RenderBox::computeReplacedLogicalWidth/Height failed because those methods
        call intrinsicLogicalWidth()/Height(). Becuase m_intrinsicSize is out-of-date and does not reflect
        the values we just obtained from the contentRenderer, we use the default 300x150 values for object
        and fail to render.
        
        In order to both fix SVG/<object> with max-width constraints and to keep <object> rendering correctly
        even when there are no max-width constraints, I was forced to update the m_intrinsicSize immediately
        in order to make sure that the RenderBox methods returned the right values when computing the width/height
        constrained to max/min-width/height values.

        Reviewed by Dan Bernstein.

        Added two new tests in svg/as-image. One test covers non-rectangular images to test for the inversion
        mistake I made. The second test applies a max-width to <object> and shows that we have never gotten
        this right before. An existing test in svg/as-image/ already covers basic <object> use (and tests that
        the intrinsic size of 300x150 is not used when an explicit non-percentage size is specified on the SVG
        itself).

        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::computeAspectRatioInformationForRenderBox):
        Add a check to update m_intrinsicSize when we know it should apply, so that the calls to check against
        min/max-width fetch this correct size.
        
        * rendering/RenderReplaced.h:
        (RenderReplaced):
        Make m_intrinsicSize mutable because of the mutation that occurs during the method above. It may be
        that we should re-evaluate whether all of these methods should be const, but this would impact RenderBox
        methods as well, so I chose to hold off going down that rabbit hole.

2012-07-19  Dominic Mazzoni  <dmazzoni@google.com>

        AX: Need AccessibilityObjects for nodes without renderers in canvas subtree
        https://bugs.webkit.org/show_bug.cgi?id=87899

        Reviewed by Chris Fleizach.

        Refactors AccessibilityRenderObject so that it inherits from a new class,
        AccessibilityNodeObject, that can be constructed from a Node without a
        renderer. Modifies AXObjectCache so that it automatically creates an
        AccessibilityNodeObject for elements in a canvas subtree but not otherwise.
        A new layout test verifies that this correctly exposes an accessibility
        tree with appropriate roles for elements in a canvas subtree.

        This patch does not try to complete the implementation of
        AccessibilityNodeObject. Most AX methods are still unimplemented and need
        to be migrated from AccessibilityRenderObject to AccessibilityNodeObject
        in a future patch.
        
        This patch also doesn't change anything outside of WebCore/accessibility, so
        the rest of WebCore only calls AXObjectCache when there are changes to a
        RenderObject, not to a Node. Accessible notifications on nodes without
        renderers need to be implemented in a future patch.

        Test: accessibility/canvas-accessibilitynodeobject.html

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::get):
        (WebCore):
        (WebCore::createFromNode):
        (WebCore::AXObjectCache::getOrCreate):
        (WebCore::AXObjectCache::remove):
        * accessibility/AXObjectCache.h:
        (AXObjectCache):
        (WebCore::AXObjectCache::get):
        (WebCore::AXObjectCache::getOrCreate):
        (WebCore::AXObjectCache::remove):
        * accessibility/AccessibilityARIAGrid.cpp:
        (WebCore::AccessibilityARIAGrid::AccessibilityARIAGrid):
        (WebCore):
        (WebCore::AccessibilityARIAGrid::~AccessibilityARIAGrid):
        (WebCore::AccessibilityARIAGrid::init):
        (WebCore::AccessibilityARIAGrid::create):
        * accessibility/AccessibilityARIAGrid.h:
        (AccessibilityARIAGrid):
        * accessibility/AccessibilityARIAGridCell.cpp:
        (WebCore::AccessibilityARIAGridCell::create):
        * accessibility/AccessibilityARIAGridRow.cpp:
        (WebCore::AccessibilityARIAGridRow::create):
        * accessibility/AccessibilityAllInOne.cpp:
        * accessibility/AccessibilityList.cpp:
        (WebCore::AccessibilityList::create):
        * accessibility/AccessibilityListBox.cpp:
        (WebCore::AccessibilityListBox::create):
        * accessibility/AccessibilityMediaControls.cpp:
        (WebCore::AccessibilityMediaControl::create):
        (WebCore::AccessibilityMediaControlsContainer::create):
        (WebCore::AccessibilityMediaTimeline::create):
        (WebCore::AccessibilityMediaTimeDisplay::create):
        * accessibility/AccessibilityMenuList.cpp:
        (WebCore::AccessibilityMenuList::create):
        (WebCore):
        * accessibility/AccessibilityMenuList.h:
        (AccessibilityMenuList):
        * accessibility/AccessibilityNodeObject.cpp: Added.
        (WebCore):
        (WebCore::AccessibilityNodeObject::AccessibilityNodeObject):
        (WebCore::AccessibilityNodeObject::~AccessibilityNodeObject):
        (WebCore::AccessibilityNodeObject::init):
        (WebCore::AccessibilityNodeObject::create):
        (WebCore::AccessibilityNodeObject::detach):
        (WebCore::AccessibilityNodeObject::childrenChanged):
        (WebCore::AccessibilityNodeObject::updateAccessibilityRole):
        (WebCore::AccessibilityNodeObject::firstChild):
        (WebCore::AccessibilityNodeObject::lastChild):
        (WebCore::AccessibilityNodeObject::previousSibling):
        (WebCore::AccessibilityNodeObject::nextSibling):
        (WebCore::AccessibilityNodeObject::parentObjectIfExists):
        (WebCore::AccessibilityNodeObject::parentObject):
        (WebCore::AccessibilityNodeObject::elementRect):
        (WebCore::AccessibilityNodeObject::setNode):
        (WebCore::AccessibilityNodeObject::document):
        (WebCore::AccessibilityNodeObject::determineAccessibilityRole):
        (WebCore::AccessibilityNodeObject::addChildren):
        (WebCore::AccessibilityNodeObject::accessibilityIsIgnored):
        (WebCore::AccessibilityNodeObject::canSetFocusAttribute):
        (WebCore::AccessibilityNodeObject::determineAriaRoleAttribute):
        (WebCore::AccessibilityNodeObject::ariaRoleAttribute):
        (WebCore::AccessibilityNodeObject::remapAriaRoleDueToParent):
        * accessibility/AccessibilityNodeObject.h: Added.
        (WebCore):
        (AccessibilityNodeObject):
        (WebCore::AccessibilityNodeObject::isAccessibilityNodeObject):
        (WebCore::AccessibilityNodeObject::node):
        (WebCore::AccessibilityNodeObject::isDetached):
        (WebCore::toAccessibilityNodeObject):
        * accessibility/AccessibilityObject.h:
        (WebCore::AccessibilityObject::isAccessibilityNodeObject):
        * accessibility/AccessibilityProgressIndicator.cpp:
        (WebCore::AccessibilityProgressIndicator::create):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
        (WebCore::AccessibilityRenderObject::init):
        (WebCore):
        (WebCore::AccessibilityRenderObject::create):
        (WebCore::AccessibilityRenderObject::detach):
        (WebCore::AccessibilityRenderObject::setRenderer):
        (WebCore::AccessibilityRenderObject::canHaveChildren):
        (WebCore::AccessibilityRenderObject::addCanvasChildren):
        (WebCore::AccessibilityRenderObject::addChildren):
        * accessibility/AccessibilityRenderObject.h:
        (AccessibilityRenderObject):
        * accessibility/AccessibilitySlider.cpp:
        (WebCore::AccessibilitySlider::create):
        * accessibility/AccessibilityTable.cpp:
        (WebCore::AccessibilityTable::AccessibilityTable):
        (WebCore):
        (WebCore::AccessibilityTable::~AccessibilityTable):
        (WebCore::AccessibilityTable::init):
        (WebCore::AccessibilityTable::create):
        * accessibility/AccessibilityTable.h:
        (AccessibilityTable):
        * accessibility/AccessibilityTableCell.cpp:
        (WebCore::AccessibilityTableCell::create):
        * accessibility/AccessibilityTableRow.cpp:
        (WebCore::AccessibilityTableRow::create):

2012-07-19  Dan Bernstein  <mitz@apple.com>

        The ATSUI-based complex text code is unused
        https://bugs.webkit.org/show_bug.cgi?id=91816

        Reviewed by Sam Weinig.

        * WebCore.gypi: Removed references to the files deleted in this change.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * platform/graphics/FontCache.h:
        (FontCache): Replaced USE(CORE_TEXT) with PLATFORM(MAC) || PLATFORM(CHROMIUM) && OS(DARWIN).
        * platform/graphics/SimpleFontData.h:
        (SimpleFontData): Removed USE(ATSUI)-only code, replaced USE(CORE_TEXT) with
        (PLATFORM(CHROMIUM) && OS(DARWIN)).
        * platform/graphics/mac/ComplexTextController.cpp: Removed USE(ATSUI)-only code. Moved
        collectComplexTextRunsForCharacters() and the ComplexTextRun constructor out of this file.
        * platform/graphics/mac/ComplexTextController.h: Removed USE(ATSUI)-only code and removed
        #if USE(CORE_TEXT) because anyone including this header is using Core Text.
        * platform/graphics/mac/ComplexTextControllerATSUI.cpp: Removed.
        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Moved from
        ComplexTextController.cpp into this file and merged with createTextRunFromFontDataCoreText().
        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Moved from
        ComplexTextController.cpp into this file and merged with
        collectComplexTextRunsForCharactersCoreText().
        * platform/graphics/mac/SimpleFontDataATSUI.mm: Removed.
        * platform/graphics/mac/SimpleFontDataMac.mm:
        (WebCore::SimpleFontData::platformInit): Remove USE(ATSUI)-only code.
        (WebCore::SimpleFontData::platformDestroy): Ditto.
        * platform/text/mac/ShapeArabic.c: Removed.
        * platform/text/mac/ShapeArabic.h: Removed.

2012-07-19  Kent Tamura  <tkent@chromium.org>

        Introduce Node::shadowHost()
        https://bugs.webkit.org/show_bug.cgi?id=91814

        Reviewed by Hajime Morita.

        Introduce Node::shadowHost(), which return the host element, or 0.
        Node::shadowAncestorNode() is used to obtain a shadow host. However it
        is confusing because it returns 'this' if this is not in a shadow tree.

        Replaces one callsite of shadowAncestorNode() with shadowHost().

        No behavior change.

        * dom/Node.cpp:
        (WebCore::Node::shadowHost): Added.
        * dom/Node.h:
        (Node): Declare shadowHost(), and add a comment to shadowAncestorNode().
        * html/shadow/CalendarPickerElement.cpp:
        (WebCore::CalendarPickerElement::hostInput):
        Replace shadowAncestorNode() with shaodwHost().

2012-07-19  Kent Tamura  <tkent@chromium.org>

        Form state restore: Need to identify a form by its content
        https://bugs.webkit.org/show_bug.cgi?id=91209

        Reviewed by Hajime Morita.

        Add names of the first two controls of a form to its formKey
        string. By this change, we can correctly restore states to
        reordered forms like webkit.org/b/91209#c0.

        Tests: Added test cases to fast/forms/state-restore-per-form.html.

        * html/FormController.cpp:
        (WebCore::recordFormStructure):
        Append at most two name attribute values.
        (WebCore::createKey): Insert a string built by recordFromStructure().
        (WebCore::formStateSignature): Bump the version.

2012-07-19  Wei James  <james.wei@intel.com>

        enable Web Audio for chromium android port
        https://bugs.webkit.org/show_bug.cgi?id=89428

        Reviewed by Kenneth Russell.

        * WebCore.gyp/WebCore.gyp:
        * platform/audio/FFTFrameStub.cpp:
        (WebCore::FFTFrame::doFFT):

2012-07-19  David Hyatt  <hyatt@apple.com>

        SVG images broken when max-width specified.
        https://bugs.webkit.org/show_bug.cgi?id=91474

        SVG images were computing intrinsic dimensions when width and height were auto that did not
        respect min-max width/height. Normal images had code that applied these constraints properly.
        Looking at the code before the check-in that broke things, these constraints used to be
        applied to all images regardless of type via calcAspectRatioLogicalWidth/Height.
        
        This patch leaves the new function structure in place but converts the code to be more like
        it was prior to the introduction of the regression. Instead of raw intrinsic sizes being
        used in the SVG case, now all image types get the intrinsic sizes constrained when doing
        width/height computations.

        Reviewed by Dan Bernstein.

        Test: svg/as-image/svg-intrinsic-size.html

        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::computeAspectRatioInformationForRenderBox):
        Rename computeIntrinsicRatioInformationForRenderBox to computeAspectRatioInformationForRenderBox.
        Also rename the intrinsicSize reference to constrainedSize to reflect the fact that the size
        is not necessarily the intrinsic size any longer but instead a size where both axes have been
        constrained based off the max-min values of the opposite axes.
        
        Move the constraining code out of RenderReplaced::computeIntrinsicRatioInformation into this
        function so that the SVG code path appies the constraints as well. The movement of this code
        is what fixes the bug.

        (WebCore::RenderReplaced::computeIntrinsicRatioInformation):
        Changed to remove the code that constrains the returned size, since it is shifting to
        computeAspectRatioInformationForRenderBox instead.

        (WebCore::RenderReplaced::computeReplacedLogicalWidth):
        (WebCore::RenderReplaced::computeReplacedLogicalHeight):
        * rendering/RenderReplaced.h:
        (RenderReplaced):
        Patch the name of the reference passed in to computeReplacedLogicalWidth/Height to be
        constrainedSize instead of intrinsicSize, so that it is more obvious that the returned
        result is not just the intrinsic size of the image.

2012-07-19  Dmitry Titov  <dimich@chromium.org>

        Unreviewed, reverting http://trac.webkit.org/changeset/123149.
        It broke an IDB test on Chromium page cycler.

        * bindings/v8/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::SerializedScriptValue):
        (WebCore):
        * bindings/v8/SerializedScriptValue.h:
        * dom/MessageEvent.cpp:
        (WebCore::MessageEvent::MessageEvent):
        (WebCore::MessageEvent::initMessageEvent):

2012-07-19  Julien Chaffraix  <jchaffraix@webkit.org>

        [CSS2.1] Anonymous tables should be inline/block-level based off their parent
        https://bugs.webkit.org/show_bug.cgi?id=15365

        Reviewed by Abhishek Arya.

        This change makes us match bullet 3 "Generate missing parents" of section 17.2.1 http://www.w3.org/TR/CSS2/tables.html#anonymous-boxes":
        "If a table is contained by an inline element, then the anonymous tables should be inline-tables."

        Patch based on an earlier change by Kang-Hao (Kenny) Lu <kennyluck@csail.mit.edu>.

        Tests: css2.1/20110323/inline-table-002b.html
               fast/dynamic/insert-before-table-part-in-continuation.html
               fast/table/inline-table-in-continuation.html
               fast/table/inline-table-with-caption.html

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::createAnonymousWithParentRenderer):
        Added a check to determine if we should be inline or block based on our parent to match CSS 2.1.

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::addChildIgnoringContinuation):
        Changed the child addition logic to not wrap a table part in an inline context. This change works
        as intended as we will call RenderObject::addChild which will create an anonymous inline table that
        will be added under |this| instead of the table part. As the table is inline, it doesn't need to be
        wrapped when we recursively call RenderInline::addChild.

2012-07-19  Chris Fleizach  <cfleizach@apple.com>

        WebKit should pass <title> element value as the default description for web views
        https://bugs.webkit.org/show_bug.cgi?id=91763

        Reviewed by Anders Carlsson.

        Update the logic for determining the description for the AXWebArea to include the document's title.

        Test: platform/mac/accessibility/document-title-used-for-description.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::webAreaAccessibilityDescription):
           Move web area description handling into a separate method.
        (WebCore::AccessibilityRenderObject::accessibilityDescription):
        * accessibility/AccessibilityRenderObject.h:
        (AccessibilityRenderObject):

2012-07-19  Zeev Lieber  <zlieber@chromium.org>

        [Chromium] Textures drawn during occlusion are incorrectly re-used when unoccluded.
        https://bugs.webkit.org/show_bug.cgi?id=91537

        Reviewed by Adrienne Walker.

        Detecting if any external occlusion occurs when drawing a
        texture. If external occlusion happens, the texture is marked as
        "incomplete" in LayerRendererChromium, and is not being considered
        for re-use.

        Minor refactoring of CCQuadCuller - extracted interface
        (CCQuadSink) and united append() and appendSurface() methods.

        Added unit tests to verify this fix; also added test to try
        clipping instead of occlusion.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (LayerRendererChromium::CachedTexture):
        (WebCore::LayerRendererChromium::CachedTexture::create):
        (WebCore::LayerRendererChromium::CachedTexture::~CachedTexture):
        (WebCore::LayerRendererChromium::CachedTexture::isComplete):
        (WebCore::LayerRendererChromium::CachedTexture::setIsComplete):
        (WebCore::LayerRendererChromium::CachedTexture::CachedTexture):
        (WebCore):
        (WebCore::LayerRendererChromium::decideRenderPassAllocationsForFrame):
        (WebCore::LayerRendererChromium::haveCachedResourcesForRenderPassId):
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
        (WebCore::CCIOSurfaceLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.h:
        (CCIOSurfaceLayerImpl):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::appendDebugBorderQuad):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore):
        (WebCore::CCLayerImpl::appendQuads):
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::::unoccludedContentRect):
        (WebCore::::unoccludedContributingSurfaceContentRect):
        (WebCore):
        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
        (CCOcclusionTrackerBase):
        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
        (WebCore::CCQuadCuller::CCQuadCuller):
        (WebCore::CCQuadCuller::append):
        * platform/graphics/chromium/cc/CCQuadCuller.h:
        (WebCore):
        (CCQuadCuller):
        (WebCore::CCQuadCuller::~CCQuadCuller):
        (WebCore::CCQuadCuller::hasExternalOcclusion):
        * platform/graphics/chromium/cc/CCQuadSink.h:
        (WebKit):
        (WebCore):
        (CCQuadSink):
        (WebCore::CCQuadSink::~CCQuadSink):
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::CCRenderPass):
        (WebCore::CCRenderPass::appendQuadsForLayer):
        (WebCore::CCRenderPass::appendQuadsForRenderSurfaceLayer):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
        (WebCore::CCRenderPassDrawQuad::create):
        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
        (CCRenderPassDrawQuad):
        (WebCore::CCRenderPassDrawQuad::hasExternalOcclusion):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::CCRenderSurface):
        (WebCore::CCRenderSurface::appendQuads):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (WebCore):
        (WebCore::CCRenderSurface::setHasExternalOcclusion):
        (WebCore::CCRenderSurface::hasExternalOcclusion):
        (CCRenderSurface):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
        (WebCore::CCScrollbarLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
        (CCScrollbarLayerImpl):
        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp:
        (WebCore::CCSolidColorLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.h:
        (CCSolidColorLayerImpl):
        * platform/graphics/chromium/cc/CCTextureLayerImpl.cpp:
        (WebCore::CCTextureLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCTextureLayerImpl.h:
        (CCTextureLayerImpl):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
        (WebCore::CCTiledLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
        (CCTiledLayerImpl):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
        (CCVideoLayerImpl):

2012-07-19  Simon Fraser  <simon.fraser@apple.com>

        Keep overlap testing on for descendants of an animating element
        https://bugs.webkit.org/show_bug.cgi?id=91787

        Reviewed by Beth Dakin.

        RenderLayerCompositor::computeCompositingRequirements() would turn off
        overlap testing for descendants of a layer that has a 3D transform,
        or has an animating transform. This could cause compositing changes
        inside an animating element when transitions start and stop, which
        is undesirable.
        
        Instead, we can keep overlap testing on for descendants of that
        animating element, but we have to turn it off for layers later
        in z-order.
        
        Also enhance the "IndirectCompositingReason" flags so that in
        the compositing log output, we can distinguish between layers that
        were composited as a result of overlap testing from those compositing
        for stacking reasons.

        Test: compositing/layer-creation/animation-overlap-with-children.html

        * rendering/RenderLayer.h: New IndirectCompositingReason value to
        distinguish overlap from stacking.
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
        Use an IndirectCompositingReason enum rather than a bool to track whether
        the layer starts as composited.
        Remove the if (layer->has3DTransform() || isRunningAcceleratedTransformAnimation(layer->renderer()))
        check that turned off overlap testing for descendants of this layer.
        Use IndirectCompositingForStacking (somewhat arbitrarily) for reflection layers.
        Turn overlap testing off for layers later in the z-order.
        (WebCore::RenderLayerCompositor::requiresOwnBackingStore): Take IndirectCompositingForStacking into
        account.
        (WebCore::RenderLayerCompositor::reasonForCompositing): Improve the logging output.

2012-07-19  No'am Rosenthal  <noam.rosenthal@nokia.com>

        [Qt] Enable CSS shaders in Qt (software mode)
        https://bugs.webkit.org/show_bug.cgi?id=85140

        Reviewed by Simon Hausmann.

        Added missing files to the Qt build.

        No new tests, WebGL is still disabled by default in the bots.

        * Target.pri:

2012-07-19  No'am Rosenthal  <noam.rosenthal@nokia.com>

        [Qt] Enable CSS shaders in Qt (software mode)
        https://bugs.webkit.org/show_bug.cgi?id=85140

        Reviewed by Simon Hausmann.

        Added missing files to the Qt build.

        No new tests, WebGL is still disabled by default in the bots.

        * Target.pri:

2012-07-19  Simon Fraser  <simon.fraser@apple.com>

        Keep overlap testing on for descendants of an animating element
        https://bugs.webkit.org/show_bug.cgi?id=91787

        Reviewed by Beth Dakin.

        RenderLayerCompositor::computeCompositingRequirements() would turn off
        overlap testing for descendants of a layer that has a 3D transform,
        or has an animating transform. This could cause compositing changes
        inside an animating element when transitions start and stop, which
        is undesirable.
        
        Instead, we can keep overlap testing on for descendants of that
        animating element, but we have to turn it off for layers later
        in z-order.
        
        Also enhance the "IndirectCompositingReason" flags so that in
        the compositing log output, we can distinguish between layers that
        were composited as a result of overlap testing from those compositing
        for stacking reasons.

        Test: compositing/layer-creation/animation-overlap-with-children.html

        * rendering/RenderLayer.h: New IndirectCompositingReason value to
        distinguish overlap from stacking.
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
        Use an IndirectCompositingReason enum rather than a bool to track whether
        the layer starts as composited.
        Remove the if (layer->has3DTransform() || isRunningAcceleratedTransformAnimation(layer->renderer()))
        check that turned off overlap testing for descendants of this layer.
        Use IndirectCompositingForStacking (somewhat arbitrarily) for reflection layers.
        Turn overlap testing off for layers later in the z-order.
        (WebCore::RenderLayerCompositor::requiresOwnBackingStore): Take IndirectCompositingForStacking into
        account.
        (WebCore::RenderLayerCompositor::reasonForCompositing): Improve the logging output.

2012-07-19  No'am Rosenthal  <noam.rosenthal@nokia.com>

        [Qt] Enable CSS shaders in Qt (software mode)
        https://bugs.webkit.org/show_bug.cgi?id=85140

        Reviewed by Simon Hausmann.

        Added missing files to the Qt build.

        No new tests, WebGL is still disabled by default in the bots.

        * Target.pri:

2012-07-17  Dmitry Titov  <dimich@chromium.org>

        [Chromium] Out of Memory is observed when a large object is passed to a Web Worker.
        https://bugs.webkit.org/show_bug.cgi?id=91535.

        Reviewed by Dave Levin.

        No new tests because of no new behavior and lack of mechanism to monitor used memory.

        * bindings/v8/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::SerializedScriptValue):
        (WebCore::SerializedScriptValue::registerMemoryAllocatedWithCurrentScriptContext):
        (WebCore):
        (WebCore::SerializedScriptValue::~SerializedScriptValue):
        * bindings/v8/SerializedScriptValue.h:
        (SerializedScriptValue):
        Added a method to SerializedScriptValue to add memory pressure on GC proportional to the size of memory allocated in serialized data.
        
        * dom/MessageEvent.cpp:
        (WebCore::MessageEvent::MessageEvent):
        (WebCore::MessageEvent::initMessageEvent):
        Call the new method of SerializedScriptValue during creation of MessageEvent (presumably in the thread which contains the right V8 context).

2012-07-19  Dan Bernstein  <mitz@apple.com>

        In flipped blocks writing modes, no flipping occurs when mapping RenderText’s local coordinates to absolute
        https://bugs.webkit.org/show_bug.cgi?id=91780

        Reviewed by Anders Carlsson.

        Test: fast/writing-mode/flipped-blocks-text-map-local-to-container.html

        When RenderObject::mapLocalToContainer() was called on a RenderText with ApplyContainerFlip,
        it would not flip (if the container was not a box) but it would always pass
        DoNotApplyContainerFlip when recurring to the parent. This meant that no one applied the flip.

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::mapLocalToContainer): Made the setting of applyContainerFlip to
        false unconditional on the container actually being flipped.
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::mapLocalToContainer): Rather than always passing
        DoNotApplyContainerFlip when recurring to the parent, changed this function to pass through
        the value of applyContainerFlip it was called with, unless it applied the flip itself.

2012-07-19  Erik Arvidsson  <arv@chromium.org>

        Window top should not be replaceable
        https://bugs.webkit.org/show_bug.cgi?id=91755

        Reviewed by Adam Barth.

        Window top is readonly and unforgable and should not be replaceable.

        http://www.whatwg.org/specs/web-apps/current-work/multipage/browsers.html#the-window-object

        This change brings JSC inline with all other browsers.

        No new tests. Modified existing tests.

        * page/DOMWindow.idl:

2012-07-19  Max Feil  <mfeil@rim.com>

        [BlackBerry] Only maintain the hole punch rect while html5 video is being renderered
        https://bugs.webkit.org/show_bug.cgi?id=91689

        Reviewed by Antonio Gomes.

        The hole punch rectangle needs to be present if and only if html5
        video content is being rendered. Otherwise unwanted content may
        show through from behind the browser tab's window.

        I am not adding any new tests because the difficulty of testing
        for this case outweighs the benefit.

        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
        (WebCore::MediaPlayerPrivate::updateStates):

2012-07-19  Bem Jones-Bey  <bjonesbe@adobe.com>

        [CSS Exclusions] - Code cleanup: make shape parsing use isComma() instead of manual checks
        https://bugs.webkit.org/show_bug.cgi?id=91760

        Reviewed by Eric Seidel.

        Remove code duplication by making the rectangle, circle, and ellipse
        methods use isComma() to detect a comma.

        No new tests needed: no new functionality added.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseExclusionShapeRectangle):
        (WebCore::CSSParser::parseExclusionShapeCircle):
        (WebCore::CSSParser::parseExclusionShapeEllipse):

2012-07-19  Raymond Toy  <rtoy@google.com>

        Limit maximum delay of DelayNode.
        https://bugs.webkit.org/show_bug.cgi?id=91675

        Reviewed by Kenneth Russell.

        Clip the maximum delay of a DelayNode to a reasonable maximum.
        
        Test: webaudio/delaynode-maxdelaylimit.html

        * Modules/webaudio/DelayNode.cpp:
        (WebCore): Add maximumAllowedDelayTime.
        (WebCore::DelayNode::DelayNode): Clip max delay.

2012-07-14  Robert Hogan  <robert@webkit.org>

        CSS 2.1 failure: text-indent-intrinsic-003 fails
        https://bugs.webkit.org/show_bug.cgi?id=80576

        Reviewed by Eric Seidel.

        Negative values of text-indent should be distributed across inline children until used up.
        This fixes text-indent-intrinsic-003 and text-indent-intrinsic-004.

        Tests: css2.1/20110323/text-indent-intrinsic-001.htm
               css2.1/20110323/text-indent-intrinsic-002.htm
               css2.1/20110323/text-indent-intrinsic-003.htm
               css2.1/20110323/text-indent-intrinsic-004.htm

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths): If text-indent is negative, keep
         applying it to inline children in the first formatted line until it's reduced to zero. This isn't
         a consideration when text-indent is a positive value.

2012-07-19  Douglas Stockwell  <dstockwell@google.com>

        Crash in WebCore::StyleResolver::collectMatchingRulesForList
        https://bugs.webkit.org/show_bug.cgi?id=90803

        Reviewed by Andreas Kling.

        When a ProcessingInstruction was removed from the document the owner
        was removed, but the style resolver was not guaranteed to be updated.
        It was then possible for an inconsistent version of the stylesheet to
        remain visible in the DOM. Fixed by removing an invalid condition and
        mirroring the logic from StyleElement.

        Test: fast/css/xml-stylesheet-removed.xhtml

        * dom/ProcessingInstruction.cpp:
        (WebCore::ProcessingInstruction::removedFrom): Mirror the logic from
        StyleElement -- always update the style resolver.

2012-07-19  Bem Jones-Bey  <bjonesbe@adobe.com>

        Shape-inside / shape-outside should support percent-based measurements
        https://bugs.webkit.org/show_bug.cgi?id=90311

        Reviewed by Andreas Kling.

        Update the CSS Parser to accept percentage length values for exclusion
        shapes.

        Testing added to LayoutTests/fast/exclusions/parsing-wrap-shape-lengths.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseExclusionShapeRectangle):
        (WebCore::CSSParser::parseExclusionShapeCircle):
        (WebCore::CSSParser::parseExclusionShapeEllipse):
        (WebCore::CSSParser::parseExclusionShapePolygon):

2012-07-19  Tony Chang  <tony@chromium.org>

        Unreviewed, rolling out r123117.
        http://trac.webkit.org/changeset/123117
        https://bugs.webkit.org/show_bug.cgi?id=91667

        Breaks chromium-win compile.

        * WebCore.gyp/WebCore.gyp:
        * WebCore.gyp/scripts/rule_bison.py:
        * bindings/scripts/preprocessor.pm:
        (applyPreprocessor):
        * make-hash-tools.pl:

2012-07-19  James Simonsen  <simonjam@chromium.org>

        Regression(120096): Protect the element used by ImageLoader until the end of notifyFinished().
        https://bugs.webkit.org/show_bug.cgi?id=90471

        Reviewed by Brady Eidson.

        Test: http/tests/security/video-poster-cross-origin-crash.html

        * html/HTMLImageLoader.cpp:
        (WebCore::HTMLImageLoader::notifyFinished): Hang on to the element until we're done.
        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::setImage): No behavior change.
        (WebCore):
        (WebCore::ImageLoader::setImageWithoutConsideringPendingLoadEvent): Split off from old setImage, minus calling updatedHasPendingLoadEvent().
        (WebCore::ImageLoader::notifyFinished): Invoke updatedHasPendingLoadEvent when done with cross origin errors.
        * loader/ImageLoader.h:
        (ImageLoader):

2012-07-19  Scott Graham  <scottmg@chromium.org>

        Use native (non-cygwin) binaries for perl, gperf, and bison in Chromium
        https://bugs.webkit.org/show_bug.cgi?id=91667

        Reviewed by Kentaro Hara.

        Using native tools instead of cygwin version improves build time
        performance by roughly 50% (on top of previous cl-instead-of-gcc
        change).

        No new tests.

        * WebCore.gyp/WebCore.gyp:
        * WebCore.gyp/scripts/rule_bison.py:
        * bindings/scripts/preprocessor.pm:
        (applyPreprocessor):
        * make-hash-tools.pl:

2012-07-19  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: CPU bars are not cleared along with the rest of the timeline panel
        https://bugs.webkit.org/show_bug.cgi?id=91753

        Reviewed by Pavel Feldman.

        - remove early bail-outs in  refreshMainThreadBars; let it run to clear bars for the non-existent / invisible events;

        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype._refreshMainThreadBars):

2012-07-19  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Throw native TypeErrors per spec
        https://bugs.webkit.org/show_bug.cgi?id=91679

        Reviewed by Kentaro Hara.

        Per the IDB spec, the advance(), openCursor(), openKeyCursor() and transaction()
        methods supposed to throw true native JavaScript TypeError objects as exceptions
        rather than DOMException objects. Implement this by adding a special DOMException
        code that is tested for in the binding layer.

        Tests: storage/indexeddb/cursor-advance.html
               storage/indexeddb/index-basics.html
               storage/indexeddb/index-basics-workers.html
               storage/indexeddb/objectstore-cursor.html
               storage/indexeddb/transaction-basics.html

        * Modules/indexeddb/IDBCursor.cpp: Use the new DOMException code.
        (WebCore::IDBCursor::advance):
        (WebCore::IDBCursor::stringToDirection):
        (WebCore::IDBCursor::directionToString):
        * Modules/indexeddb/IDBDatabase.cpp: Ditto.
        (WebCore::IDBDatabase::setVersion):
        * Modules/indexeddb/IDBDatabaseException.cpp: Remove temporary cruft/mark as legacy.
        (WebCore):
        * Modules/indexeddb/IDBDatabaseException.h: Ditto.
        * Modules/indexeddb/IDBDatabaseException.idl: Ditto.
        * Modules/indexeddb/IDBFactory.cpp: Use the new DOMException code.
        (WebCore::IDBFactory::open):
        (WebCore::IDBFactory::deleteDatabase):
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::createIndex): Use the new DOMException code.
        * Modules/indexeddb/IDBTransaction.cpp: Use the new DOMException code.
        (WebCore::IDBTransaction::stringToMode):
        (WebCore::IDBTransaction::modeToString):
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::setDOMException): Intercept new DOMException code, throw native TypeError.
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::setDOMException): Ditto.
        * dom/ExceptionCode.h: Add new DOMException code.

2012-07-19  Joshua Bell  <jsbell@chromium.org>

        Roll out r121610 and r122487 which may have been causing flaky crashes
        https://bugs.webkit.org/show_bug.cgi?id=91637

        Reviewed by Kentaro Hara.

        Flaky crashes started in random tests following r121610. It's not clear
        that r121610 is to blame, but we'd like to prove or disprove it.
        If this doesn't resolve the crashes, this patch should be rolled out.

        * WebCore.gypi:
        * bindings/v8/NPObjectWrapper.cpp: Added.
        (WebCore):
        (NPProxyObject):
        (WebCore::NPObjectWrapper::NPObjectWrapper):
        (WebCore::NPObjectWrapper::create):
        (WebCore::NPObjectWrapper::clear):
        (WebCore::NPObjectWrapper::getWrapper):
        (WebCore::NPObjectWrapper::getUnderlyingNPObject):
        (WebCore::NPObjectWrapper::getObjectForCall):
        (WebCore::NPObjectWrapper::NPAllocate):
        (WebCore::NPObjectWrapper::NPDeallocate):
        (WebCore::NPObjectWrapper::NPPInvalidate):
        (WebCore::NPObjectWrapper::NPHasMethod):
        (WebCore::NPObjectWrapper::NPInvoke):
        (WebCore::NPObjectWrapper::NPInvokeDefault):
        (WebCore::NPObjectWrapper::NPHasProperty):
        (WebCore::NPObjectWrapper::NPGetProperty):
        (WebCore::NPObjectWrapper::NPSetProperty):
        (WebCore::NPObjectWrapper::NPRemoveProperty):
        (WebCore::NPObjectWrapper::NPNEnumerate):
        (WebCore::NPObjectWrapper::NPNConstruct):
        (WebCore::NPObjectWrapper::NPInvokePrivate):
        * bindings/v8/NPObjectWrapper.h: Added.
        (WebCore):
        (NPObjectWrapper):
        * bindings/v8/NPV8Object.cpp:
        (WebCore::freeV8NPObject):
        (_NPN_Invoke):
        (_NPN_InvokeDefault):
        (_NPN_EvaluateHelper):
        (_NPN_GetProperty):
        (_NPN_SetProperty):
        (_NPN_RemoveProperty):
        (_NPN_HasProperty):
        (_NPN_HasMethod):
        (_NPN_Enumerate):
        (_NPN_Construct):
        * bindings/v8/NPV8Object.h:
        (WebCore):
        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::ScriptController):
        (WebCore::ScriptController::clearScriptObjects):
        (WebCore::ScriptController::windowScriptNPObject):
        * bindings/v8/ScriptController.h:
        (ScriptController):

2012-07-19  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: minimize number of properties on WebInspector.TimelinePresentationModel.Record
        https://bugs.webkit.org/show_bug.cgi?id=91744

        Reviewed by Pavel Feldman.

        - replace most properties on TimelinePresentationModel.Record with getters;

        This reduces the amount of memory we use for timeline presentation model records almost by 2x.

        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.Record):
        (WebInspector.TimelinePresentationModel.Record.prototype.get children):
        (WebInspector.TimelinePresentationModel.Record.prototype.get category):
        (WebInspector.TimelinePresentationModel.Record.prototype.get title):
        (WebInspector.TimelinePresentationModel.Record.prototype.get startTime):
        (WebInspector.TimelinePresentationModel.Record.prototype.get data):
        (WebInspector.TimelinePresentationModel.Record.prototype.get type):
        (WebInspector.TimelinePresentationModel.Record.prototype.get frameId):
        (WebInspector.TimelinePresentationModel.Record.prototype.get endTime):
        (WebInspector.TimelinePresentationModel.Record.prototype.get totalHeapSize):
        (WebInspector.TimelinePresentationModel.Record.prototype.get usedHeapSize):
        (WebInspector.TimelinePresentationModel.Record.prototype.get _selfTime):
        (WebInspector.TimelinePresentationModel.Record.prototype.get stackTrace):
        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):
        (WebInspector.TimelinePresentationModel.Record.prototype.calculateAggregatedStats):

2012-07-19  Dongwoo Im  <dw.im@samsung.com>

        [EFL] Fix build break when WEB_AUDIO is enabled.
        https://bugs.webkit.org/show_bug.cgi?id=91735

        Unreviewed build fix.

        New files are added for the Web Audio fearure.
        These files should be included into the CMakeLists.txt file.

        * CMakeLists.txt: Add the newly created files into the CMakeLists.txt

2012-07-19  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] Remove support for Qt versions before 4.8.0
        https://bugs.webkit.org/show_bug.cgi?id=91730

        Reviewed by Kenneth Rohde Christiansen.

        Remove Qt version check #ifdefs for Qt versions before 4.8.0.

        * platform/graphics/qt/GraphicsContextQt.cpp:
        (WebCore::GraphicsContextPlatformPrivate::clipBoundingRect):
        * platform/qt/ThirdPartyCookiesQt.cpp:
        (WebCore::urlsShareSameDomain):
        (WebCore::thirdPartyCookiePolicyPermits):

2012-07-19  Peter Rybin  <peter.rybin@gmail.com>

        Web Inspector: CodeGeneratorInspector.py: fix output write logic to support incremental build
        https://bugs.webkit.org/show_bug.cgi?id=90642

        Reviewed by Yury Semikhatsky.

        A small intermediate writer is added. It handles comparing old and new source before actual writing.

        * inspector/CodeGeneratorInspector.py:
        (flatten_list):
        (SmartOutput):
        (SmartOutput.__init__):
        (SmartOutput.write):
        (SmartOutput.close):

2012-07-19  Mario Sanchez Prada  <msanchez@igalia.com>

        [GTK] MHTML files not being loaded due to reported mime type not supported
        https://bugs.webkit.org/show_bug.cgi?id=89978

        Reviewed by Carlos Garcia Campos.

        Make 'message/rfc822' a supported MIME type for MHTML files in GTK.

        * loader/MainResourceLoader.cpp:
        (WebCore::MainResourceLoader::continueAfterContentPolicy): Add
        'message/rfc822' to the list of MIME types to be considered to
        avoid them bypasing cross-domain security checks, only for GTK.
        * loader/archive/ArchiveFactory.cpp:
        (WebCore::archiveMIMETypes): Add 'message/rfc822' to the list of
        supported MIME types when MHTML support is enabled in GTK.

2012-07-19  Jan Keromnes  <janx@linux.com>

        Web Inspector: Factor ExtensionView into separate file
        https://bugs.webkit.org/show_bug.cgi?id=91699

        Reviewed by Vsevolod Vlasov.

        The class ExtensionView was defined in ExtensionPanel.js but needed to
        be in a separate file since it is going to be reused somewhere else.

        Current test coverage is enough since no behavior was changed.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/ExtensionPanel.js:
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:

2012-07-19  Shinya Kawanaka  <shinyak@chromium.org>

        [Refactoring] Use userAgentShadowRoot() to take user agent shadow root.
        https://bugs.webkit.org/show_bug.cgi?id=91716

        Reviewed by Hajime Morita.

        We have introduced Element::userAgentShadowRoot in r123071 to take user agent shadow root.
        We have used shadow()->oldestShadowRoot() to take the user agent shadow root, however its code intention was
        not so clear. Using userAgentShadowRoot() will make it clearer.

        No new tests, simple refactoring.

        * html/ColorInputType.cpp:
        (WebCore::ColorInputType::createShadowSubtree):
        (WebCore::ColorInputType::shadowColorSwatch):
        * html/FileInputType.cpp:
        (WebCore::FileInputType::createShadowSubtree):
        (WebCore::FileInputType::multipleAttributeChanged):
        * html/HTMLDetailsElement.cpp:
        (WebCore::HTMLDetailsElement::findMainSummary):
        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::willAddAuthorShadowRoot):
        (WebCore::HTMLImageElement::imageElement):
        (WebCore::HTMLImageElement::innerElement):
        * html/HTMLKeygenElement.cpp:
        (WebCore::HTMLKeygenElement::shadowSelect):
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::innerTextElement):
        (WebCore::HTMLTextAreaElement::updatePlaceholderText):
        * html/InputType.cpp:
        (WebCore::InputType::destroyShadowSubtree):
        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::handleMouseDownEvent):
        (WebCore::RangeInputType::createShadowSubtree):
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::createShadowSubtree):
        (WebCore::TextFieldInputType::updatePlaceholderText):
        * html/ValidationMessage.cpp:
        (WebCore::ValidationMessage::deleteBubbleTree):
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::sliderThumbElementOf):
        (WebCore::trackLimiterElementOf):

2012-07-19  Keishi Hattori  <keishi@webkit.org>

        Redraw slider tick marks when datalist changes.
        https://bugs.webkit.org/show_bug.cgi?id=89544

        Reviewed by Kent Tamura.

        Updating the datalist should redraw the slider tick marks. This patch monitors
        the id target element of the list attribute using ListAttributeTargetObserver
        and notifies changes to the option element inside of a datalist element.

        Test: fast/forms/datalist/update-range-with-datalist.html

        * html/HTMLDataListElement.cpp:
        (WebCore::HTMLDataListElement::optionElementChildrenChanged): Called when a child option element's value might have changed.
        (WebCore):
        * html/HTMLDataListElement.h:
        (HTMLDataListElement):
        * html/HTMLInputElement.cpp:
        (ListAttributeTargetObserver): Inherits IdTargetObserver.
        (WebCore):
        (WebCore::HTMLInputElement::parseAttribute): Observe the form attribute target.
        (WebCore::HTMLInputElement::insertedInto): Observe the form attribute id target.
        (WebCore::HTMLInputElement::removedFrom): Remove the observer.
        (WebCore::HTMLInputElement::resetListAttributeTargetObserver):
        (WebCore::HTMLInputElement::listAttributeTargetChanged):
        (WebCore::ListAttributeTargetObserver::create):
        (WebCore::ListAttributeTargetObserver::ListAttributeTargetObserver):
        (WebCore::ListAttributeTargetObserver::idTargetChanged):
        * html/HTMLInputElement.h:
        (WebCore):
        (HTMLInputElement):
        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::parseAttribute): If the value attribute changed, notify the owner datalist element.
        (WebCore::HTMLOptionElement::childrenChanged): If the children changed, notify the owner datalist element.
        (WebCore):
        (WebCore::HTMLOptionElement::ownerDataListElement): The datalist that the option element is inside of.
        * html/HTMLOptionElement.h:
        (WebCore):
        (HTMLOptionElement):
        * html/InputType.cpp:
        (WebCore):
        (WebCore::InputType::listAttributeTargetChanged):
        * html/InputType.h:
        (InputType):
        * html/RangeInputType.cpp:
        (WebCore):
        (WebCore::RangeInputType::listAttributeTargetChanged):
        * html/RangeInputType.h:
        (RangeInputType):

2012-07-19  Dongwoo Im  <dw.im@samsung.com>

        CodeGeneratorV8.pm : @enabledAtRuntime is not used in GenerateHeader.
        https://bugs.webkit.org/show_bug.cgi?id=91715

        Reviewed by Kentaro Hara.

        @enabledAtRuntime is not used in GenerateHeader.
        We can remove it from GenerateHeader.

        No new tests as this has no functional changes.

        * bindings/scripts/CodeGeneratorV8.pm: Remove @enabledAtRuntime from GenerateHeader.
        (GenerateHeader):

2012-07-19  Abhishek Arya  <inferno@chromium.org>

        Crash in FontCache::releaseFontData.
        https://bugs.webkit.org/show_bug.cgi?id=91710

        Reviewed by Tim Horton.

        Revert back change made to StyleResolver in r122896. The
        maximum font size clamp is required there since transformed
        sizes use that code path.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-07-18  Ryosuke Niwa  <rniwa@webkit.org>

        Another build fix after r123065. Don't list deleted file in gypi.

        * WebCore.gypi:

2012-07-18  Keishi Hattori  <keishi@webkit.org>

        Implement painting slider tick marks
        https://bugs.webkit.org/show_bug.cgi?id=87844

        Reviewed by Kent Tamura.

        This implements painting slider tick marks for <datalist> support for input type=range.
        This does not support automatic update when list target changes, and it will be fixed
        in a follow up patch (Bug 89544).

        Tests: fast/forms/datalist/input-appearance-range-with-datalist-rtl.html
               fast/forms/datalist/input-appearance-range-with-datalist-zoomed.html
               fast/forms/datalist/input-appearance-range-with-datalist.html

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::sliderThumbElement):
        (WebCore):
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/InputType.h:
        (WebCore::InputType::sliderThumbElement):
        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::typeMismatchFor): We need HTMLInputElement::isValidValue("foo") to return false.
        (WebCore):
        (WebCore::RangeInputType::sliderThumbElement):
        * html/RangeInputType.h:
        (RangeInputType):
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::RenderSliderContainer::layout): Slider height needs to be increased for the tick marks.
        * platform/efl/RenderThemeEfl.cpp:
        (WebCore):
        (WebCore::RenderThemeEfl::sliderTickSize):
        (WebCore::RenderThemeEfl::sliderTickOffsetFromTrackCenter):
        * platform/efl/RenderThemeEfl.h:
        (RenderThemeEfl):
        * platform/qt/RenderThemeQt.cpp:
        (WebCore::RenderThemeQt::sliderTickSize):
        (WebCore):
        (WebCore::RenderThemeQt::sliderTickOffsetFromTrackCenter):
        * platform/qt/RenderThemeQt.h:
        (RenderThemeQt):
        * rendering/RenderTheme.cpp:
        (WebCore):
        (WebCore::RenderTheme::paintSliderTicks):
        * rendering/RenderTheme.h:
        (RenderTheme):
        * rendering/RenderThemeChromiumCommon.cpp:
        (WebCore::RenderThemeChromiumCommon::supportsDataListUI):
        * rendering/RenderThemeChromiumLinux.cpp:
        (WebCore):
        (WebCore::RenderThemeChromiumLinux::sliderTickSize): Tick size for horizontal slider. i.e. Width is length along the track.
        (WebCore::RenderThemeChromiumLinux::sliderTickOffsetFromTrackCenter): Offset from
        middle of draw rect to draw the ticks. Minus value means above the track.
        (WebCore::RenderThemeChromiumLinux::paintSliderTrack):
        * rendering/RenderThemeChromiumLinux.h:
        (RenderThemeChromiumLinux):
        * rendering/RenderThemeChromiumWin.cpp:
        (WebCore):
        (WebCore::RenderThemeChromiumWin::sliderTickSize):
        (WebCore::RenderThemeChromiumWin::sliderTickOffsetFromTrackCenter):
        (WebCore::RenderThemeChromiumWin::paintSliderTrack):
        (WebCore::RenderThemeChromiumWin::paintSliderThumb):
        * rendering/RenderThemeChromiumWin.h:
        (RenderThemeChromiumWin):
        * rendering/RenderThemeMac.h:
        (RenderThemeMac):
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintSliderTrack):
        (WebCore):
        (WebCore::RenderThemeMac::sliderTickSize):
        (WebCore::RenderThemeMac::sliderTickOffsetFromTrackCenter):

2012-07-18  Shinya Kawanaka  <shinyak@chromium.org>

        Element wants to have userAgentShadowRoot()
        https://bugs.webkit.org/show_bug.cgi?id=91564

        Reviewed by Eric Carlson.

        We introduce Element::userAgentShadowRoot() to return a UserAgentShadowRoot.
        It returns the oldest shadow root if any, and checks the type of ShadowRoot in debug build.

        Previously, we have used elementShadow()->oldestShadowRoot() to get UserAgentShadowRoot.
        The class implementor will know the oldest shadow root is UserAgentShadowRoot, but it is not
        clear for the other people. This method will make the code intention clearer.

        We will introduce userAgentShadowRoot to the other elements (e.g. HTMLInputElement) after this patch.

        No new tests, simple refactoring.

        * dom/Element.cpp:
        (WebCore::Element::userAgentShadowRoot):
        (WebCore):
        * dom/Element.h:
        (Element):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::createShadowSubtree):
        (WebCore::HTMLMediaElement::willAddAuthorShadowRoot):
        (WebCore::HTMLMediaElement::mediaControls):
        (WebCore::HTMLMediaElement::hasMediaControls):
        (WebCore::HTMLMediaElement::createMediaControls):

2012-07-18  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        [CMAKE] Remove duplicated #ifdef guard in CMakeLists.txt
        https://bugs.webkit.org/show_bug.cgi?id=91575

        Reviewed by Dirk Pranke.

        CMake files have used ENABLE_XXX macro. However, almost source and idl files are already protected by #ifdef.
        So, we don't need to guard them in CMake files again.

        In SVG idl files case, blackberry port doesn't support it yet. So, SVG idl files are handled by WebCore_SVG_IDL_FILES macro.

        No new tests. This patch isn't for functionality.

        * CMakeLists.txt:
        * PlatformBlackBerry.cmake: Change SVG_IDL_FILES with WebCore_SVG_IDL_FILES.

2012-07-18  Hironori Bono  <hbono@chromium.org>

        Move contents right when a vertical scrollbar is shown at the left side of an RTL element.
        https://bugs.webkit.org/show_bug.cgi?id=85856

        Reviewed by Hajime Morita.

        This change prevents the scrollWidth value from being cropped by the width of a
        scrollbar when a vertical scrollbar is shown at the left side of an RTL element.
        This change also increases the clientLeft value by this scrollbar width and move
        contents right to improve compliance with CSSOM <http://www.w3.org/TR/cssom-view>.

        Tests: scrollbars/rtl/div-horizontal.html
               scrollbars/rtl/div-vertical.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::paintObject): Move contents to the right.
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::topLeftLocationOffset): Move the top-left corner to the right to prevent WebKit from cropping scrollWidth.
        * rendering/RenderBox.h:
        (WebCore::RenderBox::clientLeft): Increase clientLeft by the width of a scrollbar.

2012-07-18  Kent Tamura  <tkent@chromium.org>

        Form state restore: Classify form control sates by owners in internal and serialized representations
        https://bugs.webkit.org/show_bug.cgi?id=91594

        Reviewed by Hajime Morita.

        Before this change, the internal representation of form control states
        was a map like:

            {name, type, formKey} -> [FormControlState, FormControlState, ...]

        Also, the serialized representation was:

            [name, type, formKey, FormControlState,
             name, type, formKey, formControlState,
             ...]

        This changes these represenations. The internal representation is

            A map owned by FormController:
                formKey -> SavedFormState
            SavedFormState owns a map like:
                {name, type} -> [FormControlState, FormControlState, ...]

        The serialized representation is:

            [formKey, count,
             name, type, FormControlState,
             name, type, FormControlState,
             name, type, FormControlState,
             ....
             formKey, count,
             name, type, FormControlState,
             name, type, FormControlState,
             name, type, FormControlState,
             ....]

        The serialized representation would be smaller in many cases because
        each of items doesn't have formKey.

        Tests: Covered by fast/forms/state-restore-broken-state.html,
        state-restore-per-form.html, and state-restore-skip-stateless.html.

        * html/FormController.cpp:
        (FormElementKey): Remove formKey argument and m_formKey.
        (WebCore::FormElementKey::FormElementKey):
        (WebCore::FormElementKey::operator=):
        (WebCore::FormElementKey::ref):
        (WebCore::FormElementKey::deref):
        (WebCore::operator==):

        (SavedFormState):
         - The role of SavedFromState was changed. It represented all of control
          states. Now it represent control states owned by a signle form.
         - Make this non-copyable and fast-allocated.
         - Add m_controlStateCount, a counter of FormControlState
        (WebCore::SavedFormState::SavedFormState):
         Initialize m_controlStateCount.
        (WebCore::isNotFormControlTypeCharacter):
        Moved from another place in this file.
        (WebCore::SavedFormState::deserialize):
        Added. Build a SavedFromState with the specified stateVector.
        (WebCore::SavedFormState::serializeTo):
        Added. m_controlStateCount is needed here.
        (WebCore::SavedFormState::appendControlState):
         - Remove formKey arguement.
         - Update m_controlStateCount.
        (WebCore::SavedFormState::takeControlState): ditto.

        (WebCore::formStateSignature): Bump the version.
        (WebCore::FormController::createSavedFormStateMap):
        Added. Build a SavedFormStateMap from the form control list. This is a
        helper for formElementsState, and classifies controls in the document.
        (WebCore::FormController::formElementsState):
        Build a SavedFormStateMap with createSavedFormStateMap(),
        then serializes it.
        (WebCore::FormController::setStateForNewFormElements):
        Deserialize SavedFormState, and build SavedFormStateMap.
        (WebCore::FormController::takeStateForFormElement):
        Finds the corresponding SavedFormState with a formKey, and uses it.
        * html/FormController.h:
        Declare createSavedFormStateMap(), and moved typedefs for it.

2012-07-18  Antoine Labour  <piman@chromium.org>

        [chromium] Introduce CCResourceProvider, replacing TextureAllocator and hiding textures from clients to allow transport
        https://bugs.webkit.org/show_bug.cgi?id=91044

        Reviewed by Adrienne Walker.

        This does several things:
        - Add a CCResourceProvider class, that hides textures and the 3D context
        from layers (except those that need it). Instead layers manage
        "resources". In the future, resources are expected to be transportable
        to a "parent" CCResourceProvider to allow flattening of nested
        compositors.
        - Replace texture ids by resource ids in DrawQuads (allowing them to be
        serializable).
        - Replace TextureAllocator uses by the CCResourceProvider class.
        - Upload of data is done through the CCResourceProvider instead of
        explicit GL calls.
        - External textures are wrapped into a resource at draw time (see
        caveat/FIXME in CCTextureLayerImpl).
        - Rendering with the resources is done through an explicit
        beginRenderFrom/endRenderFrom that exposes the texture only between that
        pair.
        - Merge all the LayerTextureSubImage instances (one per layer), into a
        single instance on the CCResourceProvider.

        Added CCResourceProviderTest, the refactoring is covered by existing tests.

        * WebCore.gypi:
        * platform/chromium/support/WebCompositorTextureQuad.cpp:
        (WebKit::WebCompositorTextureQuad::create):
        (WebKit::WebCompositorTextureQuad::WebCompositorTextureQuad):
        * platform/chromium/support/WebCompositorTileQuad.cpp:
        (WebKit::WebCompositorTileQuad::create):
        (WebKit::WebCompositorTileQuad::WebCompositorTileQuad):
        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
        (WebCore::BitmapCanvasLayerTextureUpdater::Texture::updateRect):
        (WebCore::BitmapCanvasLayerTextureUpdater::create):
        (WebCore::BitmapCanvasLayerTextureUpdater::BitmapCanvasLayerTextureUpdater):
        (WebCore::BitmapCanvasLayerTextureUpdater::prepareToUpdate):
        (WebCore::BitmapCanvasLayerTextureUpdater::updateTextureRect):
        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h:
        (WebCore):
        (Texture):
        (BitmapCanvasLayerTextureUpdater):
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::Texture::updateRect):
        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::create):
        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::BitmapSkPictureCanvasLayerTextureUpdater):
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
        (Texture):
        (BitmapSkPictureCanvasLayerTextureUpdater):
        * platform/graphics/chromium/ContentLayerChromium.cpp:
        (WebCore::ContentLayerChromium::createTextureUpdaterIfNeeded):
        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::createAcceleratedCanvas):
        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::Texture::updateRect):
        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h:
        (Texture):
        (FrameBufferSkPictureCanvasLayerTextureUpdater):
        * platform/graphics/chromium/ImageLayerChromium.cpp:
        (WebCore::ImageLayerTextureUpdater::create):
        (WebCore::ImageLayerTextureUpdater::updateTextureRect):
        (WebCore::ImageLayerTextureUpdater::ImageLayerTextureUpdater):
        (ImageLayerTextureUpdater):
        (WebCore::ImageLayerChromium::createTextureUpdaterIfNeeded):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::create):
        (WebCore::LayerRendererChromium::LayerRendererChromium):
        (WebCore::LayerRendererChromium::decideRenderPassAllocationsForFrame):
        (WebCore::applyFilters):
        (WebCore::LayerRendererChromium::drawBackgroundFilters):
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
        (WebCore::LayerRendererChromium::drawTileQuad):
        (WebCore::LayerRendererChromium::drawYUVVideoQuad):
        (WebCore::LayerRendererChromium::drawTextureQuad):
        (WebCore::LayerRendererChromium::drawIOSurfaceQuad):
        (WebCore::LayerRendererChromium::drawHeadsUpDisplay):
        (WebCore::LayerRendererChromium::finishDrawingFrame):
        (WebCore::LayerRendererChromium::getFramebufferTexture):
        (WebCore::LayerRendererChromium::useRenderPass):
        (WebCore::LayerRendererChromium::useScopedTexture):
        (WebCore::LayerRendererChromium::bindFramebufferToTexture):
        (WebCore::LayerRendererChromium::finishCurrentFramebuffer):
        (WebCore):
        (WebCore::LayerRendererChromium::initializeSharedObjects):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        (WebCore::LayerRendererChromium::resourceProvider):
        * platform/graphics/chromium/LayerTextureSubImage.cpp:
        (WebCore::LayerTextureSubImage::LayerTextureSubImage):
        (WebCore::LayerTextureSubImage::upload):
        (WebCore::LayerTextureSubImage::uploadWithTexSubImage):
        (WebCore::LayerTextureSubImage::uploadWithMapTexSubImage):
        * platform/graphics/chromium/LayerTextureSubImage.h:
        (WebKit):
        (LayerTextureSubImage):
        * platform/graphics/chromium/LayerTextureUpdater.h:
        (WebCore):
        (Texture):
        * platform/graphics/chromium/ManagedTexture.cpp:
        (WebCore::ManagedTexture::ManagedTexture):
        (WebCore::ManagedTexture::reserve):
        (WebCore::ManagedTexture::allocate):
        (WebCore::ManagedTexture::steal):
        (WebCore::ManagedTexture::clear):
        * platform/graphics/chromium/ManagedTexture.h:
        (WebCore::ManagedTexture::resourceId):
        (ManagedTexture):
        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        (WebCore::ScrollbarLayerChromium::pushPropertiesTo):
        (WebCore::ScrollbarLayerChromium::createTextureUpdaterIfNeeded):
        * platform/graphics/chromium/TextureCopier.cpp:
        (WebCore::AcceleratedTextureCopier::copyTexture):
        (WebCore):
        (WebCore::AcceleratedTextureCopier::flush):
        * platform/graphics/chromium/TextureCopier.h:
        (TextureCopier):
        (AcceleratedTextureCopier):
        * platform/graphics/chromium/TextureManager.cpp:
        (WebCore::TextureManager::TextureManager):
        (WebCore::TextureManager::deleteEvictedTextures):
        (WebCore::TextureManager::removeTexture):
        (WebCore::TextureManager::allocateTexture):
        (WebCore::TextureManager::requestTexture):
        * platform/graphics/chromium/TextureManager.h:
        (WebCore):
        (WebCore::TextureManager::create):
        (TextureManager):
        (TextureInfo):
        (EvictionEntry):
        * platform/graphics/chromium/TextureUploader.h:
        (TextureUploader):
        * platform/graphics/chromium/ThrottledTextureUploader.cpp:
        (WebCore::ThrottledTextureUploader::uploadTexture):
        * platform/graphics/chromium/ThrottledTextureUploader.h:
        (ThrottledTextureUploader):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::pushPropertiesTo):
        * platform/graphics/chromium/TrackingTextureAllocator.cpp: Removed.
        * platform/graphics/chromium/TrackingTextureAllocator.h: Removed.
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
        (WebCore::CCHeadsUpDisplay::draw):
        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
        (WebCore::CCIOSurfaceLayerImpl::willDraw):
        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.h:
        (CCIOSurfaceLayerImpl):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::willDraw):
        (WebCore::CCLayerImpl::didDraw):
        (WebCore::CCLayerImpl::contentsResourceId):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
        (WebCore::CCLayerTreeHost::deleteContentsTexturesOnImplThread):
        (WebCore::CCLayerTreeHost::beginCommitOnImplThread):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore):
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::CCLayerTreeHostImpl::releaseContentsTextures):
        (WebCore::CCLayerTreeHostImpl::didDrawAllLayers):
        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (WebCore):
        (WebCore::CCLayerTreeHostImpl::resourceProvider):
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCPrioritizedTexture.cpp:
        (WebCore::CCPrioritizedTexture::acquireBackingTexture):
        (WebCore::CCPrioritizedTexture::resourceId):
        (WebCore::CCPrioritizedTexture::upload):
        (WebCore::CCPrioritizedTexture::beginRenderTo):
        (WebCore::CCPrioritizedTexture::endRenderTo):
        (WebCore):
        * platform/graphics/chromium/cc/CCPrioritizedTexture.h:
        (WebCore):
        (CCPrioritizedTexture):
        (WebCore::CCPrioritizedTexture::Backing::resourceId):
        (WebCore::CCPrioritizedTexture::Backing::Backing):
        (Backing):
        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.cpp:
        (WebCore::CCPrioritizedTextureManager::CCPrioritizedTextureManager):
        (WebCore::CCPrioritizedTextureManager::~CCPrioritizedTextureManager):
        (WebCore::CCPrioritizedTextureManager::acquireBackingTextureIfNeeded):
        (WebCore::CCPrioritizedTextureManager::reduceMemory):
        (WebCore::CCPrioritizedTextureManager::clearAllMemory):
        (WebCore::CCPrioritizedTextureManager::allBackingTexturesWereDeleted):
        (WebCore::CCPrioritizedTextureManager::createBacking):
        (WebCore::CCPrioritizedTextureManager::destroyBacking):
        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.h:
        (WebCore::CCPrioritizedTextureManager::create):
        (CCPrioritizedTextureManager):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
        (WebCore::CCRenderPassDrawQuad::create):
        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
        (CCRenderPassDrawQuad):
        (WebCore::CCRenderPassDrawQuad::maskResourceId):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::appendQuads):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (WebCore):
        (CCRenderer):
        * platform/graphics/chromium/cc/CCResourceProvider.cpp: Added.
        (WebCore):
        (WebCore::textureToStorageFormat):
        (WebCore::isTextureFormatSupportedForStorage):
        (WebCore::CCResourceProvider::create):
        (WebCore::CCResourceProvider::~CCResourceProvider):
        (WebCore::CCResourceProvider::graphicsContext3D):
        (WebCore::CCResourceProvider::inUseByConsumer):
        (WebCore::CCResourceProvider::createResource):
        (WebCore::CCResourceProvider::createResourceFromExternalTexture):
        (WebCore::CCResourceProvider::deleteResource):
        (WebCore::CCResourceProvider::deleteOwnedResources):
        (WebCore::CCResourceProvider::upload):
        (WebCore::CCResourceProvider::beginRenderTo):
        (WebCore::CCResourceProvider::endRenderTo):
        (WebCore::CCResourceProvider::beginRenderFrom):
        (WebCore::CCResourceProvider::endRenderFrom):
        (WebCore::CCResourceProvider::CCResourceProvider):
        (WebCore::CCResourceProvider::initialize):
        * platform/graphics/chromium/cc/CCResourceProvider.h: Added.
        (WebKit):
        (WebCore):
        (CCResourceProvider):
        (WebCore::CCResourceProvider::maxTextureSize):
        (WebCore::CCResourceProvider::numResources):
        (Resource):
        * platform/graphics/chromium/cc/CCScopedTexture.cpp:
        (WebCore::CCScopedTexture::CCScopedTexture):
        (WebCore::CCScopedTexture::allocate):
        (WebCore::CCScopedTexture::free):
        * platform/graphics/chromium/cc/CCScopedTexture.h:
        (WebCore::CCScopedTexture::create):
        (CCScopedTexture):
        (WebCore::CCScopedTexture::beginRenderTo):
        (WebCore::CCScopedTexture::endRenderTo):
        (WebCore::CCScopedTexture::beginRenderFrom):
        (WebCore::CCScopedTexture::endRenderFrom):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
        (WebCore::CCScrollbarLayerImpl::CCScrollbarLayerImpl):
        (WebCore):
        (WebCore::CCScrollbarLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
        (WebCore::CCScrollbarLayerImpl::setBackTrackResourceId):
        (WebCore::CCScrollbarLayerImpl::setForeTrackResourceId):
        (WebCore::CCScrollbarLayerImpl::setThumbResourceId):
        (CCScrollbarLayerImpl):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::recreateContext):
        (WebCore::CCSingleThreadProxy::doCommit):
        (WebCore::CCSingleThreadProxy::stop):
        * platform/graphics/chromium/cc/CCTexture.h:
        (WebCore::CCTexture::id):
        (WebCore::CCTexture::setId):
        (CCTexture):
        * platform/graphics/chromium/cc/CCTextureLayerImpl.cpp:
        (WebCore::CCTextureLayerImpl::CCTextureLayerImpl):
        (WebCore::CCTextureLayerImpl::willDraw):
        (WebCore):
        (WebCore::CCTextureLayerImpl::appendQuads):
        (WebCore::CCTextureLayerImpl::didDraw):
        * platform/graphics/chromium/cc/CCTextureLayerImpl.h:
        (CCTextureLayerImpl):
        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:
        (WebCore::CCTextureUpdater::update):
        * platform/graphics/chromium/cc/CCTextureUpdater.h:
        (WebCore):
        (CCTextureUpdater):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::scheduledActionUpdateMoreResources):
        (WebCore::CCThreadProxy::layerTreeHostClosedOnImplThread):
        (WebCore::CCThreadProxy::recreateContextOnImplThread):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
        (WebCore::DrawableTile::resourceId):
        (WebCore::DrawableTile::setResourceId):
        (WebCore::DrawableTile::DrawableTile):
        (DrawableTile):
        (WebCore::CCTiledLayerImpl::contentsResourceId):
        (WebCore::CCTiledLayerImpl::hasTextureIdForTileAt):
        (WebCore::CCTiledLayerImpl::appendQuads):
        (WebCore::CCTiledLayerImpl::pushTileProperties):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
        (CCTiledLayerImpl):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::CCVideoLayerImpl):
        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
        (WebCore::CCVideoLayerImpl::willDraw):
        (WebCore::CCVideoLayerImpl::willDrawInternal):
        (WebCore::CCVideoLayerImpl::appendQuads):
        (WebCore::CCVideoLayerImpl::didDraw):
        (WebCore::CCVideoLayerImpl::FramePlane::allocateData):
        (WebCore::CCVideoLayerImpl::FramePlane::freeData):
        (WebCore::CCVideoLayerImpl::allocatePlaneData):
        (WebCore::CCVideoLayerImpl::copyPlaneData):
        (WebCore::CCVideoLayerImpl::freePlaneData):
        (WebCore::CCVideoLayerImpl::freeUnusedPlaneData):
        (WebCore::CCVideoLayerImpl::didLoseContext):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
        (CCVideoLayerImpl):
        (FramePlane):
        (WebCore::CCVideoLayerImpl::FramePlane::FramePlane):

2012-07-18  Hayato Ito  <hayato@chromium.org>

        [Shadow] A 'selectstart' event fired on distributed nodes should not be stopped at shadow boundary of the parent shadow host.
        https://bugs.webkit.org/show_bug.cgi?id=90508

        Reviewed by Dimitri Glazkov.

        We should not stop some kinds of events at the shadow boundary of a shadow host if the
        event is fired on distributed nodes.

        See the spec for such kinds of events.
        http://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#events-that-are-always-stopped

        Test: fast/dom/shadow/events-stopped-at-shadow-boundary.html

        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::ensureEventAncestors):
        (WebCore::inTheSameScope):
        (WebCore):
        (WebCore::EventDispatcher::determineDispatchBehavior):
        * dom/EventDispatcher.h:
        (EventDispatcher):

2012-07-18  Julien Chaffraix  <jchaffraix@webkit.org>

        Crash in RenderTableSection::addCell.
        http://webkit.org/b/89496

        Reviewed by Abhishek Arya.

        The issue comes from RenderBox::splitAnonymousBoxesAroundChild that would move sections
        across tables but didn't force the table to do a synchronous section recalc. This opened
        the way for race conditions where we would query the table column structure while it's dirty
        (this is not uncommon but as usually the table's column representation is always bigger or
        more split than a section's, it's usually harmless).

        The fix is to force a synchronous section recalc.

        Test: fast/table/split-table-no-section-update-crash.html

        * rendering/RenderBox.cpp:
        (WebCore::markBoxForRelayoutAfterSplit):
        Changed to call forceSectionsRecalc ie force a section recalc.

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::recalcSections):
        Added missing ASSERT for unneeded calls.

        * rendering/RenderTable.h:
        (WebCore::RenderTable::forceSectionsRecalc):
        Added this helper function.

2012-07-18  Julien Chaffraix  <jchaffraix@webkit.org>

        Avoid calling GraphicsContext drawing primitives for 0px borders
        https://bugs.webkit.org/show_bug.cgi?id=90039

        Reviewed by Eric Seidel.

        The current code would happily call GraphicsContext to draw empty (0px) borders.
        There is no good use case for going all the way to GraphicsContext in this case as
        0px borders, regardless of the border-style, will not be painted. Thus this is a waste
        of time on all platforms. On Chromium, this trigger some issues with pdf rendering as
        Skia interprets 0px lines as very thin lines.

        This change adds 0-checks in the border painting code as well as ASSERTs for
        performance and to catch future bad use.

        Test: fast/borders/0px-borders.html

        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::drawRect):
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::drawRect):
        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
        (WebCore::GraphicsContext::drawRect):
        * platform/graphics/qt/GraphicsContextQt.cpp:
        (WebCore::GraphicsContext::drawRect):
        * platform/graphics/skia/GraphicsContextSkia.cpp:
        (WebCore::GraphicsContext::drawRect):
        * platform/graphics/wx/GraphicsContextWx.cpp:
        (WebCore::GraphicsContext::drawRect):
        Added an ASSERT on all platforms to catch incorrect use.

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::BorderEdge::shouldRender):
        Changed to not render 0px borders, which should avoid unneeded work
        in the patining code (context saving / restoring or transparency layer
        push).

        (WebCore::RenderBoxModelObject::paintOneBorderSide):
        Added an ASSERT here that the border side is not empty.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::drawLineForBoxSide):
        Added an early return with a comment as to why it's not feasible to
        ASSERT as would be best.

2012-07-18  Elliott Sprehn  <esprehn@gmail.com>

        REGRESSION (r89900): Assertion failure on null view() when destroying the document
        https://bugs.webkit.org/show_bug.cgi?id=91547

        Reviewed by Abhishek Arya.

        Check for document destruction during insertion to avoid crash on null RenderView when trying
        to count the number of RenderQuote and RenderCounter objects.

        Test: fast/css-generated-content/bug91547.html

        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::appendChildNode):
        (WebCore::RenderObjectChildList::insertChildNode):

2012-07-18  Nat Duca  <nduca@chromium.org>

        [chromium] Add histogram for tracking compositor-thread frame rate
        https://bugs.webkit.org/show_bug.cgi?id=91692

        Reviewed by Adrienne Walker.

        This patch tracks the interval between compositor thread frames
        and pushes it into a platform histogram. This allows us to track
        compositor-thread frame rate in the wild.

        * platform/graphics/chromium/cc/CCFrameRateCounter.cpp:
        (WebCore::CCFrameRateCounter::markBeginningOfFrame):

2012-07-18  Dan Bernstein  <mitz@apple.com>

        Hit testing in the gap between pages returns incorrect results
        https://bugs.webkit.org/show_bug.cgi?id=91695

        Reviewed by Dave Hyatt.

        Test: fast/multicol/hit-test-gap-between-pages.html

        * rendering/RenderBlock.h:
        (RenderBlock): Promoted adjustPointToColumnContents from private to protected.
        * rendering/RenderView.cpp:
        (WebCore::RenderView::updateHitTestResult): If we get here, and we make the document element
        the inner node, adjust the local point for columns.

2012-07-18  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Direction parameter ignored by some openCursor() overloads
        https://bugs.webkit.org/show_bug.cgi?id=91687

        Reviewed by Tony Chang.

        A few of the openCursor() and openKeyCursor() overloads were not passing along the
        direction parameter, resulting in the default direction being used. Trivial fixes.
        Also, added a whitespace fix to a relevant console warning.

        Test: storage/indexeddb/cursor-overloads.html

        * Modules/indexeddb/IDBIndex.cpp:
        (WebCore::IDBIndex::openCursor):
        (WebCore::IDBIndex::openKeyCursor):
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::openCursor):

2012-07-18  Erik Arvidsson  <arv@chromium.org>

        [V8] Improve Replaceable extended attribute
        https://bugs.webkit.org/show_bug.cgi?id=91668

        Reviewed by Adam Barth.

        Replaceable is working by chance in the V8 bindings because V8 does not correctly handle
        read only properties on the prototype chain. With this change we generate a setter that
        uses ForceSet to replace the existing property when set.

        Test: fast/dom/Window/replaceable.html

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateReplaceableAttrSetter):
        (GenerateFunctionCallback):
        (GenerateSingleBatchedAttribute):
        (GenerateImplementation):
        * bindings/scripts/test/CPP/WebDOMTestObj.cpp:
        (WebDOMTestObj::replaceableAttribute):
        * bindings/scripts/test/CPP/WebDOMTestObj.h:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_get_property):
        (webkit_dom_test_obj_class_init):
        (webkit_dom_test_obj_get_replaceable_attribute):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore):
        (WebCore::jsTestObjReplaceableAttribute):
        (WebCore::setJSTestObjReplaceableAttribute):
        * bindings/scripts/test/JS/JSTestObj.h:
        (WebCore):
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj replaceableAttribute]):
        (-[DOMTestObj setReplaceableAttribute:]):
        * bindings/scripts/test/TestObj.idl:
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::replaceableAttributeAttrGetter):
        (TestObjV8Internal):
        (WebCore::TestObjV8Internal::TestObjReplaceableAttrSetter):
        (WebCore):

2012-07-18  Erik Arvidsson  <arv@chromium.org>

        [V8] Remove temporary flag override for es52_globals
        https://bugs.webkit.org/show_bug.cgi?id=91681

        Reviewed by Adam Barth.

        V8 has now changed their default value for the es52_globals so we no longer needs this override.

        No new tests. No change in functionality.

        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::V8DOMWindowShell::initContextIfNeeded):
        * bindings/v8/WorkerContextExecutionProxy.cpp:
        (WebCore::WorkerContextExecutionProxy::initIsolate):

2012-07-18  Alexandre Elias  <aelias@google.com>

        [chromium] Ubercomp: add id to SharedQuadState
        https://bugs.webkit.org/show_bug.cgi?id=91670

        Reviewed by Adrienne Walker.

        This assigns an integer ID to SharedQuadState objects and a
        corresponding ID to quads.  This ID is unique only within a
        RenderPass and currently is just set to the index in the shared quad
        state list.  This is redundant with the pointer and exists to
        simplify serialization.

        I found out that pointer rewriting within a pickler is blocked by
        pointers to memory being const there, so the reassignment will have to
        be performed in the application layer anyway.  In that case, it's
        simplest to add some ID integers.

        No new tests (will introduce them when making use of the ID).

        * platform/chromium/support/WebCompositorQuad.cpp:
        (WebKit::WebCompositorQuad::WebCompositorQuad):
        (WebKit::WebCompositorQuad::setSharedQuadState):
        (WebKit):
        * platform/chromium/support/WebCompositorSharedQuadState.cpp:
        (WebKit::WebCompositorSharedQuadState::WebCompositorSharedQuadState):
        (WebKit::WebCompositorSharedQuadState::create):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::createSharedQuadState):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::appendQuadsForLayer):
        (WebCore::CCRenderPass::appendQuadsForRenderSurfaceLayer):
        (WebCore::CCRenderPass::appendQuadsToFillScreen):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::createSharedQuadState):
        (WebCore::CCRenderSurface::createReplicaSharedQuadState):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (CCRenderSurface):

2012-07-18  Alexandre Elias  <aelias@google.com>

        [chromium] Ubercomp: clean up CCRenderer interface
        https://bugs.webkit.org/show_bug.cgi?id=91555

        Reviewed by Adrienne Walker.

        I replaced the one-by-one RenderPass calls with a new drawFrame()
        method that directly takes a CCRenderPassList, and moved a small
        amount of code from CCLayerTreeHostImpl to implement it.  In ubercomp
        mode, we will produce a frame bundle rather than a command-stream, so
        the full list is easier to work with.

        Also, give empty default implementations for the methods that don't
        need to do anything in a non-GL context, and make private
        setScissorToRect.

        No new tests (no-op refactoring).

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawFrame):
        (WebCore):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::drawLayers):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (WebCore::CCRenderer::viewportChanged):
        (WebCore::CCRenderer::decideRenderPassAllocationsForFrame):
        (WebCore::CCRenderer::haveCachedResourcesForRenderPassId):
        (CCRenderer):
        (WebCore::CCRenderer::finishDrawingFrame):
        (WebCore::CCRenderer::doNoOp):
        (WebCore::CCRenderer::isContextLost):

2012-07-18  Pravin D  <pravind.2k4@gmail.com>

        Content size of child having percent height inside a fixed height container having overflow:auto is wrongly calculated
        https://bugs.webkit.org/show_bug.cgi?id=11355

        Reviewed by Julien Chaffraix.

        The content height of a child must be container height minus padding, border width and height of horizontal scrollbar(if any).

        Tests: fast/overflow/child-100percent-height-inside-fixed-container-with-overflow-auto.html
               fast/overflow/replaced-child-100percent-height-inside-fixed-container-with-overflow-auto.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computePercentageLogicalHeight):
        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
        Subtracting the height of the scrollbar from the client height when the client has percentage height.

2012-07-18  Pravin D  <pravind.2k4@gmail.com>

        Content size of child having percent height inside a fixed height container having overflow:auto is wrongly calculated
        https://bugs.webkit.org/show_bug.cgi?id=11355

        Reviewed by Julien Chaffraix.

        The content height of a child must be container height minus padding, border width and height of horizontal scrollbar(if any).

        Tests: fast/overflow/child-100percent-height-inside-fixed-container-with-overflow-auto.html
               fast/overflow/replaced-child-100percent-height-inside-fixed-container-with-overflow-auto.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computePercentageLogicalHeight):
        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
        Subtracting the height of the scrollbar from the client height when the client has percentage height.

2012-07-18  Anantanarayanan G Iyengar  <ananta@chromium.org>

        [chromium] Ensure that the compositor code which is aware of flipped status of video-textures
        per platform sets the flipped bit to false on Windows.
        https://bugs.webkit.org/show_bug.cgi?id=91562
        
        Reviewed by Adrienne Walker.

        No new tests. (HW video decode is still only being tested manually for orientation)

        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::appendQuads):

2012-07-18  Emil A Eklund  <eae@chromium.org>

        Replace uses of RenderBox::x(), y() in rendering code with with point and size methods
        https://bugs.webkit.org/show_bug.cgi?id=91549

        Reviewed by Eric Seidel.

        Replaces uses of RenderBox::x() and RenderBox::y() with
        RenderBox::location(), RenderBox::locationOffset() and
        RenderBox::frameRect().

        No new tests, no change in functionality.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::layoutBlockChild):
        (WebCore::RenderBlock::positionNewFloats):
        Use child->frameRect() and child->location() instead of constructing a
        rect and size from the x, y, width and height values.       
        
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::repaintDuringLayoutIfMoved):
        Compare and copy m_frameRect directly instead of comparing and copying
        the individual values.
        
        (WebCore::RenderBox::localCaretRect):
        Use location() instead of x() and y().
        
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
        Use pixelSnappedIntSize and RenderBox::size() instead of computing and
        snapping the width and height separately.
        
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::nodeAtPoint):
        USe locationOffset() instead of creating a new LayoutSize object from the
        x() and y() values.
        
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::updateHitTestResult):
        Move by Size instead of x and y value.
        
        (WebCore::RenderInline::addFocusRingRects):
        Move by Size instead of x and y value.
        
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::offsetFromContainer):
        Shrink offset by size instead of using x and y values.
        
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::layoutRows):
        (WebCore::RenderTableSection::setLogicalPositionForCell):
        Use child->frameRect() and child->location() instead of constructing a
        rect and size from the x, y, width and height values.       

        * rendering/svg/SVGRenderTreeAsText.cpp:
        (WebCore::writeRenderSVGTextBox):
        Use location() instead of x() and y().

2012-07-18  Tony Chang  <tony@chromium.org>

        [chromium] Unreviewed, try to fix the chromium-win build after r123014.

        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:

2012-07-18  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Fix some coding style violations
        https://bugs.webkit.org/show_bug.cgi?id=91565

        Reviewed by Tony Chang.

        In declarations, put the * next to the type not the identifier.
        Remove k as a prefix for various constants.

        No new tests - no functional changes.

        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
        (WebCore::IDBCursorBackendImpl::prefetchContinueInternal):
        * Modules/indexeddb/IDBFactoryBackendImpl.cpp:
        (WebCore::computeFileIdentifier):
        * Modules/indexeddb/IDBKey.h:
        (WebCore::IDBKey::IDBKey):
        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
        (WebCore::IDBLevelDBBackingStore::getDatabaseNames):
        (WebCore::IDBLevelDBBackingStore::getIDBDatabaseMetaData):
        (WebCore::IDBLevelDBBackingStore::createIDBDatabaseMetaData):
        (WebCore::IDBLevelDBBackingStore::updateIDBDatabaseMetaData):
        (WebCore::IDBLevelDBBackingStore::deleteDatabase):
        (WebCore::IDBLevelDBBackingStore::getObjectStores):
        (WebCore::getNewObjectStoreId):
        (WebCore::IDBLevelDBBackingStore::createObjectStore):
        (WebCore::IDBLevelDBBackingStore::deleteObjectStore):
        (WebCore::getNewVersionNumber):
        (WebCore::IDBLevelDBBackingStore::nextAutoIncrementNumber):
        (WebCore::IDBLevelDBBackingStore::forEachObjectStoreRecord):
        (WebCore::IDBLevelDBBackingStore::getIndexes):
        (WebCore::getNewIndexId):
        (WebCore::IDBLevelDBBackingStore::createIndex):
        (WebCore::IDBLevelDBBackingStore::putIndexDataForRecord):
        (WebCore):
        * Modules/indexeddb/IDBLevelDBCoding.cpp:
        (IDBLevelDBCoding):
        (WebCore::IDBLevelDBCoding::maxIDBKey):
        (WebCore::IDBLevelDBCoding::minIDBKey):
        (WebCore::IDBLevelDBCoding::decodeVarInt):
        (WebCore::IDBLevelDBCoding::encodeIDBKey):
        (WebCore::IDBLevelDBCoding::decodeIDBKey):
        (WebCore::IDBLevelDBCoding::extractEncodedIDBKey):
        (WebCore::IDBLevelDBCoding::keyTypeByteToKeyType):
        (WebCore::IDBLevelDBCoding::compareEncodedIDBKeys):
        (WebCore::IDBLevelDBCoding::encodeIDBKeyPath):
        (WebCore::IDBLevelDBCoding::decodeIDBKeyPath):
        (WebCore::IDBLevelDBCoding::compare):
        (WebCore::IDBLevelDBCoding::KeyPrefix::KeyPrefix):
        (WebCore::IDBLevelDBCoding::KeyPrefix::encode):
        (WebCore::IDBLevelDBCoding::KeyPrefix::compare):
        (WebCore::IDBLevelDBCoding::KeyPrefix::type):
        (WebCore::IDBLevelDBCoding::SchemaVersionKey::encode):
        (WebCore::IDBLevelDBCoding::MaxDatabaseIdKey::encode):
        (WebCore::IDBLevelDBCoding::DatabaseFreeListKey::decode):
        (WebCore::IDBLevelDBCoding::DatabaseFreeListKey::encode):
        (WebCore::IDBLevelDBCoding::DatabaseNameKey::decode):
        (WebCore::IDBLevelDBCoding::DatabaseNameKey::encode):
        (WebCore::IDBLevelDBCoding::ObjectStoreMetaDataKey::decode):
        (WebCore::IDBLevelDBCoding::ObjectStoreMetaDataKey::encode):
        (WebCore::IDBLevelDBCoding::ObjectStoreMetaDataKey::encodeMaxKey):
        (WebCore::IDBLevelDBCoding::IndexMetaDataKey::decode):
        (WebCore::IDBLevelDBCoding::IndexMetaDataKey::encode):
        (WebCore::IDBLevelDBCoding::IndexMetaDataKey::encodeMaxKey):
        (WebCore::IDBLevelDBCoding::ObjectStoreFreeListKey::decode):
        (WebCore::IDBLevelDBCoding::ObjectStoreFreeListKey::encode):
        (WebCore::IDBLevelDBCoding::IndexFreeListKey::decode):
        (WebCore::IDBLevelDBCoding::IndexFreeListKey::encode):
        (WebCore::IDBLevelDBCoding::ObjectStoreNamesKey::decode):
        (WebCore::IDBLevelDBCoding::ObjectStoreNamesKey::encode):
        (WebCore::IDBLevelDBCoding::IndexNamesKey::decode):
        (WebCore::IDBLevelDBCoding::IndexNamesKey::encode):
        (WebCore::IDBLevelDBCoding::ObjectStoreDataKey::decode):
        (WebCore::IDBLevelDBCoding::ObjectStoreDataKey::encode):
        (WebCore::IDBLevelDBCoding::ExistsEntryKey::decode):
        (WebCore::IDBLevelDBCoding::ExistsEntryKey::encode):
        (WebCore::IDBLevelDBCoding::IndexDataKey::decode):
        * Modules/indexeddb/IDBLevelDBCoding.h:
        (IDBLevelDBCoding):
        (ObjectStoreDataKey):
        (ExistsEntryKey):

2012-07-18  Mark Pilgrim  <pilgrim@chromium.org>

        [Chromium] Call SQLiteFileSystem-related functions directly
        https://bugs.webkit.org/show_bug.cgi?id=91631

        Reviewed by Adam Barth.

        Part of a refactoring series. See tracking bug 82948.

        * Modules/webdatabase/chromium/QuotaTracker.cpp:
        (WebCore::QuotaTracker::getDatabaseSizeAndSpaceAvailableToOrigin):
        * platform/chromium/PlatformSupport.h:
        (PlatformSupport):
        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
        (WebCore::SQLiteFileSystem::deleteDatabaseFile):
        (WebCore::SQLiteFileSystem::getDatabaseFileSize):
        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:

2012-07-18  Oliver Hunt  <oliver@apple.com>

        WebKit provides APIs that make it possible for JSC to attempt to initialise the heap without initialising threading
        https://bugs.webkit.org/show_bug.cgi?id=91663

        Reviewed by Filip Pizlo.

        Initialising a JSGlobalData now requires us to have initialised JSC's threading
        logic, as that also initialises the JSC VM runtime options.  WebKit provides a
        number of routines that make use of commonJSGlobalData() that can be used before
        webcore has called the appropriate initialisation routine.  This patch makes the
        minimal change of ensuring that commonJSGlobalData initialises threading before
        attempting to create the common heap.

        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::commonJSGlobalData):

2012-07-18  Michael Saboff  <msaboff@apple.com>

        Make TextCodecUTF8 handle 8 bit data without converting to UChar's
        https://bugs.webkit.org/show_bug.cgi?id=90320

        Reviewed by Oliver Hunt.

        Change UTF8 Codec to produce 8-bit strings when data fits in 8-bit range.
        First we try decoding the string as all 8-bit and then fall back to 16 bit
        when we find the first character that doesn't fit in 8 bits.  Then we take
        the already decoded data and copy / convert it to a 16-bit buffer and then
        continue process the rest of the stream as 16-bits.

        No new tests, no change in functionality.

        * platform/text/TextCodecUTF8.cpp:
        (WebCore::TextCodecUTF8::handleError):
        (WebCore::TextCodecUTF8::decode):
        * platform/text/TextCodecUTF8.h:
        (TextCodecUTF8):

2012-07-18  Sailesh Agrawal  <sail@chromium.org>

        Chromium Mac: Add TEXTURE_RECTANGLE_ARB support to CCVideoLayerImpl
        https://bugs.webkit.org/show_bug.cgi?id=91169

        Reviewed by Adrienne Walker.

        This extends CCVideoLayerImpl to support TEXTURE_RECTANGLE_ARB. This texture target is used by the Mac hardware accelerated video decoder.

        No new tests (HW video decode on Mac is being tested manually.).

        * platform/chromium/support/WebCompositorIOSurfaceQuad.cpp:
        (WebKit::WebCompositorIOSurfaceQuad::create): Added an orientation argument.
        (WebKit::WebCompositorIOSurfaceQuad::WebCompositorIOSurfaceQuad): Added an orientation argument.
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawIOSurfaceQuad): Added support for non-flipped IOSurface textures.
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium): Changed TextureIOSurfaceProgram to be non-flipped. To draw flipped textures drawIOSurfaceQuad sets a different value for texTransformLocation.
        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
        (WebCore::CCIOSurfaceLayerImpl::appendQuads): Updated call to CCIOSurfaceDrawQuad constructor.
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::appendQuads): Added support for drawing TEXTURE_RECTANGLE_ARB textures.

2012-07-18  Michael Saboff  <msaboff@apple.com>

        Make TextCodecLatin1 handle 8 bit data without converting to UChar's
        https://bugs.webkit.org/show_bug.cgi?id=90319

        Reviewed by Oliver Hunt.

        Updated codec to create 8 bit strings where possible.
        We assume that the incoming stream can all be decoded as 8-bit values.
        If we find a 16-bit value, we take the already decoded data and
        copy / convert it to a 16-bit buffer and then continue process the rest
        of the stream as 16-bits.

        No new tests, functionality covered with existing tests.

        * platform/text/TextCodecASCIIFastPath.h:
        (WebCore::copyASCIIMachineWord):
        * platform/text/TextCodecLatin1.cpp:
        (WebCore::TextCodecLatin1::decode):

2012-07-18  Dimitri Glazkov  <dglazkov@chromium.org>

        Fix up old name in RuleSet::addRulesFromSheet
        https://bugs.webkit.org/show_bug.cgi?id=91646

        Reviewed by Andreas Kling.

        Simple parameter rename, no change in functionality.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList): Renamed styleSelector to resolver to reflect recent rename of the parameter type.

2012-07-18  Vincent Scheib  <scheib@chromium.org>

        Unify allowfullscreen logic in Document::webkitFullScreenEnabled and fullScreenIsAllowedForElement.
        https://bugs.webkit.org/show_bug.cgi?id=91448

        Reviewed by Adrienne Walker.

        Unifies redundant traversal logic and static cast previously used
        to determine if an element or document can be made fullscreen.
        This clean up prepares for pointer lock, which will use the same logic.

        Added a test to detect an edge case of an owning document with
        fullscreen permision moving an iframe to fullscreen, while that iframe
        does not have permision for its contents to be made fullscreen.

        Test: fullscreen/full-screen-iframe-without-allow-attribute-allowed-from-parent.html

        * dom/Document.cpp:
        (WebCore::isAttributeOnAllOwners):
        (WebCore::Document::fullScreenIsAllowedForElement):
        (WebCore::Document::webkitFullscreenEnabled):

2012-07-18  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] Add central error management to EFL port
        https://bugs.webkit.org/show_bug.cgi?id=91598

        Reviewed by Kenneth Rohde Christiansen.

        Define possible error types in ErrorsEfl so
        that we can reuse the header in both WebKit1
        and WebKit2. This is inspired from the GTK
        port.

        No new tests, no behavior change.

        * PlatformEfl.cmake:
        * platform/efl/ErrorsEfl.cpp: Added.
        (WebCore):
        (WebCore::cancelledError):
        (WebCore::blockedError):
        (WebCore::cannotShowURLError):
        (WebCore::interruptedForPolicyChangeError):
        (WebCore::cannotShowMIMETypeError):
        (WebCore::fileDoesNotExistError):
        (WebCore::pluginWillHandleLoadError):
        (WebCore::downloadNetworkError):
        (WebCore::downloadCancelledByUserError):
        (WebCore::downloadDestinationError):
        (WebCore::printError):
        (WebCore::printerNotFoundError):
        (WebCore::invalidPageRangeToPrint):
        * platform/efl/ErrorsEfl.h: Added.
        (WebCore):

2012-07-18  Varun Jain  <varunjain@chromium.org>

        [chromium] Fix crash in DragImageTest caused by r122996
        https://bugs.webkit.org/show_bug.cgi?id=91653

        Reviewed by Tony Chang.

        Covered by existing DragImageTest.

        * platform/chromium/DragImageChromiumSkia.cpp:
        (WebCore::deleteDragImage):

2012-07-18  Varun Jain  <varunjain@chromium.org>

        [chromium] Drag image for image elements should be scaled with device scale factor.
        https://bugs.webkit.org/show_bug.cgi?id=89688

        Reviewed by Adam Barth.

        Modified ManualTest: ManualTests/chromium/drag-image-accounts-for-device-scale.html

        * page/Frame.cpp:
        (WebCore::Frame::nodeImage):
        (WebCore::Frame::dragImageForSelection):
        * platform/chromium/DragImageChromiumSkia.cpp:
        (WebCore::dragImageSize):
        (WebCore::deleteDragImage):
        (WebCore::scaleDragImage):
        (WebCore::dissolveDragImageToFraction):
        (WebCore::createDragImageFromImage):
        * platform/chromium/DragImageRef.h:
        (DragImageChromium):
        (WebCore):
        * platform/graphics/skia/BitmapImageSingleFrameSkia.h:
        (BitmapImageSingleFrameSkia):
        * platform/graphics/skia/ImageBufferSkia.cpp:
        (WebCore::ImageBuffer::ImageBuffer):
        (WebCore::ImageBuffer::copyImage):
        * platform/graphics/skia/ImageSkia.cpp:
        (WebCore::BitmapImageSingleFrameSkia::BitmapImageSingleFrameSkia):
        (WebCore::BitmapImageSingleFrameSkia::create):
        * platform/graphics/skia/NativeImageSkia.cpp:
        (WebCore::NativeImageSkia::NativeImageSkia):
        * platform/graphics/skia/NativeImageSkia.h:
        (NativeImageSkia):
        (WebCore::NativeImageSkia::resolutionScale):

2012-07-18  Yong Li  <yoli@rim.com>

        [BlackBerry] Move about: URL handling out of WebCore
        https://bugs.webkit.org/show_bug.cgi?id=91541

        Reviewed by Rob Buis.

        Remove about URL handling from our NetworkJob.

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::NetworkJob):
        (WebCore::NetworkJob::initialize):
        (WebCore::NetworkJob::cancelJob):
        (WebCore::NetworkJob::sendResponseIfNeeded):
        * platform/network/blackberry/NetworkJob.h:
        (NetworkJob):
        * platform/network/blackberry/NetworkManager.cpp:
        (WebCore::NetworkManager::startJob):

2012-07-18  Tony Chang  <tony@chromium.org>

        Unreviewed, rolling out r122984.
        http://trac.webkit.org/changeset/122984
        https://bugs.webkit.org/show_bug.cgi?id=91171

        Broken the shared build, need to export a SkData in skia

        * platform/graphics/skia/GraphicsContextSkia.cpp:
        (WebCore::GraphicsContext::setURLForRect):

2012-07-18  Rob Buis  <rbuis@rim.com>

        Alignment crash in MIMESniffer
        https://bugs.webkit.org/show_bug.cgi?id=89787

        Reviewed by Yong Li.

        PR 169064

        Prevent ASSERT on unaligned data. Special-case handling of unaligned data
        to maskedCompareSlowCase.

        No test, too hard to reproduce.

        * platform/network/MIMESniffing.cpp:
        (std::maskedCompareSlowCase):
        (std):
        (std::maskedCompare):

2012-07-18  Steve VanDeBogart  <vandebo@chromium.org>

        Chrome/Skia: PDF print output does not have clickable links.
        https://bugs.webkit.org/show_bug.cgi?id=91171

        Reviewed by Stephen White.

        Connect GraphicsContext::setURLForRect to Skia's new API for annotations.

        Printing is not generally testable.

        * platform/graphics/skia/GraphicsContextSkia.cpp:
        (WebCore::GraphicsContext::setURLForRect):

2012-07-18  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] 0.11 build broken
        https://bugs.webkit.org/show_bug.cgi?id=91629

        Reviewed by Alexis Menard.

        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
        (webkitVideoSinkProposeAllocation): Pass null GstStructure to
        gst_query_add_allocation_meta(). Our propose-allocation method
        is simple enough to not need to set it.

2012-07-18  Chris Fleizach  <cfleizach@apple.com>

        AX: <input type="submit"> unlabelled.
        https://bugs.webkit.org/show_bug.cgi?id=91563

        Reviewed by Adele Peterson.

        Make sure the default value is returned if there is no other value specified.

        Test: platform/mac/accessibility/submit-button-default-value.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::title):

2012-07-17  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Remove awkward anchorPoint usage that implicity affects layer position
        https://bugs.webkit.org/show_bug.cgi?id=91472

        Reviewed by Adrienne Walker.

        Covered by existing layout tests and unit tests, several existing unit tests updated.

        In GraphicsLayerChromium, anchorPoint() implicity affects
        position(). Therefore, unit tests needed to remember to set
        anchorPoint correctly when trying to position layers for
        testing. However, it's easy to forget that initialization, and
        probably shouldn't be necessary anyway since conceptually
        anchorPoint does not affect layer position.

        This patch removes the "actualPosition + anchorPoint" quirk in
        GraphicsLayerChromium, so that this problem is avoided.

        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::updateLayerPosition): No longer computes position + anchorPoint. Instead this is done in calcDrawTransformsInternal.
        (WebCore::GraphicsLayerChromium::updateLayerSize): No longer affects computation of position.
        (WebCore::GraphicsLayerChromium::updateAnchorPoint): No longer affects computation of position
        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D): Position is initialized to zero instead of relative to anchorPoint
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateDrawTransformsInternal): explicitly use position + anchorPoint in this code, for both layer and replica.
            Note that replicaLayer now uses its own anchorPoint, which seems to be more consistent with Safari behavior.

2012-07-18  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: [Regression] Save as file is missing in Network panel preview/response tabs.
        https://bugs.webkit.org/show_bug.cgi?id=91625

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/HandlerRegistry.js:
        * inspector/front-end/NetworkPanel.js:

2012-07-18  Dirk Schulze  <krit@webkit.org>

        SVG CSS property types with <number> don't support exponents
        https://bugs.webkit.org/show_bug.cgi?id=52542

        Reviewed by Nikolas Zimmermann.

        Parse numbers in SVG presentation attributes with SVG parser to support scientific notations.
        The SVG parser is already well tested and has some extra checks for edge like protection from
        overflow.
        
        The patch is based upon a patch of Bear Travis.

        Test: svg/css/scientific-numbers.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::lex): Use SVG parser to parse numbers of SVG attributes.
        * svg/SVGParserUtilities.cpp:
        (WebCore::parseSVGNumber): Added accessor to call from CSSParser with double value.
        (WebCore):
        * svg/SVGParserUtilities.h:
        (WebCore):


2012-07-18  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: beautify the paused in debugger message, make it configurable from the front-end.
        https://bugs.webkit.org/show_bug.cgi?id=91628

        Reviewed by Vsevolod Vlasov.

        Made message smaller, using consistent font;
        Made message configurable from the front-end.

        * English.lproj/localizedStrings.js:
        * inspector/DOMNodeHighlighter.cpp:
        (WebCore::InspectorOverlay::InspectorOverlay):
        (WebCore::InspectorOverlay::setPausedInDebuggerMessage):
        (WebCore::InspectorOverlay::update):
        (WebCore::InspectorOverlay::drawPausedInDebugger):
        * inspector/DOMNodeHighlighter.h:
        (InspectorOverlay):
        * inspector/Inspector.json:
        * inspector/InspectorDebuggerAgent.cpp:
        (WebCore::InspectorDebuggerAgent::setOverlayMessage):
        (WebCore):
        (WebCore::InspectorDebuggerAgent::clear):
        * inspector/InspectorDebuggerAgent.h:
        (InspectorDebuggerAgent):
        * inspector/PageDebuggerAgent.cpp:
        (WebCore::PageDebuggerAgent::setOverlayMessage):
        * inspector/PageDebuggerAgent.h:
        (PageDebuggerAgent):
        * inspector/front-end/DebuggerModel.js:
        (WebInspector.DebuggerModel.prototype._setDebuggerPausedDetails):

2012-07-18  Douglas Stockwell  <dstockwell@chromium.org>

        WebCore::StylePropertySet::addParsedProperties - crash
        https://bugs.webkit.org/show_bug.cgi?id=91153

        Reviewed by Andreas Kling.

        WebKitCSSKeyframeRule::style exposed an immutable StylePropertySet.
        Modified to create a mutable copy on demand.

        Test: fast/css/css-keyframe-style-mutate-crash.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/WebKitCSSKeyframeRule.cpp:
        (WebCore::StyleKeyframe::mutableProperties): Added, creates a mutable copy of properties as required.
        (WebCore::WebKitCSSKeyframeRule::style):
        * css/WebKitCSSKeyframeRule.h:
        (WebCore::StyleKeyframe::properties): Made const, use mutableProperties to mutate.

2012-07-18  Huang Dongsung  <luxtella@company100.net>

        [Texmap] Make TextureMapperLayer clip m_state.needsDisplayRect with the layerRect.
        https://bugs.webkit.org/show_bug.cgi?id=91595

        Reviewed by Noam Rosenthal.

        Internal review by Kwang Yul Seo.

        Currently, TextureMapperLayer creates an ImageBuffer as big as
        m_state.needsDisplayRect if m_state.needsDispaly is false. The size of
        m_state.needsDisplayRect can be bigger than the size of the layerRect, so we may
        consume more memory than the size of the layerRect. It even can cause crash if
        m_state.needsDisplayRect is too big.

        No new tests, covered by existing tests.

        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::updateBackingStore):

2012-07-18  Jason Liu  <jason.liu@torchmobile.com.cn>

        [BlackBerry] We should update the status in NetworkJob if there is a new one from libcurl.
        https://bugs.webkit.org/show_bug.cgi?id=91475

        Reviewed by Yong Li.

        Libcurl sometimes sends multiple status messages, we need to keep the last 
        one in NetworkJob.
        We originally had the m_statusReceived check, then we found out that libcurl 
        sometimes sent additional 401 codes and added the 401 exception to the check, 
        and now we're removing the whole check(so we don't need the exception either).

        RIM PR# 163172
        Reviewed internally by Joe Mason.

        No new tests. This is caused by libcurl's multiple status messages.
        So we don't need to write a test case for webkit.

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::handleNotifyStatusReceived):

2012-07-18  Kevin Ellis  <kevers@chromium.org>

        TOUCH_ADJUSTMENT is too aggressive when snapping to large elements.
        https://bugs.webkit.org/show_bug.cgi?id=91262

        Reviewed by Antonio Gomes.

        Constrains the extent to which the touch point can be adjusted when
        generating synthetic mouse events when TOUCH_ADJUSTEMNT is enabled.
        Previously, the target position snapped to the center of the target
        element, which can be far removed from the touch position when tapping
        on or near a large element.  The refined strategy is to leave the
        adjusted position unchanged if tapping within the element or to snap
        to the center of the overlap region if the touch point lies outside the
        bounds of the element, but the touch area and element bounds overlap.
        For non-rectilineary bounds, a point lying outside the element boundary
        is pulled towards the center of the element, by an amount limited by
        the radius of the touch area.

        Tests: touchadjustment/big-div.html
               touchadjustment/rotated-node.html

        * page/TouchAdjustment.cpp:
        (WebCore::TouchAdjustment::contentsToWindow):
        (TouchAdjustment):
        (WebCore::TouchAdjustment::snapTo):
        (WebCore::TouchAdjustment::findNodeWithLowestDistanceMetric):

2012-07-18  Sergey Rogulenko  <rogulenko@google.com>

        Web Inspector: adding pause icon for JavaScript debugging
        https://bugs.webkit.org/show_bug.cgi?id=90880

        Reviewed by Pavel Feldman.

        Refactored DOMNodeHighlighter into InspectorOverlay class and added a feature to show a "pause" screen when
        the Javascript debugger is paused.

        * inspector/DOMNodeHighlighter.cpp:
        (WebCore::InspectorOverlay::InspectorOverlay):
        (WebCore::InspectorOverlay::paint):
        (WebCore::InspectorOverlay::drawOutline):
        (WebCore::InspectorOverlay::getHighlight):
        (WebCore::InspectorOverlay::setPausedInDebugger):
        (WebCore::InspectorOverlay::hideHighlight):
        (WebCore):
        (WebCore::InspectorOverlay::highlightNode):
        (WebCore::InspectorOverlay::setHighlightData):
        (WebCore::InspectorOverlay::clearHighlightData):
        (WebCore::InspectorOverlay::highlightedNode):
        (WebCore::InspectorOverlay::update):
        (WebCore::InspectorOverlay::drawHighlight):
        (WebCore::InspectorOverlay::drawPausedInDebugger):
        * inspector/DOMNodeHighlighter.h:
        (WebCore):
        (InspectorOverlay):
        (WebCore::InspectorOverlay::create):
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::drawHighlight):
        (WebCore::InspectorController::getHighlight):
        (WebCore::InspectorController::highlightedNode):
        * inspector/InspectorController.h:
        (WebCore):
        (InspectorController):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
        (WebCore::InspectorDOMAgent::~InspectorDOMAgent):
        (WebCore::InspectorDOMAgent::handleMousePress):
        (WebCore::InspectorDOMAgent::mouseDidMoveOverElement):
        (WebCore::InspectorDOMAgent::setSearchingForNode):
        (WebCore::InspectorDOMAgent::setHighlightDataFromConfig):
        (WebCore::InspectorDOMAgent::setInspectModeEnabled):
        (WebCore::InspectorDOMAgent::highlightRect):
        (WebCore::InspectorDOMAgent::highlightNode):
        (WebCore::InspectorDOMAgent::highlightFrame):
        (WebCore::InspectorDOMAgent::hideHighlight):
        * inspector/InspectorDOMAgent.h:
        (WebCore):
        (WebCore::InspectorDOMAgent::create):
        (InspectorDOMAgent):
        * inspector/InspectorDebuggerAgent.h:
        (InspectorDebuggerAgent):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::create):
        (WebCore::InspectorPageAgent::InspectorPageAgent):
        (WebCore::InspectorPageAgent::didPaint):
        * inspector/InspectorPageAgent.h:
        (WebCore):
        * inspector/PageDebuggerAgent.cpp:
        (WebCore::PageDebuggerAgent::create):
        (WebCore::PageDebuggerAgent::PageDebuggerAgent):
        (WebCore::PageDebuggerAgent::disable):
        (WebCore):
        (WebCore::PageDebuggerAgent::didPause):
        (WebCore::PageDebuggerAgent::didContinue):
        * inspector/PageDebuggerAgent.h:
        (WebCore):
        (PageDebuggerAgent):

2012-07-17  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: intern strings when processing timeline records
        https://bugs.webkit.org/show_bug.cgi?id=91531

        Reviewed by Pavel Feldman.

        - added StringPool that is capable of interning strings;
        - used it in TimelineModel to process all incoming records;

        * inspector/front-end/TimelineModel.js:
        (WebInspector.TimelineModel):
        (WebInspector.TimelineModel.prototype._addRecord):
        (WebInspector.TimelineModel.prototype.reset):
        * inspector/front-end/utilities.js:

2012-07-18  Scott Graham  <scottmg@chromium.org>

        Use cl to preprocess IDL for Chromium Windows generate_supplemental_dependency
        https://bugs.webkit.org/show_bug.cgi?id=91548

        Reviewed by Kentaro Hara.

        Use cl.exe as preprocessor for IDL files rather than cygwin gcc. Cuts
        two minute execution time on Windows by a bit better than 50%.

        No new tests.

        * WebCore.gyp/WebCore.gyp:
        * bindings/scripts/preprocessor.pm:
        (applyPreprocessor):

2012-07-18  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: remove search replace from behind experiment, polish the behavior
        https://bugs.webkit.org/show_bug.cgi?id=91519

        Reviewed by Vsevolod Vlasov.

        - This change makes replace loop with no boundary, removes the loop parameter
          from jumpToNext/Previous;
        - Lays out replace as a second row
        - Fixes replace all with no search matches
        - Splits Search and Search and Replace
        - Introduces explicit Next / Previous buttons in the search mode
        - Introduces editRange on the TextEditor so that it was preserving the undo stack
          (we'll need to fix editor so that it does not require it).

        * English.lproj/localizedStrings.js:
        * inspector/front-end/ConsolePanel.js:
        (WebInspector.ConsolePanel.prototype.performSearch):
        (WebInspector.ConsolePanel.prototype.jumpToNextSearchResult):
        (WebInspector.ConsolePanel.prototype.jumpToPreviousSearchResult):
        * inspector/front-end/ElementsPanel.js:
        (WebInspector.ElementsPanel.prototype.jumpToNextSearchResult):
        (WebInspector.ElementsPanel.prototype.jumpToPreviousSearchResult):
        * inspector/front-end/ExtensionPanel.js:
        (WebInspector.ExtensionPanel.prototype.performSearch):
        (WebInspector.ExtensionPanel.prototype.jumpToNextSearchResult):
        (WebInspector.ExtensionPanel.prototype.jumpToPreviousSearchResult):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.beforeTextChanged):
        * inspector/front-end/NetworkPanel.js:
        (WebInspector.NetworkLogView.prototype.jumpToPreviousSearchResult):
        (WebInspector.NetworkLogView.prototype.jumpToNextSearchResult):
        (WebInspector.NetworkPanel.prototype.jumpToPreviousSearchResult):
        (WebInspector.NetworkPanel.prototype.jumpToNextSearchResult):
        * inspector/front-end/Panel.js:
        (WebInspector.Panel.prototype.performSearch):
        (WebInspector.Panel.prototype.jumpToNextSearchResult):
        (WebInspector.Panel.prototype.jumpToPreviousSearchResult):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype.jumpToNextSearchResult):
        (WebInspector.ProfilesPanel.prototype.jumpToPreviousSearchResult):
        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.ResourcesPanel.prototype.jumpToNextSearchResult):
        (WebInspector.ResourcesPanel.prototype.jumpToPreviousSearchResult):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._editorClosed):
        (WebInspector.ScriptsPanel.prototype._editorSelected):
        (WebInspector.ScriptsPanel.prototype.performSearch.finishedCallback):
        (WebInspector.ScriptsPanel.prototype.performSearch):
        (WebInspector.ScriptsPanel.prototype.jumpToNextSearchResult):
        (WebInspector.ScriptsPanel.prototype.jumpToPreviousSearchResult):
        (WebInspector.ScriptsPanel.prototype.replaceSelectionWith):
        (WebInspector.ScriptsPanel.prototype.replaceAllWith):
        * inspector/front-end/SearchController.js:
        (WebInspector.SearchController):
        (WebInspector.SearchController.prototype.cancelSearch):
        (WebInspector.SearchController.prototype.resetSearch):
        (WebInspector.SearchController.prototype.handleShortcut):
        (WebInspector.SearchController.prototype._updateSearchNavigationButtonState):
        (WebInspector.SearchController.prototype._updateReplaceVisibility):
        (WebInspector.SearchController.prototype._onKeyDown):
        (WebInspector.SearchController.prototype._onNextButtonSearch):
        (WebInspector.SearchController.prototype._onPrevButtonSearch):
        (WebInspector.SearchController.prototype._performSearch):
        (WebInspector.SearchController.prototype._updateReplaceDetailsVisibility):
        (WebInspector.SearchController.prototype._replace):
        (WebInspector.SearchController.prototype._replaceAll):
        * inspector/front-end/Settings.js:
        (WebInspector.ExperimentsSettings):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame.prototype.beforeTextChanged):
        (WebInspector.SourceFrame.prototype.performSearch.doFindSearchMatches):
        (WebInspector.SourceFrame.prototype.performSearch):
        (WebInspector.SourceFrame.prototype.replaceSearchMatchWith):
        (WebInspector.SourceFrame.prototype.replaceAllWith):
        (WebInspector.TextEditorDelegateForSourceFrame.prototype.beforeTextChanged):
        * inspector/front-end/TextEditor.js:
        (WebInspector.TextEditor.prototype.editRange):
        * inspector/front-end/inspector.css:
        (.toolbar-search-replace .search-replace):
        (.toolbar-search):
        (.toolbar-search-replace):
        (.toolbar-search-close-button):
        (.toolbar-search-close-button:hover):
        (.toolbar-search-close-button:active):
        (.toolbar-search input[type="checkbox"]):
        (.toolbar-search-replace .toolbar-replace-control):

2012-07-18  YoungTaeck Song  <youngtaeck.song@samsung.com>

        [WK2][EFL] Divide ENABLE(WEBGL) into ENABLE(WEBGL) and USE(3D_GRAPHICS) in CMakeLists.txt
        https://bugs.webkit.org/show_bug.cgi?id=91584

        Reviewed by Noam Rosenthal.

        This patch is a subset of Efl's UI_SIDE_COMPOSITING implementation.
        Modified CMakeLists.txt so that the basic 3D-graphics sources can be compiled even when WebGL is disabled.

        * CMakeLists.txt:
        * PlatformEfl.cmake:
        * platform/graphics/GraphicsContext3D.h:
        (GraphicsContext3D):
        * platform/graphics/efl/GraphicsContext3DEfl.cpp:
        (WebCore::GraphicsContext3D::platformGraphicsContext3D):

2012-07-18  Zoltan Horvath  <zoltan@webkit.org>

        [Qt] Modify the using of the QImage::Format enum to the appropriate functions from NativeImageQt
        https://bugs.webkit.org/show_bug.cgi?id=91600

        Reviewed by Andreas Kling.

        Use NativeImageQt::defaultFormatForAlphaEnabledImages() and NativeImageQt::defaultFormatForOpaqueImages()
        instead of the direct imagetypes at the appropriate places.

        Covered by existing tests.

        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        (WebCore::GraphicsContext3D::paintToCanvas):
        * platform/graphics/qt/PathQt.cpp:
        (WebCore::scratchContext):
        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::drawRepaintCounter):
        * platform/graphics/texmap/TextureMapperImageBuffer.cpp:
        (WebCore::BitmapTextureImageBuffer::updateContents):

2012-07-18  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: create timeline detail records lazily
        https://bugs.webkit.org/show_bug.cgi?id=91513

        Reviewed by Pavel Feldman.

        - only create timeline record details when these are used;

        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelineRecordListRow.prototype.update):
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):
        (WebInspector.TimelinePresentationModel.Record.prototype._refreshDetails):
        (WebInspector.TimelinePresentationModel.Record.prototype.details):

2012-07-18  Simon Hausmann  <simon.hausmann@nokia.com>

        [ANGLE] On QT, use Bison and Flex during ANGLE build
        https://bugs.webkit.org/show_bug.cgi?id=91108

        Reviewed by Kenneth Rohde Christiansen.

        Add derived source generators for the two angle bison parsers and flex based lexers.

        * DerivedSources.pri:
        * Target.pri:

2012-07-18  Dominik Röttsches  <dominik.rottsches@intel.com>

        [EFL][WK2] Too early assertion failure if default theme is not available
        https://bugs.webkit.org/show_bug.cgi?id=91608

        Reviewed by Kenneth Rohde Christiansen.

        After bug 90107 we're setting a default theme path, which leads to a
        themeChanged() call initializing edje in createEdje() - if that theme
        path is not available we run into a premature assertion failure.
        We need to give the embedder a chance to override the default theme path
        before failing - so only the usages of m_edje should be guarded with assertions.

        No new tests, no change in rendering behavior.

        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::themePartCacheEntryReset): Adding an assertion to ensure m_edje is present - so that all usages of m_edje are now guarded.
        (WebCore::RenderThemeEfl::createEdje): Not hitting assertion if theme path doesn't contain the theme object file, allowing the embedder to override with a new path.

2012-07-18  Vsevolod Vlasov  <vsevik@chromium.org>

        IndexedDB: IDBLevelDBBackingStore compilation fails because of unused variable.
        https://bugs.webkit.org/show_bug.cgi?id=91612

        Reviewed by Pavel Feldman.

        Replaced ASSERT with ASSERT_UNUSED.

        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
        (WebCore::IDBLevelDBBackingStore::getObjectStores):

2012-07-18  Yoshifumi Inoue  <yosin@chromium.org>

        REGRESSION(r117738) [Forms] Default step base should be 0 (=1970-01) for input type month
        https://bugs.webkit.org/show_bug.cgi?id=91603

        Reviewed by Kent Tamura.

        This patch restores default step base value to 0 (=1970-01) as before
        r117738.

        No new tests. Existing test(fast/forms/month/month-stepup-stepdown-from-renderer.html)
        covers this case, although it is disabled.

        * html/MonthInputType.cpp:
        (WebCore::MonthInputType::createStepRange): Changed default value of
        step base to defaultMonthStepBase instead of DateComponents::minimumMonth().

2012-07-18  Ryuan Choi  <ryuan.choi@samsung.com>

        [EFL] Cursor is not drawn when opengl_x11 backend is choosen.
        https://bugs.webkit.org/show_bug.cgi?id=89142

        Reviewed by Simon Hausmann.

        If theme based cursor is not given, WebKit/Efl only uses Ecore_X based
        cursor as a fallback after checked whether current engine is using EcoreX.
        This patch adds opengl_x11 which is one of Ecore_X based engine in check
        lists to draw fallback cursor.

        * platform/efl/EflScreenUtilities.cpp:
        (WebCore::isUsingEcoreX):

2012-07-18  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r122345): HTMLCollection::length() sometimes returns a wrong value
        https://bugs.webkit.org/show_bug.cgi?id=91587

        Reviewed by Benjamin Poulain.

        The bug was caused by my douchey code that set the length cache to be the *offset*
        of the last item in a HTMLCollection. Clearly, the length of a collection that contains
        the last item at offset n is n + 1. Fixed that.

        Also removed the call to setLengthCache in HTMLCollection::length since it must have set
        by previous calls to itemBeforeOrAfterCachedItem already. This will allow us to catch
        regressions like this in ports that use JSC bindings as well.

        Test: fast/dom/htmlcollection-length-after-item.html

        * html/HTMLCollection.cpp:
        (WebCore::HTMLCollection::length):
        (WebCore::HTMLCollection::itemBeforeOrAfterCachedItem):

2012-07-18  Yoshifumi Inoue  <yosin@chromium.org>

        Decimal::toString should not round integer value.
        https://bugs.webkit.org/show_bug.cgi?id=91481

        Reviewed by Kent Tamura.

        This patch makes Decimal::toString not to round an integer value
        before converting string.

        Tests: WebKit/chromium/tests/DecimalTest.cpp: DecimalTest.toString

        * platform/Decimal.cpp:
        (WebCore::Decimal::toString): When the value is an integer, we don't
        round coefficient to be DBL_DIG(15) digits because double can
        represent an integer without rounding error.

2012-07-18  Luke Macpherson   <macpherson@chromium.org>

        Fix null pointer dereference introduced by Changeset 121874.
        https://bugs.webkit.org/show_bug.cgi?id=91578

        Reviewed by Pavel Feldman.

        In http://trac.webkit.org/changeset/121874/trunk/Source/WebCore/inspector/InspectorStyleSheet.cpp I introduced code that
        dereferences the return value of ownerDocument() without doing a null check. This was a bad idea.

        No new tests. I don't have a repro case, but it is clear from reading the code for ownerDocument() that it can return null.

        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyleSheet::ensureSourceData):

2012-07-17  Yoshifumi Inoue  <yosin@chromium.org>

        Decimal constructor with 99999999999999999 loses last digit
        https://bugs.webkit.org/show_bug.cgi?id=91579

        Reviewed by Kent Tamura.

        This patch changes maximum coefficient value handling in Decimal::EncodedData
        constructor not to lose the last digit. It was used ">=" operator for
        comparison instead of ">" operator.

        Tests: WebKit/chromium/tests/DecimalTest.cpp

        * platform/Decimal.cpp:
        (WebCore::Decimal::EncodedData::EncodedData): Replace ">=" to ">" for
        not getting rid of the last digit for maximum coefficient value.

2012-07-17  Ilya Tikhonovsky  <loislo@chromium.org>

        Unreviewed Web Inspector: followup fix for r122920.

        Add collected Loaders size to InspectorMemoryBlock

        * inspector/InspectorMemoryAgent.cpp:
        (MemoryBlockName):
        (WebCore):

2012-07-17  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: show loaders memory consumption on the memory chart.
        https://bugs.webkit.org/show_bug.cgi?id=90686

        Reviewed by Pavel Feldman.

        Size of FrameLoader, DocumentLoader, ResourceLoader and their resources should be shown on the memory pie chart.

        It is covered by existing WebInspector performance tests infrastructure.

        * WebCore.exp.in:
        * dom/MemoryInstrumentation.h:
        (MemoryInstrumentation):
        (WebCore::MemoryInstrumentation::addRawBuffer):
        (WebCore::MemoryInstrumentation::addInstrumentedMemberImpl):
        (WebCore):
        (WebCore::MemoryClassInfo::addInstrumentedHashSet):
        (WebCore::MemoryClassInfo::addRawBuffer):
        (WebCore::MemoryInstrumentation::addInstrumentedHashSet):
        (WebCore::MemoryInstrumentation::addVector):
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):
        (WebCore::domTreeInfo):
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::reportMemoryUsage):
        (WebCore):
        * loader/DocumentLoader.h:
        (WebCore):
        (DocumentLoader):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::reportMemoryUsage):
        (WebCore):
        * loader/FrameLoader.h:
        (WebCore):
        (FrameLoader):
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::reportMemoryUsage):
        (WebCore):
        * loader/ResourceLoader.h:
        (WebCore):
        (ResourceLoader):
        * page/Frame.cpp:
        (WebCore::Frame::reportMemoryUsage):
        (WebCore):
        * page/Frame.h:
        (WebCore):
        (Frame):
        * platform/SharedBuffer.cpp:
        (WebCore::SharedBuffer::reportMemoryUsage):
        (WebCore):
        * platform/SharedBuffer.h:
        (WebCore):
        (SharedBuffer):

2012-07-17  Kent Tamura  <tkent@chromium.org>

        Fix an assertion failure in CalendarPickerElement::hostInput().
        https://bugs.webkit.org/show_bug.cgi?id=91568

        Reviewed by Hajime Morita.

        Test: fast/forms/date/calendar-picker-type-change-onclick.html

        * html/shadow/CalendarPickerElement.cpp:
        (WebCore::CalendarPickerElement::defaultEventHandler):
        It's possible that this function is called when the element is detached
        from the document tree.

2012-07-17  Kent Tamura  <tkent@chromium.org>

        Form state: Make a new class handling HashMap<FormElementKey, Deque<>>
        https://bugs.webkit.org/show_bug.cgi?id=91480

        Reviewed by Hajime Morita.

        This is a preparation of Bug 91209, "Form state restore: Need to
        identify a from by its content."

        Make a new class which is responsible to handle "HashMap<FormElementKey,
        Deque<FormControlState>, FormElementKeyHash, FormElementKeyHashTraits>."
        Also, move the FormElementKey class declaration and related structs from
        FormController.h to FormController.cpp because FormElementKey is used
        only in FormController.cpp.

        No new tests. Just a refactoring.

        * html/FormController.cpp:
        (WebCore::FormElementKey): Moeved from FormController.h.
        (WebCore::FormElementKey::FormElementKey):
        Moved from the bottom of FormController.cpp
        (WebCore::FormElementKey::~FormElementKey): ditto.
        (WebCore::FormElementKey::operator=): ditto.
        (WebCore::FormElementKey::ref): ditto.
        (WebCore::FormElementKey::deref): ditto.
        (WebCore::operator==): Moved from FormController.h
        (FormElementKeyHash): ditto.
        (WebCore::FormElementKeyHash::equal): ditto.
        (WebCore::FormElementKeyHash::hash):
        Moved from the bottom of FormController.cpp
        (WebCore::FormElementKeyHashTraits::constructDeletedValue):
        Moved from FormController.h
        (WebCore::FormElementKeyHashTraits::isDeletedValue): ditto.

        (WebCore::SavedFormState): Added.
        (WebCore::SavedFormState::isEmpty):
        (WebCore::SavedFormState::SavedFormState): Added. The constructor.
        (WebCore::SavedFormState::create): Added. A factory function.
        (WebCore::SavedFormState::appendControlState):
        Moved some code from FormController::setStateForNewFormElements.
        (WebCore::SavedFormState::takeControlState):
        Moved some code from FormController::takeStateForFormElement.

        (WebCore::FormController::setStateForNewFormElements):
        - Creates SavedFormState if needed.
        - Uses SavedFormState::appendControlState.
        (WebCore::FormController::takeStateForFormElement):
        Uses SavedFormState.
        * html/FormController.h:
        (FormController):

2012-07-17  MORITA Hajime <morrita@google.com>

        [Shadow DOM] Some distribution invalidation can drop necessary reattachment.
        https://bugs.webkit.org/show_bug.cgi?id=88843

        Reviewed by Dimitri Glazkov.

        Following scenario caused this problem:

        - Inserting a Text node as a shadow child triggers invalidateDistribution(),
          which doen't reattach the shadow's host element.
        - Then inserting a <content> element after that triggers another invalidateDistribution(),
          which should reattach its host because <content> can affect not only distribution of new nodes,
          but also existing distribution.
        - Since the first invalidateDistribution() has marked the distribution as invalidated,
          the second invalidateDistribution() call returns early without any reattachment,
          even though it needs one.

        This change adds InvalidationType parameter to invalidateDistribution(), which asks ElementShadow to
        reattach the host regardless of its validity state. InsertionPoint::insertedInto() uses
        this flag to ensure that its insertion always results a reattachment.

        Test: fast/dom/shadow/content-after-style.html

        * dom/ElementShadow.cpp:
        (WebCore::ElementShadow::addShadowRoot): Passes InvalidationType.
        (WebCore::ElementShadow::removeAllShadowRoots): Passes InvalidationType.
        (WebCore::ElementShadow::invalidateDistribution): Added a InvalidationType parameter.
        * dom/ElementShadow.h:
        * html/shadow/InsertionPoint.cpp:
        (WebCore::InsertionPoint::insertedInto): Passes InvalidationType.

2012-07-17  Jon Lee  <jonlee@apple.com>

        Teach CodeGenerator to support for static, readonly, attributes
        https://bugs.webkit.org/show_bug.cgi?id=88920
        <rdar://problem/11650330>

        Reviewed by Oliver Hunt.

        Update the parser to be able to accept the static keyword for attribute. We will treat static attributes
        like custom static functions. They call the implementing class directly, and pass in the ExecState as a script context.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GetAttributeGetterName): Factor out the construction of the attribute getter function name.
        (GetAttributeSetterName): Factor out the construction of the attribute setter function name.
        (GenerateHeader): Determine that a class has read-write properties only if there is a read-write attribute that
        is not static.
        (GenerateAttributesHashTable): Skip static attributes in the object hash table. They will be added to the constructor
        hash table.
        (GenerateImplementation): Look for static attributes to add to the constructor hash table. Make a call to the static
        function in the class.
        * bindings/scripts/IDLParser.pm:
        (ParseInterface): Update the processing because of the regex change.
        * bindings/scripts/IDLStructure.pm: Update the attribute regex.
        * bindings/scripts/test/JS/JSTestObj.cpp: Update test results.
        * bindings/scripts/test/JS/JSTestObj.h: Update test results.
        * bindings/scripts/test/TestObj.idl: Add test cases.

2012-07-17  Kenichi Ishibashi  <bashi@chromium.org>

        [Chromium] Rename HarfBuzzFace to HarfBuzzNGFace
        https://bugs.webkit.org/show_bug.cgi?id=91458

        Reviewed by Tony Chang.

        There are HarfbuzzFace class (for old-harfbuzz) and HarfBuzzFace (for harfbuzz-ng) class. The difference is too subtle. Make them more distinct.

        No new tests. No changes in behavior.

        * WebCore.gyp/WebCore.gyp: Rename HarfBuzzFace to HarfBuzzNGFace.
        * WebCore.gypi: Ditto.
        * platform/graphics/FontPlatformData.h: Ditto.
        (FontPlatformData):
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm: Ditto.
        (WebCore::FontPlatformData::harfbuzzFace):
        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp: Ditto.
        (WebCore::FontPlatformData::harfbuzzFace):
        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h: Ditto.
        (FontPlatformData):
        * platform/graphics/harfbuzz/ng/HarfBuzzNGFaceCoreText.cpp: Renamed from Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzFaceCoreText.cpp.
        (WebCore):
        (WebCore::floatToHarfBuzzPosition):
        (WebCore::getGlyph):
        (WebCore::getGlyphHorizontalAdvance):
        (WebCore::getGlyphHorizontalOrigin):
        (WebCore::getGlyphExtents):
        (WebCore::harfbuzzCoreTextGetFontFuncs):
        (WebCore::releaseTableData):
        (WebCore::harfbuzzCoreTextGetTable):
        (WebCore::HarfBuzzNGFace::createFace):
        (WebCore::HarfBuzzNGFace::createFont):
        (WebCore::HarfBuzzShaper::createGlyphBufferAdvance):
        * platform/graphics/harfbuzz/ng/HarfBuzzNGFaceSkia.cpp: Renamed from Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzFaceSkia.cpp.
        (WebCore):
        (WebCore::SkiaScalarToHarfbuzzPosition):
        (WebCore::SkiaGetGlyphWidthAndExtents):
        (WebCore::harfbuzzGetGlyph):
        (WebCore::harfbuzzGetGlyphHorizontalAdvance):
        (WebCore::harfbuzzGetGlyphHorizontalOrigin):
        (WebCore::harfbuzzGetGlyphExtents):
        (WebCore::harfbuzzSkiaGetFontFuncs):
        (WebCore::harfbuzzSkiaGetTable):
        (WebCore::destroyPaint):
        (WebCore::HarfBuzzNGFace::createFace):
        (WebCore::HarfBuzzNGFace::createFont):
        (WebCore::HarfBuzzShaper::createGlyphBufferAdvance):
        * platform/graphics/harfbuzz/ng/HarfBuzzNGFace.cpp: Renamed from Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzFace.cpp.
        (WebCore):
        (WebCore::harfbuzzFaceCache):
        (WebCore::HarfBuzzNGFace::HarfBuzzNGFace):
        (WebCore::HarfBuzzNGFace::~HarfBuzzNGFace):
        * platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h: Renamed from Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzFace.h.
        (WebCore):
        (HarfBuzzNGFace):
        (WebCore::HarfBuzzNGFace::create):
        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp:
        (WebCore::HarfBuzzShaper::shapeHarfBuzzRuns):

2012-07-17  Kinuko Yasuda  <kinuko@chromium.org>

        Record metrics to measure the usage of Blob([ArrayBuffer]) to eventually deprecate it
        https://bugs.webkit.org/show_bug.cgi?id=90534

        Reviewed by Jian Li.

        We are removing ArrayBuffer support in Blob constructor (in favor of
        ArrayBufferView) but before doing that we should record its use relative to ArrayBufferView.
        http://dev.w3.org/2006/webapi/FileAPI/#dfn-Blob

        No new tests as this has no functional changes.

        * fileapi/WebKitBlobBuilder.cpp:
        (WebCore::WebKitBlobBuilder::append):

2012-07-17  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Key generator state not maintained across connections
        https://bugs.webkit.org/show_bug.cgi?id=91456

        Reviewed by Tony Chang.

        Explicitly store key generator state for each object store in the backing store,
        rather than deriving it from the maximum key in the data (which violates the spec
        if data is deleted).

        This change eliminates a (fragile) per-store cache of the value to simplify the
        code. A cache could be re-introduced, requiring an "onbeforecommit" hook for
        object stores, but it seems cleaner to save that for a follow-up patch.

        Test: storage/indexeddb/key-generator.html

        * Modules/indexeddb/IDBBackingStore.h: New APIs for getting/setting generator states.
        (IDBBackingStore):
        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
        (WebCore::IDBLevelDBBackingStore::getObjectStores): Read generator state (but currently ignored).
        (WebCore::IDBLevelDBBackingStore::createObjectStore): Write generator state.
        (WebCore):
        (WebCore::IDBLevelDBBackingStore::getKeyGeneratorCurrentNumber):
        (WebCore::IDBLevelDBBackingStore::maybeUpdateKeyGeneratorCurrentNumber): Update, optionally
        checking to see if the new value is greater than the old. (If caller got the value via
        getKeyGeneratorCurrentNumber it is safe to skip the check.)
        * Modules/indexeddb/IDBLevelDBBackingStore.h:
        (IDBLevelDBBackingStore):
        * Modules/indexeddb/IDBLevelDBCoding.cpp:
        * Modules/indexeddb/IDBLevelDBCoding.h:
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl): Ditch the cache.
        (WebCore::IDBObjectStoreBackendImpl::put): No need for abort task.
        (WebCore::IDBObjectStoreBackendImpl::putWithIndexKeys): Ditto.
        (WebCore::IDBObjectStoreBackendImpl::putInternal): Use the newfangled APIs below.
        (WebCore::IDBObjectStoreBackendImpl::generateKey):
        (WebCore::IDBObjectStoreBackendImpl::updateKeyGenerator):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
        (IDBObjectStoreBackendImpl):

2012-07-17  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Key generator state not maintained across connections
        https://bugs.webkit.org/show_bug.cgi?id=91456

        Reviewed by Tony Chang.

        Explicitly store key generator state for each object store in the backing store,
        rather than deriving it from the maximum key in the data (which violates the spec
        if data is deleted).

        This change eliminates a (fragile) per-store cache of the value to simplify the
        code. A cache could be re-introduced, requiring an "onbeforecommit" hook for
        object stores, but it seems cleaner to save that for a follow-up patch.

        Test: storage/indexeddb/key-generator.html

        * Modules/indexeddb/IDBBackingStore.h: New APIs for getting/setting generator states.
        (IDBBackingStore):
        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
        (WebCore::IDBLevelDBBackingStore::getObjectStores): Read generator state (but currently ignored).
        (WebCore::IDBLevelDBBackingStore::createObjectStore): Write generator state.
        (WebCore):
        (WebCore::IDBLevelDBBackingStore::getKeyGeneratorCurrentNumber):
        (WebCore::IDBLevelDBBackingStore::maybeUpdateKeyGeneratorCurrentNumber): Update, optionally
        checking to see if the new value is greater than the old. (If caller got the value via
        getKeyGeneratorCurrentNumber it is safe to skip the check.)
        * Modules/indexeddb/IDBLevelDBBackingStore.h:
        (IDBLevelDBBackingStore):
        * Modules/indexeddb/IDBLevelDBCoding.cpp:
        * Modules/indexeddb/IDBLevelDBCoding.h:
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl): Ditch the cache.
        (WebCore::IDBObjectStoreBackendImpl::put): No need for abort task.
        (WebCore::IDBObjectStoreBackendImpl::putWithIndexKeys): Ditto.
        (WebCore::IDBObjectStoreBackendImpl::putInternal): Use the newfangled APIs below.
        (WebCore::IDBObjectStoreBackendImpl::generateKey):
        (WebCore::IDBObjectStoreBackendImpl::updateKeyGenerator):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
        (IDBObjectStoreBackendImpl):

2012-07-17  Alec Flett  <alecflett@chromium.org>

        IndexedDB: createIndex should throw INVALID_ACCESS_ERR instead of NOT_SUPPORTED_ERR
        https://bugs.webkit.org/show_bug.cgi?id=91553

        Reviewed by Tony Chang.

        Update createIndex to throw an INVALID_ACCESS_ERR
        as per the IndexedDB spec.

        No new tests: existing tests have been updated

        * Modules/indexeddb/IDBDatabaseException.cpp:
        (WebCore):
        * Modules/indexeddb/IDBDatabaseException.h:
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::createIndex):

2012-07-17  Adam Barth  <abarth@webkit.org>

        DragImageChromiumMac.cpp is never compiled and can be removed
        https://bugs.webkit.org/show_bug.cgi?id=91545

        Reviewed by Tony Chang.

        This file would only be compiled on chromium-mac, but it's excluded
        from that build. This is likely left over from the CG configuration.

        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * platform/chromium/DragImageChromiumMac.cpp: Removed.

2012-07-17  Roger Fong  <roger_fong@apple.com>

        Assertion failure/crash on Windows when using a font in an SVG 
        element with an unresaonbly large font size
        https://bugs.webkit.org/show_bug.cgi?id=91273
        Radar: <rdar://problem/8355401>

        Reviewed by Tim Horton.

        When using a font in an SVG element with an unreasonably large 
        font size in Windows, WebKit crashes. The problem has to do with 
        font sizes overflowing into negative values in the Windows specific code.
        The fix is to cap the font sizes to something reasonable when the font style is getting processed. 
        The fix will apply to both CSS and SVG so that behaviour is consistent.

        Test: svg/text/font-size-too-large-crash.svg

        * css/StyleBuilder.cpp:
        (WebCore::ApplyPropertyFontSize::applyValue):
        This is where the font size capping now occurs. Caps size to 1000000.
        Both CSS and SVG reach the font size capping code here.
        
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        Capping here removed, moved to StyleBuilder.cpp.

2012-07-17  David Barr  <davidbarr@chromium.org>

        Add parsing and style application for css3-images image-orientation
        https://bugs.webkit.org/show_bug.cgi?id=89624

        Reviewed by Tony Chang.

        The css3-images module is at candidate recommendation.
        http://www.w3.org/TR/2012/CR-css3-images-20120417/#the-image-orientation

        Test: fast/css/image-orientation/image-orientation.html

        * css/CSSComputedStyleDeclaration.cpp: Add computed style for image-orientation.
        (WebCore): Add CSSPropertyImageOrientation to computedProperties.
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Map CSSPropertyImageOrientation using cast operator from PrimitiveValueMappings.
        * css/CSSParser.cpp: Add parsing rule for image-orientation.
        (WebCore::CSSParser::parseValue): Parse the value of CSSPropertyImageOrientation as an angle.
        * css/CSSPrimitiveValueMappings.h: Add mappings between CSSPrimitiveValue and ImageOrientationEnum.
        (WebCore): Add conditional include for ImageOrientation.h.
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Map the natural orientations to angles.
        (WebCore::CSSPrimitiveValue::operator ImageOrientationEnum): Round angles away from zero to quarter turns and map to the natural orientations.
        * css/CSSProperty.cpp: Add CSSPropertyImageOrientation.
        (WebCore::CSSProperty::isInheritedProperty): Map CSSPropertyImageOrientation inherited.
        * css/CSSPropertyNames.in: Add image-orientation.
        * css/StyleBuilder.cpp: Add style application logic for CSSPropertyImageOrientation.
        (WebCore::StyleBuilder::StyleBuilder): Map CSSPropertyImageOrientation to RenderStyle::imageOrientation with type ImageOrientationEnum.
        * css/StyleResolver.cpp: Handle CSSPropertyImageOrientation.
        (WebCore::StyleResolver::applyProperty): Expect CSSPropertyImageOrientation to be handled by StyleBuilder.
        * rendering/style/RenderStyle.h: Add imageOrientation, setImageOrientation and initialImageOrientation.
        * rendering/style/StyleRareInheritedData.cpp: Add m_imageOrientation.
        (WebCore::StyleRareInheritedData::StyleRareInheritedData): Add m_imageOrientation to default and copy contructors.
        (WebCore::StyleRareInheritedData::operator==): Include m_imageOrientation in comparison.
        * rendering/style/StyleRareInheritedData.h: Add m_imageOrientation.
        (StyleRareInheritedData): Add 4-bit field m_imageOrientation, mapping to ImageOrientationEnum.

2012-07-17  Adrienne Walker  <enne@google.com>

        REGRESSION(r122215) - RenderObject::willRenderImage crashes on null view()
        https://bugs.webkit.org/show_bug.cgi?id=91525

        Reviewed by Julien Chaffraix.

        Fix by doing an early out check.  This is intended to fix the crash in
        http://crbug.com/137161.

        No new test, because unfortunately a layout test is ill-suited to
        reproing this kind of Document creation/destruction bug.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::willRenderImage):

2012-07-17  Emil A Eklund  <eae@chromium.org>

        vertical-align: middle causes overflow with subpixel layout
        https://bugs.webkit.org/show_bug.cgi?id=91464

        Reviewed by Eric Seidel.

        Using vertical-align: middle in combination with an overflow value other
        than visible can cause the overflow height to be computed incorrectly.

        Test: fast/sub-pixel/vertical-align-middle-overflow.html

        * rendering/RootInlineBox.cpp:
        (WebCore::RootInlineBox::verticalPositionForBox):
        Round verticalPosition after calculation instead of flooring the result
        of the xHeight calculation. By flooring it the resulting value is in
        effect rounded up which can cause the height of the box to grow by one.
        By rounding the resulting value thevertical position is more accurate and
        the off by one error is avoided.

2012-07-17  Philip Rogers  <pdr@google.com>

        Move zero-length-subpaths from RenderSVGShape to RenderSVGPath
        https://bugs.webkit.org/show_bug.cgi?id=90716

        Reviewed by Nikolas Zimmermann.

        Previously zero-length-subpath code was present in RenderSVGShape but it is
        only needed in RenderSVGPath. This patch moves the zero-length-subpath code
        to RenderSVGPath.

        In this change, we gain:
        1) Ellipses, Circles, and Rects will no longer carry an empty Vector nor
           checks for zero-length subpaths which (per the spec) they cannot have.
        2) RenderSVGShape, the superclass of all shape rendering, has been
           drastically simplified by removing 70 lines of code that only applies
           to Path rendering. This generally aids in code understandability.

        The patch is primarily a straightforward code move but useStrokeStyleToFill
        needs further explanation:
        Zero-length-subpaths are drawn using rectangular and circular paths which
        are filled.
        Previously in RenderSVGShape::fillAndStrokePath, strokePath was called for
        the main path with ApplyToStrokeMode and then strokePath was called for
        each zero-length-subpath with ApplyToFillMode.
        ApplyToFillMode had the effect of setting the context's stroke style to
        the fill style so zero-length-subpaths were "filled" with the stroke style.
        After this patch, the context is only setup once (which is faster!) using
        ApplyToStrokeMode so we manually set the stroke style to the fill style
        using useStrokeStyleToFill.

        No new tests, just a refactoring.

        * rendering/svg/RenderSVGPath.cpp:
        (WebCore::RenderSVGPath::updateShapeFromElement):
        (WebCore):
        (WebCore::RenderSVGPath::calculateUpdatedStrokeBoundingBox):
        (WebCore::useStrokeStyleToFill):
        (WebCore::RenderSVGPath::strokeShape):
        (WebCore::RenderSVGPath::shapeDependentStrokeContains):
        (WebCore::RenderSVGPath::shouldStrokeZeroLengthSubpath):
        (WebCore::RenderSVGPath::zeroLengthLinecapPath):
        (WebCore::RenderSVGPath::zeroLengthSubpathRect):
        (WebCore::RenderSVGPath::updateZeroLengthSubpaths):
        * rendering/svg/RenderSVGPath.h:
        (RenderSVGPath):
        * rendering/svg/RenderSVGShape.cpp:
        (WebCore::RenderSVGShape::updateShapeFromElement):
        (WebCore::RenderSVGShape::strokeShape):
        (WebCore::RenderSVGShape::strokeContains):
        (WebCore):
        (WebCore::RenderSVGShape::fillShape):
        (WebCore::RenderSVGShape::fillAndStrokeShape):
        (WebCore::RenderSVGShape::paint):
        (WebCore::RenderSVGShape::calculateStrokeBoundingBox):
        * rendering/svg/RenderSVGShape.h:
        (WebCore::RenderSVGShape::hasPath):
        (WebCore::RenderSVGShape::hasNonScalingStroke):
        (RenderSVGShape):
        (WebCore::RenderSVGShape::strokeBoundingBox):

2012-07-17  Ryosuke Niwa  <rniwa@webkit.org>

        invalidateNodeListCachesInAncestors walks up ancestors even when an attribute that doesn't invalidate node lists changes
        https://bugs.webkit.org/show_bug.cgi?id=91530

        Reviewed by Ojan Vafai.

        The bug was caused by invalidateNodeListCachesInAncestors not calling Document::shouldInvalidateNodeListCaches with
        attrName. Done that.
        
        This chance revealed a bug in shouldInvalidateTypeOnAttributeChange that we weren't checking form attribute changes for
        RadioNodeList and HTMLCollection, so fixed the bug.

        Also renamed Document::clearNodeListCaches to invalidateNodeListCaches to match the name convention used elsewhere,
        and added a new version of DynamicNodeListCacheBase::invalidateCache that takes attrName to reduce the code duplication.

        Test: fast/forms/elements-invalidate-on-form-attribute-invalidation.html

        * dom/Document.cpp:
        (WebCore::Document::invalidateNodeListCaches):
        * dom/Document.h:
        (Document):
        * dom/DynamicNodeList.h:
        (WebCore::DynamicNodeListCacheBase::invalidateCache):
        (WebCore::DynamicNodeListCacheBase::shouldInvalidateTypeOnAttributeChange):
        * dom/Node.cpp:
        (WebCore::Node::invalidateNodeListCachesInAncestors):
        (WebCore::NodeListsNodeData::invalidateCaches):

2012-07-17  Max Vujovic  <mvujovic@adobe.com>

        Update ANGLE in WebKit
        https://bugs.webkit.org/show_bug.cgi?id=89039

        Reviewed by Dean Jackson and Mark Rowe.

        Update ANGLE to r1170, with the following modifications:

        (1) Use Bison 2.3 instead of Bison 2.4.2 to generate ExpressionParser.cpp and
        glslang_tab.cpp. I had to modify ExpressionParser.y to make it compatible with Bison
        2.3. The changes have been contributed back to ANGLE in r1224.

        (2) Continue to recognize QNX as POSIX in ANGLE. This has been contributed back to ANGLE
        in r1223.

        (3) Rename ANGLE/src/compiler/preprocessor/new/Diagnostic.cpp to DiagnosticBase.cpp.
        Rename ANGLE/src/compiler/preprocessor/new/DirectiveHandler.cpp to DirectiveHandlerBase.cpp.

        With the introduction of ANGLE's new preprocessor, there were two files named Diagnostic.cpp
        in ANGLE under different folders. This caused problems on the QT build when their object
        files, both named Diagnostic.o, tried to go in the same folder. Renaming one of them to
        DiagnosticBase.cpp avoids this conflict. The same situation occurred with
        DirectiveHandler.cpp. I will work on contributing this change back to ANGLE for future
        updates.

        (4) Add the following lines to glslang.y and ExpressionParser.y:
        #define YYENABLE_NLS 0
        #define YYLTYPE_IS_TRIVIAL 1

        Bison 2.3 doesn't first check that these macros are defined before reading their value,
        which causes the QT build to fail.

        We work around this issue in the same way in CSSGrammar.y.

        I will work on contributing this change back to ANGLE.

        No new tests. No change in behavior.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:

2012-07-17  Stephen Chenney  <schenney@chromium.org>

        Crash in SVGStopElement::stopColorIncludingOpacity
        https://bugs.webkit.org/show_bug.cgi?id=90814

        Reviewed by Dirk Schulze.

        No new tests as there should be no change in functionality.

        * svg/SVGStopElement.cpp:
        (WebCore::SVGStopElement::stopColorIncludingOpacity): Added a check for null
        renderer and style. It is hard to see how this is happening because
        the code is only invoked if the parent gradient has a renderer, and it seems
        the stop element should always have a renderer when the parent has a renderer.
        Still, it obviously can happen and does so frequently enough to generate multiple
        Chromium crash reports per day. The fix is marked with a FIXME, as we expect to
        remove this code entirely soon.

2012-07-17  Emil A Eklund  <eae@chromium.org>

        Incorrect offset used for scrollWidth/Height calculation
        https://bugs.webkit.org/show_bug.cgi?id=91461

        Reviewed by Eric Seidel.

        Due to a different offset being used to calculate the scrollWidth/Height
        and pixelSnappedClientWidth/Height the scroll value can be off by one in
        same cases. This can causes scrollbars to appear even when there is no
        overflow.

        Test: fast/sub-pixel/block-with-margin-overflow.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::scrollWidth):
        Change location offset passed to snapSizeToPixel to include x() to match
        offset used by pixelSnappedClientWidth.
        
        (WebCore::RenderBox::scrollHeight):
        Change location offset passed to snapSizeToPixel to include y() to match
        offset used by pixelSnappedClientHeight.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::clampScrollOffset):
        Change calculation to use pixelSnappedClientWidth/Height as it is
        subtracted from the pixel snapped scrollWidth/Height values.
        
        (WebCore::RenderLayer::scrollWidth):
        (WebCore::RenderLayer::scrollHeight):
        Change RenderLayer versions of scrollWidth/Height to include x()/y() as
        per the RenderBox versions.

2012-07-17  Hans Muller  <hmuller@adobe.com>

        Rename CSS Exclusions CSSWrapShape class properties to match Exclusion shape function parameters
        https://bugs.webkit.org/show_bug.cgi?id=89669

        Reviewed by Dirk Schulze.

        Renamed left,top properties in the exclusion shape types to better match the specification
        http://dev.w3.org/csswg/css3-exclusions/#shapes-from-svg-syntax:

        WrapShapeRectangle, CSSWrapShapeRectangle - left,top should be x, y
        WrapShapeCircle, CSSWrapShapeCircle - left,top should be centerX, centerY
        WrapShapeEllipse, CSSWrapShapeEllipse - left,top should be centerX, centerY

        No new tests or tests revisions were needed, the existing tests cover these APIs.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseExclusionShapeRectangle):
        (WebCore::CSSParser::parseExclusionShapeCircle):
        (WebCore::CSSParser::parseExclusionShapeEllipse):
        * css/CSSWrapShapes.cpp:
        (WebCore::CSSWrapShapeRectangle::cssText):
        (WebCore::CSSWrapShapeCircle::cssText):
        (WebCore::CSSWrapShapeEllipse::cssText):
        * css/CSSWrapShapes.h:
        (WebCore::CSSWrapShapeRectangle::x):
        (WebCore::CSSWrapShapeRectangle::y):
        (WebCore::CSSWrapShapeRectangle::setX):
        (WebCore::CSSWrapShapeRectangle::setY):
        (CSSWrapShapeRectangle):
        (WebCore::CSSWrapShapeCircle::centerX):
        (WebCore::CSSWrapShapeCircle::centerY):
        (WebCore::CSSWrapShapeCircle::setCenterX):
        (WebCore::CSSWrapShapeCircle::setCenterY):
        (CSSWrapShapeCircle):
        (WebCore::CSSWrapShapeEllipse::centerX):
        (WebCore::CSSWrapShapeEllipse::centerY):
        (WebCore::CSSWrapShapeEllipse::setCenterX):
        (WebCore::CSSWrapShapeEllipse::setCenterY):
        (CSSWrapShapeEllipse):
        * css/WrapShapeFunctions.cpp:
        (WebCore::valueForWrapShape):
        (WebCore::wrapShapeForValue):
        * rendering/style/WrapShapes.h:
        (WebCore::WrapShapeRectangle::x):
        (WebCore::WrapShapeRectangle::y):
        (WebCore::WrapShapeRectangle::setX):
        (WebCore::WrapShapeRectangle::setY):
        (WrapShapeRectangle):
        (WebCore::WrapShapeCircle::centerX):
        (WebCore::WrapShapeCircle::centerY):
        (WebCore::WrapShapeCircle::setCenterX):
        (WebCore::WrapShapeCircle::setCenterY):
        (WrapShapeCircle):
        (WebCore::WrapShapeEllipse::centerX):
        (WebCore::WrapShapeEllipse::centerY):
        (WebCore::WrapShapeEllipse::setCenterX):
        (WebCore::WrapShapeEllipse::setCenterY):
        (WrapShapeEllipse):

2012-07-16  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: implement search / replace in source files (behind experiment flag)
        https://bugs.webkit.org/show_bug.cgi?id=91394

        Reviewed by Vsevolod Vlasov.

        This change adds "loop" parameter to the go to next / previous search + adds a UI component
        for search / replace of text in the sources panel. New UI component is behind the experiment.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/ConsolePanel.js:
        (WebInspector.ConsolePanel.prototype.performSearch):
        (WebInspector.ConsolePanel.prototype.jumpToNextSearchResult):
        (WebInspector.ConsolePanel.prototype.jumpToPreviousSearchResult):
        * inspector/front-end/ElementsPanel.js:
        (WebInspector.ElementsPanel.prototype.jumpToNextSearchResult):
        (WebInspector.ElementsPanel.prototype.jumpToPreviousSearchResult):
        * inspector/front-end/ExtensionPanel.js:
        (WebInspector.ExtensionPanel.prototype.performSearch):
        (WebInspector.ExtensionPanel.prototype.jumpToNextSearchResult):
        (WebInspector.ExtensionPanel.prototype.jumpToPreviousSearchResult):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.afterTextChanged):
        (WebInspector.JavaScriptSourceFrame.prototype.beforeTextChanged):
        * inspector/front-end/NetworkPanel.js:
        (WebInspector.NetworkLogView.prototype._sortItems):
        (WebInspector.NetworkLogView.prototype._updateFilter):
        (WebInspector.NetworkLogView.prototype.performSearch):
        (WebInspector.NetworkLogView.prototype.jumpToPreviousSearchResult):
        (WebInspector.NetworkLogView.prototype.jumpToNextSearchResult):
        (WebInspector.NetworkPanel.prototype.performSearch):
        * inspector/front-end/Panel.js:
        (WebInspector.Panel.prototype.performSearch):
        (WebInspector.Panel.prototype.jumpToNextSearchResult):
        (WebInspector.Panel.prototype.jumpToPreviousSearchResult):
        (WebInspector.Panel.prototype.canSearchAndReplace):
        (WebInspector.Panel.prototype.replaceSelectionWith):
        (WebInspector.Panel.prototype.replaceAllWith):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype.jumpToNextSearchResult):
        (WebInspector.ProfilesPanel.prototype.jumpToPreviousSearchResult):
        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.ResourcesPanel.prototype.jumpToNextSearchResult):
        (WebInspector.ResourcesPanel.prototype.jumpToPreviousSearchResult):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.performSearch.finishedCallback):
        (WebInspector.ScriptsPanel.prototype.performSearch):
        (WebInspector.ScriptsPanel.prototype.jumpToNextSearchResult):
        (WebInspector.ScriptsPanel.prototype.jumpToPreviousSearchResult):
        (WebInspector.ScriptsPanel.prototype.canSearchAndReplace):
        (WebInspector.ScriptsPanel.prototype.replaceSelectionWith):
        (WebInspector.ScriptsPanel.prototype.replaceAllWith):
        * inspector/front-end/SearchController.js:
        (WebInspector.SearchController):
        (WebInspector.SearchController.prototype.cancelSearch):
        (WebInspector.SearchController.prototype.disableSearchUntilExplicitAction):
        (WebInspector.SearchController.prototype.handleShortcut):
        (WebInspector.SearchController.prototype.activePanelChanged.performPanelSearch):
        (WebInspector.SearchController.prototype.activePanelChanged):
        (WebInspector.SearchController.prototype._updateSearchNavigationButtonState):
        (WebInspector.SearchController.prototype.showSearchField):
        (WebInspector.SearchController.prototype._onKeyDown):
        (WebInspector.SearchController.prototype._onInput):
        (WebInspector.SearchController.prototype._onNextButtonSearch):
        (WebInspector.SearchController.prototype._onPrevButtonSearch):
        (WebInspector.SearchController.prototype._performSearch):
        (WebInspector.SearchController.prototype._toggleReplaceVisibility):
        (WebInspector.SearchController.prototype._replace):
        (WebInspector.SearchController.prototype._replaceAll):
        * inspector/front-end/Settings.js:
        (WebInspector.ExperimentsSettings):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame.createSearchRegex):
        (WebInspector.SourceFrame.prototype.beforeTextChanged):
        (WebInspector.SourceFrame.prototype.replaceSearchMatchWith):
        (WebInspector.SourceFrame.prototype.replaceAllWith):
        (WebInspector.TextEditorDelegateForSourceFrame.prototype.beforeTextChanged):
        (WebInspector.TextEditorDelegateForSourceFrame.prototype.commitEditing):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StyleSourceFrame.prototype.afterTextChanged):
        * inspector/front-end/TextEditor.js:
        (WebInspector.TextEditor.prototype._commitEditing):
        * inspector/front-end/TextEditorModel.js:
        (WebInspector.TextEditorModel.endsWithBracketRegex.):
        * inspector/front-end/inspector.css:
        (.search-replace):
        (.search-replace:focus):
        (.toolbar-search-navigation-controls):
        (.toolbar-search-navigation.enabled):
        (.toolbar-search):
        (.toolbar-search input[type="checkbox"]):
        (.toolbar-search button):
        (.toolbar-search button:active):
        (.toolbar-search-control):
        (.toolbar-replace-control):
        (.toolbar-search-navigation.enabled:active):
        (.toolbar-search-navigation.toolbar-search-navigation-prev):
        (.toolbar-search-navigation.toolbar-search-navigation-prev.enabled:active):
        (.toolbar-search-navigation.toolbar-search-navigation-next):
        (.toolbar-search-navigation.toolbar-search-navigation-next.enabled:active):
        (.drawer-header-close-button):
        (.inspector-footer):

2012-07-17  Gabor Ballabas  <gaborb@inf.u-szeged.hu>

        [Qt][V8] Remove the V8 related codepaths and configuration
        https://bugs.webkit.org/show_bug.cgi?id=90863

        Reviewed by Simon Hausmann.

        No new tests because no new functionality.

        * DerivedSources.pri:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.pri:
        * bindings/v8/ScriptCachedFrameData.cpp:
        * bindings/v8/ScriptCachedFrameData.h:
        * bindings/v8/ScriptController.cpp:
        * bindings/v8/ScriptController.h:
        (ScriptController):
        * bindings/v8/ScriptControllerQt.cpp: Removed.
        * bindings/v8/V8GCController.cpp:
        (WebCore::V8GCController::checkMemoryUsage):
        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
        (WebCore::histogramEnumeration):
        (WebCore::V8InspectorFrontendHost::recordActionTakenCallback):
        (WebCore::V8InspectorFrontendHost::recordPanelShownCallback):
        (WebCore::V8InspectorFrontendHost::recordSettingChangedCallback):
        * config.h:

2012-07-17  Zoltan Horvath  <zoltan@webkit.org>

        [QT] REGRESSION (r122720): svg/filters/feSpecularLight-premultiplied.svg
        https://bugs.webkit.org/show_bug.cgi?id=91390

        Reviewed by Zoltan Herczeg.

        Fix the regression by using the proper imagetype conversion in ImageBuffer::platformTransformColorSpace.

        The test is unskipped.

        * platform/graphics/qt/ImageBufferQt.cpp:
        (WebCore::ImageBuffer::platformTransformColorSpace):

2012-07-17  Vivek Galatage  <vivekgalatage@gmail.com>

        Web Inspector: refactor InspectorController::connectFrontend() to accept InspectorFrontendChannel.
        https://bugs.webkit.org/show_bug.cgi?id=91196

        Reviewed by Pavel Feldman.

        Refactoring InspectorClients. InspectorClient::openInspectorFrontend
        now returning the InspectorFrontendChannel. Also refactored
        InspectorController::connectFrontend() to receive
        InspectorFrontendChannel.

        No new test as code refactoring done.

        * inspector/InspectorClient.h:
        (WebCore):
        (InspectorClient):
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::connectFrontend):
        (WebCore::InspectorController::show):
        (WebCore::InspectorController::reconnectFrontend):
        * inspector/InspectorController.h:
        (WebCore):
        (InspectorController):
        * loader/EmptyClients.h:
        (WebCore::EmptyInspectorClient::openInspectorFrontend):
        (WebCore::EmptyInspectorClient::hideHighlight):

2012-07-17  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r122834.
        http://trac.webkit.org/changeset/122834
        https://bugs.webkit.org/show_bug.cgi?id=91492

        it broke the chromium (Requested by kkristof on #webkit).

        * DerivedSources.pri:
        * Target.pri:
        * WebCore.pri:
        * bindings/v8/ScriptCachedFrameData.cpp:
        (WebCore):
        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
        (WebCore::ScriptCachedFrameData::domWindow):
        (WebCore::ScriptCachedFrameData::restore):
        (WebCore::ScriptCachedFrameData::clear):
        * bindings/v8/ScriptCachedFrameData.h:
        (WebCore):
        (ScriptCachedFrameData):
        (WebCore::ScriptCachedFrameData::~ScriptCachedFrameData):
        * bindings/v8/ScriptController.cpp:
        * bindings/v8/ScriptController.h:
        (ScriptController):
        * bindings/v8/ScriptControllerQt.cpp: Copied from Source/WebCore/bindings/v8/ScriptCachedFrameData.cpp.
        (WebCore):
        (WebCore::ScriptController::qtScriptEngine):
        * bindings/v8/V8GCController.cpp:
        (WebCore::V8GCController::checkMemoryUsage):
        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
        (WebCore):
        (WebCore::V8InspectorFrontendHost::recordActionTakenCallback):
        (WebCore::V8InspectorFrontendHost::recordPanelShownCallback):
        (WebCore::V8InspectorFrontendHost::recordSettingChangedCallback):
        * config.h:

2012-07-17  Gabor Ballabas  <gaborb@inf.u-szeged.hu>

        [Qt][V8] Remove the V8 related codepaths and configuration
        https://bugs.webkit.org/show_bug.cgi?id=90863

        Reviewed by Simon Hausmann.

        No new tests, because there is no new functionality.

        * DerivedSources.pri:
        * Target.pri:
        * WebCore.pri:
        * bindings/v8/ScriptCachedFrameData.cpp:
        * bindings/v8/ScriptCachedFrameData.h:
        * bindings/v8/ScriptController.cpp:
        * bindings/v8/ScriptController.h:
        (ScriptController):
        * bindings/v8/ScriptControllerQt.cpp: Removed.
        * bindings/v8/V8GCController.cpp:
        (WebCore::V8GCController::checkMemoryUsage):
        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
        (WebCore::histogramEnumeration):
        (WebCore::V8InspectorFrontendHost::recordActionTakenCallback):
        (WebCore::V8InspectorFrontendHost::recordPanelShownCallback):
        (WebCore::V8InspectorFrontendHost::recordSettingChangedCallback):
        * config.h:

2012-07-17  Kwang Yul Seo  <skyul@company100.net>

        "in body" insertion mode, "any other end tag" step 2.1 is updated
        https://bugs.webkit.org/show_bug.cgi?id=91473

        Reviewed by Eric Seidel.

        The HTML5 spec is updated to change the 'end tag' processing to not imply
        its own end tag, since that makes no sense. Step 2.1 now says
        "Generate implied end tags, except for elements with the same tag name as the token."
        Modified to follow the updated spec. Also removed the first FIXME because now
        ElementRecord can't be deleted by the preceeding call.

        This patch does not actually change the behavior because of the previous
        check (aborts if generateImpliedEndTags has already popped the node for the token),
        so no new tests.

        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::processAnyOtherEndTagForInBody):

2012-07-17  Shinya Kawanaka  <shinyak@chromium.org> 

        [Regression] Infinite loop in document.elementFromPoint
        https://bugs.webkit.org/show_bug.cgi?id=90820

        Reviewed by Nikolas Zimmermann.

        Node::shadowAncestorNode returns the caller node itself for SVGElement. However,
        since we have already implemented event retargeting algorithm in Shadow DOM, we don't have to
        take a special care of SVGElement for Node.shadowAncestorNode() now.

        This patch will removes the special care code and fixes infinite loop in document.elementFromPoint().

        Test: svg/hittest/svg-use-element-from-point.html

        * dom/Node.cpp:
        (WebCore::Node::shadowAncestorNode):

2012-07-17  Shinya Kawanaka  <shinyak@chromium.org>

        Shadow DOM for img element
        https://bugs.webkit.org/show_bug.cgi?id=90532

        Reviewed by Hajime Morita.

        This patch adds Shadow DOM support for img element.

        According to the Shadow DOM spec, img element should behave like having a user agent Shadow DOM.
        However, if we add Shadow DOM to img by default, it will cause performance regression and memory bloat.

        So, we would like to postpone adding a Shadow DOM to img until when we really need it. In other words,
        we add our User Agent Shadow DOM to img just before a user adds Author Shadow DOM.

        The User Agent Shadow DOM for img has only one element, which displays an image. If img has
        a Shadow DOM, img will behave like <span style="display: inline-block"> by default. The display style can
        be chagned using CSS though.

        This patch also adds ImageLoaderClient. The element we render an image and the element we take an argument
        from were the same, however not they might be different. We would like to encapsulate the fact into
        ImageLoaderClient.

        Tests: fast/dom/shadow/shadowdom-for-image-alt-update.html
               fast/dom/shadow/shadowdom-for-image-alt.html
               fast/dom/shadow/shadowdom-for-image-content.html
               fast/dom/shadow/shadowdom-for-image-dynamic.html
               fast/dom/shadow/shadowdom-for-image-event-click.html
               fast/dom/shadow/shadowdom-for-image-in-shadowdom.html
               fast/dom/shadow/shadowdom-for-image-map.html
               fast/dom/shadow/shadowdom-for-image-style.html
               fast/dom/shadow/shadowdom-for-image-with-multiple-shadow.html
               fast/dom/shadow/shadowdom-for-image-with-width-and-height.html
               fast/dom/shadow/shadowdom-for-image.html

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * css/html.css:
        (img):
        * html/HTMLImageElement.cpp:
        (WebCore::ImageElement::setImageIfNecessary):
        (WebCore):
        (WebCore::ImageElement::createRendererForImage):
        (WebCore::HTMLImageElement::willAddAuthorShadowRoot): When we don't have a user agent Shadow DOM yet
        we add it.
        (WebCore::HTMLImageElement::createShadowSubtree):
        (WebCore::HTMLImageElement::imageElement):
        (WebCore::HTMLImageElement::parseAttribute):
        (WebCore::HTMLImageElement::createRenderer): If a user agent Shadow DOM is attached, we create
        Renderer from style, instead of creating RenderImage.
        (WebCore::HTMLImageElement::attach):
        (WebCore::HTMLImageElement::innerElement):
        * html/HTMLImageElement.h:
        (WebCore):
        (ImageElement):
        (HTMLImageElement):
        (WebCore::HTMLImageElement::sourceElement):
        (WebCore::HTMLImageElement::refSourceElement):
        (WebCore::HTMLImageElement::derefSourceElement):
        (WebCore::HTMLImageElement::imageRenderer):
        (WebCore::HTMLImageElement::imageLoader):
        (WebCore::isHTMLImageElement):
        (WebCore::toHTMLImageElement):
        * html/HTMLImageLoader.cpp:
        (WebCore::HTMLImageLoader::HTMLImageLoader):
        (WebCore::HTMLImageLoader::dispatchLoadEvent):
        (WebCore::HTMLImageLoader::sourceURI):
        (WebCore::HTMLImageLoader::notifyFinished):
        * html/HTMLImageLoader.h:
        (HTMLImageLoader):
        * html/HTMLInputElement.h:
        * html/HTMLObjectElement.h:
        * html/HTMLPlugInElement.h:
        * html/HTMLTagNames.in:
        * html/HTMLVideoElement.h:
        * html/shadow/ImageInnerElement.cpp: Added.
        (WebCore):
        (WebCore::ImageInnerElement::ImageInnerElement):
        (WebCore::ImageInnerElement::hostImage):
        (WebCore::ImageInnerElement::imageLoader):
        (WebCore::ImageInnerElement::attach):
        (WebCore::ImageInnerElement::createRenderer):
        * html/shadow/ImageInnerElement.h: Added.
        (WebCore):
        (ImageInnerElement):
        (WebCore::ImageInnerElement::imageRenderer):
        (WebCore::ImageInnerElement::create):
        (WebCore::isImageInnerElement):
        (WebCore::toImageInnerElement):
        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::ImageLoader):
        (WebCore::ImageLoader::~ImageLoader):
        (WebCore):
        (WebCore::ImageLoader::document):
        (WebCore::ImageLoader::updateFromElement):
        (WebCore::ImageLoader::notifyFinished):
        (WebCore::ImageLoader::renderImageResource):
        (WebCore::ImageLoader::updatedHasPendingLoadEvent):
        (WebCore::ImageLoader::dispatchPendingBeforeLoadEvent):
        (WebCore::ImageLoader::dispatchPendingLoadEvent):
        (WebCore::ImageLoader::dispatchPendingErrorEvent):
        * loader/ImageLoader.h:
        (WebCore):
        (ImageLoader):
        (WebCore::ImageLoader::client):
        * loader/ImageLoaderClient.h: Added.
        (WebCore):
        (ImageLoaderClient): Provides the necessary interfaces to ImageLoader.
        (WebCore::ImageLoaderClient::~ImageLoaderClient):
        (ImageLoaderClientBase):
        (WebCore::ImageLoaderClientBase::sourceElement):
        (WebCore::ImageLoaderClientBase::imageElement):
        (WebCore::ImageLoaderClientBase::refSourceElement):
        (WebCore::ImageLoaderClientBase::derefSourceElement):
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::paintIntoRect):
        (WebCore::RenderImage::imageMap):
        (WebCore::RenderImage::updateAltText):
        (WebCore::RenderImage::hostImageElement):
        (WebCore):
        * rendering/RenderImage.h:
        (WebCore):
        (RenderImage):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::shouldRespectImageOrientation):
        * svg/SVGImageElement.h:
        (SVGImageElement):
        * svg/SVGImageLoader.cpp:
        (WebCore::SVGImageLoader::SVGImageLoader):
        (WebCore::SVGImageLoader::dispatchLoadEvent):
        (WebCore::SVGImageLoader::sourceURI):
        * svg/SVGImageLoader.h:
        (SVGImageLoader):

2012-07-17  Kent Tamura  <tkent@chromium.org>

        Internals: Remove injectPagePopupController()
        https://bugs.webkit.org/show_bug.cgi?id=91471

        Reviewed by Hajime Morita.

        r122558 introduced injectPagePopupController(), however we'd like to
        avoid adding such JavaScript binding code. We can avoid it by exposing a
        PagePopupController for a mock and injecting the following code to the
        popup document:

        <script>window.pagePopupController = window.internals.pagePopupController</script>

        No new tests. This is a kind of refactoring.

        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::pagePopupController):
        Added. Accessor for PagePopupControler owned by the MockPagePopupDriver.
        * testing/InternalSettings.h:
        (InternalSettings): Declare pagePopupController() for Internals::pagePopupController().
        * testing/Internals.cpp:
        (WebCore::Internals::pagePopupController):
        Added. This uses InternalSettings::pagePopupController().
        * testing/Internals.h:
        (Internals): Declare pagePopupController() for Internals.idl.
        * testing/Internals.idl: Declare pagePopupController.

        * testing/MockPagePopupDriver.cpp:
        Moved m_pagePopupController from MockPagePopup to MockPagePopupDriver.
        (WebCore::MockPagePopup::MockPagePopup):
        Added a script element to prepare window.pagePopupController.
        Removed a callsite of injectPagePopupController().
        (WebCore::MockPagePopupDriver::openPagePopup):
        (WebCore::MockPagePopupDriver::closePagePopup):
        * testing/MockPagePopupDriver.h:
        (WebCore::MockPagePopupDriver::pagePopupController):
        Accessor for a PagePopupController object.
        (MockPagePopupDriver): Add RefPtr<PagePopupController> data member.

        * testing/v8/WebCoreTestSupport.cpp: Remove injectPagePopupController().
        * testing/v8/WebCoreTestSupport.h: ditto.

2012-07-17  Ryuan Choi  <ryuan.choi@samsung.com>

        [EFL] Move codes related to theme setting from Widget to RenderTheme
        https://bugs.webkit.org/show_bug.cgi?id=89842

        Reviewed by Kenneth Rohde Christiansen.

        WebKit/Efl uses custom theme for Scrollbar, RenderTheme and Cursor.
        However, theme information itself is in WidgetEfl so it is accessed by
        calling recursive function.
        Because theme is managed by each page, this patch moves codes related to
        theme from WidgetEfl to RenderThemeEfl which is contained by page.

        * platform/Widget.h: Removed functions related to theme.
        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::setThemePath): Added to set theme path.
        (WebCore::RenderThemeEfl::createEdje): Updated method to use RenderThemeEfl's theme.
        (WebCore::RenderThemeEfl::RenderThemeEfl):
        * platform/efl/RenderThemeEfl.h:
        (WebCore::RenderThemeEfl::themePath): Added to get theme path
        * platform/efl/ScrollbarEfl.cpp: Updated method to use RenderThemeEfl's theme.
        (ScrollbarEfl::setParent):
        * platform/efl/WidgetEfl.cpp: Removed codes related theme.
        (WidgetPrivate):

2012-07-17  Shinya Kawanaka  <shinyak@chromium.org>

        HTMLMediaElement should not use Element::ensureShadowRoot()
        https://bugs.webkit.org/show_bug.cgi?id=77936

        Reviewed by Hajime Morita.

        a video element and an audio element add UserAgentShadowRoot dynamically, and they assume that it's the oldest ShadowRoot.
        However an AuthorShadowRoot could be added by a user before a video element and an audio element add UserAgentShadowRoot.
        It breaks the assumption that the UserAgentShadowRoot is the oldest.

        If the UserAgentShadowRoot is not the oldest, the AuthorShadowRoot a page author added might be ignored.
        Since the timing to add UserAgentShadowRoot is not known by a user, the fact that UserAgentShadorRoot is
        not the oldest will cause inconsistent behavior.

        Adding AuthorShadowRoot to a video element and an audio element is allowed by this patch.

        Test: fast/dom/shadow/shadowdom-for-media.html

        * dom/ShadowRoot.cpp:
        (WebCore::allowsAuthorShadowRoot):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::createShadowSubtree):
        (WebCore):
        (WebCore::HTMLMediaElement::willAddAuthorShadowRoot):
        (WebCore::HTMLMediaElement::createMediaControls):
        * html/HTMLMediaElement.h:
        (HTMLMediaElement):

2012-07-16  Daniel Bates  <dbates@webkit.org>

        Attempt to fix the Chromium Mac build after <http://trac.webkit.org/changeset/122802>
        (https://bugs.webkit.org/show_bug.cgi?id=91451)
 
        Remove unused private instance variable AbsoluteQuadsGeneratorContext::m_wasFixed.
        This instance variable has remained unused since it was added in
        <http://trac.webkit.org/changeset/116718> (https://bugs.webkit.org/show_bug.cgi?id=85725).

        I'm unclear as to why the Chromium Mac build began to complain about this
        unused instance variable following <http://trac.webkit.org/changeset/122802>, since this
        code has been in the tree for a while and we previously instantiated AbsoluteQuadsGeneratorContext
        with wasFixed (even though it wasn't used). Regardless, we should remove the unused
        instance variable AbsoluteQuadsGeneratorContext::m_wasFixed.

        * rendering/RenderInline.cpp:
        (WebCore): Remove AbsoluteQuadsGeneratorContext::m_wasFixed.
        (WebCore::RenderInline::absoluteQuads):

2012-07-16  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Add RegisterProtocolHandlerClient to the Modules/protocolhandler
        https://bugs.webkit.org/show_bug.cgi?id=90940

        Reviewed by Hajime Morita.

        As a step to let protocol handler be moved to the modules, RegisterProtocolHandlerClient needs
        to be added to the Modules/protocolhandler. Because ChromeClient has some virtual functions for
        protocol handlers, virtual functions should be moved to RegisterProtocolHandlerClient.

        In addition, NavigatorRegisterProtocolHandler should be supplementable.

        No new tests. Covered by existing tests.

        * GNUmakefile.list.am:
        * Modules/protocolhandler/NavigatorRegisterProtocolHandler.cpp:
        (WebCore::NavigatorRegisterProtocolHandler::from):
        (WebCore::NavigatorRegisterProtocolHandler::create):
        (WebCore):
        (WebCore::NavigatorRegisterProtocolHandler::registerProtocolHandler):
        (WebCore::customHandlersStateString):
        (WebCore::NavigatorRegisterProtocolHandler::isProtocolHandlerRegistered):
        (WebCore::NavigatorRegisterProtocolHandler::unregisterProtocolHandler):
        (WebCore::NavigatorRegisterProtocolHandler::supplementName):
        (WebCore::provideRegisterProtocolHandlerTo):
        * Modules/protocolhandler/NavigatorRegisterProtocolHandler.h:
        (WebCore):
        (NavigatorRegisterProtocolHandler):
        (WebCore::NavigatorRegisterProtocolHandler::NavigatorRegisterProtocolHandler):
        (WebCore::NavigatorRegisterProtocolHandler::client):
        * Modules/protocolhandler/RegisterProtocolHandlerClient.h: Added.
        (WebCore):
        (RegisterProtocolHandlerClient):
        * WebCore.gypi:
        * loader/EmptyClients.h:
        * page/ChromeClient.h:
        (ChromeClient):
        * platform/network/soup/CookieJarSoup.cpp:
        (WebCore::setCookies):
        (WebCore::getRawCookies):

2012-07-16  Pete Williamson  <petewil@google.com>

        Changed the behavior of iconURLs to always recalculate the list.
        https://bugs.webkit.org/show_bug.cgi?id=88665

        Reviewed by Kent Tamura.

        As it turns out, it can contain stale URLs in the case that some script
        manipulates the DOM, which breaks scripts trying to reset the favicon
        URL. Also added a method in Internals to allow tests to get the list of
        icon

        Tests: fast/dom/icon-url-change.html
               fast/dom/icon-url-list.html

        * WebCore.exp.in: export Document::iconURLs on the mac for the Internals class
        * dom/Document.cpp:
        (WebCore::Document::iconURLs): Changed the method to recalculate the iconURL list every time
        (WebCore::Document::addIconURL): we no longer need to add to the internal list since we recalculate it
        (WebCore::Document::setUseSecureKeyboardEntryWhenActive): removed extra whitespace
        * dom/Document.h:
        (Document): removed the addIconURL method which is no longer used
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::iconType): exposed the icon type with an accessor
        (WebCore):
        (WebCore::HTMLLinkElement::iconSizes): exposed the icon sizes with an accessor
        * html/HTMLLinkElement.h:
        (HTMLLinkElement): declared the icon type and size accessors
        * testing/Internals.cpp:
        (WebCore::Internals::iconURLs): made a method to be used by unit tests for inspecting the icon URL list
        (WebCore):
        * testing/Internals.h:
        (Internals): declared the method for unit testing the icon URL list
        * testing/Internals.idl: exported the Document::iconURLs function

2012-07-16  Hajime Morrita  <morrita@chromium.org>

        WebCore needs WEBCORE_TESTING macro to mark methods being exported for testing.
        https://bugs.webkit.org/show_bug.cgi?id=90764

        Reviewed by Adam Barth.

        Defined WEBCORE_TESTING based on USE(EXPORT_MACROS_FOR_TESTING) and
        applied it to FrameDestructionObserver.

        * bindings/js/JSDOMGlobalObject.h: Removed conflicting symbols
        * page/FrameDestructionObserver.h: Added WEBKIT_TESTING
        (FrameDestructionObserver):
        * platform/PlatformExportMacros.h:

2012-07-16  Kiran Muppala  <cmuppala@apple.com>

        REGRESSION: RenderInline::absoluteQuads produces incorrect results for fixed position.
        https://bugs.webkit.org/show_bug.cgi?id=91451

        Reviewed by Simon Fraser.

        RenderInline::absoluteQuads relies on copies of RenderGeometryMap,
        created indirectly by passing AbsoluteQuadsGeneratorContext object by
        value.  These copies are unsafe because the individual transform steps
        within the geometry map include a owned poitner to their respective
        transform.

        Modify the callee methods to take context by reference and disable
        copy constructor for RenderGeometryMap.

        Test: fast/inline/inline-fixed-position-boundingbox.html

        * rendering/RenderGeometryMap.h:
        (WebCore::RenderGeometryMapStep::RenderGeometryMapStep): Add missing
        m_offset to copy constructor initialization list.
        (RenderGeometryMap): Disable copy constructor.
        * rendering/RenderInline.cpp: Pass context object by reference.
        (WebCore::RenderInline::generateLineBoxRects): 
        (WebCore::RenderInline::generateCulledLineBoxRects):
        (WebCore::RenderInline::absoluteRects):
        (WebCore::RenderInline::absoluteQuads):
        (WebCore::RenderInline::linesBoundingBox):
        (WebCore::RenderInline::culledInlineVisualOverflowBoundingBox):
        (WebCore::RenderInline::addFocusRingRects):
        * rendering/RenderInline.h:
        (RenderInline::generateLineBoxRects): Update method declarations to
        show pass by reference context parameter.
        (RenderInline::generateCulledLineBoxRects): Ditto.

2012-07-16  Hayato Ito  <hayato@chromium.org>

        Some events should be always stopped at shadow boundary.
        https://bugs.webkit.org/show_bug.cgi?id=90436

        Reviewed by Ryosuke Niwa.

        The spec is here:
        https://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#events-that-are-always-stopped

        Test: fast/dom/shadow/events-stopped-at-shadow-boundary.html

        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::determineDispatchBehavior):

2012-07-16  Yoshifumi Inoue  <yosin@chromium.org>

        REGRESSION(r119948): [Form] HTMLInputElement.valueAsNumber for input type "month" should return number of month since January 1970
        https://bugs.webkit.org/show_bug.cgi?id=91211

        Reviewed by Kent Tamura.

        This patch changes BaseDateAndTimeInputType::valueAsDouble() to call
        virtual function parseToNumber() which "month" input type overrides
        instead of non-virtual function parseToDouble() which returns number
        of milliseconds.

        No new tests. Existing test (fast/form/month/input-valueasnumber-month.html) coverts this, although it is disabled.

        * html/BaseDateAndTimeInputType.cpp:
        (WebCore::BaseDateAndTimeInputType::valueAsDouble): Changed to call parseToNumber().
        (WebCore::BaseDateAndTimeInputType::parseToNumber): Changed to what parseToDouble() did.
        * html/BaseDateAndTimeInputType.h:
        (BaseDateAndTimeInputType): Remove parseToDouble().

2012-07-16  Adrienne Walker  <enne@google.com>

        [chromium] Turn off ScrollbarLayerChromium for Windows due to bad alpha values
        https://bugs.webkit.org/show_bug.cgi?id=91438

        Reviewed by Kenneth Russell.

        r120509 turned on blending for scrollbar thumbs. Unfortunately for
        Windows XP scrollbar thumbs, their alpha channel is bogus and so the
        thumb ends up being completely transparent. This should ultimately be
        fixed in Chromium theme code, but in the meantime this patch turns
        off the use of ScrollbarLayerChromium.

        This change makes Windows scrollbars fall back to using normal
        ContentLayerChromiums and being painted all in one layer on the main
        thread rather than being painted separately and composited on the
        compositor thread.

        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        (WebCore::createScrollbarLayer):

2012-07-16  Koji Ishii  <kojiishi@gmail.com>

        Vertical alternate glyph (GSUB) support for OpenTypeVerticalData
        https://bugs.webkit.org/show_bug.cgi?id=81389

        Reviewed by Tony Chang.

        This patch adds support for reading 'GSUB' OpenType table to get
        vertical alternate glyphs.
        http://www.microsoft.com/typography/otspec/gsub.htm

        Like bug 81326, this code isn't on any code path yet.

        Tests: WebKit/chromium/tests/OpenTypeVerticalDataTest.cpp

        * platform/graphics/opentype/OpenTypeTypes.h:
        (WebCore::OpenType::validateTable): Moved from OpenTypeVerticalData.cpp for unit tests.
        (OpenType):
        (TableBase): Ditto.
        (WebCore::OpenType::TableBase::isValidEnd):
        (WebCore::OpenType::TableBase::validatePtr):
        (WebCore::OpenType::TableBase::validateOffset):
        * platform/graphics/opentype/OpenTypeVerticalData.cpp:
        (OpenType): Added several OpenType tables used by 'GSUB' table.
        (CoverageTable):
        (Coverage1Table):
        (Coverage2Table):
        (RangeRecord):
        (SubstitutionSubTable):
        (WebCore::OpenType::SubstitutionSubTable::coverage):
        (SingleSubstitution2SubTable):
        (LookupTable):
        (WebCore::OpenType::LookupTable::getSubstitutions):
        (LookupList):
        (WebCore::OpenType::LookupList::lookup):
        (FeatureTable):
        (WebCore::OpenType::FeatureTable::getGlyphSubstitutions):
        (FeatureList):
        (FeatureRecord):
        (WebCore::OpenType::FeatureList::feature):
        (LangSysTable):
        (WebCore::OpenType::LangSysTable::feature):
        (ScriptTable):
        (LangSysRecord):
        (WebCore::OpenType::ScriptTable::defaultLangSys):
        (ScriptList):
        (ScriptRecord):
        (WebCore::OpenType::ScriptList::script):
        (WebCore::OpenType::ScriptList::defaultScript):
        (WebCore::OpenType::ScriptList::defaultLangSys):
        (GSUBTable):
        (WebCore::OpenType::GSUBTable::scriptList):
        (WebCore::OpenType::GSUBTable::featureList):
        (WebCore::OpenType::GSUBTable::lookupList):
        (WebCore::OpenType::GSUBTable::defaultLangSys):
        (WebCore::OpenType::GSUBTable::feature):
        (WebCore::OpenType::GSUBTable::getVerticalGlyphSubstitutions):
        (WebCore::OpenTypeVerticalData::OpenTypeVerticalData):
        (WebCore::OpenTypeVerticalData::loadMetrics): Split code to load metrics from ctor.
        (WebCore::OpenTypeVerticalData::loadVerticalGlyphSubstitutions): Load the vertical alternate Glyph substitution table.
        (WebCore):
        (WebCore::OpenTypeVerticalData::substituteWithVerticalGlyphs): Substitute Glyph IDs with vertical alternate Glyph IDs.
        * platform/graphics/opentype/OpenTypeVerticalData.h:
        (OpenTypeVerticalData): Added m_verticalGlyphMap.

2012-07-16  Vincent Scheib  <scheib@chromium.org>

        Fix spelling of EnforceIFrameAllowFullScreenRequirement and ExemptIFrameAllowFullScreenRequirement.
        https://bugs.webkit.org/show_bug.cgi?id=91437

        Reviewed by Adrienne Walker.

        Document contained spelling errors of 'FulScreen' instead of 'FullScreen'
        for the FullScreenCheckType enumeration.

        No test changes needed.

        * dom/Document.cpp:
        (WebCore::Document::requestFullScreenForElement):
        * dom/Document.h:
        * dom/Element.cpp:
        (WebCore::Element::webkitRequestFullscreen):
        (WebCore::Element::webkitRequestFullScreen):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::enterFullscreen):
        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlFullscreenButtonElement::defaultEventHandler):

2012-07-16  MORITA Hajime  <morrita@google.com>

        Comment on WebCore::HTMLMediaElement::childShouldCreateRenderer() should explain why
        https://bugs.webkit.org/show_bug.cgi?id=91174

        Reviewed by Kent Tamura.

        Clarified the explanation.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::childShouldCreateRenderer):

2012-07-16  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120033.
        http://trac.webkit.org/changeset/120033
        https://bugs.webkit.org/show_bug.cgi?id=91454

        Broke background gradients (Requested by smfr on #webkit).

        * platform/graphics/GeneratorGeneratedImage.cpp:
        (WebCore::GeneratorGeneratedImage::draw):

2012-07-16  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Implement spec updates to IDBTransaction.error
        https://bugs.webkit.org/show_bug.cgi?id=91409

        Reviewed by Tony Chang.

        The Indexed DB spec was updated to resolve some edge cases around the
        IDBTransaction.error attribute. It was agreed that accessing error should
        never throw, error should be null if the transaction is not finished or
        abort() was explicitly called, an appropriate error should be returned if
        a commit failed, and a generic AbortError should be used if a request
        callback throws. These cases are now handled per spec, except that a reason
        is not provided for the commit failure (it's always UnknownError).

        Test: storage/indexeddb/transaction-error.html
              storage/indexeddb/transaction-abort.html

        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::dispatchEvent): Refactor some nested if() blocks; don't
        re-abort the transaction if dispatching in response to an abort.
        (WebCore::IDBRequest::uncaughtExceptionInEventHandler): Abort transaction
        only if not already aborting, and set it's error to AbortError.
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::onAbort): Set error if abort triggered by back end.
        * Modules/indexeddb/IDBTransaction.h:
        (WebCore::IDBTransaction::db): Move impl to header file.
        (WebCore::IDBTransaction::error): Move impl to header file, simplify.
        (IDBTransaction):
        * Modules/indexeddb/IDBTransaction.idl: The error attribute no longer throws.

2012-07-16  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Implement spec updates to IDBTransaction.error
        https://bugs.webkit.org/show_bug.cgi?id=91409

        Reviewed by Tony Chang.

        The Indexed DB spec was updated to resolve some edge cases around the
        IDBTransaction.error attribute. It was agreed that accessing error should
        never throw, error should be null if the transaction is not finished or
        abort() was explicitly called, an appropriate error should be returned if
        a commit failed, and a generic AbortError should be used if a request
        callback throws. These cases are now handled per spec, except that a reason
        is not provided for the commit failure (it's always UnknownError).

        Test: storage/indexeddb/transaction-error.html
              storage/indexeddb/transaction-abort.html

        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::dispatchEvent): Refactor some nested if() blocks; don't
        re-abort the transaction if dispatching in response to an abort.
        (WebCore::IDBRequest::uncaughtExceptionInEventHandler): Abort transaction
        only if not already aborting, and set it's error to AbortError.
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::onAbort): Set error if abort triggered by back end.
        * Modules/indexeddb/IDBTransaction.h:
        (WebCore::IDBTransaction::db): Move impl to header file.
        (WebCore::IDBTransaction::error): Move impl to header file, simplify.
        (IDBTransaction):
        * Modules/indexeddb/IDBTransaction.idl: The error attribute no longer throws.

2012-07-16  Alec Flett  <alecflett@chromium.org>

        IndexedDB: Introduce putWithIndexKeys and calculate them in the renderer
        https://bugs.webkit.org/show_bug.cgi?id=90923

        Reviewed by Darin Fisher.

        Refactor IndexWriter to depend only on IDBIndexMetadata and on
        (databaseId, objectStoreId, indexId) so that it can talk directly
        to the backing store, and also eventually be moved into the renderer.

        This also introduces IDBObjectStoreBackendInterface::putWithIndexKeys
        as a replacement for IDBObjectStoreBackendInterface::put, already
        stubbed out in the chromium port. It will fully replace put()
        after both chromium and webkit sides have reached alignment.

        No new tests as this is just a refactor and existing tests cover
        correctness.

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::setValueReady):
        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
        * Modules/indexeddb/IDBIndexBackendImpl.h:
        * Modules/indexeddb/IDBObjectStore.h:
        (IDBObjectStore):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::put):
        (WebCore):
        (WebCore::IDBObjectStoreBackendImpl::putWithIndexKeys):
        (WebCore::IDBObjectStoreBackendImpl::putInternal):
        (WebCore::IDBObjectStoreBackendImpl::populateIndex):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
        (IDBObjectStoreBackendImpl):
        * Modules/indexeddb/IDBObjectStoreBackendInterface.h:
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::onSuccess):

2012-07-16  Adrienne Walker  <enne@google.com>

        [chromium] Unify compositor quad transforms into content space
        https://bugs.webkit.org/show_bug.cgi?id=91350

        Reviewed by Kenneth Russell.

        For the purpose of simplification and as a first step towards removing
        any transform that takes a centered rect, remove the ability of layers
        to override the quad transform. All quads and quad transforms operate
        on content space with the origin in the top left.

        The gutter quads used to use the root layer (that doesn't draw
        content) as the layer to create the shared quad state from. This is
        now created manually as a layer without bounds should never in general
        need a shared quad state created for it.

        No change in functionality; tested by existing layout and unit tests.

        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
        (WebCore::CCIOSurfaceLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::createSharedQuadState):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::appendQuadsToFillScreen):
        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp:
        (WebCore::CCSolidColorLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.h:
        (CCSolidColorLayerImpl):
        * platform/graphics/chromium/cc/CCTextureLayerImpl.cpp:
        (WebCore::CCTextureLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
        (CCTiledLayerImpl):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::appendQuads):

2012-07-16  Adrienne Walker  <enne@google.com>

        [chromium] Unify compositor quad transforms into content space
        https://bugs.webkit.org/show_bug.cgi?id=91350

        Reviewed by Kenneth Russell.

        For the purpose of simplification and as a first step towards removing
        any transform that takes a centered rect, remove the ability of layers
        to override the quad transform. All quads and quad transforms operate
        on content space with the origin in the top left.

        The gutter quads used to use the root layer (that doesn't draw
        content) as the layer to create the shared quad state from. This is
        now created manually as a layer without bounds should never in general
        need a shared quad state created for it.

        No change in functionality; tested by existing layout and unit tests.

        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
        (WebCore::CCIOSurfaceLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::createSharedQuadState):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::appendQuadsToFillScreen):
        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp:
        (WebCore::CCSolidColorLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.h:
        (CCSolidColorLayerImpl):
        * platform/graphics/chromium/cc/CCTextureLayerImpl.cpp:
        (WebCore::CCTextureLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
        (CCTiledLayerImpl):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::appendQuads):

2012-07-16  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Resolve test and IDL FIXMEs for a handful of landed patches
        https://bugs.webkit.org/show_bug.cgi?id=91423

        Reviewed by Tony Chang.

        IDBObjectStore.createIndex() had a hack to handle a null keyPath argument for the
        DOMString[] overload and treat it as the string "null". Now that IDL arrays are not
        nullable by default following r121817 this hack can be removed and the binding layer
        will automagically coerce to DOMString.

        Test: storage/indexeddb/keypath-basics.html

        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::createIndex): Remove special case for null in DOMString[] overload.
        * Modules/indexeddb/IDBObjectStore.idl: Remove Nullable suffix from DOMString[] overload
        so that the DOMString overload will match null.

2012-07-16  Bear Travis  <betravis@adobe.com>

        Resolve CSS Exclusions shapeInside, shapeOutside properties to Length based WrapShape classes
        https://bugs.webkit.org/show_bug.cgi?id=89670

        Reviewed by Dirk Schulze.

        Layout of CSS Exclusions requires length based WrapShape classes,
        rather than the existing CSSValue based CSSWrapShape classes. This
        patch adds length based WrapShape analogs to the CSSWrapShapes, and
        modifies RenderStyle to use a WrapShape instead of a CSSWrapShape.
        The translation between WrapShape and CSSWrapShape classes
        is handled by helper functions in the new WrapShapeFunctions files.
        StyleBuilder resolves CSSWrapShapes to WrapShapes for layout use.
        CSSComputedStyleDeclaration translates WrapShapes to CSSWrapShapes
        for style use.

        There are existing tests that cover the style serialization / resolution
        in fast/exclusions/parsing-wrap-shape-inside.html and
        fast/exclusions/parsing/wrap-shape-outside.html

        Test: fast/exclusions/parsing-wrap-shape-lengths.html

        * CMakeLists.txt: Build system changes for adding new files
        * GNUmakefile.list.am: Ditto
        * Target.pri: Ditto
        * WebCore.gypi: Ditto
        * WebCore.vcproj/WebCore.vcproj: Ditto
        * WebCore.xcodeproj/project.pbxproj: Ditto
        * css/CSSComputedStyleDeclaration.cpp: Translate WrapShapes back to CSSWrapShapes
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSWrapShapes.h: Mostly changing functions to be const
        (WebCore::CSSWrapShapeRectangle::type):
        (WebCore::CSSWrapShapeCircle::type):
        (WebCore::CSSWrapShapeEllipse::type):
        (WebCore::CSSWrapShapePolygon::getXAt):
        (WebCore::CSSWrapShapePolygon::getYAt):
        (WebCore::CSSWrapShapePolygon::values):
        (WebCore::CSSWrapShapePolygon::type):
        * css/StyleBuilder.cpp: Resolve CSSWrapShapes to WrapShapes
        (WebCore):
        (WebCore::ApplyPropertyWrapShape::setValue):
        (WebCore::ApplyPropertyWrapShape::applyValue):
        (WebCore::ApplyPropertyWrapShape::createHandler):
        * css/WrapShapeFunctions.cpp: Added.
        (WebCore):
        (WebCore::valueForWrapShape):
        (WebCore::convertToLength):
        (WebCore::wrapShapeForValue):
        * css/WrapShapeFunctions.h: Added.
        (WebCore):
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleRareNonInheritedData.h:
        (StyleRareNonInheritedData):
        * rendering/style/WrapShapes.h: Added.
        (WebCore):
        (WrapShape):
        (WebCore::WrapShape::~WrapShape):
        (WebCore::WrapShape::WrapShape):
        (WrapShapeRectangle):
        (WebCore::WrapShapeRectangle::create):
        (WebCore::WrapShapeRectangle::left):
        (WebCore::WrapShapeRectangle::top):
        (WebCore::WrapShapeRectangle::width):
        (WebCore::WrapShapeRectangle::height):
        (WebCore::WrapShapeRectangle::cornerRadiusX):
        (WebCore::WrapShapeRectangle::cornerRadiusY):
        (WebCore::WrapShapeRectangle::setLeft):
        (WebCore::WrapShapeRectangle::setTop):
        (WebCore::WrapShapeRectangle::setWidth):
        (WebCore::WrapShapeRectangle::setHeight):
        (WebCore::WrapShapeRectangle::setCornerRadiusX):
        (WebCore::WrapShapeRectangle::setCornerRadiusY):
        (WebCore::WrapShapeRectangle::type):
        (WebCore::WrapShapeRectangle::WrapShapeRectangle):
        (WrapShapeCircle):
        (WebCore::WrapShapeCircle::create):
        (WebCore::WrapShapeCircle::left):
        (WebCore::WrapShapeCircle::top):
        (WebCore::WrapShapeCircle::radius):
        (WebCore::WrapShapeCircle::setLeft):
        (WebCore::WrapShapeCircle::setTop):
        (WebCore::WrapShapeCircle::setRadius):
        (WebCore::WrapShapeCircle::type):
        (WebCore::WrapShapeCircle::WrapShapeCircle):
        (WrapShapeEllipse):
        (WebCore::WrapShapeEllipse::create):
        (WebCore::WrapShapeEllipse::top):
        (WebCore::WrapShapeEllipse::left):
        (WebCore::WrapShapeEllipse::radiusX):
        (WebCore::WrapShapeEllipse::radiusY):
        (WebCore::WrapShapeEllipse::setTop):
        (WebCore::WrapShapeEllipse::setLeft):
        (WebCore::WrapShapeEllipse::setRadiusX):
        (WebCore::WrapShapeEllipse::setRadiusY):
        (WebCore::WrapShapeEllipse::type):
        (WebCore::WrapShapeEllipse::WrapShapeEllipse):
        (WrapShapePolygon):
        (WebCore::WrapShapePolygon::create):
        (WebCore::WrapShapePolygon::windRule):
        (WebCore::WrapShapePolygon::values):
        (WebCore::WrapShapePolygon::getXAt):
        (WebCore::WrapShapePolygon::getYAt):
        (WebCore::WrapShapePolygon::setWindRule):
        (WebCore::WrapShapePolygon::appendPoint):
        (WebCore::WrapShapePolygon::type):
        (WebCore::WrapShapePolygon::WrapShapePolygon):

2012-07-16  Simon Fraser  <simon.fraser@apple.com>

        Fix compositing layers in columns when in paginated mode
        https://bugs.webkit.org/show_bug.cgi?id=91425

        Reviewed by Dave Hyatt.

        Enhance a hack that was added to allow composited layers to
        display in columns to work for paginated mode, where the
        RenderView is renderer with columns.

        Test: compositing/columns/composited-in-paginated.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::updateLayerPosition):

2012-07-16  Emil A Eklund  <eae@chromium.org>

        Inconsistent rounding in table layout causes background color to bleed through
        https://bugs.webkit.org/show_bug.cgi?id=91410

        Reviewed by Eric Seidel.

        At certain zoom levels a rounding error in the table layout code cases
        the table background color to bleed through between cells. Tables layout
        happens on pixel bounds however the paint offset wasn't correctly rounded.

        Test: fast/sub-pixel/table-rows-no-gaps.html

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::paintObject):
        Round paintOffset before passing it to the paint method of the children.

2012-07-16  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r122739.
        http://trac.webkit.org/changeset/122739
        https://bugs.webkit.org/show_bug.cgi?id=91424

        Broke mac builds (Requested by rniwa on #webkit).

        * inspector/CodeGeneratorInspector.py:
        (flatten_list):

2012-07-16  Dana Jansens  <danakj@chromium.org>

        [chromium] Remove non-ephemeral data from RenderSurface as it duplicates data from the owning layer
        https://bugs.webkit.org/show_bug.cgi?id=91418

        Reviewed by Adrienne Walker.

        This removes the filters and masks from render surfaces, and makes them
        used directly from the owning layer. Also removes skipsDraw from
        surfaces as it was just not used at all.

        Covered by existing tests.

        * platform/graphics/chromium/LayerChromium.h:
        (WebCore::LayerChromium::filters):
        (WebCore::LayerChromium::backgroundFilters):
        (WebCore::LayerChromium::hasMask):
        (WebCore::LayerChromium::hasReplica):
        (WebCore::LayerChromium::replicaHasMask):
        (LayerChromium):
        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
        (WebCore::RenderSurfaceChromium::RenderSurfaceChromium):
        * platform/graphics/chromium/RenderSurfaceChromium.h:
        (RenderSurfaceChromium):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore::CCLayerImpl::hasMask):
        (WebCore::CCLayerImpl::hasReplica):
        (WebCore::CCLayerImpl::replicaHasMask):
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::calculateMemoryForRenderSurfaces):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateDrawTransformsInternal):
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::::finishedRenderTarget):
        (WebCore::reduceOcclusionBelowSurface):
        (WebCore::::leaveToRenderTarget):
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::appendQuadsForRenderSurfaceLayer):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::drawableContentRect):
        (WebCore::CCRenderSurface::appendQuads):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (CCRenderSurface):

2012-07-16  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=91299
        Paginated views should restrict available height to column height
        -and corresponding-
        <rdar://problem/11152108>

        Reviewed by Dan Bernstein.

        Now that RenderViews can have columns, availableLogicalHeight needs to consider 
        that column height, much like how availableLogicalWidth already considers column 
        width.

        availableLogicalHeight is newly virtual, like the already-virtual 
        availableLogicalWidth.
        * rendering/RenderBox.h:
        (RenderBox):

        Check with the columnHeight.
        * rendering/RenderView.cpp:
        (WebCore):
        (WebCore::RenderView::availableLogicalHeight):
        * rendering/RenderView.h:

        setPagination now takes pageLength as an optional parameter. 
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::setPagination):
        * testing/InternalSettings.h:
        (WebCore::InternalSettings::setPagination):
        (InternalSettings):
        * testing/InternalSettings.idl:
        * testing/Internals.cpp:
        (WebCore::Internals::setPagination):
        * testing/Internals.h:
        (WebCore::Internals::setPagination):
        (Internals):
        * testing/Internals.idl:

2012-07-16  Dana Jansens  <danakj@chromium.org>

        [chromium] Remove targetRenderSurface concept, give layers a renderTarget which is the layer whose coordinate space they draw into
        https://bugs.webkit.org/show_bug.cgi?id=91288

        Reviewed by Adrienne Walker.

        Always use pointers to layers when discussing render targets instead of
        pointing directly to a RenderSurface.

        Covered by existing tests.

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::LayerChromium):
        (WebCore::LayerChromium::createRenderSurface):
        * platform/graphics/chromium/LayerChromium.h:
        (WebCore::LayerChromium::renderTarget):
        (WebCore::LayerChromium::setRenderTarget):
        (LayerChromium):
        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
        * platform/graphics/chromium/RenderSurfaceChromium.h:
        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        (WebCore::ScrollbarLayerChromium::setTexturePriorities):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::setTexturePrioritiesInRect):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::CCLayerImpl):
        (WebCore::CCLayerImpl::createRenderSurface):
        (WebCore::CCLayerImpl::dumpLayerProperties):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore::CCLayerImpl::renderTarget):
        (WebCore::CCLayerImpl::setRenderTarget):
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateLayerScissorRect):
        (WebCore::calculateSurfaceScissorRect):
        (WebCore::calculateVisibleContentRect):
        (WebCore::computeScrollCompensationForThisLayer):
        (WebCore::calculateDrawTransformsInternal):
        (WebCore::pointIsClippedBySurfaceOrClipRect):
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::::enterLayer):
        (WebCore::::leaveLayer):
        (WebCore::::enterRenderTarget):
        (WebCore::::finishedRenderTarget):
        (WebCore):
        (WebCore::reduceOcclusionBelowSurface):
        (WebCore::::leaveToRenderTarget):
        (WebCore::::markOccludedBehindLayer):
        (WebCore::::occluded):
        (WebCore::::unoccludedContentRect):
        (WebCore::::unoccludedContributingSurfaceContentRect):
        (WebCore::::layerScissorRectInTargetSurface):
        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
        (CCOcclusionTrackerBase):
        (WebCore::CCOcclusionTrackerBase::StackObject::StackObject):
        (StackObject):
        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
        (WebCore::CCQuadCuller::appendSurface):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (CCRenderSurface):

2012-07-16  Florin Malita  <fmalita@chromium.org>

        SVGAnimationElement::currentValuesForValuesAnimation crash
        https://bugs.webkit.org/show_bug.cgi?id=91326

        Reviewed by Simon Fraser.

        SVGSMILElement::progress() assumes that seekToIntervalCorrespondingToTime() always
        lands inside a defined interval, but one can force arbitrary time offsets using
        setCurrentTime(). This patch adds logic for handling non-interval time offsets
        gracefully.

        Test: svg/animations/smil-setcurrenttime-crash.svg

        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::progress):

2012-07-16  Joshua Netterfield  <jnetterfield@rim.com>

        [BlackBerry] Upstream WebGL Code
        https://bugs.webkit.org/show_bug.cgi?id=91143

        Reviewed by Rob Buis.

        This patch includes BlackBerry-specific fixes for anti-aliasing, logging, and shader compilation.

        No new tests, because there is no new functionality.

        * platform/graphics/GraphicsContext3D.h: Add a value for TI Imagination chipsets on BlackBerry platforms
        * platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp: Multiple downstream changes
        (WebCore::GraphicsContext3D::GraphicsContext3D):
        (WebCore::GraphicsContext3D::reshapeFBOs):
        (WebCore):
        (WebCore::GraphicsContext3D::logFrameBufferStatus):
        (WebCore::GraphicsContext3D::readPixelsIMG): BlackBerry-specific fix for Imagination hardware.
        (WebCore::GraphicsContext3D::paintsIntoCanvasBuffer):
        (WebCore::GraphicsContext3D::platformTexture):
        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
        (WebCore::GraphicsContext3D::paintToCanvas):
        * platform/graphics/opengl/Extensions3DOpenGL.h: Remove unnecessary whitespace.
        (Extensions3DOpenGL):
        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:
        (WebCore::Extensions3DOpenGLCommon::getTranslatedShaderSourceANGLE): Hack to fix ANGLE-generated code on BlackBerry platforms.
        * platform/graphics/opengl/Extensions3DOpenGLCommon.h:
        (Extensions3DOpenGLCommon):
        * platform/graphics/opengl/Extensions3DOpenGLES.cpp: I am not in a position to change system headers from correct to incorrect.
        (WebCore::Extensions3DOpenGLES::renderbufferStorageMultisample):
        (WebCore::Extensions3DOpenGLES::supportsExtension):
        * platform/graphics/opengl/Extensions3DOpenGLES.h: I am not in a position to change system headers from correct to incorrect.
        (Extensions3DOpenGLES):
        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp: Add a BlackBerry-specific anti-aliasing fix.
        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):
        (WebCore::GraphicsContext3D::prepareTexture):
        (WebCore::GraphicsContext3D::bindFramebuffer):
        (WebCore::GraphicsContext3D::compileShader):
        (WebCore::GraphicsContext3D::copyTexImage2D):
        (WebCore::GraphicsContext3D::copyTexSubImage2D):
        (WebCore):
        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
        (WebCore):

2012-07-16  Tony Chang  <tony@chromium.org>

        Position grid items by row/column index
        https://bugs.webkit.org/show_bug.cgi?id=91293

        Reviewed by Ojan Vafai.

        Do some initial grid positioning. Only handle the simple case where tracks are
        fixed values and don't properly size the grid items. This gives us something to
        work with and starts implementing the "Grid Track Sizing Algorithm":
        http://dev.w3.org/csswg/css3-grid-layout/#grid-track-sizing-algorithm0

        Test: fast/css-grid-layout/place-cell-by-index.html

        * rendering/RenderGrid.cpp:
        (RenderGrid::GridTrack): Data structure for holding the track size. UsedBreadth matches the terminology
        used in the spec.
        (WebCore::RenderGrid::layoutBlock): Pull in some boiler plate code and put the
        grid specific code in layoutGridItems.
        (WebCore::RenderGrid::computedUsedBreadthOfGridTracks): Implement part of the grid track sizing algorithm.
        (WebCore::RenderGrid::layoutGridItems): Compute the size of grid tracks, layout and position children.
        (WebCore::RenderGrid::findChildLogicalPosition): Map track sizes to the actual position of the child.
        * rendering/RenderGrid.h:
        * rendering/style/RenderStyle.h: Just return a copy of Length rather than a reference to Length. This seems
        more consistent with other getters that return a Length.

2012-07-16  Sami Kyostila  <skyostil@chromium.org>

        [chromium] Only apply page scale delta to root scroll layer
        https://bugs.webkit.org/show_bug.cgi?id=91374

        Reviewed by Adrienne Walker.

        When the user pinch-zooms the web page though the Chromium compositor, the
        per-layer page scale delta is used to keep track of the difference between the
        page scale on the compositor thread versus the main thread. On the next
        commit to the main thread these values are reset to 1.

        When calculating layer positions, the compositor applies a layer's page scale
        delta both to the layer itself as well as all of its children. Since we are
        currently updating the page scale delta on all scrollable layers, this results
        in scrollable child layers getting scaled multiple times.

        This patch changes the compositor to only apply the page scale delta on the
        root scroll layer.

        New unit test: CCLayerTreeHostImplTest.pageScaleDeltaAppliedToRootScrollLayerOnly

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::setPageScaleFactorAndLimits):
        (WebCore::CCLayerTreeHostImpl::setPageScaleDelta):

2012-07-16  Kihong Kwon  <kihong.kwon@samsung.com>

        Remove setController from BatteryClient
        https://bugs.webkit.org/show_bug.cgi?id=90944

        Reviewed by Adam Barth.

        BatteryClient doesn't need to keep m_controller,
        because BatteryController can be accessed using BatteryController::from().
        Remove BatteryClient::setController function.

        No new tests. Covered by existing tests.

        * Modules/battery/BatteryClient.h:
        * Modules/battery/BatteryController.cpp:
        (WebCore::BatteryController::BatteryController):

2012-07-16  Mike West  <mkwst@chromium.org>

        Invalid `script-nonce` directives should block script execution.
        https://bugs.webkit.org/show_bug.cgi?id=91353

        Reviewed by Adam Barth.

        If the `script-nonce` Content Security Policy directive contains an
        invalid value, we should fail loudly, throwing a warning to the console
        and denying execution of script on the page. The is in line with the
        current state of the experimental CSP 1.1 Editors Draft[1].

        [1]: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#script-nonce--experimental

        Test: http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce.html

        * page/ContentSecurityPolicy.cpp:
        (WebCore::CSPDirectiveList::checkNonceAndReportViolation):
            Check against null rather than empty for early exit, otherwise
            only compare nonces if the stored nonce isn't empty.
        (WebCore::CSPDirectiveList::parseScriptNonce):
            Assign the empty string if nonce is invalid.

2012-07-16  Min Qin  <qinmin@chromium.org>

        [Android] remove RenderThemeChromiumAndroid::paintMediaFullscreenButton()
        https://bugs.webkit.org/show_bug.cgi?id=91291

        Reviewed by Adam Barth.

        The recent media control refactoring added paintMediaFullscreenButton() in RenderThemeChromiumSkia.
        Since RenderThemeChromiumAndroid inherits from that class, we don't need to redefine this function.
        No test needed as this change just removes an unnecessary override.

        * rendering/RenderThemeChromiumAndroid.cpp:
        * rendering/RenderThemeChromiumAndroid.h:

2012-07-16  Peter Rybin  <peter.rybin@gmail.com>

        Web Inspector: CodeGeneratorInspector.py: fix output write logic to support incremental build
        https://bugs.webkit.org/show_bug.cgi?id=90642

        Reviewed by Yury Semikhatsky.

        A small intermediate writer is added. It handles comparing old and new source before actual writing.

        * inspector/CodeGeneratorInspector.py:
        (flatten_list):
        (SmartOutput):
        (SmartOutput.__init__):
        (SmartOutput.write):
        (SmartOutput.close):

2012-07-16  Dana Jansens  <danakj@chromium.org>

        [chromium] Incorrect assertion: Replicas will cause a RenderPass to be removed twice
        https://bugs.webkit.org/show_bug.cgi?id=91328

        Reviewed by Adrienne Walker.

        We asserted that we would never attempt to remove a render pass that had
        already been removed. This was incorrect as a surface with a replica has
        two quads and both may cause us to attempt its removal. We must handle
        this case gracefully.

        Test: CCLayerTreeHostTestSurfaceNotAllocatedForLayersOutsideMemoryLimit

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithNoQuads::shouldRemoveRenderPass):

2012-07-16  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: native memory: fix instrumentation for string members
        https://bugs.webkit.org/show_bug.cgi?id=91384

        Reviewed by Pavel Feldman.

        It was possible to report a string member via addMember instead of addString.
        This patch is fixing the problem and adding a link time guard.

        Covered by existing inspector performance tests infrastructure.

        * dom/ElementAttributeData.h:
        (WebCore::ElementAttributeData::reportMemoryUsage):
        * dom/MemoryInstrumentation.h:
        (WebCore):
        (WebCore::MemoryClassInfo::addString):
        * dom/QualifiedName.h:
        (WebCore::QualifiedName::QualifiedNameImpl::reportMemoryUsage):

2012-07-16  Zoltan Horvath  <zoltan@webkit.org>

        Unreviewed. Remove unnecessary executable bits after r122720.

        * platform/graphics/ImageSource.h:
        * platform/graphics/qt/ImageBufferQt.cpp:
        * platform/graphics/qt/ImageDecoderQt.cpp:
        * platform/graphics/qt/ImageQt.cpp:
        * platform/graphics/qt/StillImageQt.h:
        * platform/graphics/qt/TransparencyLayer.h:

2012-07-16  Zoltan Horvath  <zoltan@webkit.org>

        [Qt] Change NativeImagePtr from QPixmap* to QImage*
        https://bugs.webkit.org/show_bug.cgi?id=88785

        Reviewed by Simon Hausmann.

        Since we use raster engine there is no difference between QPixmap and QImage, so we are going
        to use QImage everywhere where it is possible. This refactoring contains the change of the
        NativeImagePtr typedef from QPixmap* to QImage* and covers the related modifications.

        Part of the change is similar to Viatcheslav Ostapenko's internal work.

        Covered by existing tests.

        * bridge/qt/qt_pixmapruntime.cpp:
        (JSC::Bindings::QtPixmapAssignToElementMethod::invoke):
        (JSC::Bindings::QtPixmapInstance::variantFromObject):
        * platform/DragImage.h:
        (WebCore):
        * platform/graphics/GraphicsContext.h:
        (GraphicsContext):
        * platform/graphics/Image.h:
        (Image):
        * platform/graphics/ImageSource.h:
        (WebCore):
        * platform/graphics/gstreamer/ImageGStreamer.h:
        * platform/graphics/gstreamer/ImageGStreamerQt.cpp:
        (ImageGStreamer::ImageGStreamer):
        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        (WebCore::GraphicsContext3D::getImageData):
        * platform/graphics/qt/GraphicsContextQt.cpp:
        (WebCore::GraphicsContext::pushTransparencyLayerInternal):
        (WebCore::GraphicsContext::beginPlatformTransparencyLayer):
        (WebCore::GraphicsContext::endPlatformTransparencyLayer):
        * platform/graphics/qt/ImageBufferDataQt.h:
        (ImageBufferData):
        * platform/graphics/qt/ImageBufferQt.cpp:
        (WebCore::ImageBufferData::ImageBufferData):
        (WebCore::ImageBuffer::copyImage):
        (WebCore::ImageBuffer::clip):
        (WebCore::ImageBuffer::platformTransformColorSpace):
        (WebCore::getImageData):
        (WebCore::ImageBuffer::putByteArray):
        (WebCore::encodeImage):
        (WebCore::ImageBuffer::toDataURL):
        * platform/graphics/qt/ImageDecoderQt.cpp:
        (WebCore::ImageFrame::asNewNativeImage):
        * platform/graphics/qt/ImageQt.cpp:
        (graphics):
        (loadResourceImage):
        (WebCore::Image::loadPlatformResource):
        (WebCore::Image::setPlatformResource):
        (WebCore::Image::drawPattern):
        (WebCore::BitmapImage::BitmapImage):
        (WebCore::BitmapImage::draw):
        (WebCore::BitmapImage::checkForSolidColor):
        (WebCore::BitmapImage::create):
        * platform/graphics/qt/NativeImageQt.h: Added.
        (WebCore):
        (NativeImageQt):
        (WebCore::NativeImageQt::defaultFormatForAlphaEnabledImages):
        (WebCore::NativeImageQt::defaultFormatForOpaqueImages):
         * platform/graphics/qt/PatternQt.cpp:
        (WebCore::Pattern::createPlatformPattern):
        * platform/graphics/qt/StillImageQt.cpp:
        (WebCore::StillImage::StillImage):
        (WebCore::StillImage::~StillImage):
        (WebCore::StillImage::currentFrameHasAlpha):
        (WebCore::StillImage::size):
        (WebCore::StillImage::nativeImageForCurrentFrame):
        (WebCore::StillImage::draw):
        * platform/graphics/qt/StillImageQt.h:
        (WebCore::StillImage::create):
        (WebCore::StillImage::createForRendering):
        (StillImage):
        * platform/graphics/qt/TransparencyLayer.h:
        (WebCore::TransparencyLayer::TransparencyLayer):
        (TransparencyLayer):
        * platform/graphics/texmap/TextureMapperGL.cpp:
        * platform/graphics/surfaces/qt/GraphicsSurfaceQt.cpp:
        (WebCore::GraphicsSurface::createReadOnlyImage):
         * platform/qt/ClipboardQt.cpp:
        (WebCore::ClipboardQt::createDragImage):
        (WebCore::ClipboardQt::declareAndWriteDragImage):
        * platform/qt/CursorQt.cpp:
        (WebCore::createCustomCursor):
        * platform/qt/DragImageQt.cpp:
        (WebCore::createDragImageFromImage):
        * platform/qt/PasteboardQt.cpp:
        (WebCore::Pasteboard::writeImage):

2012-07-16  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: moving forward to the better memory instrumentation API
        https://bugs.webkit.org/show_bug.cgi?id=91259

        Reviewed by Pavel Feldman.

        I'm trying to remove unnecessary complexity of the API
        reportInstrumentedObject and reportInstrumentedPointer will be replaced with addInstrumentedMember
        The same will happen with reportPointer, reportObject pair.
        Also info.report* will be replaced with info.add*

        * bindings/js/ScriptWrappable.h:
        (WebCore::ScriptWrappable::reportMemoryUsage):
        * bindings/v8/DOMDataStore.cpp:
        (WebCore::DOMDataStore::reportMemoryUsage):
        * bindings/v8/IntrusiveDOMWrapperMap.h:
        (WebCore::ChunkedTable::reportMemoryUsage):
        * bindings/v8/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
        * bindings/v8/ScriptWrappable.h:
        (WebCore::ScriptWrappable::reportMemoryUsage):
        * bindings/v8/V8Binding.cpp:
        (WebCore::V8BindingPerIsolateData::reportMemoryUsage):
        (WebCore::StringCache::reportMemoryUsage):
        * bindings/v8/V8DOMMap.h:
        * css/StylePropertySet.h:
        (WebCore::StylePropertySet::reportMemoryUsage):
        * dom/CharacterData.cpp:
        (WebCore::CharacterData::reportMemoryUsage):
        * dom/ContainerNode.h:
        (WebCore::ContainerNode::reportMemoryUsage):
        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        * dom/Element.h:
        (WebCore::Element::reportMemoryUsage):
        * dom/ElementAttributeData.h:
        (WebCore::ElementAttributeData::reportMemoryUsage):
        * dom/MemoryInstrumentation.h:
        (WebCore::MemoryInstrumentation::addInstrumentedMember):
        (MemoryInstrumentation):
        (WebCore::MemoryInstrumentation::addMember):
        (WebCore::MemoryInstrumentation::OwningTraits::addInstrumentedMember):
        (WebCore::MemoryInstrumentation::OwningTraits::addMember):
        (WebCore::MemoryInstrumentation::addInstrumentedMemberImpl):
        (WebCore::MemoryInstrumentation::addMemberImpl):
        (WebCore::MemoryClassInfo::addInstrumentedMember):
        (WebCore::MemoryClassInfo::addMember):
        (WebCore::MemoryClassInfo::addHashMap):
        (WebCore::MemoryClassInfo::addHashSet):
        (WebCore::MemoryClassInfo::addListHashSet):
        (WebCore::MemoryClassInfo::addVector):
        (WebCore::MemoryClassInfo::addString):
        (WebCore::MemoryInstrumentation::addHashMap):
        (WebCore::MemoryInstrumentation::addHashSet):
        (WebCore::MemoryInstrumentation::addListHashSet):
        (WebCore::MemoryInstrumentation::addVector):
        * dom/Node.cpp:
        (WebCore::Node::reportMemoryUsage):
        * dom/QualifiedName.h:
        (WebCore::QualifiedName::QualifiedNameImpl::reportMemoryUsage):
        (WebCore::QualifiedName::reportMemoryUsage):
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):
        * platform/TreeShared.h:
        (WebCore::TreeShared::reportMemoryUsage):

2012-07-16  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r122714.
        http://trac.webkit.org/changeset/122714
        https://bugs.webkit.org/show_bug.cgi?id=91380

        It broke mac compilation (Requested by loislo on #webkit).

        * bindings/js/ScriptWrappable.h:
        (WebCore::ScriptWrappable::reportMemoryUsage):
        * bindings/v8/DOMDataStore.cpp:
        (WebCore::DOMDataStore::reportMemoryUsage):
        * bindings/v8/IntrusiveDOMWrapperMap.h:
        (WebCore::ChunkedTable::reportMemoryUsage):
        * bindings/v8/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
        * bindings/v8/ScriptWrappable.h:
        (WebCore::ScriptWrappable::reportMemoryUsage):
        * bindings/v8/V8Binding.cpp:
        (WebCore::V8BindingPerIsolateData::reportMemoryUsage):
        (WebCore::StringCache::reportMemoryUsage):
        * bindings/v8/V8DOMMap.h:
        * css/StylePropertySet.h:
        (WebCore::StylePropertySet::reportMemoryUsage):
        * dom/CharacterData.cpp:
        (WebCore::CharacterData::reportMemoryUsage):
        * dom/ContainerNode.h:
        (WebCore::ContainerNode::reportMemoryUsage):
        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        * dom/Element.h:
        (WebCore::Element::reportMemoryUsage):
        * dom/ElementAttributeData.h:
        (WebCore::ElementAttributeData::reportMemoryUsage):
        * dom/MemoryInstrumentation.h:
        (WebCore::MemoryInstrumentation::reportObject):
        (MemoryInstrumentation):
        (WebCore::MemoryInstrumentation::reportPointer):
        (WebCore::MemoryClassInfo::reportInstrumentedPointer):
        (WebCore::MemoryClassInfo::reportInstrumentedObject):
        (WebCore::MemoryClassInfo::reportPointer):
        (WebCore::MemoryClassInfo::reportObject):
        (WebCore::MemoryClassInfo::reportHashMap):
        (WebCore::MemoryClassInfo::reportHashSet):
        (WebCore::MemoryClassInfo::reportListHashSet):
        (WebCore::MemoryClassInfo::reportVector):
        (MemoryClassInfo):
        (WebCore::MemoryClassInfo::reportString):
        (WebCore):
        (WebCore::MemoryInstrumentation::reportInstrumentedPointer):
        (WebCore::MemoryInstrumentation::reportInstrumentedObject):
        (WebCore::MemoryInstrumentation::reportHashMap):
        (WebCore::MemoryInstrumentation::reportHashSet):
        (WebCore::MemoryInstrumentation::reportListHashSet):
        (WebCore::MemoryInstrumentation::reportVector):
        * dom/Node.cpp:
        (WebCore::Node::reportMemoryUsage):
        * dom/QualifiedName.h:
        (WebCore::QualifiedName::QualifiedNameImpl::reportMemoryUsage):
        (WebCore::QualifiedName::reportMemoryUsage):
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):
        * platform/TreeShared.h:
        (WebCore::TreeShared::reportMemoryUsage):

2012-07-16  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: moving forward to the better memory instrumentation API
        https://bugs.webkit.org/show_bug.cgi?id=91259

        Reviewed by Pavel Feldman.

        I'm trying to remove unnecessary complexity of the API
        reportInstrumentedObject and reportInstrumentedPointer will be replaced with addInstrumentedMember
        The same will happen with reportPointer, reportObject pair.
        Also info.report* will be replaced with info.add*

        * bindings/js/ScriptWrappable.h:
        (WebCore::ScriptWrappable::reportMemoryUsage):
        * bindings/v8/DOMDataStore.cpp:
        (WebCore::DOMDataStore::reportMemoryUsage):
        * bindings/v8/IntrusiveDOMWrapperMap.h:
        (WebCore::ChunkedTable::reportMemoryUsage):
        * bindings/v8/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
        * bindings/v8/ScriptWrappable.h:
        (WebCore::ScriptWrappable::reportMemoryUsage):
        * bindings/v8/V8Binding.cpp:
        (WebCore::V8BindingPerIsolateData::reportMemoryUsage):
        (WebCore::StringCache::reportMemoryUsage):
        * bindings/v8/V8DOMMap.h:
        * css/StylePropertySet.h:
        (WebCore::StylePropertySet::reportMemoryUsage):
        * dom/CharacterData.cpp:
        (WebCore::CharacterData::reportMemoryUsage):
        * dom/ContainerNode.h:
        (WebCore::ContainerNode::reportMemoryUsage):
        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        * dom/Element.h:
        (WebCore::Element::reportMemoryUsage):
        * dom/ElementAttributeData.h:
        (WebCore::ElementAttributeData::reportMemoryUsage):
        * dom/MemoryInstrumentation.h:
        (WebCore::MemoryInstrumentation::addInstrumentedMember):
        (MemoryInstrumentation):
        (WebCore::MemoryInstrumentation::addMember):
        (WebCore::MemoryInstrumentation::OwningTraits::addInstrumentedMember):
        (WebCore::MemoryInstrumentation::OwningTraits::addMember):
        (WebCore::MemoryInstrumentation::addInstrumentedMemberImpl):
        (WebCore::MemoryInstrumentation::addMemberImpl):
        (WebCore::MemoryClassInfo::addInstrumentedMember):
        (WebCore::MemoryClassInfo::addMember):
        (WebCore::MemoryClassInfo::addHashMap):
        (WebCore::MemoryClassInfo::addHashSet):
        (WebCore::MemoryClassInfo::addListHashSet):
        (WebCore::MemoryClassInfo::addVector):
        (WebCore::MemoryClassInfo::addString):
        (WebCore::MemoryInstrumentation::addHashMap):
        (WebCore::MemoryInstrumentation::addHashSet):
        (WebCore::MemoryInstrumentation::addListHashSet):
        (WebCore::MemoryInstrumentation::addVector):
        * dom/Node.cpp:
        (WebCore::Node::reportMemoryUsage):
        * dom/QualifiedName.h:
        (WebCore::QualifiedName::QualifiedNameImpl::reportMemoryUsage):
        (WebCore::QualifiedName::reportMemoryUsage):
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):
        * platform/TreeShared.h:
        (WebCore::TreeShared::reportMemoryUsage):

2012-07-16  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: native memory instrumentation: extract instrumentation methods into MemoryClassInfo
        https://bugs.webkit.org/show_bug.cgi?id=91227

        Reviewed by Pavel Feldman.

        void Node::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
        {
            MemoryClassInfo<Node> info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
            info.visitBaseClass<ScriptWrappable>(this);

            info.addMember(m_notInstrumentedPointer); // automatically detects poniter/reference
            info.addInstrumentedMember(m_next);
            info.addHashSet<MemoryInstrumentation::NonClass>(m_aHash);                // NonClass value_type (report only size of internal template structures)
            info.addHashSet<MemoryInstrumentation::NotInstrumentedClass>(m_aHashSet); // not instrumented value_type (use sizeof)
            info.addHashSet<MemoryInstrumentation::InstrumentedClass>(m_aHashSet);    // instrumented value_type (call visit)
        }

        The change is covered by existing tests for native memory snapshot.

        * bindings/v8/DOMDataStore.cpp:
        (WebCore::DOMDataStore::reportMemoryUsage):
        * bindings/v8/IntrusiveDOMWrapperMap.h:
        (WebCore::ChunkedTable::reportMemoryUsage):
        * bindings/v8/ScriptWrappable.h:
        (WebCore::ScriptWrappable::reportMemoryUsage):
        * bindings/v8/V8Binding.cpp:
        (WebCore::V8BindingPerIsolateData::reportMemoryUsage):
        (WebCore::StringCache::reportMemoryUsage):
        * bindings/v8/V8DOMMap.h:
        * css/StylePropertySet.h:
        (WebCore::StylePropertySet::reportMemoryUsage):
        * dom/CharacterData.cpp:
        (WebCore::CharacterData::reportMemoryUsage):
        * dom/ContainerNode.h:
        (WebCore::ContainerNode::reportMemoryUsage):
        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        * dom/Element.h:
        (WebCore::Element::reportMemoryUsage):
        * dom/ElementAttributeData.h:
        (WebCore::ElementAttributeData::reportMemoryUsage):
        * dom/MemoryInstrumentation.h:
        (MemoryInstrumentation):
        (WebCore::MemoryObjectInfo::objectType):
        (WebCore::MemoryObjectInfo::objectSize):
        (WebCore::MemoryObjectInfo::memoryInstrumentation):
        (MemoryObjectInfo):
        (WebCore::MemoryObjectInfo::reportObjectInfo):
        (WebCore):
        (MemoryClassInfo):
        (WebCore::MemoryClassInfo::MemoryClassInfo):
        (WebCore::MemoryClassInfo::visitBaseClass):
        (WebCore::MemoryClassInfo::reportInstrumentedPointer):
        (WebCore::MemoryClassInfo::reportInstrumentedObject):
        (WebCore::MemoryClassInfo::reportPointer):
        (WebCore::MemoryClassInfo::reportObject):
        (WebCore::MemoryClassInfo::reportHashMap):
        (WebCore::MemoryClassInfo::reportHashSet):
        (WebCore::MemoryClassInfo::reportListHashSet):
        (WebCore::MemoryClassInfo::reportVector):
        (WebCore::MemoryClassInfo::reportString):
        * dom/Node.cpp:
        (WebCore::Node::reportMemoryUsage):
        * dom/QualifiedName.h:
        (WebCore::QualifiedName::QualifiedNameImpl::reportMemoryUsage):
        (WebCore::QualifiedName::reportMemoryUsage):
        * platform/TreeShared.h:
        (WebCore::TreeShared::reportMemoryUsage):

2012-07-15  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix make distcheck.

        * GNUmakefile.am: Add missing idl directory.
        * GNUmakefile.list.am: Add missing files to compilation.

2012-07-16  Eugene Klyuchnikov  <eustas.big@gmail.com>

        Web Inspector: Implement message loop instrumentation for timeline
        https://bugs.webkit.org/show_bug.cgi?id=88325

        Reviewed by Pavel Feldman.

        Message loop instrumentation will show when the render thread is busy.

        * inspector/front-end/Settings.js:
        (WebInspector.ExperimentsSettings):
        Added new experiment.
        * inspector/front-end/TimelineGrid.js:
        (WebInspector.TimelineGrid.prototype.get dividersLabelBarElement):
        Exposed label bar element.
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel):
        (WebInspector.TimelinePanel.prototype._resetPanel):
        Cleanups recorded tasks.
        (WebInspector.TimelinePanel.prototype._refresh):
        Updates CPU bar.
        (WebInspector.TimelinePanel.prototype._refreshRecords):
        Ditto.
        (WebInspector.TimelinePanel.prototype._refreshCpuBars.compareEndTime):
        Ditto.
        (WebInspector.TimelinePanel.prototype._refreshCpuBars):
        Ditto.
        (WebInspector.TimelinePanel.prototype._enableMainThreadMonitoringExperiment):
        Adds CPU bar to UI.
        (WebInspector.TimelinePanel.prototype._showPopover):
        Fix NPE.
        (WebInspector.TimelineCalculator.prototype.computeTime):
        Utility for position to time conversion.
        (WebInspector.TimelineCalculator.prototype.setDisplayWindow):
        Remenbers clientWidth.
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.categories):
        Define CPU bar colors.
        * inspector/front-end/timelinePanel.css:
        (.timeline-cpu-bars):
        CPU bar styles.
        (.timeline-cpu-bars-label):
        Ditto.

2012-07-16  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r122681.
        http://trac.webkit.org/changeset/122681
        https://bugs.webkit.org/show_bug.cgi?id=91363

        Patch introduces crashes in debug builds for GTK and EFL ports
        (Requested by zdobersek on #webkit).

        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::scrollPositionChanged):

2012-07-16  Luke Macpherson  <macpherson@chromium.org>

        Compilation failure in StyleResolver.cpp (clang)
        https://bugs.webkit.org/show_bug.cgi?id=89892

        Reviewed by Ryosuke Niwa.

        Patch adds assertions that unreachable code is in fact not reached.

        Covered by fast/css/variables tests.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-07-15  Mike Lawther  <mikelawther@chromium.org>

        Fix calculation of rgba's alpha in CSS custom text
        https://bugs.webkit.org/show_bug.cgi?id=91355

        Reviewed by Ryosuke Niwa.

        Alpha values are stored as an 8 bit value. To convert this to a float in the
        range [0,1], we need to divide by 255, not 256. 

        Test: fast/css/rgba-custom-text.html

        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::customCssText):

2012-07-15  Jason Liu  <jason.liu@torchmobile.com.cn>

        [BlackBerry] We shouldn't call didFinishLoading for the old request when a new request has been sent by notifyAuthReceived.
        https://bugs.webkit.org/show_bug.cgi?id=90962

        Reviewed by Rob Buis.

        We start a new NetworkJob with credentials after receiving 401/407 status.
        We should not release resources in webcore when the old job is closed because
        they are needed by the new one.
        We should do as 3XX.

        No new tests. No change in behaviour.

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::NetworkJob):
        (WebCore::NetworkJob::notifyAuthReceived):
        (WebCore::NetworkJob::shouldReleaseClientResource):
        (WebCore::NetworkJob::handleRedirect):
        * platform/network/blackberry/NetworkJob.h:
        (NetworkJob):

2012-07-15  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r122660): Cannot iterate over HTMLCollection that contains non-child descendent nodes in some conditions
        https://bugs.webkit.org/show_bug.cgi?id=91334

        Reviewed by Ojan Vafai.

        The bug was caused by using lastChild() as the starting node for traversePreviousNode. Since it's the inverse of
        Node::traverseNextNode(), which visits nodes in pre order, we must start our search from the last descendent node,
        which is visited traverseNextNode immediately before reaching the root node.

        Test: fast/dom/htmlcollection-backwards-subtree-iteration.html

        * html/HTMLCollection.cpp:
        (WebCore::lastDescendent):
        (WebCore):
        (WebCore::itemBeforeOrAfter):

2012-07-15  Joseph Pecoraro  <pecoraro@apple.com>

        Windowless WebView not firing JavaScript load event if there is a media element
        https://bugs.webkit.org/show_bug.cgi?id=91331

        Reviewed by Eric Carlson.

        In prepareForLoad we start deferring the load event. If we fall into this
        clause where the page can not start loading media we bail, potentially
        indefinitely waiting until we can start loading media. Since we can not
        be certain this will ever happen, we should stop deferring the page's
        load event.

        Test: WebKit1.WindowlessWebViewWithMedia TestWebKitAPI test. The only
        way this path was reachable right now is on the mac port.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::loadInternal):

2012-07-15  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/11875795> REGRESSION (tiled drawing): Page’s scroll bars flash with each character you type in a textarea (affects Wikipedia and YouTube)
        https://bugs.webkit.org/show_bug.cgi?id=91348

        Reviewed by Anders Carlsson.

        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::scrollPositionChanged): Added an early return if the scroll position
        did not, in fact, change. This avoids the call to ScrollAnimator::notifyContentAreaScrolled,
        which is what causes the scroll bars to flash.

2012-07-14  Eric Carlson  <eric.carlson@apple.com>

        Enable AVCF hardware video decoding
        https://bugs.webkit.org/show_bug.cgi?id=90015
        <rdar://problem/10770317>

        Reviewed by Anders Carlsson.

        * html/HTMLMediaElement.cpp:
        (WebCore):
        (WebCore::HTMLMediaElement::mediaPlayerGraphicsDeviceAdapter): New, return the client's graphics 
            device adapter.
        * html/HTMLMediaElement.h:

        * page/ChromeClient.h:
        (WebCore::ChromeClient::graphicsDeviceAdapter): New.

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::graphicsDeviceAdapter): New, ask the media element for the graphics
            device adapter.
        * platform/graphics/MediaPlayer.h:

        * platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h: Soft-link AVCFPlayerSetDirect3DDevice
            and AVCFPlayerEnableHardwareAcceleratedVideoDecoderKey.

        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp: 
        (WebCore::MediaPlayerPrivateAVFoundationCF::createAVAssetForURL): Pass the current d3d9
            device interface to the AVFWrapper.
        (WebCore::AVFWrapper::createAssetForURL): If the d3d9 device implements IDirect3DDevice9Ex,
            tell the AVAsset to enable hardware video decoding.
        (WebCore::AVFWrapper::createPlayer): Pass the d3d9 device to the player if it implements IDirect3DDevice9Ex.

        * platform/graphics/ca/win/CACFLayerTreeHost.h:
        (WebCore::CACFLayerTreeHost::graphicsDeviceAdapter): New, default implementation.

        * platform/graphics/ca/win/LegacyCACFLayerTreeHost.h:
        (WebCore::LegacyCACFLayerTreeHost::graphicsDeviceAdapter): New, default implementation.
        * platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp:
        (WebCore::WKCACFViewLayerTreeHost::graphicsDeviceAdapter): New.
        * platform/graphics/ca/win/WKCACFViewLayerTreeHost.h:

        * platform/win/SoftLinking.h: Define SOFT_LINK_DLL_IMPORT_OPTIONAL, SOFT_LINK_LOADED_LIBRARY,
            and SOFT_LINK_VARIABLE_DLL_IMPORT_OPTIONAL.

2012-07-14  Ryosuke Niwa  <rniwa@webkit.org>

        Fix Chromium Mac build failure after r122670.

        * platform/graphics/mac/ComplexTextController.cpp:

2012-07-14  Mark Rowe  <mrowe@apple.com>

        Fix the Snow Leopard build.

        * platform/LocalizedStrings.cpp:
        (WebCore::contextMenuItemTagLookUpInDictionary): Fix a typo in the condition so that Snow Leopard
        continues to take the expected path.

2012-07-14  Ryosuke Niwa  <rniwa@webkit.org>

        Accessing the last item in children should be a constant time operation
        https://bugs.webkit.org/show_bug.cgi?id=91320

        Reviewed by Ojan Vafai.

        Traverse nodes from the last item when the target offset we're looking for is closer to the last item
        than to the cached item. e.g. if the cached item was at offset 0 in the collection and length was 100,
        we should not be looking for the item at offset 95 from the cached item.

        Note that this trick can be only used in HTML collection that supports itemBefore and when the length
        cache is available.

        Also broke shouldSearchFromFirstItem into smaller logical pieces to clarify the intents.

        Test: perf/htmlcollection-last-item.html

        * html/HTMLCollection.cpp:
        (WebCore):
        (WebCore::HTMLCollection::isLastItemCloserThanLastOrCachedItem):
        (WebCore::HTMLCollection::isFirstItemCloserThanCachedItem):
        (WebCore::HTMLCollection::item):
        * html/HTMLCollection.h:
        (HTMLCollection):

2012-07-14  Mark Rowe  <mrowe@apple.com>

        Fix the Windows build.

        * platform/network/cf/DNSCFNet.cpp: Fix the condition to take Windows in to account.

2012-07-14  Mark Rowe  <mrowe@apple.com>

        Make it explicit which code paths iOS should use when doing checks based on OS X versions.

        Rubber-stamped by David Kilzer.

        * WebCore.exp.in:
        * accessibility/AccessibilityList.h:
        * accessibility/AccessibilityTable.h:
        * accessibility/mac/AXObjectCacheMac.mm:
        * editing/mac/EditorMac.mm:
        * loader/MainResourceLoader.cpp:
        * loader/MainResourceLoader.h:
        * page/AlternativeTextClient.h:
        * page/mac/SettingsMac.mm:
        * platform/LocalizedStrings.cpp:
        * platform/MemoryPressureHandler.cpp:
        * platform/audio/mac/AudioBusMac.mm:
        * platform/graphics/Gradient.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        * platform/graphics/ca/PlatformCALayer.h:
        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
        * platform/graphics/ca/mac/TileCache.mm:
        * platform/graphics/cg/GraphicsContextCG.cpp:
        * platform/graphics/cg/ImageBufferCG.cpp:
        * platform/graphics/cg/ImageBufferDataCG.h:
        * platform/graphics/cg/ImageCG.cpp:
        * platform/graphics/cg/ImageSourceCG.cpp:
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        * platform/graphics/mac/ComplexTextController.cpp:
        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
        * platform/graphics/mac/FontCacheMac.mm:
        * platform/graphics/mac/FontCustomPlatformData.cpp:
        * platform/graphics/mac/FontMac.mm:
        * platform/graphics/mac/GraphicsContextMac.mm:
        * platform/graphics/mac/SimpleFontDataMac.mm:
        * platform/graphics/mac/WebLayer.h:
        * platform/graphics/mac/WebLayer.mm:
        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
        * platform/mac/DisplaySleepDisabler.cpp:
        * platform/mac/DisplaySleepDisabler.h:
        * platform/mac/HTMLConverter.h:
        * platform/mac/HTMLConverter.mm:
        * platform/mac/MemoryPressureHandlerMac.mm:
        * platform/mac/SharedTimerMac.mm:
        * platform/mac/SuddenTermination.mm:
        * platform/mac/WebFontCache.mm:
        * platform/network/Credential.h:
        * platform/network/ResourceHandle.h:
        * platform/network/cf/DNSCFNet.cpp:
        * platform/network/cf/ProxyServerCFNet.cpp:
        * platform/network/cf/ResourceRequest.h:
        * platform/network/cf/SocketStreamHandleCFNet.cpp:
        * platform/network/mac/AuthenticationMac.mm:
        * platform/network/mac/CookieStorageMac.mm:
        * platform/network/mac/ResourceHandleMac.mm:
        * platform/network/mac/ResourceRequestMac.mm:
        * platform/network/mac/WebCoreURLResponse.mm:
        * platform/text/TextChecking.h:
        * platform/text/cf/HyphenationCF.cpp:
        * platform/text/mac/HyphenationMac.mm:
        * rendering/RenderLayerBacking.cpp:
        * rendering/RenderLayerCompositor.cpp:

2012-07-14  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r122614.
        http://trac.webkit.org/changeset/122614
        https://bugs.webkit.org/show_bug.cgi?id=91317

        Broke performance tests (Requested by rniwa on #webkit).

        * bindings/v8/V8Binding.cpp:
        (WebCore::StringCache::v8ExternalStringSlow):

2012-07-05  Robert Hogan  <robert@webkit.org>

        CSS 2.1 failure: vertical-align-boxes-001 fails
        https://bugs.webkit.org/show_bug.cgi?id=90626

        Reviewed by Eric Seidel.

        Tests: css2.1/20110323/vertical-align-boxes-001.htm

        A percentage value vertical-align is always a percentage of the actual line-height rather than
        the margin box per http://www.w3.org/TR/CSS21/visudet.html#propdef-vertical-align: 'Percentages: 
        refer to the 'line-height' of the element itself'.  Confusingly, RenderBox::lineheight() is a
        shorthand into the dimensions of the margin box for replaced elements in the other vertical-align
        cases, i.e. where it's the margin box that's relevant rather than the 'line-height'. So rather than patch RenderBox's
        lineHeight() to somehow consider the percentage cases, just give percentage vertical-align the full computedLineHeight()
        rather than lineHeight()'s margin box.

        * rendering/RootInlineBox.cpp:
        (WebCore::RootInlineBox::verticalPositionForBox):

2012-07-13  Ryosuke Niwa  <rniwa@webkit.org>

        Iterating backwards over HTMLCollection is O(n^2)
        https://bugs.webkit.org/show_bug.cgi?id=91306

        Reviewed by Anders Carlsson.

        Fixed the bug by introducing itemBefore that iterates nodes backwards to complement itemAfter.
        Unfortunately, some HTML collections such as HTMLFormCollection and HTMLTableRowsCollection have
        its own itemAfter function and writing an equivalent itemBefore is somewhat tricky. For now,
        added a new boolean flag indicating whether a given HTML collection supports itemBefore or not,
        and left those HTML collections that override itemAfter alone.

        This also paves our way to share more code between DynamicNodeList and HTMLCollection.

        Test: perf/htmlcollection-backwards-iteration.html

        * dom/DynamicNodeList.h:
        (WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase): Takes ItemBeforeSupportType.
        (WebCore::DynamicNodeListCacheBase::supportsItemBefore): Added.
        (DynamicNodeListCacheBase):
        (WebCore::DynamicNodeListCacheBase::setItemCache): Replaced a FIXME by an assertion now that
        we can.
        * html/HTMLAllCollection.cpp:
        (WebCore::HTMLAllCollection::HTMLAllCollection): Supports itemBefore since it doesn't override
        itemAfter.
        * html/HTMLCollection.cpp:
        (WebCore::HTMLCollection::HTMLCollection):
        (WebCore::HTMLCollection::create):
        (WebCore::isAcceptableElement): Made it a static local function instead of a static member.
        (WebCore::nextNode): Templatized.
        (WebCore::itemBeforeOrAfter): Extracted from itemAfter and templatized.
        (WebCore::HTMLCollection::itemBefore): Added.
        (WebCore::HTMLCollection::itemAfter):
        (WebCore::HTMLCollection::shouldSearchFromFirstItem): Added. Determines whether we should reset
        the item cache to the first item. We obviously do if the cache is invalid. If the target offset
        is after the cached offset, then we shouldn't go back regardless of availability of itemBefore.
        Otherwise, we go back to the first item iff itemBefore is not available or the distance from
        the cached offset to the target offset is greater than the target offset itself.
        (WebCore::HTMLCollection::length):
        (WebCore::HTMLCollection::item): Use the term "offset" to match the terminology elsewhere.
        (WebCore::HTMLCollection::itemBeforeOrAfterCachedItem): Ditto. Also added the logic to iterate
        nodes backwards using itemBefore. Once we're in this branch, we should always find a matching
        item since the target offset was less than the cached offset, and offsets are non-negative.
        If we had ever reached the end of the loop without finding an item, it indicates that the cache
        has been invalid and we have some serious bug elsewhere.
        * html/HTMLCollection.h:
        (WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase):
        (HTMLCollection):
        * html/HTMLOptionsCollection.cpp:
        (WebCore::HTMLOptionsCollection::HTMLOptionsCollection): Supports itemBefore since it doesn't
        override itemAfter.
        * html/HTMLFormCollection.cpp:
        (WebCore::HTMLFormCollection::HTMLFormCollection): Doesn't support itemBefore as it overrides
        itemAfter.
        * html/HTMLNameCollection.cpp:
        (WebCore::HTMLNameCollection::HTMLNameCollection): Ditto.
        * html/HTMLPropertiesCollection.cpp:
        (WebCore::HTMLPropertiesCollection::HTMLPropertiesCollection):
        * html/HTMLTableRowsCollection.cpp:
        (WebCore::HTMLTableRowsCollection::HTMLTableRowsCollection):

2012-07-13  Eric Penner  <epenner@google.com>

        [chromium] Add 'self-managed' option to CCPrioritizedTexture to enable render-surface and canvas use cases.
        https://bugs.webkit.org/show_bug.cgi?id=91177

        Reviewed by Adrienne Walker.

        This makes the render-surface memory use case generic as 'self-managed' textures,
        as this use case is popping up in other places (eg. canvases). It's exactly the
        same idea except we can have as many place-holders as we want at arbitrary
        priorities.

        This already tested by the render surface unit tests which now also use the 
        generic placeholder.

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
        (WebCore::CCLayerTreeHost::updateLayers):
        (WebCore::CCLayerTreeHost::setPrioritiesForSurfaces):
        (WebCore):
        (WebCore::CCLayerTreeHost::setPrioritiesForLayers):
        (WebCore::CCLayerTreeHost::prioritizeTextures):
        (WebCore::CCLayerTreeHost::calculateMemoryForRenderSurfaces):
        (WebCore::CCLayerTreeHost::paintLayerContents):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCPrioritizedTexture.cpp:
        (WebCore::CCPrioritizedTexture::CCPrioritizedTexture):
        (WebCore::CCPrioritizedTexture::setToSelfManagedMemoryPlaceholder):
        * platform/graphics/chromium/cc/CCPrioritizedTexture.h:
        (CCPrioritizedTexture):
        (WebCore::CCPrioritizedTexture::setIsSelfManaged):
        (WebCore::CCPrioritizedTexture::isSelfManaged):
        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.cpp:
        (WebCore::CCPrioritizedTextureManager::prioritizeTextures):
        (WebCore::CCPrioritizedTextureManager::acquireBackingTextureIfNeeded):
        (WebCore::CCPrioritizedTextureManager::destroyBacking):
        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.h:
        (CCPrioritizedTextureManager):
        (WebCore::CCPrioritizedTextureManager::memoryForSelfManagedTextures):

2012-07-13  Kent Tamura  <tkent@chromium.org>

        Internals: Clean up the mock PagePopupDriver correctly.
        https://bugs.webkit.org/show_bug.cgi?id=91250

        Unreviewed, a trivial testing code fix.

        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::restoreTo):
        (WebCore::InternalSettings::reset):
        Resetting PaePopupDriver here instead of Backup::restoreTo.
        Also, close the mock popup before resetting PagePopupDriver by clearing m_pagePopupDriver.
        * testing/MockPagePopupDriver.cpp:
        (WebCore::MockPagePopupDriver::~MockPagePopupDriver):
        Close the popup.

2012-07-13  Tony Payne  <tpayne@chromium.org>

        Remove Widget from screenColorProfile
        https://bugs.webkit.org/show_bug.cgi?id=91300

        Reviewed by Adam Barth.

        Chromium, the only platform implementing screenColorProfile, does not
        need the Widget, so removing for simplicity.

        Covered by existing tests.

        * platform/PlatformScreen.h:
        (WebCore): Updated comment to remove reference to type param that no
        longer exists and removed Widget param.
        * platform/blackberry/PlatformScreenBlackBerry.cpp:
        (WebCore::screenColorProfile): Removed widget param.
        * platform/chromium/PlatformScreenChromium.cpp:
        (WebCore::screenColorProfile): Removed widget param.
        * platform/efl/PlatformScreenEfl.cpp:
        (WebCore::screenColorProfile): Removed widget param.
        * platform/gtk/PlatformScreenGtk.cpp:
        (WebCore::screenColorProfile): Removed widget param.
        * platform/image-decoders/ImageDecoder.h:
        (WebCore::ImageDecoder::qcmsOutputDeviceProfile): removed param to
        match screenColorProfile()'s new spec.
        * platform/mac/PlatformScreenMac.mm:
        (WebCore::screenColorProfile): Removed widget param.
        * platform/qt/PlatformScreenQt.cpp:
        (WebCore::screenColorProfile): Removed widget param.
        * platform/win/PlatformScreenWin.cpp:
        (WebCore::screenColorProfile): Removed widget param.

2012-07-13  Brian Anderson  <brianderson@chromium.org>

        [chromium] Add flushes to CCTextureUpdater::update
        https://bugs.webkit.org/show_bug.cgi?id=89035

        Reviewed by Adrienne Walker.

        Automatic flushes are being removed from the command buffer, so
        this moves the flushes into the CCTextureUpdater itself.

        CCTextureUpdaterTest added to verify texture upload/flushing patterns.

        * platform/graphics/chromium/cc/CCGraphicsContext.h:
        (WebCore::CCGraphicsContext::flush):
        (CCGraphicsContext):
        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:
        (WebCore):
        (WebCore::CCTextureUpdater::update): Manual flushes added here.

2012-07-13  Kiran Muppala  <cmuppala@apple.com>

        REGRESSION: RenderInline boundingBox ignores relative position offset
        https://bugs.webkit.org/show_bug.cgi?id=91168

        Reviewed by Simon Fraser.

        RenderGeometryMap, used for caching the transform to the view,
        expects the first mapping pushed, to be that of the view itself.
        RenderInline was instead pushing it's own offset first.  Besides
        the offset of the view itself was not being pushed.

        Relaxed the RenderGeometryMap restriction that the first pushed
        step should be of the view.  It is sufficient that the view's mapping
        is pushed in the first call to pushMappingsToAncestor.  Modified
        RenderInline to push the offset of the view also to the geometry map.

        Test: fast/inline/inline-relative-offset-boundingbox.html

        * rendering/RenderGeometryMap.cpp:
        (WebCore::RenderGeometryMap::pushMappingsToAncestor): Add assertion to
        check if mapping to view was pushed in first invocation.
        (WebCore::RenderGeometryMap::pushView): Correct assertion that checks
        if the view's mapping is the first one to be applied.
        (WebCore::RenderGeometryMap::stepInserted): Use isRenderView to check if
        a mapping step belongs to a view instead of using mapping size.
        (WebCore::RenderGeometryMap::stepRemoved): Ditto.
        * rendering/RenderInline.cpp:
        (WebCore::(anonymous namespace)::AbsoluteQuadsGeneratorContext::AbsoluteQuadsGeneratorContext):
        Push mappings all the way up to and including the view.

2012-07-13  Xianzhu Wang  <wangxianzhu@chromium.org>

        Move WebCore/platform/text/Base64 to WTF/wtf/text
        https://bugs.webkit.org/show_bug.cgi?id=91162

        Reviewed by Adam Barth.

        No new tests. Files moving only.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Modules/websockets/WebSocketHandshake.cpp:
        (WebCore::generateSecWebSocketKey):
        (WebCore::WebSocketHandshake::getExpectedWebSocketAccept):
        * Target.pri:
        * WebCore.gypi:
        * WebCore.order:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * fileapi/FileReaderLoader.cpp:
        (WebCore::FileReaderLoader::convertToDataURL):
        * inspector/DOMPatchSupport.cpp:
        (WebCore::DOMPatchSupport::createDigest):
        * inspector/InspectorFileSystemAgent.cpp:
        (WebCore):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::cachedResourceContent):
        (WebCore::InspectorPageAgent::sharedBufferContent):
        * loader/archive/mhtml/MHTMLArchive.cpp:
        (WebCore::MHTMLArchive::generateMHTMLData):
        * loader/archive/mhtml/MHTMLParser.cpp:
        (WebCore::MHTMLParser::parseNextPart):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::btoa):
        (WebCore::DOMWindow::atob):
        * page/Page.cpp:
        (WebCore::Page::userStyleSheetLocationChanged):
        * platform/graphics/cairo/ImageBufferCairo.cpp:
        (WebCore::ImageBuffer::toDataURL):
        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::CGImageToDataURL):
        * platform/graphics/gtk/ImageBufferGtk.cpp:
        (WebCore::ImageBuffer::toDataURL):
        * platform/graphics/skia/FontCustomPlatformData.cpp:
        (WebCore::createUniqueFontName):
        * platform/graphics/skia/ImageBufferSkia.cpp:
        (WebCore::ImageBuffer::toDataURL):
        (WebCore::ImageDataToDataURL):
        * platform/graphics/win/FontCustomPlatformData.cpp:
        (WebCore::createUniqueFontName):
        * platform/graphics/wince/FontCustomPlatformData.cpp:
        (WebCore::createUniqueFontName):
        * platform/graphics/wince/ImageBufferWinCE.cpp:
        * platform/graphics/wx/ImageBufferWx.cpp:
        * platform/network/DataURL.cpp:
        (WebCore::handleDataURL):
        * platform/network/cf/ResourceHandleCFNet.cpp:
        (WebCore::applyBasicAuthorizationHeader):
        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::applyBasicAuthorizationHeader):
        * platform/network/soup/ResourceHandleSoup.cpp:
        * platform/win/SSLKeyGeneratorWin.cpp:
        (WebCore::WebCore::signedPublicKeyAndChallengeString):

2012-07-13  Xianzhu Wang  <wangxianzhu@chromium.org>

        [Chromium] Sometimes bottom of text is truncated when page has a fractional scale
        https://bugs.webkit.org/show_bug.cgi?id=88684

        Reviewed by Tony Chang.

        When the page has a fractional scale, the ascent and descent part of the fonts might be fractional.
        If the descent part is rounded down, the bottom of the text might be truncated when displayed
        when subpixel text positioning is enabled.
        To avoid that, borrow one unit from the ascent when possible.

        Test: fast/text/descent-clip-in-scaled-page.html

        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp:
        (WebCore::FontPlatformData::setupPaint): Moved NoPreference handling into querySystemForRenderStyle so that fontRenderStyle() can have actual styles without NoPreference.
        (WebCore::FontPlatformData::querySystemForRenderStyle): Added NoPreference handling (moved from setupPaint)
        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h:
        (FontPlatformData):
        (WebCore::FontPlatformData::fontRenderStyle): Added to let SimpleFontDataSkia access the font render styles.
        * platform/graphics/skia/SimpleFontDataSkia.cpp:
        (WebCore::SimpleFontData::platformInit):

2012-07-13  Ryosuke Niwa  <rniwa@webkit.org>

        Remove an assertion after r122637.

        * dom/DynamicNodeList.h:
        (WebCore::DynamicNodeListCacheBase::shouldInvalidateTypeOnAttributeChange):

2012-07-13  Pierre Rossi  <pierre.rossi@gmail.com>

        [Qt] Improve the mobile theme slightly
        https://bugs.webkit.org/show_bug.cgi?id=90806

        Reviewed by Kenneth Rohde Christiansen.

        Improve drawing of the mobile theme's controls' background.

        Ensure the focus ring never appears with the mobile theme, since it
        looks bad in combination with the highlights.

        No new tests. The painting code from the mobile theme is still
        not covered specifically (it will when we revive pixel tests).

        * platform/qt/RenderThemeQtMobile.cpp:
        (WebCore):
        (WebCore::addPointToOctants): Added. This is simply a helper to avoid
            doing too much duplicate work in drawControlBackground.
        (WebCore::drawControlBackground): Rely on the octant logic added above
            and take the opportunity to increase the granularity.
        (WebCore::borderPen):
        (WebCore::StylePainterMobile::findLineEdit):
        (WebCore::RenderThemeQtMobile::adjustTextFieldStyle):
        * platform/qt/RenderThemeQtMobile.h:
        (RenderThemeQtMobile):
        (WebCore::RenderThemeQtMobile::supportsFocusRing):

2012-07-13  Julien Chaffraix  <jchaffraix@webkit.org>

        Remove an always-failing table-wrapping check in RenderObject::addChild
        https://bugs.webkit.org/show_bug.cgi?id=91286

        Reviewed by Eric Seidel.

        Due to the structure of the code, this test is always failing (newChild->isTableCell()
        is true to get in the branch).

        The changeset adding the code didn't add testing so I poundered adding the mentioned test,
        which is passing. However the test would need to be blindly changed to be included in our
        test harness. I would also expect this code to be exercised by other table tests anyway.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::addChild):
        Removed never-reached branch. While at it, removed a 'what' comment in the same file.

2012-07-13  Emil A Eklund  <eae@chromium.org>

        Use LayoutBoxExtent for image outsets
        https://bugs.webkit.org/show_bug.cgi?id=91166

        Reviewed by Tony Chang.

        Change RenderStyle and calling code to use LayoutBoxExtent for image
        outsets and remove text direction and writing mode versions of the
        outline getters from RenderStyle as LayoutBoxExtent provides the same
        functionality.

        No new tests, no change in functionality.

        * platform/graphics/FractionalLayoutBoxExtent.h:
        * platform/graphics/FractionalLayoutBoxExtent.cpp:
        (WebCore::FractionalLayoutBoxExtent::logicalTop):
        (WebCore::FractionalLayoutBoxExtent::logicalBottom):
        Add logicalTop and logicalBottom methods to go with the existing
        logicalLeft and logicalRight ones.

        * platform/graphics/FractionalLayoutRect.h:
        (WebCore::FractionalLayoutRect::expand):
        Add FractionalLayoutBoxExtent version of expand method.

        * rendering/InlineFlowBox.cpp:
        (WebCore::InlineFlowBox::addBorderOutsetVisualOverflow):
        Change implementation to use the new FractionalLayoutBoxExtent version of
        borderImageOutsets and the logicalTop/Bottom/Left/Right methods.
        
        (WebCore::clipRectForNinePieceImageStrip):
        Change implementation to use the new FractionalLayoutBoxExtent version of
        borderImageOutsets.
        
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::maskClipRect):
        Change implementation to use the new FractionalLayoutBoxExtent version of
        borderImageOutsets and the new FractionalLayoutRect::expand method.
        
        (WebCore::RenderBox::addVisualEffectOverflow):
        Change implementation to use the new FractionalLayoutBoxExtent version of
        borderImageOutsets.
        
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintNinePieceImage):
        Change implementation to use the new FractionalLayoutBoxExtent version of
        borderImageOutsets and the new FractionalLayoutRect::expand method.

        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::imageOutsets):
        Change getImageOutsets to return a FractionalLayoutBoxExtent object and
        rename to imageOutsets to match the webkit naming convention for getters.

        Remove getBorderImageHorizontalOutsets, getBorderImageVerticalOutsets,
        getBorderImageInlineDirectionOutsets, getImageHorizontalOutsets,
        getImageVerticalOutsets and getBorderImageBlockDirectionOutsets methods
        as the same functionality is provided by FractionalLayoutBoxExtent.

2012-07-13  David Hyatt  <hyatt@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=91278
        Improve block margin estimation function to account for not having a layout and for quirks mode
        
        Reviewed by Simon Fraser.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::marginBeforeEstimateForChild):
        Revise marginBeforeEstimateForChild so that it computes block margins for the grandchild before
        recurring. This includes the quirks margin information as well. This ensures that the margins are
        up-to-date when checked, even before the object has had its first layout.
        
        * rendering/RenderBlock.h:
        (WebCore::RenderBlock::setMarginStartForChild):
        (WebCore::RenderBlock::setMarginEndForChild):
        (WebCore::RenderBlock::setMarginBeforeForChild):
        (WebCore::RenderBlock::setMarginAfterForChild):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeBlockDirectionMargins):
        * rendering/RenderBox.h:
        (RenderBox):
        Add consts in order to compile.

2012-07-13  Ryosuke Niwa  <rniwa@webkit.org>

        NodeLists should not invalidate on irreleavnt attribute changes
        https://bugs.webkit.org/show_bug.cgi?id=91277

        Reviewed by Ojan Vafai.

        Explicitely check the invalidation type and the changed attribute in NodeListNodeData::invalidateCaches
        and ElementRareData::clearHTMLCollectionCaches to only invalidate node lists affected by the change.

        Also merged invalidateNodeListsCacheAfterAttributeChanged and invalidateNodeListsCacheAfterChildrenChanged
        as invalidateNodeListCachesInAncestors since they're almost identical after r122498.

        In addition, moved shouldInvalidateNodeListForType from Document.cpp to DynamicNodeList.h and renamed it to
        shouldInvalidateTypeOnAttributeChange since it needs to called in Node.cpp and ElementRareData.h.

        * dom/Attr.cpp:
        (WebCore::Attr::setValue):
        (WebCore::Attr::childrenChanged):
        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::childrenChanged):
        * dom/Document.cpp:
        (WebCore::Document::registerNodeListCache): Calls isRootedAtDocument() instead of directly comparing
        the value of NodeListRootType in order to prepare for the bug 80269.
        (WebCore::Document::unregisterNodeListCache): Ditto.
        (WebCore): shouldInvalidateNodeListForType is moved to DynamicNodeList.h
        (WebCore::Document::shouldInvalidateNodeListCaches):
        * dom/DynamicNodeList.h:
        (DynamicNodeListCacheBase):
        (WebCore::DynamicNodeListCacheBase::shouldInvalidateTypeOnAttributeChange): Moved from Document.cpp.
        * dom/Element.cpp: 
        (WebCore::Element::attributeChanged):
        * dom/ElementRareData.h:
        (WebCore::ElementRareData::clearHTMLCollectionCaches): Takes const QualifiedName* to compare against
        the invalidation type of HTML collections via shouldInvalidateTypeOnAttributeChange.
        * dom/Node.cpp:
        (WebCore::Node::invalidateNodeListCachesInAncestors): Merged invalidateNodeListCachesInAncestors and
        invalidateNodeListsCacheAfterChildrenChanged. Also pass attrName to clearHTMLCollectionCaches.
        (WebCore::NodeListsNodeData::invalidateCaches): Compares attrName against the invalidation type of
        node lists via shouldInvalidateTypeOnAttributeChange.
        (WebCore):
        * dom/Node.h:
        (Node):
        * dom/NodeRareData.h:
        (WebCore::NodeRareData::ensureNodeLists): Merged NodeRareData::createNodeLists.
        (WebCore::NodeRareData::clearChildNodeListCache): Moved from Node.cpp.
        (NodeRareData):
        * html/HTMLCollection.h:
        (HTMLCollectionCacheBase):

2012-07-13  Arpita Bahuguna  <arpitabahuguna@gmail.com>

        Refactor RenderTable to use the section's iteration functions.
        https://bugs.webkit.org/show_bug.cgi?id=89751

        Reviewed by Julien Chaffraix.

        Removing anti-pattern wherever possible from RenderTable code. Also, modifying
        RenderTable sections' iterations to use helper functions.

        No new tests required for this change since no change in behavior is expected.

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::addOverflowFromChildren):
        (WebCore::RenderTable::setCellLogicalWidths):
        (WebCore::RenderTable::outerBorderStart):
        (WebCore::RenderTable::outerBorderEnd):
        Removed anti-patterns involving iterations over RenderObjects.

        (WebCore::RenderTable::outerBorderAfter):
        Modified RenderTable sections' iteration to use helper functions.

2012-07-13  Enrica Casucci  <enrica@apple.com>

        Threadsafety issues in WebScriptObject
        https://bugs.webkit.org/show_bug.cgi?id=90849

        Reviewed by Geoff Garen.

        Updated fix for this bug. The JSC API lock needs to be acquired also in JSObject.

        * bindings/objc/WebScriptObject.mm:
        (-[WebScriptObject JSObject]):

2012-07-13  Raymond Toy  <rtoy@google.com>

        DelayNode doesn't work if delayTime.value == delayTime.maxValue
        https://bugs.webkit.org/show_bug.cgi?id=90357

        Reviewed by Kenneth Russell.

        Increase delay buffer size slightly so that the read and write
        pointers don't become equal when the delay and the max delay are
        the same.
        
        Tests: webaudio/delaynode-max-default-delay.html
               webaudio/delaynode-max-nondefault-delay.html

        * Modules/webaudio/DelayDSPKernel.cpp:
        (WebCore): Moved SmoothingTimeConstant to WebCore namespace.
        (WebCore::DelayDSPKernel::DelayDSPKernel): Add some additional checks to prevent crashes; use bufferLengthForDelay to compute buffer length.
        (WebCore::DelayDSPKernel::bufferLengthForDelay): New function to compute buffer length.
        * Modules/webaudio/DelayDSPKernel.h:
        (DelayDSPKernel): Declare bufferLengthForDelay. 

2012-07-13  Benjamin Poulain  <bpoulain@apple.com>

        Always aggressively preload on iOS
        https://bugs.webkit.org/show_bug.cgi?id=91276

        Reviewed by Simon Fraser.

        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::preload):

2012-07-13  Vineet Chaudhary  <rgf748@motorola.com>

        Restructure V8Utilities::extractTransferables() with help of toV8Sequence()
        https://bugs.webkit.org/show_bug.cgi?id=91208

        Reviewed by Kentaro Hara.

        We can remove the specialised check for MessagePort from V8Utilities::extractTransferables()
        using toV8Sequence() as it validates the passed object for sequence type per WebIDL spec.

        No new test as just refactoring.
        Existing tests under fast/dom/Window/window-* fast/dom/events/*
        covers tests.

        * bindings/v8/V8Utilities.cpp:
        (WebCore::extractTransferables):

2012-07-13  Vincent Scheib  <scheib@chromium.org>

        Pointer Lock handles disconnected DOM elements
        https://bugs.webkit.org/show_bug.cgi?id=77029

        Reviewed by Adrienne Walker.

        Pointer Lock Controller now checks when elements or documents are
        removed, and unlocks if the target element is being removed.

        Tests: pointer-lock/locked-element-iframe-removed-from-dom.html
               pointer-lock/locked-element-removed-from-dom.html

        * dom/Document.cpp:
        (WebCore::Document::detach):
        * dom/Element.cpp:
        (WebCore::Element::removedFrom):
        (WebCore::Element::webkitRequestPointerLock):
        * page/PointerLockController.cpp:
        (WebCore::PointerLockController::requestPointerLock):
        (WebCore::PointerLockController::elementRemoved):
        (WebCore):
        (WebCore::PointerLockController::documentDetached):
        (WebCore::PointerLockController::didLosePointerLock):
        (WebCore::PointerLockController::enqueueEvent):
        * page/PointerLockController.h:
        (WebCore):
        (PointerLockController):

2012-07-13  Ryosuke Niwa  <rniwa@webkit.org>

        HTMLCollection should use DynamicNodeList's invalidation model
        https://bugs.webkit.org/show_bug.cgi?id=90326

        Reviewed by Anders Carlsson.

        Make HTMLCollection invalidated upon attribute and children changes instead of invalidating it on demand
        by comparing DOM tree versions. Node that HTMLCollections owned by Document are invalidated with other
        document-rooted node lists in m_listsInvalidatedAtDocument for simplicity although this mechanism is
        normally used for node lists owned by a non-Document node that contains nodes outside of its subtree.
        ItemProperties and FormControls are more "traditional" users of the mechanism.

        Also, merged DynamicNodeList::invalidateCache and HTMLCollection::invalidateCache.

        * dom/Document.cpp:
        (WebCore::Document::registerNodeListCache): Renamed. No longer takes NodeListInvalidationType or
        NodeListRootType since they can be obtained from the cache base. Increment the node list counter for
        InvalidateOnIdNameAttrChange when a HTMLCollection is passed in since all HTMLCollections need to be
        invalidated on id or name content attribute changes due to named getters.
        (WebCore::Document::unregisterNodeListCache): Ditto.
        (WebCore::shouldInvalidateNodeListForType):
        (WebCore::Document::shouldInvalidateNodeListCaches):
        (WebCore::Document::clearNodeListCaches):
        * dom/Document.h:
        (WebCore): Added InvalidateOnIdNameAttrChange, InvalidateOnHRefAttrChange, and InvalidateOnAnyAttrChange.
        (Document):
        * dom/DynamicNodeList.cpp:
        (WebCore::DynamicNodeListCacheBase::invalidateCache): Added. Invalidates caches of both DynamicNodeList
        and HTMLCollection. We can't afford to use virtual function calls here because this function is called on
        all node lists and HTML collections owned by ancestors of an element under which a node is added, removed,
        or its attributes are changed.
        (WebCore):
        * dom/DynamicNodeList.h:
        (WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase): Initializes member variables directly
        instead of calling clearCache now that DynamicNodeListCacheBase::invalidateCache has become polymorphic.
        (DynamicNodeListCacheBase): Increased the number of bits for m_invalidationType since we now have 9
        invalidation types.
        (WebCore::DynamicSubtreeNodeList::~DynamicSubtreeNodeList):
        (WebCore::DynamicSubtreeNodeList::DynamicSubtreeNodeList):
        * dom/ElementRareData.h:
        (ElementRareData):
        (WebCore::ElementRareData::clearHTMLCollectionCaches): Added.
        (WebCore::ElementRareData::adoptTreeScope): Added; similar to NodeRareData::adoptTreeScope.
        * dom/Node.cpp:
        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged): Clears HTML collection caches as well as
        node list caches.
        (WebCore::Node::invalidateNodeListsCacheAfterChildrenChanged): Ditto.
        * dom/NodeRareData.h:
        (WebCore::NodeListsNodeData::adoptTreeScope):
        * dom/TreeScopeAdopter.cpp:
        (WebCore::TreeScopeAdopter::moveTreeToNewScope): Calls ElementRareData's adoptTreeScope as well as
        NodeRareData's.
        * html/HTMLAllCollection.cpp:
        (WebCore::HTMLAllCollection::namedItemWithIndex):
        * html/HTMLCollection.cpp:
        (WebCore::rootTypeFromCollectionType): Added. As mentioned above, treat all Document-owned HTML collection
        as if rooted at document for convenience.
        (WebCore::invalidationTypeExcludingIdAndNameAttributes): Added. Since all HTML collection requires
        invalidation on id and name content attribute changes, which is taken care by the special logic in
        Document::registerNodeListCache, exclude those two attributes from consideration.
        (WebCore::HTMLCollection::HTMLCollection): Calls Document::registerNodeListCache.
        (WebCore::HTMLCollection::~HTMLCollection): Calls Document::unregisterNodeListCache.
        (WebCore::HTMLCollection::length):
        (WebCore::HTMLCollection::item):
        (WebCore::HTMLCollection::namedItem):
        (WebCore::HTMLCollection::updateNameCache):
        * html/HTMLCollection.h:
        (WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase):
        (HTMLCollectionCacheBase): Removed m_cacheTreeVersion and clearCache since they're no longer used.
        (HTMLCollection):
        * html/HTMLFormCollection.cpp:
        (WebCore::HTMLFormCollection::namedItem):
        (WebCore::HTMLFormCollection::updateNameCache):
        * html/HTMLOptionsCollection.h:
        (HTMLOptionsCollection):
        * html/HTMLPropertiesCollection.cpp:
        (WebCore::HTMLPropertiesCollection::updateNameCache):
        * html/HTMLPropertiesCollection.h:
        (WebCore::HTMLPropertiesCollection::invalidateCache):

2012-07-13  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Remove incorrect debug assertion in LayerRendererChromium.cpp
        https://bugs.webkit.org/show_bug.cgi?id=91260

        Reviewed by Adrienne Walker.

        ASSERT(!clipped) was being triggered after skinny almost-degenerate
        quads went through anti-aliasing inflation, and then were being
        transformed back from device space to local space. It turns out
        this assertion is too aggressive, and we don't yet have an obvious
        need to change the behavior on the clipped==true case.

        No new tests needed, this patch fixes only comments and debug code.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
           fixed a comment.

        (WebCore::LayerRendererChromium::drawTileQuad):
           fixed a similar comment, removed unnecessary assertion.

2012-07-13  Philip Rogers  <pdr@google.com>

        Remove assert in localCoordinateSpaceTransform()
        https://bugs.webkit.org/show_bug.cgi?id=91189

        Reviewed by Nikolas Zimmermann.

        The assert in localCoordinateSpaceTransform was added to catch subclasses forgetting
        to override the method but it is better to simply return the identity matrix.

        This scenario can occur when we break the SVG content model, such as asking for
        the CTM of a <g> element inside a <tspan>. This is undefined in the spec because
        tspan is not a subclass of SVGLocatable but both Firefox and Opera
        implement this by returning the identity matrix.

        Test: svg/custom/invalid-ctm.svg

        * svg/SVGStyledElement.cpp:
        (WebCore::SVGStyledElement::localCoordinateSpaceTransform):

2012-07-13  Kentaro Hara  <haraken@chromium.org>

        [V8] String wrappers should be marked Independent
        https://bugs.webkit.org/show_bug.cgi?id=91251

        Reviewed by Adam Barth.

        Currently V8 String wrappers are not marked Independent.
        By marking them Independent, they can be reclaimed by the scavenger GC.

        I tried to find some cases where this change reduces memory usage,
        but couldn't due to sensitive behavior of GC.

        No tests. No change in behavior.

        * bindings/v8/V8Binding.cpp:
        (WebCore::StringCache::v8ExternalStringSlow):

2012-07-13  Peter Beverloo  <peter@chromium.org>

        [Chromium] Make the v8 i18n API dependency conditional for Android, disable strict aliasing
        https://bugs.webkit.org/show_bug.cgi?id=91240

        Reviewed by Adam Barth.

        Disable the v8 internationalization API for Chromium Android, as it's
        disabled and not always available in checkouts. Furthermore, disable
        strict aliasing for the webkit_remaining target, similar to what
        x11-based builds are doing (see the webcore_prerequisites target).

        * WebCore.gyp/WebCore.gyp:

2012-07-13  Kentaro Hara  <haraken@chromium.org>

        [CallWith=XXX] arguments should be placed at the head of method arguments
        https://bugs.webkit.org/show_bug.cgi?id=91217

        Reviewed by Adam Barth.

        The EFL build with the ENABLE_FILE_SYSTEM flag caused a build error,
        because CodeGeneratorJS.pm assumes webkitEntries(ScriptExecutionContext*, HTMLInputElement*)
        but the actual signature is webkitEntries(HTMLInputElement*, ScriptExecutionContext*) (bug 91185).

        Per https://trac.webkit.org/wiki/WebKitIDL#CallWith, [CallWith=XXX] arguments should be placed
        at the head of the arguments. (i.e. the behavior of CodeGeneratorJS.pm is correct.)

        Thus the correct fix is (1) to change the signature of webkitEntries() and webkitGetAsEntry()
        so that ScriptExecutionContext* comes first and (2) to modify CodeGeneratorV8.pm to support the order.

        Test: bindings/scripts/test/TestObj.idl

        * Modules/filesystem/DataTransferItemFileSystem.h: Placed ScriptExecutionContext* at the head of arguments.
        (DataTransferItemFileSystem):
        * Modules/filesystem/HTMLInputElementFileSystem.cpp: Ditto.
        (WebCore::HTMLInputElementFileSystem::webkitEntries):
        * Modules/filesystem/HTMLInputElementFileSystem.h: Ditto.
        (HTMLInputElementFileSystem):
        * Modules/filesystem/chromium/DataTransferItemFileSystemChromium.cpp: Ditto.
        (WebCore::DataTransferItemFileSystem::webkitGetAsEntry):

        * bindings/scripts/CodeGeneratorV8.pm: Modified to support the correct order.
        (GenerateNormalAttrGetter):
        (GenerateNormalAttrSetter):
        (GenerateFunctionCallString):

        * bindings/scripts/test/V8/V8TestInterface.cpp: Updated run-bindings-tests results.
        (WebCore::TestInterfaceV8Internal::supplementalMethod2Callback):

2012-07-13  Mary Wu  <mary.wu@torchmobile.com.cn>

        [BlackBerry] Some small changes in network code
        https://bugs.webkit.org/show_bug.cgi?id=90974

        Reviewed by Rob Buis.

        1. Set status in NetworkJob/SocketStreamHandleBlackBerry so that
        its wrapped stream can also query the stream result.
        2. pass download attribute to NetworkRequest.

        RIM PR# 171555
        Reviewed internally by Lyon Chen and Joe Mason.

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::handleNotifyClose):
        * platform/network/blackberry/NetworkJob.h:
        (WebCore::NetworkJob::status):
        * platform/network/blackberry/ResourceRequestBlackBerry.cpp:
        (WebCore::platformTargetTypeForRequest):
        * platform/network/blackberry/SocketStreamHandle.h:
        (WebCore::SocketStreamHandle::status):
        (SocketStreamHandle):
        * platform/network/blackberry/SocketStreamHandleBlackBerry.cpp:
        (WebCore::SocketStreamHandle::notifyStatusReceived):
        (WebCore::SocketStreamHandle::notifyClose):

2012-07-13  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Remove uiSourceCode from Resource.
        https://bugs.webkit.org/show_bug.cgi?id=91201

        Reviewed by Pavel Feldman.

        Removed Resource._uiSourceCode field as it is not used anymore.

        * inspector/front-end/Resource.js:
        (WebInspector.Resource.prototype.isHidden):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode):

2012-07-13  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r122450 and r122580.
        http://trac.webkit.org/changeset/122450
        http://trac.webkit.org/changeset/122580
        https://bugs.webkit.org/show_bug.cgi?id=91263

        Caused multiple regressions on ClusterFuzz (Requested by
        inferno-sec on #webkit).

        * bindings/js/ScriptWrappable.h:
        (WebCore::ScriptWrappable::reportMemoryUsage):
        * bindings/v8/DOMDataStore.cpp:
        (WebCore::DOMDataStore::reportMemoryUsage):
        * bindings/v8/IntrusiveDOMWrapperMap.h:
        (WebCore::ChunkedTable::reportMemoryUsage):
        * bindings/v8/ScriptWrappable.h:
        (WebCore::ScriptWrappable::reportMemoryUsage):
        * bindings/v8/V8Binding.cpp:
        (WebCore::V8BindingPerIsolateData::reportMemoryUsage):
        (WebCore::StringCache::reportMemoryUsage):
        * bindings/v8/V8DOMMap.h:
        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::InlineCSSStyleDeclaration::ensureMutablePropertySet):
        * css/StylePropertySet.cpp:
        * css/StylePropertySet.h:
        (WebCore::StylePropertySet::reportMemoryUsage):
        * dom/CharacterData.cpp:
        (WebCore::CharacterData::reportMemoryUsage):
        * dom/ContainerNode.h:
        (WebCore::ContainerNode::reportMemoryUsage):
        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        * dom/Element.cpp:
        (WebCore::Element::detachAttribute):
        (WebCore::Element::removeAttribute):
        (WebCore::Element::attributes):
        (WebCore::Element::setAttributeInternal):
        (WebCore::Element::parserSetAttributes):
        (WebCore::Element::hasEquivalentAttributes):
        (WebCore::Element::createAttributeData):
        (WebCore):
        (WebCore::Element::setAttributeNode):
        (WebCore::Element::removeAttributeNode):
        (WebCore::Element::getAttributeNode):
        (WebCore::Element::getAttributeNodeNS):
        (WebCore::Element::hasAttribute):
        (WebCore::Element::hasAttributeNS):
        (WebCore::Element::normalizeAttributes):
        (WebCore::Element::cloneAttributesFromElement):
        * dom/Element.h:
        (WebCore::Element::attributeData):
        (Element):
        (WebCore::Element::reportMemoryUsage):
        (WebCore::Element::ensureAttributeData):
        (WebCore::Element::updatedAttributeData):
        (WebCore::Element::ensureUpdatedAttributeData):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::attrIfExists):
        (WebCore::ElementAttributeData::ensureAttr):
        (WebCore::ElementAttributeData::setAttr):
        (WebCore::ElementAttributeData::removeAttr):
        (WebCore::ElementAttributeData::setClass):
        (WebCore):
        (WebCore::ElementAttributeData::ensureInlineStyle):
        (WebCore::ElementAttributeData::ensureMutableInlineStyle):
        (WebCore::ElementAttributeData::destroyInlineStyle):
        (WebCore::ElementAttributeData::addAttribute):
        (WebCore::ElementAttributeData::removeAttribute):
        (WebCore::ElementAttributeData::isEquivalent):
        (WebCore::ElementAttributeData::detachAttrObjectsFromElement):
        (WebCore::ElementAttributeData::getAttributeItemIndexSlowCase):
        (WebCore::ElementAttributeData::cloneDataFrom):
        (WebCore::ElementAttributeData::clearAttributes):
        (WebCore::ElementAttributeData::replaceAttribute):
        (WebCore::ElementAttributeData::getAttributeNode):
        * dom/ElementAttributeData.h:
        (WebCore::ElementAttributeData::create):
        (ElementAttributeData):
        (WebCore::ElementAttributeData::setIdForStyleResolution):
        (WebCore::ElementAttributeData::setAttributeStyle):
        (WebCore::ElementAttributeData::length):
        (WebCore::ElementAttributeData::isEmpty):
        (WebCore::ElementAttributeData::attributeItem):
        (WebCore::ElementAttributeData::getAttributeItem):
        (WebCore::ElementAttributeData::reportMemoryUsage):
        (WebCore::ElementAttributeData::ElementAttributeData):
        (WebCore::ElementAttributeData::attributeVector):
        (WebCore::ElementAttributeData::clonedAttributeVector):
        (WebCore::ElementAttributeData::removeAttribute):
        (WebCore::ElementAttributeData::getAttributeItemIndex):
        * dom/MemoryInstrumentation.h:
        (MemoryInstrumentation):
        (MemoryObjectInfo):
        (WebCore::MemoryObjectInfo::reportInstrumentedPointer):
        (WebCore::MemoryObjectInfo::reportPointer):
        (WebCore::MemoryObjectInfo::reportInstrumentedObject):
        (WebCore::MemoryObjectInfo::reportObject):
        (WebCore::MemoryObjectInfo::reportObjectInfo):
        (WebCore::MemoryObjectInfo::reportHashMap):
        (WebCore::MemoryObjectInfo::reportHashSet):
        (WebCore::MemoryObjectInfo::reportListHashSet):
        (WebCore::MemoryObjectInfo::reportVector):
        (WebCore::MemoryObjectInfo::reportString):
        (WebCore::MemoryObjectInfo::objectType):
        (WebCore::MemoryObjectInfo::objectSize):
        (WebCore::MemoryObjectInfo::memoryInstrumentation):
        * dom/Node.cpp:
        (WebCore::Node::reportMemoryUsage):
        * dom/QualifiedName.h:
        (WebCore::QualifiedName::QualifiedNameImpl::reportMemoryUsage):
        (WebCore::QualifiedName::reportMemoryUsage):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::style):
        (WebCore::StyledElement::classAttributeChanged):
        (WebCore::StyledElement::setInlineStyleProperty):
        (WebCore::StyledElement::removeInlineStyleProperty):
        (WebCore::StyledElement::addSubresourceAttributeURLs):
        * dom/StyledElement.h:
        (WebCore::StyledElement::ensureInlineStyle):
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::createHTMLElementFromSavedElement):
        * platform/TreeShared.h:
        (WebCore::TreeShared::reportMemoryUsage):
        * xml/parser/XMLDocumentParserQt.cpp:
        (WebCore::XMLDocumentParser::XMLDocumentParser):

2012-07-13  Huang Dongsung  <luxtella@company100.net>

        Remove down-casting to BitmapImage in GraphicsContext::drawImage.
        https://bugs.webkit.org/show_bug.cgi?id=90755

        Reviewed by Simon Fraser.

        Add a BitmapImage draw method which takes RespectImageOrientationEnum enum as
        the last argument for CG. Then we can remove the conditional down-casting in
        GraphicsContext::drawImage.

        This change is needed for parallel image decoders. Because parallel image
        decoders use a Bitmap image wrapper class which extends Image (not Bitmap), the
        down-casting above causes the loss of RespectImageOrientationEnum which must be
        passed to BitmapImage.

        No new tests, no behavior change.

        * platform/graphics/BitmapImage.cpp:
        * platform/graphics/BitmapImage.h:
        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::drawImage):
        * platform/graphics/Image.cpp:
        (WebCore::Image::draw):
        (WebCore):
        * platform/graphics/Image.h:
        (Image):

2012-07-13  Lauro Neto  <lauro.neto@openbossa.org>

        Fix QtWebKit build with OpenGLES after GC3D/E3D refactor
        https://bugs.webkit.org/show_bug.cgi?id=91156

        Reviewed by Noam Rosenthal.

        Adds several build fixes.

        * platform/graphics/GraphicsContext3D.h:
            Use E3DOpenGLES instead of previously removed E3DQt.

        * platform/graphics/OpenGLESShims.h:
            Enable defines for Qt.

        * platform/graphics/opengl/Extensions3DOpenGLES.cpp:
        (WebCore::Extensions3DOpenGLES::blitFramebuffer):
        (WebCore):
        (WebCore::Extensions3DOpenGLES::renderbufferStorageMultisample):
        (WebCore::Extensions3DOpenGLES::copyTextureCHROMIUM):
            Added pure virtual stubs.

        (WebCore::Extensions3DOpenGLES::supportsExtension):
            Remove PROC suffix. See bug #91130.

        * platform/graphics/opengl/Extensions3DOpenGLES.h:
        (Extensions3DOpenGLES):
            Added pure virtual stubs.

        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
        (WebCore::GraphicsContext3D::reshapeFBOs):
            Readded missing function after removed in r122250.

        (WebCore):
            Use PLATFORM(BLACKBERRY) guard around port-specific include.

        * platform/graphics/qt/GraphicsContext3DQt.cpp:
            Added USE(OPENGL_ES_2) guard instead of always loading the OpenGL extensions.


2012-07-13  Keishi Hattori  <keishi@webkit.org>

        Form of FormAssociatedElement is not updated when id target changes.
        https://bugs.webkit.org/show_bug.cgi?id=91042

        Reviewed by Kent Tamura.

        Test: fast/forms/update-form-attribute-element.html

        This patch introduces the IdTargetObserver and IdTargetObserverRegistry class.
        They can be used to be notified when the element that an id is pointing to (the id target)
        changes.

        * CMakeLists.txt: Added IdTargetObserverRegistry.{h,cpp} and IdTargetObserver.{h,cpp}
        * GNUmakefile.list.am: Ditto.
        * Target.pri: Ditto.
        * WebCore.gypi: Ditto.
        * WebCore.vcproj/WebCore.vcproj: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * dom/DOMAllInOne.cpp:
        * dom/IdTargetObserver.cpp: Added. When you want notified of changes to an id target, you should create a new class that inherits this.
        (WebCore):
        (WebCore::IdTargetObserver::IdTargetObserver):
        (WebCore::IdTargetObserver::~IdTargetObserver):
        * dom/IdTargetObserver.h: Added.
        (WebCore):
        (IdTargetObserver):
        * dom/IdTargetObserverRegistry.cpp: Added.
        (WebCore):
        (WebCore::IdTargetObserverRegistry::create):
        (WebCore::IdTargetObserverRegistry::addObserver): Register an IdTargetObserver to observe an id target.
        (WebCore::IdTargetObserverRegistry::removeObserver): Unregisters an IdTargetObserver from observing.
        (WebCore::IdTargetObserverRegistry::notifyObserversInternal):
        * dom/IdTargetObserverRegistry.h: Added.
        (WebCore):
        (IdTargetObserverRegistry):
        (WebCore::IdTargetObserverRegistry::IdTargetObserverRegistry):
        (WebCore::IdTargetObserverRegistry::notifyObservers): Calls idTargetChanged on all observers for an id. Inlining first part of function for performance.
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::TreeScope):
        (WebCore::TreeScope::addElementById): Calls IdTargetObserverRegistry::notifyObservers because the id target might have changed.
        (WebCore::TreeScope::removeElementById): Ditto.
        * dom/TreeScope.h:
        (WebCore):
        (WebCore::TreeScope::idTargetObserverRegistry):
        (TreeScope):
        * html/FormAssociatedElement.cpp: Observer for id targets defined by the form attribute.
        (WebCore::FormAssociatedElement::didMoveToNewDocument):
        (WebCore::FormAssociatedElement::insertedInto):
        (WebCore::FormAssociatedElement::removedFrom):
        (WebCore::FormAssociatedElement::formAttributeChanged):
        (WebCore::FormAssociatedElement::resetFormAttributeTargetObserver): Creates and sets up a new FormAttributeTargetObserver.
        (WebCore):
        (WebCore::FormAssociatedElement::formAttributeTargetChanged):
        (WebCore::FormAttributeTargetObserver::create):
        (WebCore::FormAttributeTargetObserver::FormAttributeTargetObserver):
        (WebCore::FormAttributeTargetObserver::idTargetChanged):
        * html/FormAssociatedElement.h:
        (FormAssociatedElement):
        * html/FormController.cpp:
        * html/FormController.h:
        (FormController):
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::removedFrom):
        (WebCore::HTMLFormElement::formElementIndexWithFormAttribute): Modified to take a range. It
        scans the range and returns the index to insert the element in m_associatedElement.
        (WebCore::HTMLFormElement::formElementIndex): Modified to only scan the elements in
        m_associatedElement that precede and follow the form element.
        * html/HTMLFormElement.h:
        (HTMLFormElement):

2012-07-13  Gabor Rapcsanyi  <rgabor@webkit.org>

        Optimizing blend filter to ARM-NEON with intrinsics
        https://bugs.webkit.org/show_bug.cgi?id=90949

        Reviewed by Zoltan Herczeg.

        The feBlend SVG filter modes can be greatly fasten up with ARM-NEON since
        we are able to calculate with 2 pixels (8 channels) at the same time.
        The code is written with NEON intrinsics and it doesn't affect the
        general - it has the same behaviour as the original algorithm.
        With this NEON optimization the calculation is ~4.5 times faster for each mode.

        Existing tests cover this issue.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/filters/FEBlend.cpp:
        (WebCore::FEBlend::platformApplyGeneric):
        (WebCore):
        (WebCore::FEBlend::platformApplySoftware):
        * platform/graphics/filters/FEBlend.h:
        (FEBlend):
        * platform/graphics/filters/arm/FEBlendNEON.h: Added.
        (WebCore):
        (FEBlendUtilitiesNEON):
        (WebCore::FEBlendUtilitiesNEON::div255): integer divison with 255
        (WebCore::FEBlendUtilitiesNEON::normal): calculate normal mode blending for two pixels
        (WebCore::FEBlendUtilitiesNEON::multiply): calculate multiply mode blending for two pixels
        (WebCore::FEBlendUtilitiesNEON::screen): calculate screen mode blending for two pixels
        (WebCore::FEBlendUtilitiesNEON::darken): calculate darken mode blending for two pixels
        (WebCore::FEBlendUtilitiesNEON::lighten): calculate lighten mode blending for two pixels
        (WebCore::FEBlend::platformApplyNEON):

2012-07-13  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: native memory instrumentation: extract instrumentation methods into MemoryClassInfo
        https://bugs.webkit.org/show_bug.cgi?id=91227

        Reviewed by Pavel Feldman.

        void Node::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
        {
            MemoryClassInfo<Node> info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
            info.visitBaseClass<ScriptWrappable>(this);

            info.addMember(m_notInstrumentedPointer); // automatically detects poniter/reference
            info.addInstrumentedMember(m_next);
            info.addHashSet<MemoryInstrumentation::NonClass>(m_aHash);                // NonClass value_type (report only size of internal template structures)
            info.addHashSet<MemoryInstrumentation::NotInstrumentedClass>(m_aHashSet); // not instrumented value_type (use sizeof)
            info.addHashSet<MemoryInstrumentation::InstrumentedClass>(m_aHashSet);    // instrumented value_type (call visit)
        }

        The change is covered by existing tests for native memory snapshot.

        * bindings/v8/DOMDataStore.cpp:
        (WebCore::DOMDataStore::reportMemoryUsage):
        * bindings/v8/IntrusiveDOMWrapperMap.h:
        (WebCore::ChunkedTable::reportMemoryUsage):
        * bindings/v8/ScriptWrappable.h:
        (WebCore::ScriptWrappable::reportMemoryUsage):
        * bindings/v8/V8Binding.cpp:
        (WebCore::V8BindingPerIsolateData::reportMemoryUsage):
        (WebCore::StringCache::reportMemoryUsage):
        * bindings/v8/V8DOMMap.h:
        * css/StylePropertySet.h:
        (WebCore::StylePropertySet::reportMemoryUsage):
        * dom/CharacterData.cpp:
        (WebCore::CharacterData::reportMemoryUsage):
        * dom/ContainerNode.h:
        (WebCore::ContainerNode::reportMemoryUsage):
        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        * dom/Element.h:
        (WebCore::Element::reportMemoryUsage):
        * dom/ElementAttributeData.h:
        (WebCore::ElementAttributeData::reportMemoryUsage):
        * dom/MemoryInstrumentation.h:
        (MemoryInstrumentation):
        (WebCore::MemoryObjectInfo::objectType):
        (WebCore::MemoryObjectInfo::objectSize):
        (WebCore::MemoryObjectInfo::memoryInstrumentation):
        (MemoryObjectInfo):
        (WebCore::MemoryObjectInfo::reportObjectInfo):
        (WebCore):
        (MemoryClassInfo):
        (WebCore::MemoryClassInfo::MemoryClassInfo):
        (WebCore::MemoryClassInfo::visitBaseClass):
        (WebCore::MemoryClassInfo::reportInstrumentedPointer):
        (WebCore::MemoryClassInfo::reportInstrumentedObject):
        (WebCore::MemoryClassInfo::reportPointer):
        (WebCore::MemoryClassInfo::reportObject):
        (WebCore::MemoryClassInfo::reportHashMap):
        (WebCore::MemoryClassInfo::reportHashSet):
        (WebCore::MemoryClassInfo::reportListHashSet):
        (WebCore::MemoryClassInfo::reportVector):
        (WebCore::MemoryClassInfo::reportString):
        * dom/Node.cpp:
        (WebCore::Node::reportMemoryUsage):
        * dom/QualifiedName.h:
        (WebCore::QualifiedName::QualifiedNameImpl::reportMemoryUsage):
        (WebCore::QualifiedName::reportMemoryUsage):
        * platform/TreeShared.h:
        (WebCore::TreeShared::reportMemoryUsage):

2012-07-13  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: align scope filters
        https://bugs.webkit.org/show_bug.cgi?id=91213

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/elementsPanel.css:
        (.crumbs):
        * inspector/front-end/inspector.css:
        (.status-bar > div):
        (.scope-bar):
        (.scope-bar li):
        (.scope-bar li.all):
        * inspector/front-end/networkLogView.css:

2012-07-13  Peter Rybin  <peter.rybin@gmail.com>

        Web Inspector: too many hardcoded strings in InspectorBackendDispatcher.
        https://bugs.webkit.org/show_bug.cgi?id=89198

        Reviewed by Yury Semikhatsky.

        Instead of generating error message string on every call (mostly for nothing),
        error message is generated deeper inside the handler and only command name
        is passed every time.

        * inspector/CodeGeneratorInspector.py:
        (Generator.process_command):

2012-07-13  Joshua Netterfield  <jnetterfield@rim.com>

        [BlackBerry] Update about:* pages
        https://bugs.webkit.org/show_bug.cgi?id=91121

        Reviewed by Yong Li.

        Update the about:config pages, and improve the aesthetics of the about:build, about:version, about:credits, about:memory, about:config, and similar pages.

        No new tests, because there is no new funtionality.

        * platform/network/blackberry/NetworkJob.cpp: Update the aesthetics of about:* pages

2012-07-13  Olivier Blin  <olivier.blin@softathome.com>

        Fix checking for optional DeviceOrientationEvent.absolute in JSC bindings
        https://bugs.webkit.org/show_bug.cgi?id=91225

        Reviewed by Steve Block.

        This issue comes from r105036

        * bindings/js/JSDeviceOrientationEventCustom.cpp:
        (WebCore::JSDeviceOrientationEvent::initDeviceOrientationEvent):

2012-07-13  Andrei Bucur  <abucur@adobe.com>
        [CSS Regions] Fix build for bug 89000
        https://bugs.webkit.org/show_bug.cgi?id=91215

        Reviewed by Kentaro Hara.

        Remove the unused variable m_state that was a leftover from a previous version of the patch.

        Tests: No new tests, build fix.

        * dom/WebKitNamedFlow.cpp:
        (WebCore::WebKitNamedFlow::WebKitNamedFlow):
        * dom/WebKitNamedFlow.h:
        (WebKitNamedFlow):

2012-07-13  Kenichi Ishibashi  <bashi@chromium.org>

        [Chromium] Fix bugs in HarfBuzzShaper
        https://bugs.webkit.org/show_bug.cgi?id=90951

        Reviewed by Tony Chang.

        The current implementation has following problems:
        - Cannot render RTL text if the TextRun is divided into more than two
          HarfBuzzRun.
        - Script handling in TextRun partitioning is incorrect.
        - Inaccurate calculation of selection rect.
        - Wrong rendering position when the first glyph of the TextRun have
          non-zero offsets in terms of HarfBuzz.

        To fix these problems I rewrote HarfBuzzShaper class. Here is the summary:
        - Divide the whole range of TextRun first, then shape them in visual
          order.
        - Divide TextRun in the same way of old-harfbuzz's
          hb_utf16_script_run_next().
        - Prefer float than int when calculating selection.
        - Adjust the drawing point after shaping.

        Added tests covers the fix except for the last problem. The last problem will be covered
        by fast/text/international/complex-joining-using-gpos.html after chromium linux port switches
        to use HarfBuzzShaper.

        Tests: fast/text/shaping/shaping-script-order.html
               fast/text/shaping/shaping-selection-rect.html

        * platform/graphics/harfbuzz/FontHarfBuzz.cpp:
        (WebCore::Font::drawComplexText): Adjusts point after shaping.
        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp:
        (WebCore::HarfBuzzShaper::HarfBuzzRun::HarfBuzzRun):
        (WebCore):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::applyShapeResult): Added.
        (WebCore::HarfBuzzShaper::HarfBuzzRun::setGlyphAndAdvance): Offsets are no longer needed.
        (WebCore::HarfBuzzShaper::HarfBuzzRun::xPositionForOffset): Calculates character offset based on advance.
        (WebCore::normalizeCharacters): Added.
        (WebCore::HarfBuzzShaper::HarfBuzzShaper):
        (WebCore::HarfBuzzShaper::~HarfBuzzShaper):
        (WebCore::HarfBuzzShaper::shape): Divides TextRun first, then shapes them.
        (WebCore::HarfBuzzShaper::adjustStartPoint): Added.
        (WebCore::HarfBuzzShaper::collectHarfBuzzRuns): Added.
        (WebCore::HarfBuzzShaper::shapeHarfBuzzRuns): Added.
        (WebCore::HarfBuzzShaper::setGlyphPositionsForHarfBuzzRun): Followed other changes.
        (WebCore::HarfBuzzShaper::selectionRect): Use float for calculating selection.
        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.h:
        (HarfBuzzShaper): Holds the start index of character. Removed unnecessary variables.
        (WebCore::HarfBuzzShaper::HarfBuzzRun::create): Ditto.
        (HarfBuzzRun):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::fontData): Added.
        (WebCore::HarfBuzzShaper::HarfBuzzRun::startIndex): Ditto.
        (WebCore::HarfBuzzShaper::HarfBuzzRun::glyphs): Ditto.
        (WebCore::HarfBuzzShaper::HarfBuzzRun::advances): Ditto.

2012-07-13  Kentaro Hara  <haraken@chromium.org>

        Unreviewed, rolling out r122545.
        http://trac.webkit.org/changeset/122545
        https://bugs.webkit.org/show_bug.cgi?id=91185

        We found that this was a wrong fix

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):

2012-07-13  Kentaro Hara  <haraken@chromium.org>

        Unreviewed, rolling out r122553.
        http://trac.webkit.org/changeset/122553
        https://bugs.webkit.org/show_bug.cgi?id=91198

        We found that this was a wrong fix

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):

2012-07-13  Kent Tamura  <tkent@chromium.org>

        Change the timing of form state restore
        https://bugs.webkit.org/show_bug.cgi?id=89962

        Reviewed by Hajime Morita.

        For a preparation to fix a form identification problem (Bug 91209),
        restore controls states when the parsing of their owner forms is
        completed. For controls without owners, their states are restored when
        their parsing is completed as ever.

        No new tests. This doesn't change observable behavior.

        * html/FormController.cpp:
        (WebCore::ownerFormForState):
        Added. This code was used in formKey(), and restoreControlState*() use it.
        (WebCore::FormKeyGenerator::formKey): Use ownerFormForState(). No behavior change.
        (WebCore::FormController::restoreControlStateFor):
        Moved some code from HTMLFormControlElementWithState::finishParsingChildren().
        The difference is we don't resotre state if this control is owned by a form.
        (WebCore::FormController::restoreControlStateIn):
        Restore states of associated controls. This is called from
        finishParsingChildren() for <form>.
        * html/FormController.h:
        (FormController):
        - Declare restoreControlStateFor() and restoreControlStateIn().
        - Make takeStateForFormElement() private.

        * html/FormAssociatedElement.cpp:
        (WebCore::FormAssociatedElement::isFormControlElementWithState):
        Added. The default implementation returns false.
        * html/FormAssociatedElement.h:
        (FormAssociatedElement):
        Added isFormControlElementWithState() for FormController::restoreControlStateIn().
        * html/HTMLFormControlElementWithState.cpp:
        (WebCore::HTMLFormControlElementWithState::finishParsingChildren):
        Some code was moved to FormController:restoreControlStateFor().
        (WebCore::HTMLFormControlElementWithState::isFormControlElementWithState):
        Added. Returns true.
        * html/HTMLFormControlElementWithState.h:
        (HTMLFormControlElementWithState): Declare isFormControlElementWithState().
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::finishParsingChildren):
        Added. Calls FormController::restoreControlStateIn().
        * html/HTMLFormElement.h:
        (HTMLFormElement): Declare finishParsingChildren().

2012-07-13  Kent Tamura  <tkent@chromium.org>

        Make calendar pickers testable
        https://bugs.webkit.org/show_bug.cgi?id=84827

        Reviewed by Hajime Morita.

        WebCore:
        - Add PagePopupDriver, an interface to open/close a PagePopup.
        - Add setPagePopupDriver() to ChromeClient in order to inject a
        PagePopupDriver for testing.

        Internals:
        Add MockPagePopupDriver, which creates a MockPagePopup, which creates a
        normal <iframe> in the top-level document, and load the popup content on
        it. MockPagePopupDriver is enabled by
        internals.settings.setEnableMockPagePopup(true).

        Test: fast/forms/date/calendar-picker-appearance.html

        * WebCore.gypi: Add new files.
        * WebCore.xcodeproj/project.pbxproj: Add files to make this buildable.
        * page/ChromeClient.h:
        (ChromeClient): Add function for PagePopupDriver.
        * loader/EmptyClients.h: Add empty implementations for PagePopupDriver functions.
        * page/PagePopupDriver.h: Added.
        (PagePopupDriver):
        (WebCore::PagePopupDriver::~PagePopupDriver):

        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::restoreTo): Reset the mock PagePopupDriver.
        (WebCore::InternalSettings::setEnableMockPagePopup):
        Register MockPagePopupDriver to ChromeClient.
        * testing/InternalSettings.h:
        (InternalSettings): Declare setEnableMockPagePopup().
        * testing/InternalSettings.idl: ditto.
        * testing/MockPagePopupDriver.cpp: Added.
        (MockPagePopup): Pseudo PagePopup implementation with the standard <iframe>.
        (WebCore::MockPagePopupDriver::MockPagePopupDriver): Added.
        (WebCore::MockPagePopupDriver::create): Added.
        (WebCore::MockPagePopupDriver::~MockPagePopupDriver): Added.
        (WebCore::MockPagePopupDriver::openPagePopup):
        Added. An override of PagePopupDriver function. This creates a MockPagePopup.
        (WebCore::MockPagePopupDriver::closePagePopup):
        Added. An override of PagePopupDriver function. This deletes the MockPagePopup.
        * testing/MockPagePopupDriver.h:
        (MockPagePopupDriver): Added.

        * testing/v8/WebCoreTestSupport.cpp:
        (WebCoreTestSupport::injectPagePopupController):
        Added. Production code uses per-Page context feature framework. However
        MockPagePopup uses the same page as the host page. So we can't use the
        framework and need to inject window.pagePopupController manually.
        * testing/v8/WebCoreTestSupport.h:
        (WebCoreTestSupport): Add injectPagePopupController().

2012-07-12  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: mute the native looks of the selects in the console.
        https://bugs.webkit.org/show_bug.cgi?id=91120

        Reviewed by Vsevolod Vlasov.

        This is necessary for Mac now that we don't use border images for select.

        * inspector/front-end/ConsoleView.js:
        (WebInspector.ConsoleView.prototype.get statusBarItems):
        (WebInspector.ConsoleView.prototype.addContext):
        (WebInspector.ConsoleView.prototype.removeContext):
        (WebInspector.ConsoleView.prototype._updateIsolatedWorldSelector):
        (WebInspector.ConsoleView.prototype._appendIsolatedContextOption):
        (WebInspector.ConsoleView.prototype._currentEvaluationContext):
        (WebInspector.ConsoleView.prototype._currentIsolatedContextId):
        * inspector/front-end/StatusBarButton.js:
        (WebInspector.StatusBarComboBox):
        (WebInspector.StatusBarComboBox.prototype.addOption):
        (WebInspector.StatusBarComboBox.prototype.removeOption):
        (WebInspector.StatusBarComboBox.prototype.removeOptions):
        (WebInspector.StatusBarComboBox.prototype.selectedOption):
        * inspector/front-end/inspector.css:
        (.status-bar-select-container):
        (select.status-bar-item):
        (.console-context):

2012-07-13  Andrei Bucur  <abucur@adobe.com>

        [CSS Regions] Fix the lifecycle for the flow objects and their renderers
        https://bugs.webkit.org/show_bug.cgi?id=89000

        Reviewed by Eric Seidel.

        This patch adds the concept of a NamedFlowCollection, owned by the document, that keeps track of
        all the named flows that exist in the Document. This collection contains a ListHashSet of weak references to
        all the existing NamedFlows in the document. This is not a managed set because the CREATED flows are referenced from the renderer and
        the NULL flows are only cached, they should be destructible.
        Two named flows are considered to be equal if they have the same name.
        I've changed the NamedFlow state to depend on the existence of its renderer. A flow thread that has a renderer will also have a NamedFlow object.
        A flow thread without a renderer can have a NamedFlow object, but only in the NULL state. It's possible for a NamedFlow object to jump from the
        NULL state to the CREATED state if it was not destroyed (e.g. it was referenced from JS). Keeping track of the NULL state flows that have listeners will be important
        so when they go back to the CREATED state, the listeners would still be there.

        Link to spec: http://www.w3.org/TR/2012/WD-css3-regions-20120503/

        Tests: The old tests have been modified to take into account the new behavior

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/DOMAllInOne.cpp:
        * dom/Document.cpp:
        (WebCore::Document::~Document):
        (WebCore):
        (WebCore::Document::webkitGetFlowByName):
        (WebCore::Document::namedFlows):
        * dom/Document.h:
        (WebCore):
        (Document):
        * dom/WebKitNamedFlow.cpp:
        (WebCore::WebKitNamedFlow::WebKitNamedFlow):
        (WebCore::WebKitNamedFlow::~WebKitNamedFlow):
        (WebCore::WebKitNamedFlow::create):
        (WebCore):
        (WebCore::WebKitNamedFlow::name):
        (WebCore::WebKitNamedFlow::overset):
        (WebCore::nodeInFlowThread):
        (WebCore::WebKitNamedFlow::getRegionsByContentNode):
        (WebCore::WebKitNamedFlow::getContent):
        (WebCore::WebKitNamedFlow::setRenderer):
        * dom/WebKitNamedFlow.h:
        (WebCore):
        (WebKitNamedFlow):
        (WebCore::WebKitNamedFlow::getFlowState):
        (WebCore::WebKitNamedFlow::switchFlowState):
        * dom/WebKitNamedFlowCollection.cpp: Added.
        (WebCore):
        (WebCore::WebKitNamedFlowCollection::WebKitNamedFlowCollection):
        (WebCore::WebKitNamedFlowCollection::length): An O(1) operation
        (WebCore::WebKitNamedFlowCollection::item): An O(N) operation
        (WebCore::WebKitNamedFlowCollection::flowByName): An O(1) operation
        (WebCore::WebKitNamedFlowCollection::ensureNamedFlowInCreatedState): An O(1) operation
        (WebCore::WebKitNamedFlowCollection::moveNamedFlowToNullState): An O(1) operation
        (WebCore::WebKitNamedFlowCollection::discardNamedFlow): An O(1) operation
        (WebCore::WebKitNamedFlowCollection::documentDestroyed):
        (WebCore::WebKitNamedFlowCollection::NamedFlowHashFunctions::hash):
        (WebCore::WebKitNamedFlowCollection::NamedFlowHashFunctions::equal):
        (WebKitNamedFlowCollection::NamedFlowHashFunctions):
        (WebCore::WebKitNamedFlowCollection::NamedFlowHashTranslator::hash):
        (WebCore::WebKitNamedFlowCollection::NamedFlowHashTranslator::equal):
        * dom/WebKitNamedFlowCollection.h: Copied from Source/WebCore/dom/WebKitNamedFlow.h.
        (WebCore):
        (WebKitNamedFlowCollection):
        (WebCore::WebKitNamedFlowCollection::create):
        (WebCore::WebKitNamedFlowCollection::document):
        * rendering/FlowThreadController.cpp:
        (WebCore::FlowThreadController::ensureRenderFlowThreadWithName):
        (WebCore::FlowThreadController::removeFlowThread):
        (WebCore):
        * rendering/FlowThreadController.h:
        (FlowThreadController):
        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::RenderNamedFlowThread):
        (WebCore):
        (WebCore::RenderNamedFlowThread::~RenderNamedFlowThread):
        (WebCore::RenderNamedFlowThread::removeRegionFromThread):
        (WebCore::RenderNamedFlowThread::unregisterNamedFlowContentNode):
        (WebCore::RenderNamedFlowThread::flowThreadName):
        (WebCore::RenderNamedFlowThread::willBeDestroyed):
        * rendering/RenderNamedFlowThread.h:
        (RenderNamedFlowThread):
        (WebCore::RenderNamedFlowThread::contentNodes):
        (WebCore::RenderNamedFlowThread::canBeDestroyed):

2012-07-13  Vineet Chaudhary  <rgf748@motorola.com>

        [V8Bindings] Implement generalised method to validates that the passed object is a sequence type.
        https://bugs.webkit.org/show_bug.cgi?id=91056

        Reviewed by Kentaro Hara.

        Currently the V8 implementation validates that the passed object is a sequence type only
        for MessagePort in V8Utilities::extractTransferables().
        There should be generalised method for other types too.
        Spec URL: http://www.w3.org/TR/2012/WD-WebIDL-20120207/#es-sequence

        No new test, Just refactoring. There should be no behavioral changes.

        * bindings/v8/V8Binding.h:
        (WebCore::toV8Sequence): Added implementation of toV8Sequence().

2012-07-13  Zeno Albisser  <zeno@webkit.org>

        [Qt][WK2] Implement GraphicsSurface for Linux/GLX.
        https://bugs.webkit.org/show_bug.cgi?id=90881

        Add a GLX based GraphicsSurface implementation for Linux.
        Native X windows are being used for exchanging textures
        with the UIProcess.

        Reviewed by Noam Rosenthal.

        * Target.pri:
        * WebCore.pri:
        * platform/graphics/surfaces/GraphicsSurface.cpp:
        (WebCore::GraphicsSurface::create):
            Move creating GraphicsSurface instance into
            platformCreate/platformImport functions to allow
            platform specific creation based on the provided flags.
        (WebCore::GraphicsSurface::GraphicsSurface):
        (WebCore::GraphicsSurface::~GraphicsSurface):
            Call platformDestroy when destroying a GraphicsSurface.
        (WebCore):
        * platform/graphics/surfaces/GraphicsSurface.h:
            Make platformCreate/platformImport functions static
            to be able to call these from the static create function.
            Add Destructor prototype and add GraphicsSurfacePrivate member.
        (WebCore):
        (GraphicsSurface):
        * platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp:
        (WebCore):
        (WebCore::GraphicsSurface::platformCreate):
        (WebCore::GraphicsSurface::platformImport):
            Insert creation of GraphicsSurface instance.
            This allows having a platform specific creation mechanism
            for GLX.
        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp: Added.
        (WebCore):
        (OffScreenRootWindow):
        (WebCore::OffScreenRootWindow::OffScreenRootWindow):
        (WebCore::OffScreenRootWindow::get):
        (WebCore::OffScreenRootWindow::~OffScreenRootWindow):
            Add an OffScreenRootWindow singelton that is being used
            as a parent for all native offscreen windows.
        (GraphicsSurfacePrivate):
            This class is used to manage all the X related resources
            such as opening a display or creating XPixmaps etc.
        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
            Open a connection to the X server and create a
            QOpenGLContext that can be used to resolve GL functions.
        (WebCore::GraphicsSurfacePrivate::~GraphicsSurfacePrivate):
            Properly cleanup and release all the X resources again.
        (WebCore::GraphicsSurfacePrivate::createSurface):
            Create a surface that is placed off screen and can be
            used as a rendering target by the WebProcess.
        (WebCore::GraphicsSurfacePrivate::createPixmap):
            Create a GLXPixmap from the XWindow that was previously
            redirected by the WebProcess. This GLXPixmap can then be
            bound to a texture and being painted on screen by the
            UIProcess.
        (WebCore::GraphicsSurfacePrivate::makeCurrent):
        (WebCore::GraphicsSurfacePrivate::swapBuffers):
        (WebCore::GraphicsSurfacePrivate::display):
        (WebCore::GraphicsSurfacePrivate::glxPixmap):
        (WebCore::GraphicsSurfacePrivate::size):
        (WebCore::GraphicsSurfacePrivate::glContext):
        (WebCore::resolveGLMethods):
            Initialize all the function pointers for the GL functions used.
        (WebCore::GraphicsSurface::platformExport):
        (WebCore::GraphicsSurface::platformGetTextureID):
            Bind the GLXPixmap to a texture.
        (WebCore::GraphicsSurface::platformCopyToGLTexture):
            Not beeing implemented for GLX.
        (WebCore::GraphicsSurface::platformCopyFromFramebuffer):
            Blit origin fbo onto the GraphicsSurface's backing.
        (WebCore::GraphicsSurface::platformCreate):
        (WebCore::GraphicsSurface::platformImport):
        (WebCore::GraphicsSurface::platformLock):
        (WebCore::GraphicsSurface::platformUnlock):
        (WebCore::GraphicsSurface::platformDestroy):

2012-07-13  Dongwoo Im  <dw.im@samsung.com>

        CodeGeneratorJS.pm : SetterExpression should use 'push' rather than 'unshift'
        https://bugs.webkit.org/show_bug.cgi?id=91198

        Reviewed by Kentaro Hara.

        'SetterExpression' should use 'push' to make arguments, rather than 'unshift'.

        No new tests. Covered by existing tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):

2012-07-13  Yoshifumi Inoue  <yosin@chromium.org>

        REGRESSION(r119948): [Forms] Spin button Up/Down actions make value to zero for input type "number" when step mismatched
        https://bugs.webkit.org/show_bug.cgi?id=91197

        Reviewed by Kent Tamura.

        This patch fixes implementation of Decimal::ceiling() and floor().
        They return wrong value for small fractional numbers.

        The bug is occurred when:
          - Step-able input type, e.g. number, date, datetime, and so on.
          - Current value is step mismatched
          - Current value is smaller than step
          - Step up/down by spin button
        because spin button up/down actions are implemented in InputType::setpUpFromRenderer
        which calls Decimal::ceiling() and floor() for step mismatched case.

        Tests: fast/forms/number/number-stepup-stepdown-from-renderer.html: Added test cases
               WebKit/chromium/tests/DecimalTest.cpp: Added test cases

        * platform/Decimal.cpp:
        (WebCore::Decimal::ceiling): Changed to return 1 for positive small fractional number.
        (WebCore::Decimal::floor): Changed to return -1 for negative small fractional number.

2012-07-13  Dominic Mazzoni  <dmazzoni@google.com>

        Should be possible to focus elements within canvas fallback content
        https://bugs.webkit.org/show_bug.cgi?id=87898

        Reviewed by Chris Fleizach.

        Patches isFocusable in dom/Node.cpp and html/HTMLFormControlElement.cpp
        to make elements focusable if they're a descendent of a canvas element
        if they would otherwise have been focusable but just didn't have
        a renderer. Adds a bit to ElementRareData to efficiently keep track
        of elements in a canvas subtree.

        Test: fast/canvas/fallback-content.html

        * dom/Element.cpp:
        (WebCore::Element::attach):
        (WebCore::Element::detach):
        (WebCore::Element::setIsInCanvasSubtree):
        (WebCore):
        (WebCore::Element::isInCanvasSubtree):
        * dom/Element.h:
        (Element):
        * dom/ElementRareData.h:
        (ElementRareData):
        (WebCore::ElementRareData::ElementRareData):
        * dom/Node.cpp:
        (WebCore::Node::isFocusable):
        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::attach):
        (WebCore):
        * html/HTMLCanvasElement.h:
        (HTMLCanvasElement):
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::isFocusable):

2012-07-12  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Add API to get HTTPS status to WebKit2 GTK+
        https://bugs.webkit.org/show_bug.cgi?id=91100

        Reviewed by Martin Robinson.

        * platform/network/soup/ResourceResponse.h:
        (WebCore::ResourceResponse::soupMessageCertificate): Return the
        certificate.
        (WebCore::ResourceResponse::setSoupMessageCertificate): Set a
        certificate.
        (WebCore::ResourceResponse::soupMessageTLSErrors): Return the TLS
        errors.
        (WebCore::ResourceResponse::setSoupMessageTLSErrors): Set TLS
        errors.
        * platform/network/soup/ResourceResponseSoup.cpp:
        (WebCore::ResourceResponse::toSoupMessage): Set the certificate
        and TLS errors to the newly created SoupMessage.
        (WebCore::ResourceResponse::updateFromSoupMessage): Get the
        certificate and TLS errors from the SoupMessage.

2012-07-13  Ryosuke Niwa  <rniwa@webkit.org>

        RadioNodeList is not updated upon input type change
        https://bugs.webkit.org/show_bug.cgi?id=91178

        Reviewed by Alexey Proskuryakov.

        Invalidate the radio node lists when type content attribute changes since it excludes
        image type input elements.

        Test: fast/forms/radionodelist-image-type.html

        * dom/Document.cpp:
        (WebCore::shouldInvalidateNodeListForType):
        * dom/Document.h: Renamed InvalidateOnIdNameForAttrChange to InvalidateOnFormAttrChange
        since listing all attribute name isn't useful at this point.
        * html/RadioNodeList.cpp:
        (WebCore::RadioNodeList::RadioNodeList):

2012-07-12  Dongwoo Im  <dw.im@samsung.com>

        CodeGeneratorJS.pm need to handle the attribute which has "CallWith=ScriptExecutionContext" option.
        https://bugs.webkit.org/show_bug.cgi?id=91185

        Reviewed by Kentaro Hara.

        When an attribute has "CallWith=ScriptExecutionContext" option, 'ScriptExecutionContext*' parameter should be the last parameter.

        No new tests. Covered by existing tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):

2012-07-12  Yoshifumi Inoue  <yosin@chromium.org>

        REGRESSION(r117738): [Forms] stepMismatch for input type "time" with large step value always return false.
        https://bugs.webkit.org/show_bug.cgi?id=91062

        Reviewed by Kent Tamura.

        This patch changes value of StepRange::acceptableError to zero for
        integer restricted step value.

        No new tests, existing test covers (fast/forms/time/ValidityState-stepMismatch-time.html) this change although they are listed in TestExpectation file.

        * html/StepRange.cpp:
        (WebCore::StepRange::acceptableError): Changed to return 0 if step value is restricted to be an integer.

2012-07-12  Dan Bernstein  <mitz@apple.com>

        Pass an option flag to CFStringGetHyphenationLocationBeforeIndex() that tells it to not
        terminate the search at the last word boundary before the given index.

        Reviewed by Adele Peterson.

        No test, because the current version of Core Foundation ignores the options parameter.

        * platform/text/cf/HyphenationCF.cpp:
        (WebCore::lastHyphenLocation): Changed the options parameter from 0 to 1.

2012-07-12  Eric Seidel  <eric@webkit.org>

        Incorrect behaviour calling Range setStart or setEnd with boundary in different document
        https://bugs.webkit.org/show_bug.cgi?id=42517

        Reviewed by Ojan Vafai.

        Added a new static inline "checkForDifferentRootContainer" to share some code
        and made setStart/setEnd do the right thing in the x-document case.  I removed
        the bogus checks in set*After/set*Before functions, and since they just call
        through to setStart/setEnd, they also now do the right thing.

        Test: fast/dom/Range/set-wrong-document-err.html

        * dom/Range.cpp:
        (WebCore::checkForDifferentRootContainer):
        (WebCore):
        (WebCore::Range::setStart):
        (WebCore::Range::setEnd):
        (WebCore::Range::setStartAfter):
        (WebCore::Range::setEndBefore):
        (WebCore::Range::setEndAfter):
        (WebCore::Range::setStartBefore):

2012-07-12  Erik Arvidsson  <arv@chromium.org>

        [V8] Simplify CodeGeneratorV8 since V8OnProto is only true for DOMWindow
        https://bugs.webkit.org/show_bug.cgi?id=91165

        Reviewed by Nate Chapin.

        The old code was dead code since V8OnProto only ever gets set to 1 for DOMWindow.

        No new tests. No change in functionality.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrSetter):

2012-07-12  Ryosuke Niwa  <rniwa@webkit.org>

        Build fix. Initialize unused const member variables to make compilers happy.

        * dom/DynamicNodeList.h:
        (WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase):

2012-07-12  Konrad Piascik  <kpiascik@rim.com>

        Web Inspector: Geolocation override
        https://bugs.webkit.org/show_bug.cgi?id=89365

        Reviewed by Pavel Feldman.

        Reverted original patch.
        Change has not been reviewed by the right people. It declares
        public protocol methods and is wrong in several ways.

        * Modules/geolocation/GeolocationController.cpp:
        (WebCore::GeolocationController::GeolocationController):
        (WebCore::GeolocationController::positionChanged):
        * Modules/geolocation/GeolocationController.h:
        (GeolocationController):
        * inspector/Inspector.json:
        * inspector/InspectorInstrumentation.cpp:
        (WebCore):
        * inspector/InspectorInstrumentation.h:
        (WebCore):
        (InspectorInstrumentation):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::InspectorPageAgent):
        * inspector/InspectorPageAgent.h:
        * inspector/front-end/Settings.js:
        * inspector/front-end/SettingsScreen.js:
        (WebInspector.UserAgentSettingsTab):
        (WebInspector.UserAgentSettingsTab.prototype._createDeviceMetricsElement):
        * inspector/front-end/UserAgentSupport.js:

2012-07-12  Ryosuke Niwa  <rniwa@webkit.org>

        Move m_type and m_hasNameCache from HTMLCollectionCacheBase to DynamicNodeListCacheBase for better bit packing
        https://bugs.webkit.org/show_bug.cgi?id=91164

        Reviewed by Anders Carlsson.

        Moved m_type and m_hasNameCache from HTMLCollection and renamed them to m_collectionType and m_isNameCacheValid.

        Also renamed shouldIncludeChildren to shouldOnlyIncludeDirectChildren and negated the return value since
        all HTMLCollection include children in the collection and the function was meant to tell us whether the collection
        should include descendents that are not direct children of base().

        In addition, renamed nextNodeOrSibling to nextNode since "or sibling" doesn't seem to add any semantic clarity.

        * dom/DynamicNodeList.h:
        (WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase):
        (DynamicNodeListCacheBase):
        (WebCore::DynamicNodeListCacheBase::type):
        (WebCore::DynamicNodeListCacheBase::hasNameCache):
        (WebCore::DynamicNodeListCacheBase::setHasNameCache):
        (WebCore::DynamicNodeListCacheBase::clearCache):
        * html/HTMLCollection.cpp:
        (WebCore::shouldOnlyIncludeDirectChildren):
        (WebCore::HTMLCollection::HTMLCollection):
        (WebCore::HTMLCollection::isAcceptableElement):
        (WebCore::nextNode):
        (WebCore::HTMLCollection::itemAfter):
        * html/HTMLCollection.h:
        (WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase):
        (HTMLCollectionCacheBase):
        (WebCore::HTMLCollectionCacheBase::clearCache):

2012-07-12  Shinya Kawanaka  <shinyak@chromium.org>

        Needs callback before AuthorShadowRoot is added.
        https://bugs.webkit.org/show_bug.cgi?id=91167

        Reviewed by Hajime Morita.

        This is a preliminary patch for adding multiple Shadow DOM support for media elements and form elements.
        They assume that UserAgentShadowRoot is the oldest, however currently a page author may try to add
        AuthorShadowRoot before adding UserAgentShadowRoot.

        This patch adds a callback before AuthorShadowRoot is being added, and allow us to add UserAgentShadowRoot
        for those elements. See also Bug 77936, Bug 77937, Bug 90532.

        * dom/Element.h:
        (WebCore::Element::willAddAuthorShadowRoot):
        * dom/ElementShadow.cpp:
        (WebCore::ElementShadow::addShadowRoot):
        * dom/ElementShadow.h:
        (ElementShadow):
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::create):

2012-07-12  Dana Jansens  <danakj@chromium.org>

        [chromium] Remove the RenderPass pointer from RenderPassDrawQuad
        https://bugs.webkit.org/show_bug.cgi?id=91023

        Reviewed by Adrienne Walker.

        Removes the RenderPass pointer and keeps only an integer id in the
        quad to refer back to the RenderPass the quad reads from.

        Covered by existing tests.

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::findRenderPassById):
        (WebCore):
        (WebCore::removeRenderPassesRecursive):
        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithCachedTextures::shouldRemoveRenderPass):
        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithNoQuads::shouldRemoveRenderPass):
        (WebCore::CCLayerTreeHostImpl::removeRenderPasses):
        (WebCore::CCLayerTreeHostImpl::prepareToDraw):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (FrameData):
        (CullRenderPassesWithCachedTextures):
        (CullRenderPassesWithNoQuads):
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::appendQuadsForRenderSurfaceLayer):
        * platform/graphics/chromium/cc/CCRenderPass.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
        (WebCore::CCRenderPassDrawQuad::create):
        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
        (CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::appendQuads):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (CCRenderSurface):

2012-07-12  Elliott Sprehn  <esprehn@gmail.com>

        Unneeded tree walking when adding or removing children due to RenderCounter / RenderQuote logic
        https://bugs.webkit.org/show_bug.cgi?id=89900

        Reviewed by Eric Seidel and Abhishek Arya.

        Previously we would walk the all children a renderer whenever adding
        or removing a child renderer from its RenderObjectChildList to look for 
        RenderQuote and RenderCounter instances to update. This patch introduces 
        a counter in RenderView for the number of RenderQuote and RenderCounter 
        instances in that document so we can avoid these traversals.

        No tests needed since this is just a short circuiting of logic and the existing
        tests should cover it.

        * rendering/RenderCounter.cpp:
        (WebCore::RenderCounter::RenderCounter): Increment instance counter.
        (WebCore::RenderCounter::willBeDestroyed): Decrement instance counter.
        (WebCore):
        (WebCore::RenderCounter::rendererRemovedFromTree): Short circuit when counter is zero.
        (WebCore::RenderCounter::rendererSubtreeAttached): Short circuit when counter is zero.
        * rendering/RenderCounter.h:
        (RenderCounter):
        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::removeChildNode): Short circuit calling into Counter and Quote code when the document is being destroyed.
        * rendering/RenderQuote.cpp:
        (WebCore::RenderQuote::RenderQuote):
        (WebCore::RenderQuote::willBeDestroyed):
        (WebCore):
        (WebCore::RenderQuote::rendererSubtreeAttached): Increment instance counter.
        (WebCore::RenderQuote::rendererRemovedFromTree): Decrement instance counter.
        * rendering/RenderQuote.h:
        (RenderQuote):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::RenderView):
        * rendering/RenderView.h: Methods for managing the RenderQuote and RenderCounter counts.
        (RenderView):
        (WebCore::RenderView::addRenderQuote):
        (WebCore::RenderView::removeRenderQuote):
        (WebCore::RenderView::hasRenderQuotes):
        (WebCore::RenderView::addRenderCounter):
        (WebCore::RenderView::removeRenderCounter):
        (WebCore::RenderView::hasRenderCounters):

2012-07-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge HTMLCollectionWithArrayStorage into HTMLCollection
        https://bugs.webkit.org/show_bug.cgi?id=91144

        Reviewed by Anders Carlsson.

        Merged HTMLCollectionWithArrayStorage::item into HTMLCollection::item and got rid of
        HTMLCollectionWithArrayStorage. Also de-virtualized HTMLCollection::item and HTMLCollection::length
        and merged itemInArrayAfter and itemAfter.

        In addition, improved the algorithm in HTMLCollection::length to take advantage of item cache.
        Instead of always computing the length from the beginning, we start the search from the cached item
        so that if we're near end of the collection, we avoid significant portion of the node traversal.

        Furthermore, made HTMLCollection always call setItemCache with a non-null item and HTMLCollection::item
        set the length cache when it reaches the end of the collection to avoid redundant length calculations.

        * dom/DynamicNodeList.h:
        (WebCore::DynamicNodeListCacheBase::setItemCache): Add a FIXME.
        * html/HTMLCollection.cpp:
        (WebCore::HTMLCollection::itemAfter): Regular HTMLCollection doesn't have uses elements array so
        assert that offsetInArray is always 0.
        (WebCore): Removed calcLength.
        (WebCore::HTMLCollection::length): Rewritten. The algorithm is as follows:
        When there is no item cache, we look for the first item by calling item(0). If item(0) returns null,
        then it must have set the length cache so bail out. If the previous step didn't bail out, then
        the item cache is valid and not null (see above), so count the number of remaining items in collection
        starting at the cached item's offset + 1.
        (WebCore::HTMLCollection::item): Avoid calling setItemCache with null. When the first item is null,
        set the length cache instead.
        (WebCore::HTMLCollection::itemAfterCachedItem): Extracted from HTMLCollectionWithArrayStorage::item.
        (WebCore::HTMLCollection::namedItem): Pass in arrayOffset to itemAfter. Note this variable is never
        used since only HTMLFormCollection and HTMLPropertiesCollection use array offsets but they override
        this function.
        (WebCore::HTMLCollection::updateNameCache): Ditto.
        * html/HTMLCollection.h:
        (HTMLCollection):
        (WebCore):
        * html/HTMLFormCollection.cpp: Removed calcLength(). Even though this function didn't iterate over
        the collection directly, HTMLFormElement::length and HTMLFieldSetElement::length did so we're not
        regressing any performance here.
        (WebCore::HTMLFormCollection::HTMLFormCollection):
        (WebCore::HTMLFormCollection::itemAfter):
        * html/HTMLFormCollection.h:
        (HTMLFormCollection):
        * html/HTMLNameCollection.cpp:
        (WebCore::HTMLNameCollection::itemAfter):
        * html/HTMLNameCollection.h:
        (HTMLNameCollection):
        * html/HTMLPropertiesCollection.cpp: Removed calcLength().
        (WebCore::HTMLPropertiesCollection::HTMLPropertiesCollection):
        (WebCore::HTMLPropertiesCollection::itemAfter):
        (WebCore):
        * html/HTMLPropertiesCollection.h:
        (HTMLPropertiesCollection):
        * html/HTMLTableRowsCollection.cpp:
        (WebCore::HTMLTableRowsCollection::itemAfter):
        * html/HTMLTableRowsCollection.h:
        (HTMLTableRowsCollection):

2012-07-12  Pravin D  <pravind.2k4@gmail.com>

        Row size/position is wrongly calculated when table having overlapping rowspan cell and colspan cell
        https://bugs.webkit.org/show_bug.cgi?id=16811

        Reviewed by Julien Chaffraix.

        The height of a row is calculated by taking the max height of the cells contained in it. When a row contains
        a rowSpan cell and if this row is not the last row of the cell, then its height is max height of other non
        rowSpan cells. If the row is the last row of the rowSpan cell, then using the contraint laid by CSS2.1 spec
        "For a rowSpan cell, the sum of the row heights involved must be great enough to encompass the cell spanning the rows",
        the last remaining height of the rowSpan(cell height minus heights of other involved rows) is taken into consideration
        while calculating the height of this row.
        Currently when calculating the height of the row we are only using the height of the primary cell at position (row, col).
        However when a row has colSpan cell and rowSpan, they might overlap. In such a sitution as only the primary cells height
        is considered, the height of the row will be calculated worngly if the other overlapping cell has greater height.
        Thus all the overlapping cell at position (row, col) must be considered while calculating the height of a row. 

        Test: fast/table/last-cell-of-rowspan-overlapping-colspan-cell.html

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::calcRowLogicalHeight):
        Fixed function to use all the overlapping cells at position(row, col) to calculate the height/position of rows.

2012-07-12  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Enable IDBFactory.deleteDatabase() and webkitGetDatabaseNames() in Workers
        https://bugs.webkit.org/show_bug.cgi?id=90310

        Reviewed by Tony Chang.

        Simplify Document vs. Worker logic for IDBFactory::open() and hook up the
        other two IDBFactory methods for use by workers as well.

        Test: storage/indexeddb/factory-basics-workers.html

        * Modules/indexeddb/IDBFactory.cpp:
        (isContextValid): Helper function consolidating checks that context is usable.
        (getIndexedDBDatabasePath): Helper function for accessing group settings.
        (WebCore::IDBFactory::getDatabaseNames): Simplify - just pass context through to back end.
        (WebCore::IDBFactory::open): Ditto.
        (WebCore::IDBFactory::deleteDatabase): Ditto.
        (WebCore::IDBFactory::cmp): Whitespace.
        * Modules/indexeddb/IDBFactoryBackendImpl.cpp: Obsolete openFromWorker() removed.
        (WebCore::IDBFactoryBackendImpl::getDatabaseNames): Signature updated.
        (WebCore::IDBFactoryBackendImpl::deleteDatabase): Signature updated.
        (WebCore::IDBFactoryBackendImpl::open): Signature updated.
        * Modules/indexeddb/IDBFactoryBackendImpl.h:
        (IDBFactoryBackendImpl):
        * Modules/indexeddb/IDBFactoryBackendInterface.h: Interface methods now take both SecurityOrigin
        and ScriptExecutionContext, but not Frame. In the proxy, SecurityOrigin is redundant (can be
        accessed from context) but on the real back end the context is null (as Frame was previously).
        (IDBFactoryBackendInterface):
        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore):
        (WebCore::InspectorIndexedDBAgent::requestDatabaseNamesForFrame):
        (WebCore::InspectorIndexedDBAgent::requestDatabase):
        (WebCore::InspectorIndexedDBAgent::requestData):

2012-07-12  Dana Jansens  <danakj@chromium.org>

        [chromium] The root layer should not try create a second RenderSurface for itself
        https://bugs.webkit.org/show_bug.cgi?id=91124

        Reviewed by Adrienne Walker.

        Tests: CCLayerTreeHostImplTest.rootLayerDoesntCreateExtraSurface

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::subtreeShouldRenderToSeparateSurface):

2012-07-12  Adam Barth  <abarth@webkit.org>

        Regression (r122359) Layout Test html5lib/runner.html is failing
        https://bugs.webkit.org/show_bug.cgi?id=91047

        Reviewed by Tony Chang.

        This ASSERT is bogus because doctypes can be removed from the DOM and
        then re-added.

        Test: fast/viewport/viewport-legacy-xhtmlmp-remove-and-add.html

        * dom/Document.cpp:
        (WebCore::Document::setDocType):

2012-07-12  Ojan Vafai  <ojan@chromium.org>

        Implied minimum size of flex items is min-content
        https://bugs.webkit.org/show_bug.cgi?id=87546

        Reviewed by Tony Chang.

        http://dev.w3.org/csswg/css3-flexbox/#min-size-auto
        In the main axis direction, min-size of auto means min-content.

        Test: css3/flexbox/flex-item-min-size.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeLogicalWidthInRegionUsing):
        (WebCore::RenderBox::computeContentLogicalHeightUsing):
        (WebCore::RenderBox::computeReplacedLogicalWidthUsing):
        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
        (WebCore::RenderBox::computePositionedLogicalWidthUsing):
        (WebCore::RenderBox::computePositionedLogicalHeightUsing):
        It turned out that these FIXMEs are all unnecessary with the changes to RenderFlexibleBox.

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes):
        (WebCore::RenderFlexibleBox::adjustChildSizeForMinAndMax):

2012-07-12  Eric Penner  <epenner@google.com>

        [chromium] Use CCTexture/TextureAllocator and remove TextureManager
        https://bugs.webkit.org/show_bug.cgi?id=91001

        Reviewed by Adrienne Walker.

        Use CCTexture to clean up CCPrioritizedTexture::Backing.
        Add TextureAllocator.h and remove remainder of TextureManager.h/cpp.
        Minor move/refactoring of link/unlink in CCPrioritizedTexture.
        Remove double initialization of the default memory limit.

        Covered by existing tests (refactoring).

        * WebCore.gypi:
        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h:
        (WebCore):
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
        (WebCore):
        * platform/graphics/chromium/ImageLayerChromium.cpp:
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::initialize):
        * platform/graphics/chromium/ManagedTexture.cpp: Removed.
        * platform/graphics/chromium/ManagedTexture.h: Removed.
        * platform/graphics/chromium/RenderSurfaceChromium.h:
        (WebCore):
        * platform/graphics/chromium/TextureAllocator.h: Copied from Source/WebCore/platform/graphics/chromium/cc/CCPriorityCalculator.h.
        (WebCore):
        (TextureAllocator):
        (WebCore::TextureAllocator::~TextureAllocator):
        * platform/graphics/chromium/TextureManager.cpp: Removed.
        * platform/graphics/chromium/TextureManager.h: Removed.
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        * platform/graphics/chromium/TrackingTextureAllocator.cpp:
        (WebCore::TrackingTextureAllocator::createTexture):
        (WebCore::TrackingTextureAllocator::deleteTexture):
        * platform/graphics/chromium/TrackingTextureAllocator.h:
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::prioritizeTextures):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCPrioritizedTexture.cpp:
        (WebCore::CCPrioritizedTexture::CCPrioritizedTexture):
        (WebCore::CCPrioritizedTexture::setDimensions):
        (WebCore::CCPrioritizedTexture::textureId):
        (WebCore::CCPrioritizedTexture::bindTexture):
        (WebCore::CCPrioritizedTexture::framebufferTexture2D):
        (WebCore::CCPrioritizedTexture::link):
        (WebCore):
        (WebCore::CCPrioritizedTexture::unlink):
        * platform/graphics/chromium/cc/CCPrioritizedTexture.h:
        (WebCore):
        (WebCore::CCPrioritizedTexture::bytes):
        (CCPrioritizedTexture):
        (WebCore::CCPrioritizedTexture::haveBackingTexture):
        (WebCore::CCPrioritizedTexture::Backing::Backing):
        (WebCore::CCPrioritizedTexture::Backing::~Backing):
        (WebCore::CCPrioritizedTexture::Backing::owner):
        (Backing):
        (WebCore::CCPrioritizedTexture::backing):
        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.cpp:
        (WebCore::CCPrioritizedTextureManager::prioritizeTextures):
        (WebCore::CCPrioritizedTextureManager::requestLate):
        (WebCore::CCPrioritizedTextureManager::acquireBackingTextureIfNeeded):
        (WebCore::CCPrioritizedTextureManager::reduceMemory):
        (WebCore::CCPrioritizedTextureManager::clearAllMemory):
        (WebCore::CCPrioritizedTextureManager::registerTexture):
        (WebCore::CCPrioritizedTextureManager::returnBackingTexture):
        (WebCore::CCPrioritizedTextureManager::createBacking):
        (WebCore::CCPrioritizedTextureManager::destroyBacking):
        (WebCore::CCPrioritizedTextureManager::assertInvariants):
        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.h:
        (CCPrioritizedTextureManager):
        (WebCore::CCPrioritizedTextureManager::defaultMemoryAllocationLimit):
        (WebCore::CCPrioritizedTextureManager::compareBackings):
        * platform/graphics/chromium/cc/CCPriorityCalculator.h:
        * platform/graphics/chromium/cc/CCScopedTexture.cpp:
        * platform/graphics/chromium/cc/CCScopedTexture.h:
        * platform/graphics/chromium/cc/CCTexture.h:
        (WebCore::CCTexture::CCTexture):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
        (WebCore):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:

2012-07-12  Ryosuke Niwa  <rniwa@webkit.org>

        Let Xcode have its own way.

        * WebCore.xcodeproj/project.pbxproj:

2012-07-12  Julien Chaffraix  <jchaffraix@webkit.org>

        ASSERT(genChild->isListMarker() || genChild->style()->styleType() == FIRST_LETTER) triggered on flex-box content
        https://bugs.webkit.org/show_bug.cgi?id=91003

        Reviewed by Abhishek Arya.

        Tests: fast/flexbox/assert-generated-deprecated-flexbox.html
               fast/flexbox/assert-generated-new-flexbox.html

        The issue was that findBeforeAfterParent didn't return the right parent for the flex-box case. This would
        make us update the wrong children (and not propagate the style updates properly).

        * rendering/RenderObjectChildList.cpp:
        (WebCore::findBeforeAfterParent):
        Added a check for flex boxes (both deprecated and new).

2012-07-12  Pravin D  <pravind.2k4@gmail.com>

        Percentage width replaced element in zero percent/fixed width container block incorrectly rendered.
        https://bugs.webkit.org/show_bug.cgi?id=9493

        Reviewed by Andy Estes.

        When the width of the container is zero percent/fixed value then the width of the replaced element must also be zero.

        Test: fast/css/percent-width-img-inside-zero-percent-and-fixed-container.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeReplacedLogicalWidthUsing):
          When the containing block's available width is zero there can be two cases.
          The containing block is floated/positioned in which case the width of the replaced child element must be its instrinsic width.
          On the other hand if the width of the container is specified to be either zero percent or fixed value then the width of the
          replaced elment must be zero.

2012-07-11  Ryosuke Niwa  <rniwa@webkit.org>

        invalidateNodeListsCacheAfterAttributeChanged should dynamically figure out which attribute needs invalidation
        https://bugs.webkit.org/show_bug.cgi?id=91046

        Reviewed by Anders Carlsson.

        Added an array of counters (m_nodeListCounts) for each set of attributes (NodeListInvalidationType) node lists care about
        to Document, and made DynamicSubtreeNodeList's constructor and destructor increment and decrement these counters via
        registerDynamicSubtreeNodeList and unregisterDynamicSubtreeNodeList respectively. shouldInvalidateDynamicSubtreeNodeList,
        which is called by invalidateNodeListsCacheAfterAttributeChanged, then use these counters to determine whether a given
        attribute change should result in node list invalidations.

        Also removed m_numNodeListCaches from TreeScope because this counter has now become redundant with m_nodeListCounts.

        * dom/ChildNodeList.cpp:
        (WebCore::ChildNodeList::ChildNodeList): Do not invalidate on attribute changes.
        * dom/ClassNodeList.cpp:
        (WebCore::ClassNodeList::ClassNodeList): Invalidate on class attribute changes.
        * dom/Document.cpp:
        (WebCore::Document::Document): Initialize m_nodeListCounts.
        (WebCore::Document::~Document): Add assertions to make sure m_listsInvalidatedAtDocument, m_nodeListCounts, and
        m_collections are all empty.
        (WebCore::Document::registerDynamicSubtreeNodeList): This function is now called for all DynamicSubtreeNodeLists supposed
        to just ones rooted at the document in order to increment the counter for each invalidation type.
        (WebCore::Document::unregisterDynamicSubtreeNodeList): Ditto.
        (WebCore::shouldInvalidateDynamicSubtreeNodeListForType): Checks the attribute name against NodeListInvalidationType.
        (WebCore::Document::shouldInvalidateDynamicSubtreeNodeList): Returns true if the given attribute name matches the invalidation
        type of the existing DynamicSubtreeNodeLists in the document. If the attribute name is not given (used when children change),
        then it checks for the existence of any DynamicSubtreeNodeLists. Conceptually, this function can be written as a list of
        "if" statements that checks values in m_nodeListCounts and the attribute name. We use "for" loop and switch statement instead
        to share logic and detect future addition of values to NodeListInvalidationType.
        * dom/Document.h:
        (Document): Moved RootType and InvalidationType from DynamicNodeListCacheBase and renamed them to NodeListRootType and
        NodeListInvalidationType respectively in order to reduce the possibility of future name collisions. Also the invalidation type
        now contains 6 values instead of 2.
        * dom/DynamicNodeList.cpp:
        (WebCore):
        * dom/DynamicNodeList.h:
        (WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase): 
        (WebCore::DynamicNodeListCacheBase::shouldInvalidateOnAttributeChange):
        (WebCore::DynamicNodeListCacheBase::rootType): Added.
        (WebCore::DynamicNodeListCacheBase::invalidationType): Added.
        (DynamicNodeListCacheBase): Uses 3 bits to store invalidation type now that the number of values have increased from 2 to 6.
        (WebCore::DynamicNodeList::DynamicNodeList):
        (WebCore::DynamicSubtreeNodeList::~DynamicSubtreeNodeList): Call unregisterDynamicSubtreeNodeList.
        (WebCore::DynamicSubtreeNodeList::DynamicSubtreeNodeList): Call registerDynamicSubtreeNodeList.
        * dom/MicroDataItemList.cpp:
        (WebCore::MicroDataItemList::MicroDataItemList): Invalidate on itemscope, itemprop, and itemtype content attribute changes.
        * dom/NameNodeList.cpp:
        (WebCore::NameNodeList::NameNodeList): Invalidate on name attribute changes.
        * dom/Node.cpp:
        (WebCore::Node::clearRareData):
        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged): Replaced the hard coded check list of attributes, by a call
        to shouldInvalidateDynamicSubtreeNodeList.
        (WebCore::Node::invalidateNodeListsCacheAfterChildrenChanged): Calls shouldInvalidateDynamicSubtreeNodeList.
        (WebCore::Node::getElementsByTagName):
        (WebCore::Node::getElementsByTagNameNS):
        (WebCore::Node::getElementsByName):
        (WebCore::Node::getElementsByClassName):
        (WebCore::Node::radioNodeList):
        (WebCore::NodeRareData::createNodeLists):
        * dom/NodeRareData.h:
        (WebCore::NodeListsNodeData::adoptTreeScope): Unregister and register node lists in m_tagNodeListCacheNS since all node lists
        need to be accounted in m_nodeListCounts.
        (WebCore::NodeRareData::ensureNodeLists):
        (NodeRareData):
        * dom/TagNodeList.cpp:
        (WebCore::TagNodeList::TagNodeList): Do not invalidate on any attribute changes.
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::TreeScope): No longer initializes m_numNodeListCaches since it has been removed.
        * dom/TreeScope.h:
        (TreeScope): Removed m_numNodeListCaches.
        * dom/TreeScopeAdopter.cpp:
        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
        * html/HTMLCollection.h:
        (WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase): Just pass in DoNotInvalidateOnAttributeChanges for now since
        it's never used in HTMLCollections.
        * html/LabelableElement.cpp:
        (WebCore::LabelableElement::labels):
        * html/LabelsNodeList.cpp:
        (WebCore::LabelsNodeList::LabelsNodeList): Invalidate on for content attribute changes.
        (WebCore::LabelsNodeList::~LabelsNodeList):
        * html/RadioNodeList.cpp:
        (WebCore::RadioNodeList::RadioNodeList): Invalidate on id, name, and for content attribute changes.
        (WebCore::RadioNodeList::~RadioNodeList):

2012-07-12  Gavin Barraclough  <barraclough@apple.com>

        Threadsafety issues in WebScriptObject
        https://bugs.webkit.org/show_bug.cgi?id=90849

        Reviewed by Filip Pizlo & Oliver Hunt.

        Updated fix for this bug. Taking the JSC API lock from WebScriptObject::release
        may not be safe; better to just guard the JSWrapperCache with its own spinlock.

        * bindings/objc/WebScriptObject.mm:
        (WebCore::getJSWrapper):
            - Added spinlock; also retain/autorelease the returned wrapper - it is unsafe
              to wait for the caller to do so, due to a race condition vs release removing
              the wrapper from the map.
        (WebCore::addJSWrapper):
            - Take the spinlock guarding the cache.
        (WebCore::removeJSWrapper):
            - Take the spinlock guarding the cache.
        (WebCore::removeJSWrapperIfRetainCountOne):
            - Take the spinlock guarding the cache, remove the wrapper if retainCount is one.
        (WebCore::createJSWrapper):
            - Remove the API lock; this method no longer needs to retain/autorelease (this is
              done by getJSWrapper).
        (-[WebScriptObject _setImp:originRootObject:rootObject:]):
            - Remove the API lock.
        (-[WebScriptObject release]):
            - Remove the API lock, retainCount check moved into removeJSWrapperIfRetainCountOne.

2012-07-11  David Hyatt  <hyatt@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=91000
        REGRESSION (r122244): Overflow elements don't shrink as much as they should.

        Reviewed by Simon Fraser.

        This is a fix for a a regression from https://bugs.webkit.org/show_bug.cgi?id=90646.

        I incorrectly analyzed the issue with Robert Hogan's negative margin patch and fooled myself into putting back
        in an incorrect minimum width check from long ago.
        
        What should have happened in the test case I patched is that the overflow element should shrink to 0. The issue 
        with improving the logical top estimate in the previous patch is it made the clear delta become 0. This in turn
        exposed a bug in our clearing algorithm with Robert's changes where you could need a relayout even if you didn't
        actually move. This issue only occurs because the floats list is getting changed mid-layout because of negative margins.

        The patch changes getClearDelta to call setChildNeedsLayout(true) on children whose widths change even when their
        positions do not. In effect this dynamic addition of new floats after you have done a layout on the child already means
        that you can need to lay out again despite not actually having to move.
        
        To handle this, the code that does the relayout is now called if the child needs a relayout. This is done even if
        the logical top estimate matches the final position.
        
        No new tests required, since the test in fast/block/float is now correctly covering the issue.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::layoutBlockChild):
        (WebCore::RenderBlock::getClearDelta):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::shrinkLogicalWidthToAvoidFloats):

2012-07-12  James Weatherall  <wez@chromium.org>

        storage tests are flaky (crashing) on windows
        https://bugs.webkit.org/show_bug.cgi?id=90469

        Reviewed by Kentaro Hara.

        Add a missing check that the underlying V8 object reference in a V8 NPObject is valid, and zero the NPObject's rootObject member when disposing it, to ensure that it won't be mistakenly touched after that point.

        This patch is intended to resolve flakiness in the storage tests including:
          storage/indexeddb/mozilla/indexes.html
          storage/indexeddb/mozilla/key-requirements-inline-and-passed.html
          storage/websql/multiple-databases-garbage-collection.html

        * bindings/v8/NPV8Object.cpp:
        (WebCore::disposeUnderlyingV8Object):
        Zero the NPObject's underlying rootObject.
        (_NPN_EvaluateHelper):
        Add check that the underlying V8 object reference is valid.

2012-07-12  No'am Rosenthal  <noam.rosenthal@nokia.com>

        Move TextureMapperAnimation and texmap/LayerTransform to platform/graphics
        https://bugs.webkit.org/show_bug.cgi?id=91111

        Reviewed by Kenneth Rohde Christiansen.

        TextureMapperAnimation and LayerTransform are not specific to TextureMapper, and we want
        to use them for other purposes as well. Moving them to platform/graphics would make that
        more explicit.

        No new tests, moving files around.

        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * platform/graphics/GraphicsLayerAnimation.cpp: Renamed from Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp.
        * platform/graphics/GraphicsLayerAnimation.h: Renamed from Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.h.
        * platform/graphics/GraphicsLayerTransform.cpp: Renamed from Source/WebCore/platform/graphics/texmap/LayerTransform.cpp.
        * platform/graphics/GraphicsLayerTransform.h: Renamed from Source/WebCore/platform/graphics/texmap/LayerTransform.h.
        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
        (WebCore::GraphicsLayerTextureMapper::addAnimation):
        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
        (GraphicsLayerTextureMapper):
        * platform/graphics/texmap/TextureMapperLayer.h:
        (TextureMapperLayer):
        (WebCore::TextureMapperLayer::setAnimatedTransform):
        (WebCore::TextureMapperLayer::setAnimatedOpacity):

2012-07-12  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Simplify UISourceCode code after moving revisions support inside it.
        https://bugs.webkit.org/show_bug.cgi?id=91118

        Reviewed by Pavel Feldman.

        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode.prototype._setContent):
        (WebInspector.UISourceCode.prototype.revertToOriginal):
        (WebInspector.UISourceCode.prototype.revertAndClearHistory):
        (WebInspector.UISourceCode.prototype.contentChanged):
        (WebInspector.UISourceCode.prototype.commitWorkingCopy):
        (WebInspector.Revision.prototype.revertToThis):

2012-07-12  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Unreviewed. Build fix for r122462.

        * platform/qt/MemoryUsageSupportQt.cpp:

2012-07-12  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Remove resources panel edited resources search support.
        https://bugs.webkit.org/show_bug.cgi?id=91101

        Reviewed by Pavel Feldman.

        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.ResourcesPanel.prototype.performSearch.callback):
        (WebInspector.ResourcesPanel.prototype.performSearch):

2012-07-12  Vsevolod Vlasov  <vsevik@chromium.org>

        Unreviewed r122460 inspector closure compilation fix follow up.

        * inspector/front-end/RevisionHistoryView.js:
        (WebInspector.RevisionHistoryView):

2012-07-12  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: fix native memory instrumentation code for the bindings instrumentation.
        https://bugs.webkit.org/show_bug.cgi?id=91096

        The instrumented class has to have instrumentation method which reports class size and type and
        the member objects and pointers.

        Sample:
        void Node::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
        {
            memoryObjectInfo->reportObjectInfo(this, MemoryInstrumentation::DOM); // report object size and type.
            TreeShared<Node, ContainerNode>::reportMemoryUsage(memoryObjectInfo); // call base class instrumentation.
            ScriptWrappable::reportMemoryUsage(memoryObjectInfo); // call base class instrumentation.
            memoryObjectInfo->reportPointer(m_document, MemoryInstrumentation::DOM); // report uninstrumented pointer.
            memoryObjectInfo->reportInstrumentedPointer(m_next); // report instrumented pointer.
            memoryObjectInfo->reportInstrumentedObject(m_anObject); // report instrumented object.
        }

        Reviewed by Pavel Feldman.

        Existing tests for native memory instrumentation.

        * bindings/v8/DOMDataStore.cpp:
        (WebCore::DOMDataStore::reportMemoryUsage):
        * bindings/v8/DOMDataStore.h:
        (WebCore):
        (DOMDataStore):
        * bindings/v8/IntrusiveDOMWrapperMap.h:
        (WebCore::ChunkedTable::reportMemoryUsage):
        * bindings/v8/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
        * bindings/v8/V8Binding.cpp:
        (WebCore::V8BindingPerIsolateData::reportMemoryUsage):
        (WebCore::StringCache::reportMemoryUsage):
        * bindings/v8/V8Binding.h:
        (WebCore):
        (StringCache):
        (V8BindingPerIsolateData):
        * bindings/v8/V8DOMMap.h:
        (WebCore):
        (AbstractWeakReferenceMap):
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):

2012-07-12  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: beautify find bar looks, simplify search update routines.
        https://bugs.webkit.org/show_bug.cgi?id=91087

        Reviewed by Vsevolod Vlasov.

        This change updates the looks to the one on the screenshots and simplifies match count update routines.

        * inspector/front-end/SearchController.js:
        (WebInspector.SearchController.onMatchesMouseDown):
        (WebInspector.SearchController):
        (WebInspector.SearchController.prototype.activePanelChanged.performPanelSearch):
        (WebInspector.SearchController.prototype.activePanelChanged):
        (WebInspector.SearchController.prototype._updateSearchNavigationButtonState):
        (WebInspector.SearchController.prototype._updateSearchMatchesCountAndCurrentMatchIndex):
        (WebInspector.SearchController.prototype._onKeyDown):
        (WebInspector.SearchController.prototype._onInput):
        (WebInspector.SearchController.prototype._onNextButtonSearch):
        (WebInspector.SearchController.prototype._onPrevButtonSearch):
        (WebInspector.SearchController.prototype._performSearch):
        * inspector/front-end/inspector.css:
        (#search):
        (#search:focus):
        (.toolbar-search-navigation-controls):
        (.toolbar-search-navigation):
        (.toolbar-search-navigation.enabled:hover):
        (.toolbar-search-navigation.enabled, .toolbar-search-navigation.enabled:active):
        (.toolbar-search):
        (.toolbar-search-control):
        (.search-results-matches):
        (.inspector-footer):

2012-07-12  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: ASSERT hit calling open from callback in Worker
        https://bugs.webkit.org/show_bug.cgi?id=90832

        Reviewed by Kentaro Hara.

        GroupSettings are used to provide the backing store path in some
        ports. Accessing those settings from a Worker was added, but the
        access referenced thread startup data that is cleared before the
        run loop, so an IDBFactory.open() call executed asynchronously
        would dereference a null pointer. Plumb the settings startup
        data into the context itself, like all of the other properties.

        Test: storage/indexeddb/open-twice-workers.html

        * Modules/indexeddb/IDBFactory.cpp:
        (WebCore::IDBFactory::open):
        * workers/DedicatedWorkerContext.cpp:
        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
        * workers/DedicatedWorkerContext.h:
        (WebCore::DedicatedWorkerContext::create):
        (DedicatedWorkerContext):
        * workers/DedicatedWorkerThread.cpp:
        (WebCore::DedicatedWorkerThread::createWorkerContext):
        * workers/DedicatedWorkerThread.h:
        (DedicatedWorkerThread):
        * workers/SharedWorkerContext.cpp:
        (WebCore::SharedWorkerContext::SharedWorkerContext):
        * workers/SharedWorkerContext.h:
        (WebCore::SharedWorkerContext::create):
        (SharedWorkerContext):
        * workers/SharedWorkerThread.cpp:
        (WebCore::SharedWorkerThread::createWorkerContext):
        * workers/SharedWorkerThread.h:
        (SharedWorkerThread):
        * workers/WorkerContext.cpp:
        (WebCore::WorkerContext::WorkerContext):
        * workers/WorkerContext.h:
        (WebCore::WorkerContext::groupSettings):
        (WorkerContext):
        * workers/WorkerThread.cpp:
        (WebCore::WorkerThread::workerThread):
        * workers/WorkerThread.h:
        (WorkerThread):

2012-07-12  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        [Qt] Implement MemoryUsageSupport
        https://bugs.webkit.org/show_bug.cgi?id=91094

        Reviewed by Adam Barth.

        Implements Qt versions of the memory-usage functions using the information we have available
        from the various memory systems used in WebKit.

        Also gets rid of a redundant indirection in V8GCController.

        * Target.pri:
        * bindings/v8/V8GCController.cpp:
        (WebCore::V8GCController::gcEpilogue):
        (WebCore::V8GCController::checkMemoryUsage):
        * platform/qt/MemoryUsageSupportQt.cpp: Added.
        (WebCore::mallocMemoryUsage):
        (WebCore::memoryUsageKB):
        (WebCore::actualMemoryUsageKB):
        (WebCore::MemoryUsageSupport::memoryUsageMB):
        (WebCore::MemoryUsageSupport::actualMemoryUsageMB):
        (WebCore::MemoryUsageSupport::lowMemoryUsageMB):
        (WebCore::MemoryUsageSupport::highMemoryUsageMB):
        (WebCore::MemoryUsageSupport::highUsageDeltaMB):
        (WebCore::MemoryUsageSupport::processMemorySizesInBytes):
        * platform/qt/PlatformSupport.h:
        (PlatformSupport):

2012-07-12  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Revision history view should be updated when uiSourceCodes are removed or replaced.
        https://bugs.webkit.org/show_bug.cgi?id=91095

        Reviewed by Pavel Feldman.

        RevisionHistoryView is now reset in WorkspaceReset event handler.
        UISourceCodes are now removed from RevisionHistoryView when uiSourceCode is removed or replace.

        * inspector/front-end/RevisionHistoryView.js:
        (WebInspector.RevisionHistoryView):
        (WebInspector.RevisionHistoryView.prototype._clearHistory):
        (WebInspector.RevisionHistoryView.prototype._uiSourceCodeRemoved):
        (WebInspector.RevisionHistoryView.prototype._uiSourceCodeReplaced):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._reset):

2012-07-12  Dongwoo Im  <dw.im@samsung.com>

        InspectorFileSystemAgent.cpp have to include File.h explicitly
        https://bugs.webkit.org/show_bug.cgi?id=91078

        Reviewed by Vsevolod Vlasov.

        Make sure the InspectorFileSystemAgent.cpp include the File.h by including explicitly.

        No new tests. Covered by existing tests.

        * inspector/InspectorFileSystemAgent.cpp: Include File.h

2012-07-12  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: [Regression] Stale revisions should be removed on navigation.
        https://bugs.webkit.org/show_bug.cgi?id=91080

        Reviewed by Pavel Feldman.

        Moved all the code responsible for script mapping resetting to Workspace.
        Stale revisions are removed in Workspace._reset now.

        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.ScriptSnippetModel):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StylesUISourceCodeProvider):
        (WebInspector.StylesUISourceCodeProvider.prototype._populate):
        (WebInspector.StylesUISourceCodeProvider.prototype.reset):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode.prototype._restoreRevisionHistory):
        * inspector/front-end/Workspace.js:
        (WebInspector.Workspace):
        (WebInspector.Workspace.prototype._reset):

2012-07-12  Andreas Kling  <kling@webkit.org>

        Make ElementAttributeData a variable-sized object to reduce memory use.
        <http://webkit.org/b/88240>

        Reviewed by Antti "Obi-Wan" Koivisto.

        Take advantage of the fact that we know at ElementAttributeData construction time how many attributes
        it needs to accomodate and allocate exactly as much space as needed instead of using a Vector.
        For elements that never have their attribute list mutated (the vast majority), this saves a lot of
        memory and removes the indirection to Vector<Attribute>'s heap-allocated storage.

        Introduced a mutability flag to ElementAttributeData and sprinkled assertions all over to make sure
        that nothing tries to mutate an element with a raw attribute array.

        When an Element's attribute(s) are mutated, we reconstruct the ElementAttributeData, this time using
        a Vector as backing instead. This is triggered when calling Element::mutableAttributeData().

        This reduces memory consumption by 3.2MB when viewing the full HTML5 spec at <http://whatwg.org/c/>.
        That is a ~35% reduction in DOM attribute memory use.

        Furthermore, that page ends up promoting 27% of the elements to mutable attribute storage due to dynamic
        adding of "class" attributes. For more static pages, savings are even greater.

        Also did away with ElementAttributeData::removeAttribute(name) and do separate index lookup where
        needed. Not a big deal but avoids double lookup of attributes when removing them.

        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::InlineCSSStyleDeclaration::ensureMutablePropertySet):

            Call ensureInlineStyle() on the element so we know we have a StylePropertySet to work with.
            May cause the creation (and replacement) of a new underlying StylePropertySet on the Element's
            attribute data.

        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::adoptCSSOMWrapperFrom):

            Added. Allows switching the underlying StylePropertySet object while retaining CSSOM wrapper
            identity (web facing behavior.)

        * dom/Element.cpp:
        (WebCore::Element::detachAttribute):
        (WebCore::Element::removeAttribute):
        (WebCore::Element::attributes):
        (WebCore::Element::setAttributeInternal):
        (WebCore::Element::parserSetAttributes):
        (WebCore::Element::hasEquivalentAttributes):
        (WebCore::Element::setAttributeNode):
        (WebCore::Element::removeAttributeNode):
        (WebCore::Element::getAttributeNode):
        (WebCore::Element::getAttributeNodeNS):
        (WebCore::Element::hasAttribute):
        (WebCore::Element::hasAttributeNS):
        (WebCore::Element::normalizeAttributes):
        (WebCore::Element::cloneAttributesFromElement):
        (WebCore::Element::createMutableAttributeData):
        * dom/Element.h:
        (WebCore::Element::attributeData):
        (Element):
        (WebCore::Element::updatedAttributeData):
        (WebCore::Element::ensureAttributeData):
        (WebCore::Element::ensureUpdatedAttributeData):
        (WebCore::Element::mutableAttributeData):
        (WebCore):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::createImmutable):
        (WebCore):
        (WebCore::ElementAttributeData::ElementAttributeData):
        (WebCore::ElementAttributeData::~ElementAttributeData):
        (WebCore::ElementAttributeData::attrIfExists):
        (WebCore::ElementAttributeData::ensureAttr):
        (WebCore::ElementAttributeData::setAttr):
        (WebCore::ElementAttributeData::removeAttr):
        (WebCore::ElementAttributeData::ensureInlineStyle):
        (WebCore::ElementAttributeData::ensureMutableInlineStyle):
        (WebCore::ElementAttributeData::destroyInlineStyle):
        (WebCore::ElementAttributeData::addAttribute):
        (WebCore::ElementAttributeData::removeAttribute):
        (WebCore::ElementAttributeData::isEquivalent):
        (WebCore::ElementAttributeData::detachAttrObjectsFromElement):
        (WebCore::ElementAttributeData::getAttributeItemIndexSlowCase):
        (WebCore::ElementAttributeData::cloneDataFrom):
        (WebCore::ElementAttributeData::clearAttributes):
        (WebCore::ElementAttributeData::replaceAttribute):
        (WebCore::ElementAttributeData::getAttributeNode):
        * dom/ElementAttributeData.h:
        (WebCore::ElementAttributeData::create):
        (ElementAttributeData):
        (WebCore::ElementAttributeData::setClass):
        (WebCore::ElementAttributeData::setIdForStyleResolution):
        (WebCore::ElementAttributeData::inlineStyle):
        (WebCore::ElementAttributeData::setAttributeStyle):
        (WebCore::ElementAttributeData::reportMemoryUsage):
        (WebCore::ElementAttributeData::isMutable):
        (WebCore::ElementAttributeData::makeMutable):
        (WebCore::ElementAttributeData::length):
        (WebCore):
        (WebCore::ElementAttributeData::isEmpty):
        (WebCore::ElementAttributeData::array):
        (WebCore::ElementAttributeData::removeAttribute):
        (WebCore::ElementAttributeData::getAttributeItem):
        (WebCore::ElementAttributeData::getAttributeItemIndex):
        (WebCore::ElementAttributeData::attributeItem):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::style):
        (WebCore::StyledElement::classAttributeChanged):
        (WebCore::StyledElement::setInlineStyleProperty):
        (WebCore::StyledElement::removeInlineStyleProperty):
        (WebCore::StyledElement::addSubresourceAttributeURLs):
        * dom/StyledElement.h:
        (WebCore::StyledElement::ensureInlineStyle):
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::createHTMLElementFromSavedElement):
        * xml/parser/XMLDocumentParserQt.cpp:
        (WebCore::XMLDocumentParser::XMLDocumentParser):

2012-07-12  Florin Malita  <fmalita@chromium.org>

        Incorrect handling of chained pending resources in SVGUseElement
        https://bugs.webkit.org/show_bug.cgi?id=89686

        Reviewed by Nikolas Zimmermann.

        Currently SVGUseElement builds the shadow tree when the target first
        becomes available. This is normally OK, but if the target itself (or
        one of its children) is a <use> element with pending resources, then
        the shadow expansion only captures the current state of the tree and
        never gets updated when the pending resource becomes available.

        In order to support arbitrary <use>-on-<use> constructs, this patch
        tracks nested <use> dependencies and rebuilds the dependent trees
        whenever the target gets updated.


        Tests: svg/custom/use-nested-expected.svg
               svg/custom/use-nested.svg

        * svg/SVGElement.cpp:
        (WebCore::SVGElement::removedFrom): removedFrom needs to be called up the inheritance chain
        before invoking removeAllElementReferencesForTarget. Otherwise we could end up finding the
        element being removed as a valid target in SVGUseElement::buildInstanceTree because its
        InDocument flag is not cleared yet.
        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::~SVGUseElement):
        (WebCore::SVGUseElement::clearResourceReferences):
        (WebCore::SVGUseElement::buildPendingResource):
        (WebCore::SVGUseElement::buildShadowAndInstanceTree):
        (WebCore::SVGUseElement::buildInstanceTree):
        * svg/SVGUseElement.h:
        (SVGUseElement):
        Track <use> -> <use> dependencies using SVGDocumentExtensions'
        m_elementDependencies framework and ensure dependent trees are rebuilt
        when the target itself gets rebuilt.

2012-07-12  MORITA Hajime  <morrita@google.com>

        Typo: ParentTranversalDetails should be ParentTraversalDetails
        https://bugs.webkit.org/show_bug.cgi?id=91059

        Reviewed by Andreas Kling.

        Did a bare rename from ParentTranversalDetails to ParentTraversalDetails

        No new tests, just a rename.

        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::ComposedShadowTreeWalker::ParentTraversalDetails::didTraverseInsertionPoint):
        (WebCore::ComposedShadowTreeWalker::ParentTraversalDetails::didTraverseShadowRoot):
        (WebCore::ComposedShadowTreeWalker::ParentTraversalDetails::didFindNode):
        (WebCore::ComposedShadowTreeWalker::findParent):
        (WebCore::ComposedShadowTreeWalker::traverseNodeEscapingFallbackContents):
        (WebCore::ComposedShadowTreeWalker::traverseParent):
        (WebCore::ComposedShadowTreeWalker::traverseParentInCurrentTree):
        (WebCore::ComposedShadowTreeWalker::traverseParentBackToYoungerShadowRootOrHost):
        * dom/ComposedShadowTreeWalker.h:
        (WebCore::ComposedShadowTreeWalker::ParentTraversalDetails::ParentTraversalDetails):
        (ComposedShadowTreeWalker):
        * dom/NodeRenderingContext.h:
        (NodeRenderingContext):

2012-07-11  Antti Koivisto  <antti@apple.com>

        Failure to dispatch didFinishLoadForFrame if font load fails synchronously 
        https://bugs.webkit.org/show_bug.cgi?id=91018

        Reviewed by Enrica Casucci.

        New font loads may be triggered by layout after the document load is complete but before we have dispatched
        didFinishLoading for the frame. If the load fails synchronously we might fail to ever invoke 
        FrameLoader::checkLoadComplete and so fail to dispatch didFinishLoading.
        
        Make sure this doesn't happen by calling FrameLoader::checkLoadComplete explicitly after triggering font loads.

        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::beginLoadTimerFired):

2012-07-12  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Register protocol handler files should be in Modules/protocolhandler
        https://bugs.webkit.org/show_bug.cgi?id=90766

        Reviewed by Hajime Morita.

        The register protocol handler files are now self-contained. This patch is moved to the Modules.

        No new tests. Covered by existing tests.

        * CMakeLists.txt:
        * GNUmakefile.am:
        * GNUmakefile.list.am:
        * Modules/protocolhandler/NavigatorRegisterProtocolHandler.cpp: Renamed from Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp.
        (WebCore):
        (WebCore::initProtocolHandlerWhitelist):
        (WebCore::verifyCustomHandlerURL):
        (WebCore::isProtocolWhitelisted):
        (WebCore::verifyProtocolHandlerScheme):
        (WebCore::NavigatorRegisterProtocolHandler::NavigatorRegisterProtocolHandler):
        (WebCore::NavigatorRegisterProtocolHandler::~NavigatorRegisterProtocolHandler):
        (WebCore::NavigatorRegisterProtocolHandler::registerProtocolHandler):
        (WebCore::customHandlersStateString):
        (WebCore::NavigatorRegisterProtocolHandler::isProtocolHandlerRegistered):
        (WebCore::NavigatorRegisterProtocolHandler::unregisterProtocolHandler):
        * Modules/protocolhandler/NavigatorRegisterProtocolHandler.h: Renamed from Source/WebCore/page/NavigatorRegisterProtocolHandler.h.
        (WebCore):
        (NavigatorRegisterProtocolHandler):
        * Modules/protocolhandler/NavigatorRegisterProtocolHandler.idl: Renamed from Source/WebCore/page/NavigatorRegisterProtocolHandler.idl.
        * Target.pri:
        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * WebCore.pri:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.vcproj/WebCoreCommon.vsprops:
        * WebCore.vcproj/copyForwardingHeaders.cmd:
        * WebCore.xcodeproj/project.pbxproj:

2012-07-12  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>

        [BlackBerry] Cannot use digest proxy auth and NTLM auth at the same time
        https://bugs.webkit.org/show_bug.cgi?id=91054

        Reviewed by George Staikos.

        Added an interface function syncProxyCredential() in class
        PageClientBlackBerry, which is responsible to notify WebPageClient
        to synchronize proxy credential to the chrome process.

        Internally reviewed by Jason Liu <jason.liu@torchmobile.com.cn>

        No new tests since there's no functional change.

        * platform/blackberry/PageClientBlackBerry.h:
        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::storeCredentials): Remember the accepted proxy
        credential and notify webpage client to synchronize it.

2012-07-12  Xingnan Wang  <xingnan.wang@intel.com>

        [IndexedDB] upperOpen set to true in lowerBound()/lowerOpen set to true in upperBound()
        https://bugs.webkit.org/show_bug.cgi?id=90867

        Reviewed by Tony Chang.

        In the latest W3C spec upperOpen/lowerOpen are set to true in lowerBound()/upperBound(), which
        we should keep aligned with.

        No new tests - updated storage/indexeddb/keyrange.html to match new behavior.

        * Modules/indexeddb/IDBKeyRange.cpp:
        (WebCore::IDBKeyRange::lowerBound):
        (WebCore::IDBKeyRange::upperBound):

2012-07-12  MORITA Hajime  <morrita@google.com>

        [Shadow DOM] <video> with <shadow> crashes
        https://bugs.webkit.org/show_bug.cgi?id=91055

        Reviewed by Kent Tamura.

        This is similar to Bug 90480, where an undesired renderer is created by
        locating an insertion point on the shadow boundary.

        This change adds a guard for such case by cheking whether the
        source node of each to-be-created renderer comes from the UA shadow
        tree, which is allowed to have a renderer.

        Test: fast/dom/shadow/insertion-point-video-crash.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::childShouldCreateRenderer): Added a check.
        (WebCore::HTMLMediaElement::mediaControls): Added const.
        (WebCore::HTMLMediaElement::hasMediaControls): Added const.
        * html/HTMLMediaElement.h:
        (HTMLMediaElement):

2012-07-12  Yoshifumi Inoue  <yosin@chromium.org>

        REGRESSION(r122184): LocaleMac::currentLocale should use current locale rather than newly create locale object. 
        https://bugs.webkit.org/show_bug.cgi?id=91057

        Reviewed by Kent Tamura.

        This patch changes NSLocale object of LocaleMac::m_locale variable to
        current NSLocale object rather than newly created NSLocale object from
        locale identifier.

        No new tests. We don't have way to change system preferences from
        test scripts and restoring them. To test this patch, we need to do so.

        * platform/text/mac/LocaleMac.h:
        (LocaleMac): Added a constructor which takes NSLocale object.
        * platform/text/mac/LocaleMac.mm:
        (WebCore::LocaleMac::LocaleMac): Added a constructor which takes NSLocale object.
        (WebCore::LocaleMac::currentLocale): Changed to construct LocaleMac object from NSLocale object rather than locale identifier.

2012-07-11  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Add webkit_cookie_manager_set_persistent_storage() to WebKit2 GTK+ API
        https://bugs.webkit.org/show_bug.cgi?id=83016

        Reviewed by Martin Robinson.

        * platform/network/soup/CookieStorageSoup.cpp:
        (WebCore::soupCookiesChanged): Do not notify about changes in
        other cookie jars than the current one.

2012-07-12  Philip Rogers  <pdr@google.com>

        Refactor RenderSVGShape bounding box code
        https://bugs.webkit.org/show_bug.cgi?id=90655

        Reviewed by Nikolas Zimmermann.

        RenderSVGShape::objectBoundingBox worked differently than RenderSVGShape::strokeBoundingBox by
        not caching the object bounding box and instead computing it on each call. For consistency and
        performance objectBoundingBox has been refactored to return a cached value.

        createShape has been renamed updateShapeFromElement for understandability. updateShapeFromElement
        now updates the internal state of the shape (bounding boxes, etc) from the associated element.
        RenderSVGShape::inflateWithStrokeAndMarkerBounds has been merged into
        RenderSVGShape::calculateStrokeBoundingBox which is called from updateShapeFromElement.

        After this change all bounding box computation is now handled in updateShapeFromElement. Because
        subclasses override updateShapeFromElement it will be easy for them to have custom bounding box
        code there (as will happen for RenderSVGPath in a followup patch).

        strokeBoundingBox and objectBoundingBox are now able to return their cached values immediately
        in RenderSVGRect and RenderSVGEllipse instead of checking their fallback state on each call.

        Additionally, to save space RenderSVGEllipse and RenderSVGRect now use the m_fillBoundingBox and
        m_strokeBoundingBox of RenderSVGShape instead of having their own.

        This patch also removes setStrokeAndMarkerBoundingBox that was previously dead code.

        No new tests, just a refactoring.

        * rendering/svg/RenderSVGEllipse.cpp:
        (WebCore::RenderSVGEllipse::updateShapeFromElement):
        (WebCore):
        (WebCore::RenderSVGEllipse::fillShape):
        (WebCore::RenderSVGEllipse::strokeShape):
        (WebCore::RenderSVGEllipse::shapeDependentStrokeContains):
        * rendering/svg/RenderSVGEllipse.h:
        (RenderSVGEllipse):
        (WebCore::RenderSVGEllipse::isEmpty):
        * rendering/svg/RenderSVGRect.cpp:
        (WebCore::RenderSVGRect::updateShapeFromElement):
        (WebCore):
        (WebCore::RenderSVGRect::fillShape):
        (WebCore::RenderSVGRect::strokeShape):
        (WebCore::RenderSVGRect::shapeDependentStrokeContains):
        (WebCore::RenderSVGRect::shapeDependentFillContains):
        * rendering/svg/RenderSVGRect.h:
        (RenderSVGRect):
        (WebCore::RenderSVGRect::isEmpty):
        * rendering/svg/RenderSVGShape.cpp:
        (WebCore::RenderSVGShape::updateShapeFromElement):
        (WebCore):
        (WebCore::RenderSVGShape::layout):
        (WebCore::RenderSVGShape::calculateObjectBoundingBox):
        (WebCore::RenderSVGShape::calculateStrokeBoundingBox):
        (WebCore::RenderSVGShape::updateRepaintBoundingBox):
        * rendering/svg/RenderSVGShape.h:
        (RenderSVGShape):
        (WebCore::RenderSVGShape::objectBoundingBox):
        (WebCore::RenderSVGShape::strokeBoundingBox):

2012-07-12  Kent Tamura  <tkent@chromium.org>

        Do not save the form state signature if nothing is saved
        https://bugs.webkit.org/show_bug.cgi?id=91050

        Reviewed by Hajime Morita.

        This change will reduce the size of HistoyItem.

        Test: fast/forms/state-restore-empty-state.html

        * html/FormController.cpp:
        (WebCore::FormController::formElementsState):
        If stateVector has only the signature string, clear it.

2012-07-11  Mark Rowe  <mrowe@apple.com>

        <http://webkit.org/b/91051> Fix the Qt Mac build after r122400.

        Qt on Mac builds with a deployment target of OS X 10.5. However, it was not been setting
        BUILDING_ON_LEOPARD / TARGETING_LEOPARD and thus was falling down code paths in DisplaySleepDisabler.cpp
        that were specific to Snow Leopard and newer. After the removal of BUILDING_ON_LEOPARD
        and TARGETING_LEOPARD it ended up falling down the correct Leopard-compatible code path,
        which revealed that the code made assumptions about which headers had already been included.

        * platform/mac/DisplaySleepDisabler.cpp: Include CoreServices/CoreServices.h to pull in
        a declaration of UpdateSystemActivity when targeting Leopard.

2012-07-11  Matt Falkenhagen  <falken@chromium.org>

        Add dialog element feature toggle to InternalSettings
        https://bugs.webkit.org/show_bug.cgi?id=90934

        Reviewed by Hajime Morita.

        This enables layout tests to be written for dialog although the feature is disabled by default.

        Tests: fast/dom/HTMLDialogElement/dialog-disabled.html
               fast/dom/HTMLDialogElement/dialog-enabled.html

        * WebCore.exp.in: Added newly exported symbol.
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::Backup): Backup dialog feature flag.
        (WebCore::InternalSettings::Backup::restoreTo): Restore dialog feature flag.
        (WebCore::InternalSettings::setDialogElementEnabled): Added.
        (WebCore):
        * testing/InternalSettings.h: Added support for dialog.
        (Backup):
        (InternalSettings):
        * testing/InternalSettings.idl: Added support for dialog.

2012-07-11  Kent Tamura  <tkent@chromium.org>

        Accessing width or height of a detached image input element causes crash
        https://bugs.webkit.org/show_bug.cgi?id=90885

        Reviewed by Kentaro Hara.

        Test: fast/forms/image/width-and-height-of-detached-input.html

        * html/ImageInputType.cpp:
        (WebCore::ImageInputType::height): Add null check for m_imageLoader.
        (WebCore::ImageInputType::width): ditto.

2012-07-11  Kent Tamura  <tkent@chromium.org>

        Do not save state of stateless form controls
        https://bugs.webkit.org/show_bug.cgi?id=90964

        Reviewed by Hajime Morita.

        By Bug 89409, we started to store unmodified form control
        state. However we don't need to make such state for the following
        types.
        - password
        - submit
        - reset
        - button
        - keygen

        Test: fast/forms/state-restore-skip-stateless.html

        * html/BaseButtonInputType.cpp:
        (WebCore::BaseButtonInputType::shouldSaveAndRestoreFormControlState):
        Added. Disable saving state for submit, reset, and button types.
        * html/BaseButtonInputType.h:
        (BaseButtonInputType): Add shouldSaveAndRestoreFormControlState.
        * html/HTMLFormControlElementWithState.h:
        (HTMLFormControlElementWithState): Make shouldSaveAndRestoreFormControlState virtual.
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::shouldSaveAndRestoreFormControlState):
        Added. Checks InputType::shouldSaveAndRestoreFormControlState first.
        * html/HTMLInputElement.h:
        (HTMLInputElement): Override shouldSaveAndRestoreFormControlState.
        * html/HTMLKeygenElement.cpp:
        (WebCore::HTMLKeygenElement::shouldSaveAndRestoreFormControlState)
        Added. Disable saving state for <keygen>.:
        * html/HTMLKeygenElement.h: Override shouldSaveAndRestoreFormControlState.
        * html/InputType.cpp:
        (WebCore::InputType::shouldSaveAndRestoreFormControlState):
        Added. Enable saving state for all types by default.
        * html/InputType.h:
        (InputType): Add shouldSaveAndRestoreFormControlState.
        * html/PasswordInputType.cpp:
        (WebCore::PasswordInputType::shouldSaveAndRestoreFormControlState):
        Added. Disabled saving state.
        (WebCore::PasswordInputType::saveFormControlState):
        Because shouldSaveAndRestoreFormControlState() returns false,
        saveFormControlState should be never called.
        * html/PasswordInputType.h:
        (PasswordInputType): Override shouldSaveAndRestoreFormControlState.

2012-07-11  No'am Rosenthal  <noam.rosenthal@nokia.com>

        Compilation error with GLES2 when using gl2ext.h from ANGLE.
        https://bugs.webkit.org/show_bug.cgi?id=91030

        Reviewed by Kenneth Russell.

        gl2ext.h defines PFNGLRENDERBUFFERSTORAGEMULTISAMPLEIMG and not
        PFNGLRENDERBUFFERSTORAGEMULTISAMPLEIMGPROC. This is a bug in the original Khronos header,
        but we should work around it until fixed headers are integrated.


        * platform/graphics/opengl/Extensions3DOpenGLES.h:
        (Extensions3DOpenGLES):
            Removed the "PROC" suffix to work around the header bug.

2012-07-11  Mark Rowe  <mrowe@apple.com>

        Attempt to fix the Chromium Mac build after r122400.

        * platform/text/cf/HyphenationCF.cpp: Ensure that Chromium only compiles the body of this file if
        building for a new enough version of OS X.

2012-07-11  Kent Tamura  <tkent@chromium.org>

        [Mac] Sort project.pbxproj

        * WebCore.xcodeproj/project.pbxproj: Apply Tools/Scripts/sort-Xcode-project-file

2012-07-11  Dan Bernstein  <mitz@apple.com>

        When a table row height grows because of pagination, not all cells’ heights are adjusted
        https://bugs.webkit.org/show_bug.cgi?id=91043

        Reviewed by Sam Weinig.

        The fix for in bug <http://webkit.org/b/83595> in <http://trac.webkit.org/r113738> made table
        rows grow as necessary to fit cells that grow as a result of pagination. But it had two bad
        side effects: earlier cells on the row would not grow by the same amount, and later cells on
        the row would factor the existing growth into their intrinsic padding.

        Test: fast/multicol/table-row-height-increase.html

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::layoutRows): Now when a cell becomes taller than the row height,
        the additional height needed is recorded, and the cell is shrunk back to row height. Then
        after finishing the row, all cells occurring on the row (including cells spanning it but not
        starting on it) are grown by the same amount.

2012-07-11  Mark Rowe  <mrowe@apple.com>

        <http://webkit.org/b/91024> Build against the latest SDK when targeting older OS X versions.

        Reviewed by Dan Bernstein.

        The deployment target is already set to the version that we're targeting, and it's that setting
        which determines which functionality from the SDK is available to us.

        * Configurations/Base.xcconfig:

2012-07-11  Mark Rowe  <mrowe@apple.com>

        Switch a few cases that care about the SDK over to checking __MAC_OS_X_VERSION_MAX_ALLOWED so that things build.

        Part of <http://webkit.org/b/91015> Remove BUILDING_ON / TARGETING macros in favor of system availability macros

        Reviewed by Filip Pizlo.

        * platform/graphics/cg/GraphicsContextCG.cpp: The SDK we're building against determines whether the constant is available.
        * platform/mac/EmptyProtocolDefinitions.h:  The SDK we're building against determines whether the protocols are declared.
        * platform/mac/NSScrollerImpDetails.h: The SDK we're building against determines whether the constants and method are
        available.
        * platform/mac/SharedTimerMac.mm: The SDK we're building against determines whether the function has already been declared.

2012-07-11  Mark Rowe  <mrowe@apple.com>

        <http://webkit.org/b/91015> Remove BUILDING_ON / TARGETING macros in favor of system availability macros

        This removal was handled by a script that translates the relevant macros in to the equivalent checks
        using the system availability macros.

        Reviewed by Filip Pizlo.

        * WebCore.exp.in:
        * accessibility/AccessibilityList.h:
        * accessibility/AccessibilityTable.h:
        * accessibility/mac/AXObjectCacheMac.mm:
        * editing/mac/EditorMac.mm:
        * loader/MainResourceLoader.cpp:
        * loader/MainResourceLoader.h:
        * page/AlternativeTextClient.h:
        * page/ContextMenuController.cpp:
        * page/mac/SettingsMac.mm:
        * platform/LocalizedStrings.cpp:
        * platform/MemoryPressureHandler.cpp:
        * platform/audio/mac/AudioBusMac.mm:
        * platform/graphics/Gradient.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        * platform/graphics/ca/PlatformCALayer.h:
        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
        * platform/graphics/ca/mac/TileCache.mm:
        * platform/graphics/cg/GraphicsContextCG.cpp:
        * platform/graphics/cg/ImageBufferCG.cpp:
        * platform/graphics/cg/ImageBufferDataCG.cpp:
        * platform/graphics/cg/ImageBufferDataCG.h:
        * platform/graphics/cg/ImageCG.cpp:
        * platform/graphics/cg/ImageSourceCG.cpp:
        * platform/graphics/cg/PathCG.cpp:
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        * platform/graphics/mac/ComplexTextController.cpp:
        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
        * platform/graphics/mac/FontCacheMac.mm:
        * platform/graphics/mac/FontCustomPlatformData.cpp:
        * platform/graphics/mac/FontMac.mm:
        * platform/graphics/mac/GraphicsContextMac.mm:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        * platform/graphics/mac/SimpleFontDataMac.mm:
        * platform/graphics/mac/WebLayer.h:
        * platform/graphics/mac/WebLayer.mm:
        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
        * platform/mac/CursorMac.mm:
        * platform/mac/DisplaySleepDisabler.cpp:
        * platform/mac/DisplaySleepDisabler.h:
        * platform/mac/EmptyProtocolDefinitions.h:
        * platform/mac/HTMLConverter.h:
        * platform/mac/HTMLConverter.mm:
        * platform/mac/MemoryPressureHandlerMac.mm:
        * platform/mac/NSScrollerImpDetails.h:
        * platform/mac/PlatformEventFactoryMac.mm:
        * platform/mac/PopupMenuMac.mm:
        * platform/mac/ScrollAnimatorMac.mm:
        * platform/mac/ScrollElasticityController.mm:
        * platform/mac/SharedTimerMac.mm:
        * platform/mac/SuddenTermination.mm:
        * platform/mac/WebCoreFullScreenWindow.mm:
        * platform/mac/WebCoreNSCellExtras.h:
        * platform/mac/WebCoreSystemInterface.h:
        * platform/mac/WebCoreSystemInterface.mm:
        * platform/mac/WebFontCache.mm:
        * platform/mac/WebVideoFullscreenController.mm:
        * platform/mac/WebVideoFullscreenHUDWindowController.mm:
        * platform/network/Credential.h:
        * platform/network/ResourceHandle.h:
        * platform/network/cf/DNSCFNet.cpp:
        * platform/network/cf/ProxyServerCFNet.cpp:
        * platform/network/cf/ResourceRequest.h:
        * platform/network/cf/ResourceRequestCFNet.cpp:
        * platform/network/cf/SocketStreamHandleCFNet.cpp:
        * platform/network/mac/AuthenticationMac.mm:
        * platform/network/mac/CookieStorageMac.mm:
        * platform/network/mac/ResourceHandleMac.mm:
        * platform/network/mac/ResourceRequestMac.mm:
        * platform/network/mac/WebCoreURLResponse.mm:
        * platform/text/TextChecking.h:
        * platform/text/cf/HyphenationCF.cpp:
        * platform/text/mac/HyphenationMac.mm:
        * rendering/RenderLayerBacking.cpp:
        * rendering/RenderLayerCompositor.cpp:
        * rendering/RenderThemeMac.mm:

2012-07-11  Robert Kroeger  <rjkroege@chromium.org>

        Suppress horizontal conversion of PlatformWheelEvents when hasPreciseScrollingDeltas is true
        https://bugs.webkit.org/show_bug.cgi?id=89580

        WebKit GTK and Chromium Linux force vertical wheel events to
        scroll horizontally when over horizontal scroll bars.  This is
        undesirable for touchpad scrolling with
        hasPreciseScrollingDeltas() == true. Modified shouldTurnVerticalTicksIntoHorizontal
        to not perform this conversion for PlatformWheelEvents with preciseScrollingDeltas.

        Reviewed by Adam Barth.

        Tests: fast/events/touch/gesture/touch-gesture-scroll-sideways.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal): 
        (WebCore::EventHandler::handleWheelEvent):
        * page/EventHandler.h:
        (EventHandler):
        * page/chromium/EventHandlerChromium.cpp:
        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
        * page/gtk/EventHandlerGtk.cpp:
        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):

2012-07-11  Hayato Ito  <hayato@chromium.org>

        Unreviewed gardening.
        Build fix for r122373.

        * platform/chromium/support/WebCompositorSharedQuadState.cpp:
        (WebKit::WebCompositorSharedQuadState::WebCompositorSharedQuadState):

2012-07-11  Shinya Kawanaka  <shinyak@chromium.org> 

        SVGUseElement should not use Element::ensureShadowRoot().
        https://bugs.webkit.org/show_bug.cgi?id=90938

        Reviewed by Hajime Morita.

        We would like to remove Element::ensureShadowRoot() because we would like to stabilize the lifecycle of Shadow DOM.
        This patch rewrites SVGUseElement::create() not to use Element::ensureShadowRoot(). Since our convention to create
        a shadow subtree is to create a method createShadowSubtree(), I obeyed it.

        No new tests. Simple refactoring.

        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::create):
        (WebCore::SVGUseElement::createShadowSubtree):
        (WebCore):
        * svg/SVGUseElement.h:
        (SVGUseElement):

2012-07-11  Alexandre Elias  <aelias@google.com>

        [chromium] Move compositor quads to Platform/chromium/public
        https://bugs.webkit.org/show_bug.cgi?id=90582

        Reviewed by Adrienne Walker.

        This moves CCSharedQuadState, CCDrawQuad, and all but two CC*DrawQuad
        classes to the WebKit namespace, as a first step to pushing them
        across the process boundary for the ubercompositor.

        - The intent is to serialize the class hierarchy using the same
        mechanism as WebInputEvent.  In order to do this, there are three
        requirements: pure POD data, a method returning size, and a packing
        pragma.

        - Private data members are fine with this kind of serializer, and a
        default constructor is not needed.  Because of that, we can maintain
        the same encapsulation and convenient APIs (behind
        WEBKIT_IMPLEMENTATION) as the original classes.  To ease the
        transition, the original WebCore headers still exist and typedef to
        the new classes.

        - However, SharedQuadState will be serialized using the normal
        IPC_STRUCT_TRAITS macro, so I made its members public.  A custom
        serializer (on quad lists) will maintain the pointers from quads to
        SharedQuadStates.

        - I converted the Material casting mechanism to materialCast() methods
        living in the derived classes.  That way, the WebCompositorQuad header
        doesn't need to know about all its derived classes.

        - Quad classes not yet transitioned can still be used in
        non-ubercompositor mode.  CCRenderPassDrawQuad and CCYUVVideoDrawQuad
        are currently non-POD and I left them in their original files.

        This approach is the best I've found so far, since it preserves all
        WebCore-facing APIs and avoids unnecessary code duplication (new quad
        types or members can be added by modifying only one place).  There
        also should not be an unreasonable amount of custom serializer code
        required.

        No new tests. (No-op refactoring.)

        * WebCore.gypi:
        * platform/chromium/support/WebCompositorQuad.cpp: Added.
        (WebKit):
        (WebKit::WebCompositorQuad::WebCompositorQuad):
        (WebKit::WebCompositorQuad::opaqueRect):
        (WebKit::WebCompositorQuad::setQuadVisibleRect):
        (WebKit::WebCompositorQuad::size):
        * platform/chromium/support/WebCompositorSharedQuadState.cpp: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCSharedQuadState.cpp.
        (WebKit):
        (WebKit::WebCompositorSharedQuadState::WebCompositorSharedQuadState):
        (WebKit::WebCompositorSharedQuadState::create):
        (WebKit::WebCompositorSharedQuadState::isLayerAxisAlignedIntRect):
        * platform/chromium/support/WebCompositorSolidColorQuad.cpp: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCSolidColorDrawQuad.cpp.
        (WebKit):
        (WebKit::WebCompositorSolidColorQuad::create):
        (WebKit::WebCompositorSolidColorQuad::WebCompositorSolidColorQuad):
        (WebKit::WebCompositorSolidColorQuad::materialCast):
        * platform/chromium/support/WebCompositorTextureQuad.cpp: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCTextureDrawQuad.cpp.
        (WebKit):
        (WebKit::WebCompositorTextureQuad::create):
        (WebKit::WebCompositorTextureQuad::WebCompositorTextureQuad):
        (WebKit::WebCompositorTextureQuad::setNeedsBlending):
        (WebKit::WebCompositorTextureQuad::materialCast):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawQuad):
        * platform/graphics/chromium/LayerRendererChromium.h:
        * platform/graphics/chromium/cc/CCCheckerboardDrawQuad.cpp:
        (WebCore::CCCheckerboardDrawQuad::create):
        (WebCore::CCCheckerboardDrawQuad::CCCheckerboardDrawQuad):
        (WebCore::CCCheckerboardDrawQuad::materialCast):
        (WebCore):
        * platform/graphics/chromium/cc/CCCheckerboardDrawQuad.h:
        (CCCheckerboardDrawQuad):
        * platform/graphics/chromium/cc/CCDebugBorderDrawQuad.cpp:
        (WebCore::CCDebugBorderDrawQuad::create):
        (WebCore::CCDebugBorderDrawQuad::CCDebugBorderDrawQuad):
        (WebCore::CCDebugBorderDrawQuad::materialCast):
        (WebCore):
        * platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h:
        (CCDebugBorderDrawQuad):
        * platform/graphics/chromium/cc/CCDrawQuad.cpp: Removed.
        * platform/graphics/chromium/cc/CCDrawQuad.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.cpp:
        (WebCore::CCIOSurfaceDrawQuad::create):
        (WebCore::CCIOSurfaceDrawQuad::CCIOSurfaceDrawQuad):
        (WebCore::CCIOSurfaceDrawQuad::materialCast):
        (WebCore):
        * platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.h:
        (CCIOSurfaceDrawQuad):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCRenderPass.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
        (WebCore::CCRenderPassDrawQuad::create):
        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
        (WebCore::CCRenderPassDrawQuad::materialCast):
        (WebCore):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
        (CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCSharedQuadState.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCSolidColorDrawQuad.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCStreamVideoDrawQuad.cpp:
        (WebCore::CCStreamVideoDrawQuad::create):
        (WebCore::CCStreamVideoDrawQuad::CCStreamVideoDrawQuad):
        (WebCore::CCStreamVideoDrawQuad::materialCast):
        (WebCore):
        * platform/graphics/chromium/cc/CCStreamVideoDrawQuad.h:
        (CCStreamVideoDrawQuad):
        * platform/graphics/chromium/cc/CCTextureDrawQuad.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCTileDrawQuad.cpp:
        (WebCore::CCTileDrawQuad::create):
        (WebCore::CCTileDrawQuad::CCTileDrawQuad):
        (WebCore::CCTileDrawQuad::materialCast):
        (WebCore):
        * platform/graphics/chromium/cc/CCTileDrawQuad.h:
        (CCTileDrawQuad):
        * platform/graphics/chromium/cc/CCYUVVideoDrawQuad.cpp:
        (WebCore::CCYUVVideoDrawQuad::create):
        (WebCore::CCYUVVideoDrawQuad::CCYUVVideoDrawQuad):
        (WebCore::CCYUVVideoDrawQuad::materialCast):
        (WebCore):
        * platform/graphics/chromium/cc/CCYUVVideoDrawQuad.h:
        (CCYUVVideoDrawQuad):

2012-07-11  Robert Kroeger  <rjkroege@chromium.org>

        [chromium] [regression] Don't use ScrollByPrecisePixels on Chromium Mac.
        https://bugs.webkit.org/show_bug.cgi?id=91020

        Reviewed by Adam Barth.

        A change in https://bugs.webkit.org/show_bug.cgi?id=87535 to
        improve the operation of smooth scrolling incorrectly caused
        Chromium Mac to use the wrong scroll granularity on
        hasPreciseScrollingDeltas() == true wheelevent scrolls.
        Exclude the change on the Chromium Mac platform.

        * platform/ScrollAnimator.cpp:
        (WebCore::ScrollAnimator::handleWheelEvent): Adjusted #ifdef to exclude Chromium
        Mac from ScrollByPrecisePixels change.

2012-07-11  Jia Pu  <jpu@apple.com>

        On Mac, autocorrection sometimes fails to take place in Safari.
        https://bugs.webkit.org/show_bug.cgi?id=89982

        Reviewed by Ryosuke Niwa.

        We should check the value of shouldCheckForCorrection, not shouldShowCorrectionPanel, to determine if we should
        early return in markAndReplaceFor(). Also, since we don't want autocorrection to happen when we only change selection,
        not the content, so we shouldn't set TextCheckingTypeCorrection flag in markMisspellingsAndBadGrammar() as this function
        is triggered only by selection change.

        * editing/Editor.cpp:
        (WebCore::Editor::markAndReplaceFor):
        (WebCore::Editor::markMisspellingsAndBadGrammar):

2012-07-11  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r122361.
        http://trac.webkit.org/changeset/122361
        https://bugs.webkit.org/show_bug.cgi?id=91027

        Broke Windows build and fast/forms/state-restore-broken-
        state.html (Requested by rniwa on #webkit).

        * testing/Internals.idl:

2012-07-10  Simon Fraser  <simon.fraser@apple.com>

        Assertion ASSERTION FAILED: enclosingIntRect(rendererMappedResult) == enclosingIntRect(FloatQuad(result).boundingBox()) when compositing in paginated mode
        https://bugs.webkit.org/show_bug.cgi?id=90919

        Reviewed by Antti Koivisto.

        r121124 added a fast path for geometry mapping that goes via layers
        when possible. However, this broke paginated pages, which put
        the root (RenderView) layer into column mode, because it failed
        to check for columns on the ancestor layer.
        
        Rather than make a risky change to convertToLayerCoords(), add a local
        function canMapViaLayer(), which is like RenderLayer::canUseConvertToLayerCoords(),
        but doesn't check for compositing (compositing itself is not a reason
        to avoid convertToLayerCoords). Call canMapViaLayer() with the ancestorLayer
        to check whether the ancestor has columns, which fixes the bug.

        Test: compositing/columns/geometry-map-paginated-assert.html

        * rendering/RenderGeometryMap.cpp:
        (WebCore::canMapViaLayer):
        (WebCore::RenderGeometryMap::pushMappingsToAncestor):

2012-07-11  Dana Jansens  <danakj@chromium.org>

        [chromium] Rename layerRect to contentRect for rects that live in content space
        https://bugs.webkit.org/show_bug.cgi?id=90843

        Reviewed by Adrienne Walker.

        Dropped the layerTransform() from CCSharedQuadState, as nothing should be
        using it to draw with. RenderPasses need a weird drawTransform right now
        which was stored in layerTransform, so moved this to the RenderPass quad.

        No new tests. No change in behaviour.

        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
        (WebCore::CanvasLayerTextureUpdater::paintContents):
        * platform/graphics/chromium/ContentLayerChromium.cpp:
        (WebCore::ContentLayerChromium::update):
        (WebCore::ContentLayerChromium::needMoreUpdates):
        * platform/graphics/chromium/ImageLayerChromium.cpp:
        (WebCore::ImageLayerChromium::update):
        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::visibleContentOpaqueRegion):
        * platform/graphics/chromium/LayerChromium.h:
        (WebCore::LayerChromium::visibleContentRect):
        (WebCore::LayerChromium::setVisibleContentRect):
        (LayerChromium):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
        (WebCore::LayerRendererChromium::drawTileQuad):
        (WebCore::LayerRendererChromium::drawYUVVideoQuad):
        (WebCore::LayerRendererChromium::drawStreamVideoQuad):
        (WebCore::LayerRendererChromium::drawIOSurfaceQuad):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::updateBounds):
        (WebCore::TiledLayerChromium::setNeedsDisplayRect):
        (WebCore::TiledLayerChromium::invalidateContentRect):
        (WebCore::TiledLayerChromium::updateTiles):
        (WebCore::TiledLayerChromium::setTexturePriorities):
        (WebCore::TiledLayerChromium::setTexturePrioritiesInRect):
        (WebCore::TiledLayerChromium::visibleContentOpaqueRegion):
        (WebCore::TiledLayerChromium::updateContentRect):
        (WebCore::TiledLayerChromium::needsIdlePaint):
        (WebCore::TiledLayerChromium::idlePaintRect):
        * platform/graphics/chromium/TiledLayerChromium.h:
        (TiledLayerChromium):
        * platform/graphics/chromium/cc/CCDrawQuad.h:
        (WebCore::CCDrawQuad::visibleContentRect):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::createSharedQuadState):
        (WebCore::CCLayerImpl::appendDebugBorderQuad):
        (WebCore::CCLayerImpl::visibleContentOpaqueRegion):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore::CCLayerImpl::visibleContentRect):
        (WebCore::CCLayerImpl::setVisibleContentRect):
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTilingData.cpp:
        (WebCore::CCLayerTilingData::contentRectToTileIndices):
        (WebCore::CCLayerTilingData::opaqueRegionInContentRect):
        (WebCore::CCLayerTilingData::setBounds):
        * platform/graphics/chromium/cc/CCLayerTilingData.h:
        (CCLayerTilingData):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateVisibleContentRect):
        (WebCore::layerShouldBeSkipped):
        (WebCore):
        (WebCore::calculateVisibleAndScissorRectsInternal):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::addOcclusionBehindLayer):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
        (WebCore::CCRenderPassDrawQuad::create):
        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
        (CCRenderPassDrawQuad):
        (WebCore::CCRenderPassDrawQuad::drawTransform):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::createSharedQuadState):
        (WebCore::CCRenderSurface::createReplicaSharedQuadState):
        (WebCore::CCRenderSurface::appendQuads):
        * platform/graphics/chromium/cc/CCSharedQuadState.cpp:
        (WebCore::CCSharedQuadState::create):
        (WebCore::CCSharedQuadState::CCSharedQuadState):
        (WebCore::CCSharedQuadState::isLayerAxisAlignedIntRect):
        * platform/graphics/chromium/cc/CCSharedQuadState.h:
        (CCSharedQuadState):
        (WebCore::CCSharedQuadState::visibleContentRect):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
        (WebCore::CCTiledLayerImpl::appendQuads):
        (WebCore::CCTiledLayerImpl::visibleContentOpaqueRegion):

2012-07-11  Chris Fleizach  <cfleizach@apple.com>

        ARIA spinbutton role incorrectly mapped to ProgressIndicatorRole
        https://bugs.webkit.org/show_bug.cgi?id=77298

        Reviewed by Anders Carlsson.

        * accessibility/AccessibilityObject.cpp:
        (WebCore::createARIARoleMap):

2012-07-11  Huang Dongsung  <luxtella@company100.net>

        BitmapImage::frameIsCompleteAtIndex() must return false if ImageDecoder is not initialized.
        https://bugs.webkit.org/show_bug.cgi?id=90757

        Reviewed by Simon Fraser.

        The current code fortunately has worked so far because only
        BitmapImage::startAnimation calls frameIsCompleteAtIndex, and startAnimation
        cannot call frameIsCompleteAtIndex if ImageDecoder is not yet initialized.
        startAnimation returns at the first line becase shouldAnimate() always return
        false in this case.

            if (m_frameTimer || !shouldAnimate() || frameCount() <= 1)
                return;

        This change is needed because parallel image decoders call
        BitmapImage::frameIsCompleteAtIndex in other places too.

        No new tests, manually tested whether the caller exists or not that
        calls BitmapImage::frameIsCompleteAtIndex() before ImageDecoder is
        initialized.

        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::frameIsCompleteAtIndex):

2012-07-11  Kevin Ollivier  <kevino@theolliviers.com>

        [wx] Unreviewed build fix. Update code to use the new constant name.
        
        * platform/wx/PasteboardWx.cpp:
        (WebCore::Pasteboard::documentFragment):

2012-07-11  Kevin Ollivier  <kevino@theolliviers.com>

        [wx] Unreviewed build fix. Ignore array and sequence types for attributes as well
        as functions since the CPP bindings do not yet support them.

        * bindings/scripts/CodeGeneratorCPP.pm:
        (SkipAttribute):

2012-07-11  Kevin Ollivier  <kevino@theolliviers.com>

        [wx] Unreviewed build fix. Use DOMStringList instead of DOMString[] for in / out type.

        * testing/Internals.idl:

2012-07-11  Dana Jansens  <danakj@chromium.org>

        [chromium] Minimum size used for occlusion tracking should be a setting on CCLayerTreeHost
        https://bugs.webkit.org/show_bug.cgi?id=90993

        Reviewed by Adrienne Walker.

        Move the default minimum size used for occlusion tracking from the
        CCOcclusionTracker class into CCLayerTreeSettings. This value is then
        used on both threads as the lower limit for any occlusion to be
        remembered.

        This allows us to use (0, 0) as the minimum size for tests, allowing all
        occlusion to be tracked.

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::paintLayerContents):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::CCLayerTreeSettings::CCLayerTreeSettings):
        (CCLayerTreeSettings):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        * platform/graphics/chromium/cc/CCOcclusionTracker.h:

2012-07-11  Anders Carlsson  <andersca@apple.com>

        Add -Wtautological-compare and -Wsign-compare warning flags
        https://bugs.webkit.org/show_bug.cgi?id=90994

        Reviewed by Mark Rowe.

        * Configurations/Base.xcconfig:

2012-07-11  Dean Jackson  <dino@apple.com>

        TileCache layers have wrong border debug color
        https://bugs.webkit.org/show_bug.cgi?id=90922

        Reviewed by Simon Fraser.

        Commit r122152 updated the layer hierarchy when a tile
        cache is being used by the view. As part of that, GraphicsLayerClient::shouldUseTileCache()
        was changed to return false in some situations (the idea was that it
        should only be called from the createGraphicsLayer method). However
        there were two other call points: one that sets the debug colors on
        borders, the other was a call that keeps the document background in sync.

        Add a new method usingTileCache() that returns the current state. Also fix
        a FIXME where the debug code always called into the client rather than
        caching the value on the GraphicsLayer.

        Test: compositing/document-background-color.html

        * platform/graphics/GraphicsLayer.cpp:
        (WebCore::GraphicsLayer::GraphicsLayer):
        (WebCore::GraphicsLayer::updateDebugIndicators): check the local variable when
        setting the debug colors.
        * platform/graphics/GraphicsLayer.h:
        (GraphicsLayer): new bool member variable m_usingTileCache.
        * platform/graphics/GraphicsLayerClient.h:
        (WebCore::GraphicsLayerClient::usingTileCache): new virtual method to query if
        this client is actually using the tile cache.
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::GraphicsLayerCA): set the member variable m_usingTileCache
        if the GraphicsLayerClient says we are.
        * rendering/RenderLayerBacking.h:
        (WebCore::RenderLayerBacking::usingTileCache):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::documentBackgroundColorDidChange): call usingTileCache()
        rather than shouldUseTileCache(), because the latter's value might not always reflect
        the existence of a cache.

2012-07-11  Ryosuke Niwa  <rniwa@webkit.org>

        Clang build fix after r122345.
        Also let Xcode do its own thing.

        * WebCore.xcodeproj/project.pbxproj:
        * html/HTMLCollection.cpp:
        (WebCore::HTMLCollectionWithArrayStorage::item):
        * html/HTMLCollection.h:
        (HTMLCollectionWithArrayStorage):
        * html/HTMLFormCollection.cpp:
        (WebCore::HTMLFormCollection::itemInArrayAfter):
        * html/HTMLFormCollection.h:
        (HTMLFormCollection):
        * html/HTMLPropertiesCollection.cpp:
        (WebCore::HTMLPropertiesCollection::itemInArrayAfter):
        * html/HTMLPropertiesCollection.h:
        (HTMLPropertiesCollection):

2012-07-11  Arnaud Renevier  <a.renevier@sisa.samsung.com>

        [Gtk] allow building with css-filters
        https://bugs.webkit.org/show_bug.cgi?id=90908

        Reviewed by Eric Seidel.

        Add support for css-filters in Source/WebCore/GNUmakefile.am
        configure.ac

        No functional change, so no new tests.

        * GNUmakefile.am:

2012-07-10  Ryosuke Niwa  <rniwa@webkit.org>

        HTMLFormCollection::item and HTMLPropertiesCollection::item should share code
        https://bugs.webkit.org/show_bug.cgi?id=90932

        Reviewed by Anders Carlsson.

        Merged HTMLFormCollection::item and HTMLPropertiesCollection::item as HTMLCollectionWithArrayStorage::item,
        which can be merged into HTMLCollection::item in a follow up patch.

        Also moved the call to invalidateCacheIfNeeded into HTMLCollection::updateNameCache() as done in
        HTMLPropertiesCollection.

        In addition, moved the early bail out for when the base element doesn't have itemscope attribute from individual
        functions to updateRefElements so that HTMLCollectionWithArrayStorage::item doesn't need to have this check.

        * html/HTMLCollection.cpp:
        (WebCore::HTMLCollectionWithArrayStorage::item): Added. It's based on HTMLPropertiesCollection::item but it only
        has the single loop (as supposed to nested loops) as HTMLFormCollection doesn't have multiple items per element
        in the array unlike HTMLPropertiesCollection. In addition, offsetInArray (was i in HTMLPropertiesCollection::item) is
        incremented in each itemAfter due to this semantic difference in each itemAfter.
        (WebCore::HTMLCollection::updateNameCache):
        (WebCore::HTMLCollection::hasNamedItem):
        (WebCore::HTMLCollection::namedItems):
        * html/HTMLCollection.h:
        (HTMLCollectionWithArrayStorage):
        (WebCore::HTMLCollectionWithArrayStorage::HTMLCollectionWithArrayStorage):
        * html/HTMLFormCollection.cpp:
        (WebCore::HTMLFormCollection::HTMLFormCollection):
        (WebCore::HTMLFormCollection::calcLength): Merged numberOfFormControlElements since it was only called here.
        (WebCore::HTMLFormCollection::itemAfter): Added. HTMLFormCollection has exactly one item per element in the array
        so we increment the offset in each iteration. Note that when we're continuing a search, we need to increment
        the offset in order to avoid returning the same item.
        (WebCore::HTMLFormCollection::updateNameCache):
        * html/HTMLFormCollection.h:
        (HTMLFormCollection):
        * html/HTMLPropertiesCollection.cpp:
        (WebCore::HTMLPropertiesCollection::HTMLPropertiesCollection):
        (WebCore::HTMLPropertiesCollection::updateRefElements): Set m_hasItemRefElements true upfront since we never fail to
        update ref elements. Bail out as soon as we cleared the m_itemRefElements when the base element doesn't have itemscope
        content attribute.
        (WebCore::HTMLPropertiesCollection::itemAfter): Added. We reset previousItem to null because the existing itemAfter
        requires previousItem be null when we're moving to a new entry in m_itemRefElements.
        (WebCore::HTMLPropertiesCollection::calcLength):
        (WebCore::HTMLPropertiesCollection::cacheFirstItem):
        (WebCore::HTMLPropertiesCollection::updateNameCache): Merged findProperties since this was the only caller.
        (WebCore::HTMLPropertiesCollection::names):
        (WebCore::HTMLPropertiesCollection::namedItem):
        (WebCore::HTMLPropertiesCollection::hasNamedItem):
        * html/HTMLPropertiesCollection.h:
        (HTMLPropertiesCollection): Made updateRefElements public as it's called in HTMLCollectionWithArrayStorage::item.

2012-07-11  Sami Kyostila  <skyostil@chromium.org>

        RenderView layer is marked as fixed position container in the scrolling tree if page scale != 1
        https://bugs.webkit.org/show_bug.cgi?id=89216

        Reviewed by Simon Fraser.

        Render layers with CSS transforms should become containers for any fixed
        positioned descendants. However, because this check is done with
        RenderLayer::hasTransform(), we also end up marking the RenderLayer for the
        RenderView as fixed position container if a non-identity page scale factor is
        used. This is because page scale is applied as a transform for that layer.

        This breaks fixed position layers, because they become fixed relative to the
        RenderView layer instead of outer scroll clip layer.

        The fix is to avoid marking any root layers as fixed position containers.

        No new test because the scrolling tree isn't currently testable.

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):

2012-07-11  Julien Chaffraix  <jchaffraix@webkit.org>

        REGRESSION (r116203): overflow sections don't have scrollbars
        https://bugs.webkit.org/show_bug.cgi?id=90052

        Reviewed by Simon Fraser.

        This issue stems from RenderLayers with overlay scrollbars not being considered
        self-painting.

        After r120395 (follow-up of r116203), we ignore subtrees that have no self-painting layer for
        painting. Normal scrollbars are painted by their renderer so they were properly painted. However
        overlay scrollbars need to be painted by their RenderLayer as a separate phase (see bug 57057) so
        they were not painted anymore. The fix is simple: make RenderLayer with overlay scrollbars
        self-painting as they should have been in the first place.

        Unfortunately no tests as I don't think we have a good way of testing overlay
        scrollbars. Tested manually though on the super simple test case from the bug.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::shouldBeSelfPaintingLayer):
        Overlay scrollbars make the layer self-painting.

        (WebCore::RenderLayer::updateScrollbarsAfterLayout):
        Added a call to updateSelfPaintingLayer.

        (WebCore::RenderLayer::styleChanged):
        Moved the call to updateSelfPaintingLayer after recomputing the scrollbars to ensure proper behavior.
        Added a comment underlining the reason.

        (WebCore::RenderLayer::updateSelfPaintingLayer):
        Renamed as it is now called during layout too.

        * rendering/RenderLayer.h:
        (RenderLayer): Updated after updateSelfPaintingLayer rename.

2012-07-11  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        NodesFromRect doesn't work on SVG root elements.
        https://bugs.webkit.org/show_bug.cgi?id=89990

        Reviewed by Antonio Gomes.

        Adds support for rect-based hit-testing on the SVG root element.
        This means that while rect-based hit-testing is still not supported
        within SVG elements, that at least it works on SVG root elements as
        it would on any other replaced element.

        Test: fast/dom/nodesFromRect-svg.html

        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::nodeAtPoint):

2012-07-11  Joshua Netterfield  <jnetterfield@rim.com>

        [Qt] REGRESSION(r122250): It broke USE(3D_GRAPHICS)=1 and ENABLE(WEBGL)=0 builds
        https://bugs.webkit.org/show_bug.cgi?id=90943

        Reviewed by Csaba Osztrogonác.

        Uses proper guarding in Extensions3DOpenGLCommon and Extensions3DOpenGLES as per https://bugs.webkit.org/show_bug.cgi?id=90506.

        No new tests, becasue there is no new functionality.

        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp: Use proper guarding.
        * platform/graphics/opengl/Extensions3DOpenGLES.cpp: Use proper guarding.

2012-07-10  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: migrate from background images to CSS for statusbar rendering.
        https://bugs.webkit.org/show_bug.cgi?id=90902

        Reviewed by Vsevolod Vlasov.

        This change removes statusbar* images and uses gradients and borders to re-create original inspector look.

        * WebCore.gypi:
        * inspector/front-end/Images/statusbarBackground.png: Removed.
        * inspector/front-end/Images/statusbarBottomBackground.png: Removed.
        * inspector/front-end/Images/statusbarButtons.png: Removed.
        * inspector/front-end/Images/statusbarMenuButton.png: Removed.
        * inspector/front-end/Images/statusbarMenuButtonSelected.png: Removed.
        * inspector/front-end/StatusBarButton.js:
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.css:
        (body.drawer-visible #main-status-bar):
        (body.drawer-visible #main-status-bar::after):
        (.status-bar-background):
        (.status-bar > div):
        (.glyph):
        (button.status-bar-item):
        (.status-bar button.status-bar-item:active):
        (select.status-bar-item):
        (select.status-bar-item, select.status-bar-item:hover):
        (body.detached .alternate-status-bar-buttons-bar):
        (.alternate-status-bar-buttons-bar):
        (.alternate-status-bar-buttons-bar .status-bar-item):
        (.alternate-status-bar-buttons-bar .status-bar-item.emulate-active):
        (#drawer):
        (body.drawer-visible #drawer-contents):
        (#drawer-status-bar):
        * inspector/front-end/inspector.html:
        * inspector/front-end/scriptsPanel.css:
        (button.status-bar-item.scripts-navigator-show-hide-button):
        (button.status-bar-item.scripts-navigator-show-hide-button:active):
        (button.status-bar-item.scripts-debugger-show-hide-button):
        (button.status-bar-item.scripts-debugger-show-hide-button:active):

2012-07-11  Jason Liu  <jason.liu@torchmobile.com.cn>

        [BlackBerry] crash in CookieDatabaseBackingStore.
        https://bugs.webkit.org/show_bug.cgi?id=90270

        Reviewed by George Staikos.

        There is one case for this crash.
        1. A browser crashes and locks cookies' database for a while.
        2. Open a new browser when the old one doesn't finish crashing.
        3. The new one writes the cookies' database and receives a SQLITE_BUSY error
           in CookieDatabaseBackingStore's invokeOpen. So this database isn't opened.
        4. invokeGetCookiesWithLimit returns 0.
        5. Crash happens when using a null pointer.

        Add function setBusyTimeout(1000) and a guard for cookies' pointer.
        setBusyTimeout will call sqlite3_busy_timeout.

        When the SQLite database is accessed for reading it is locked for writing
        until the reading access is finished. Another process cannot access the database
        while it is locked. The timeout time sets a limit while this process tries to access
        the locked database. If the database is unlocked within the timeout time it can be
        accessed, otherwise an access fails.

        No new tests. This crash is hard to reproduce, and it happens only on our platform.

        * platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.cpp:
        (WebCore::CookieDatabaseBackingStore::getCookiesFromDatabase):

2012-07-11  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Move revisions support to UISourceCode.
        https://bugs.webkit.org/show_bug.cgi?id=90888

        Reviewed by Pavel Feldman.

        Moved revisions support to UISourceCode.
        Revision management code is moved unchanged where possible and should be refactored later.

        * inspector/front-end/CSSStyleModel.js:
        (WebInspector.CSSStyleModelResourceBinding.prototype._innerStyleSheetChanged): revision is now added to uiSourceCode, not resource.
        * inspector/front-end/ExtensionServer.js:
        (WebInspector.ExtensionServer.prototype._notifyUISourceCodeContentCommitted):
        Extension server is now listening for Workspace.UISourceCodeContentCommitted event instead of ResourceTreeModel.ResourceContentCommitted.
        * inspector/front-end/Resource.js:
        * inspector/front-end/ResourceTreeModel.js: ResourceTreeModel.ResourceContentCommitted renamed to Workspace.UISourceCodeContentCommitted.
        * inspector/front-end/ResourceView.js:
        (WebInspector.ResourceSourceFrame): ResourceSourceFrame is not update when revisions are added anymore as resource conenten is considered immutable now
        * inspector/front-end/RevisionHistoryView.js:
        (WebInspector.RevisionHistoryView.populateRevisions):
        (WebInspector.RevisionHistoryView):
        (WebInspector.RevisionHistoryView.showHistory):
        (WebInspector.RevisionHistoryView.prototype._createUISourceCodeItem):
        (WebInspector.RevisionHistoryView.prototype._revisionAdded.get if):
        (WebInspector.RevisionHistoryView.prototype._revisionAdded):
        (WebInspector.RevisionHistoryView.prototype._revealUISourceCode.get if):
        (WebInspector.RevisionHistoryView.prototype._revealUISourceCode):
        (WebInspector.RevisionHistoryView.prototype._reset):
        * inspector/front-end/ScriptSnippetModel.js: Snippets are not loaded before ResourceTreeModel.mainFrame is available anymore.
        (WebInspector.ScriptSnippetModel):
        (WebInspector.ScriptSnippetModel.prototype._setScriptSnippetContent):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode):
        (WebInspector.UISourceCode.prototype.requestOriginalContent):
        (WebInspector.UISourceCode.prototype._setContent):
        (WebInspector.UISourceCode.prototype.addRevision):
        (WebInspector.UISourceCode.prototype._restoreRevisionHistory):
        (WebInspector.UISourceCode.prototype._clearRevisionHistory):
        (WebInspector.UISourceCode.prototype.revertToOriginal):
        (WebInspector.UISourceCode.prototype.revertAndClearHistory):
        (WebInspector.UISourceCode.prototype.revertAndClearHistory.clearHistory):
        (WebInspector.UISourceCode.prototype.commitWorkingCopy):
        (WebInspector.UISourceCode.prototype.canonicalMimeType):
        (WebInspector.Revision):
        (WebInspector.Revision._revisionHistoryRegistry):
        (WebInspector.Revision._ensureStaleRevisionsFileteredOut.persist):
        (WebInspector.Revision._ensureStaleRevisionsFileteredOut):
        (WebInspector.Revision.prototype.get uiSourceCode):
        (WebInspector.Revision.prototype.get timestamp):
        (WebInspector.Revision.prototype.get content):
        (WebInspector.Revision.prototype.revertToThis):
        (WebInspector.Revision.prototype.contentURL):
        (WebInspector.Revision.prototype.contentType):
        (WebInspector.Revision.prototype.requestContent):
        (WebInspector.Revision.prototype.searchInContent):
        (WebInspector.Revision.prototype._persist):
        * inspector/front-end/UserAgentSupport.js: Drive-by closure compilation fix.
        * inspector/front-end/Workspace.js:
        * inspector/front-end/inspector.js: ScriptSnippetModel is now created after ResourceTreeModel.

2012-07-11  MORITA Hajime  <morrita@google.com>

        WebCoreSupport needs objects each of which follows major WebCore objects
        https://bugs.webkit.org/show_bug.cgi?id=88499

        Reviewed by Alexey Proskuryakov.

        This change

        - Makes Internals rough lifetime to follow Document.
          Note that Internals can survive longer than Document in same case.
          Internals::m_document is cleared when the document destruction is notified.
        - Makes InternalSettings rough lifetime to follow the Page.
          This is done by making InternalSettings a supplement of the page.
          Now InternalSettings object is created per Page instead of per Frame.

        Per-test setting clearance is done by newly introduced InternalSettings::Backup,
        which recovers the modified settings and refreshes it for each time a test starts.

        * WebCore.exp.in:
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::Backup):
        (WebCore):
        (WebCore::InternalSettings::Backup::restoreTo):
        (WebCore::InternalSettings::from):
        (WebCore::InternalSettings::~InternalSettings):
        (WebCore::InternalSettings::InternalSettings):
        (WebCore::InternalSettings::reset):
        (WebCore::InternalSettings::settings):
        (WebCore::InternalSettings::setFixedElementsLayoutRelativeToFrame):
        (WebCore::InternalSettings::setFixedPositionCreatesStackingContext):
        (WebCore::InternalSettings::allowRoundingHacks):
        (WebCore::InternalSettings::userPreferredLanguages):
        (WebCore::InternalSettings::setUserPreferredLanguages):
        (WebCore::InternalSettings::setShouldDisplayTrackKind):
        (WebCore::InternalSettings::shouldDisplayTrackKind):
        (WebCore::InternalSettings::setPagination):
        * testing/InternalSettings.h:
        (Backup):
        (InternalSettings):
        (WebCore::InternalSettings::page):
        * testing/InternalSettings.idl:
        * testing/Internals.cpp:
        (WebCore::Internals::Internals):
        (WebCore):
        (WebCore::Internals::contextDocument):
        (WebCore::Internals::frame):
        (WebCore::Internals::settings):
        (WebCore::Internals::setPagination): Replaced as an alias.
        (WebCore::Internals::userPreferredLanguages): Replaced as an alias.
        (WebCore::Internals::setUserPreferredLanguages): Replaced as an alias.
        (WebCore::Internals::setShouldDisplayTrackKind): Replaced as an alias.
        (WebCore::Internals::shouldDisplayTrackKind): Replaced as an alias.
        (WebCore::Internals::emitInspectorDidBeginFrame):
        (WebCore::Internals::emitInspectorDidCancelFrame):
        (WebCore::Internals::allowRoundingHacks): Replaced as an alias.
        * testing/Internals.h:
        (WebCore):
        (Internals):
        * testing/js/WebCoreTestSupport.cpp:
        (WebCoreTestSupport::injectInternalsObject):
        (WebCoreTestSupport::resetInternalsObject):
        * testing/v8/WebCoreTestSupport.cpp:
        (WebCoreTestSupport::injectInternalsObject):
        (WebCoreTestSupport::resetInternalsObject):

2012-07-11  Yoshifumi Inoue  <yosin@chromium.org>

        [Mac] Expose time format related functions
        https://bugs.webkit.org/show_bug.cgi?id=90956

        Reviewed by Kent Tamura.

        This patch introduces localizedTimeFormatText, localizedShortTimeFormatText
        and timeAMPMLabels for Mac within feature flag ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS.

        See also:
          ICU version: https://bugs.webkit.org/show_bug.cgi?id=89965
          Win version: https://bugs.webkit.org/show_bug.cgi?id=90236

        No new tests. This patch doesn't change behavior.

        * platform/text/mac/LocalizedDateMac.cpp:
        (WebCore::localizedTimeFormatText): Added.
        (WebCore::localizedShortTimeFormatText): Added.
        (WebCore::timeAMPMLabels): Added.

2012-07-11  Kenichi Ishibashi  <bashi@chromium.org>

        [Chromium] Adding HarfBuzz-ng for Linux
        https://bugs.webkit.org/show_bug.cgi?id=90362

        Reviewed by Tony Chang.

        This patch adds harfbuzz-ng support for Chromium Linux port as a part of
        transition from old harfbuzz. HarfBuzzFaceSkia.cpp implements harfbuzz-ng
        callbacks by using Skia APIs. For now, the feature is enabled only when
        WTF_USE_HARFBUZZ_NG is defined.

        No new tests. No change in behavior now.

        * WebCore.gyp/WebCore.gyp: Added use_harfbuzz_ng variable and related files.
        * WebCore.gypi: Added HarfBuzzFaceSkia.cpp
        * platform/graphics/harfbuzz/FontHarfBuzz.cpp: Added USE(HARFBUZZ_NG).
        (WebCore::Font::drawComplexText):
        (WebCore::Font::floatWidthForComplexText):
        (WebCore::Font::offsetForPositionForComplexText):
        (WebCore::Font::selectionRectForComplexText):
        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp: Ditto.
        (WebCore):
        (WebCore::FontPlatformData::harfbuzzFace):
        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h: Ditto.
        (FontPlatformData):
        * platform/graphics/harfbuzz/ng/HarfBuzzFaceSkia.cpp: Added.
        (WebCore):
        (WebCore::SkiaScalarToHarfbuzzPosition):
        (WebCore::SkiaGetGlyphWidthAndExtents):
        (WebCore::harfbuzzGetGlyph):
        (WebCore::harfbuzzGetGlyphHorizontalAdvance):
        (WebCore::harfbuzzGetGlyphHorizontalOrigin):
        (WebCore::harfbuzzGetGlyphExtents):
        (WebCore::harfbuzzSkiaGetFontFuncs):
        (WebCore::harfbuzzSkiaGetTable):
        (WebCore::destroyPaint):
        (WebCore::HarfBuzzFace::createFace):
        (WebCore::HarfBuzzFace::createFont):
        (WebCore::HarfBuzzShaper::createGlyphBufferAdvance):
        * platform/graphics/skia/GlyphPageTreeNodeSkia.cpp: Added USE(HARFBUZZ_NG).
        (WebCore::substituteWithVerticalGlyphs):

2012-07-11  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Clean up FileSystem related code
        https://bugs.webkit.org/show_bug.cgi?id=90592

        Reviewed by Vsevolod Vlasov.

        Clean up FileSystem related code in Inspector as follows:
        - Clean up layout tests and add test case for error case,
        - Fix error handling on request,
        - s/GetFileSystemRootTask/FileSystemRootRequest/g
        - s/ReadDirectoryTask/DirectoryContentRequest/g
        - s/ReadFileTask/FileContentRequest/g

        Tests: http/tests/inspector/filesystem/request-directory-content.html
               http/tests/inspector/filesystem/request-file-content.html
               http/tests/inspector/filesystem/request-filesystem-root.html
               http/tests/inspector/filesystem/request-metadata.html

        * inspector/InspectorFileSystemAgent.cpp:
        (WebCore):
        (WebCore::InspectorFileSystemAgent::requestFileSystemRoot): Add early error handling.
        (WebCore::InspectorFileSystemAgent::requestDirectoryContent): Add early error handling.
        (WebCore::InspectorFileSystemAgent::requestMetadata): Add early error handling.
        (WebCore::InspectorFileSystemAgent::requestFileContent): Add early error handling.
        * inspector/InspectorFileSystemAgent.h: Remove unused forward declaration and unused header.
        (WebCore):
        (InspectorFileSystemAgent):
        * inspector/front-end/FileSystemModel.js:
        (WebInspector.FileSystemRequestManager.prototype.requestFileSystemRoot.requestAccepted):
        (WebInspector.FileSystemRequestManager.prototype.requestFileSystemRoot): Add early error handling.
        (WebInspector.FileSystemRequestManager.prototype.requestDirectoryContent.requestAccepted):
        (WebInspector.FileSystemRequestManager.prototype.requestDirectoryContent): Add early error handling.
        (WebInspector.FileSystemRequestManager.prototype.requestMetadata.requestAccepted):
        (WebInspector.FileSystemRequestManager.prototype.requestMetadata): Add early error handling.
        (WebInspector.FileSystemRequestManager.prototype.requestFileContent.requestAccepted):
        (WebInspector.FileSystemRequestManager.prototype.requestFileContent): Add early error handling.

2012-07-09  Eugene Klyuchnikov  <eustas.bug@gmail.com>

        Web Inspector: Forward message loop instrumentation data to frontend.
        https://bugs.webkit.org/show_bug.cgi?id=89584

        Reviewed by Yury Semikhatsky.

        Transmit collected message loop tasks to inspector frontend.
        Now "Program" should be a top-level event on browsers that
        support message loop instrumentation.
        Frontend was changed so that user will not see any changes.

        * inspector/InspectorTimelineAgent.cpp:
        (TimelineRecordType):
        Added new event type - "Program"
        (WebCore::InspectorTimelineAgent::willProcessTask):
        Begin "Program" event.
        (WebCore::InspectorTimelineAgent::didProcessTask):
        Finish "Program" event.
        (WebCore::InspectorTimelineAgent::setHeapSizeStatistic):
        Do not add counters to "Program" events.
        (WebCore):
        (WebCore::InspectorTimelineAgent::innerSetHeapSizeStatistic):
        Renamed from "setHeapSizeStatistic"
        * inspector/InspectorTimelineAgent.h:
        (InspectorTimelineAgent):
        * inspector/front-end/MemoryStatistics.js:
        (WebInspector.MemoryStatistics.prototype._onRecordAdded):
        Unwraps "Program" events.
        (WebInspector.MemoryStatistics.prototype._innerRecordAdded):
        Renamed from "_onRecordAdded"
        * inspector/front-end/TimelineFrameController.js:
        (WebInspector.TimelineFrameController.prototype._addRecord):
        Unwraps "Program" events.
        (WebInspector.TimelineFrameController.prototype._innerAddRecord):
        Renamed from "_addRecord"
        * inspector/front-end/TimelineModel.js:
        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineCategoryStrips.prototype.update.appendRecord):
        Filter out "Program" category.
        (WebInspector.TimelineCategoryStrips.prototype.update):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
        Filter out "Program" category.
        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
        Unwraps "Program" events.
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.categories):
        Added "Program" category.
        (WebInspector.TimelinePresentationModel.recordStyle):
        Ditto.
        (WebInspector.TimelinePresentationModel.prototype.addRecord):
        Unwraps "Program" events.
        (WebInspector.TimelinePresentationModel.prototype._addRecord):
        Renamed from "addRecord"

2012-07-11  Kenichi Ishibashi  <bashi@chromium.org>

        [Chromium] Adding HarfBuzz-ng for Linux
        https://bugs.webkit.org/show_bug.cgi?id=90362

        Reviewed by Tony Chang.

        This patch adds harfbuzz-ng support for Chromium Linux port as a part of
        transition from old harfbuzz. HarfBuzzFaceSkia.cpp implements harfbuzz-ng
        callbacks by using Skia APIs. For now, the feature is enabled only when
        WTF_USE_HARFBUZZ_NG is defined.

        No new tests. No change in behavior now.

        * WebCore.gyp/WebCore.gyp: Added use_harfbuzz_ng variable and related files.
        * WebCore.gypi: Added HarfBuzzFaceSkia.cpp
        * platform/graphics/harfbuzz/FontHarfBuzz.cpp: Added USE(HARFBUZZ_NG).
        (WebCore::Font::drawComplexText):
        (WebCore::Font::floatWidthForComplexText):
        (WebCore::Font::offsetForPositionForComplexText):
        (WebCore::Font::selectionRectForComplexText):
        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp: Ditto.
        (WebCore):
        (WebCore::FontPlatformData::harfbuzzFace):
        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h: Ditto.
        (FontPlatformData):
        * platform/graphics/harfbuzz/ng/HarfBuzzFaceSkia.cpp: Added.
        (WebCore):
        (WebCore::SkiaScalarToHarfbuzzPosition):
        (WebCore::SkiaGetGlyphWidthAndExtents):
        (WebCore::harfbuzzGetGlyph):
        (WebCore::harfbuzzGetGlyphHorizontalAdvance):
        (WebCore::harfbuzzGetGlyphHorizontalOrigin):
        (WebCore::harfbuzzGetGlyphExtents):
        (WebCore::harfbuzzSkiaGetFontFuncs):
        (WebCore::harfbuzzSkiaGetTable):
        (WebCore::destroyPaint):
        (WebCore::HarfBuzzFace::createFace):
        (WebCore::HarfBuzzFace::createFont):
        (WebCore::HarfBuzzShaper::createGlyphBufferAdvance):
        * platform/graphics/skia/GlyphPageTreeNodeSkia.cpp: Added USE(HARFBUZZ_NG).
        (WebCore::substituteWithVerticalGlyphs):

2012-07-11  Kenneth Russell  <kbr@google.com>

        compositing/webgl/webgl-nonpremultiplied-blend.html is flaky on Lion
        https://bugs.webkit.org/show_bug.cgi?id=82412

        Reviewed by Adrienne Walker.

        When compositing premultipliedAlpha=false WebGL canvases, use a separate
        blend function for the alpha channel to avoid writing alpha < 1. This
        makes the behavior more consistent with all other compositing results
        and avoids situations where the alpha channel is preserved on some
        platforms and discarded on others.

        Covered by existing tests.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawTextureQuad):
            Use separate alpha blend function when compositing premultipliedAlpha=false WebGL canvases.

2012-07-10  Yoshifumi Inoue  <yosin@chromium.org>

        [Chromium-Windows] Implement functions for localized time format information
        https://bugs.webkit.org/show_bug.cgi?id=90236

        Reviewed by Kent Tamura.

        This patch introduces following localized time format related
        functions:
            - localizedTimeFormatText
            - localizeShortTimeFormatText()
            - timeAMPMLabels
        for Windows in feature flag: ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS.

        See also:
          ICU version: https://bugs.webkit.org/show_bug.cgi?id=89965
          Mac version: https://bugs.webkit.org/show_bug.cgi?id=90237

        Tests: WebKit/chromium/tests/LocalWinTest.cpp

        * platform/text/LocaleWin.cpp:
        (WebCore::mapCharacterToDateTimeFieldType): Added.
        (WebCore::convertWindowsTimeFormatToLDML): Added.
        (WebCore::LocaleWin::timeFormatText): Added.
        (WebCore::LocaleWin::shortTimeFormatText): Added.
        (WebCore::LocaleWin::timeAMPMLabels): Added.
        * platform/text/LocaleWin.h:
        (LocaleWin): Added time format related functions and variables.
        * platform/text/LocalizedDateWin.cpp:
        (WebCore::localizedTimeFormatText): Added.
        (WebCore::localizedShortTimeFormatText):  Added.
        (WebCore::timeAMPMLabels):  Added.

2012-07-10  Douglas Stockwell  <dstockwell@chromium.org>

        Style not updated for element with display:none becoming first/last-child
        https://bugs.webkit.org/show_bug.cgi?id=90356

        Reviewed by Kent Tamura.

        Always trigger style recalc when an element without a renderer becomes the first/last-child.

        Tests: fast/css/first-child-display-change.html
               fast/css/last-child-display-change.html

        * dom/Element.cpp:
        (WebCore::checkForSiblingStyleChanges):

2012-07-10  Shinya Kawanaka  <shinyak@chromium.org>

        ShadowRoot should know its type in debug build.
        https://bugs.webkit.org/show_bug.cgi?id=90933

        Reviewed by Hajime Morita.

        For assertion, ShadowRoot should know its type is UserAgentShadowRoot or AuthorShadowRoot.

        This patch also renames ShadowRootCreationPurpose to ShadowRootType, since it is suitable
        name for ShadowRoot to have.

        No new tests, since it is used only for assertion.

        * dom/Element.cpp:
        (WebCore::Element::ensureShadowRoot):
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::create):
        * dom/ShadowRoot.h:
        (ShadowRoot):
        (WebCore::ShadowRoot::type):
        * html/HTMLDetailsElement.cpp:
        (WebCore::HTMLDetailsElement::createShadowSubtree):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::createShadowSubtree):
        * html/HTMLKeygenElement.cpp:
        (WebCore::HTMLKeygenElement::HTMLKeygenElement):
        * html/HTMLMeterElement.cpp:
        (WebCore::HTMLMeterElement::createShadowSubtree):
        * html/HTMLProgressElement.cpp:
        (WebCore::HTMLProgressElement::createShadowSubtree):
        * html/HTMLSummaryElement.cpp:
        (WebCore::HTMLSummaryElement::createShadowSubtree):
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::createShadowSubtree):
        * html/InputType.cpp:
        (WebCore::InputType::destroyShadowSubtree): Asserts that ShadowRoot type is UserAgentShadowRoot.
        * html/shadow/TextFieldDecorationElement.cpp:
        (WebCore::getDecorationRootAndDecoratedRoot):
        * svg/SVGTRefElement.cpp:
        (WebCore::SVGTRefElement::createShadowSubtree):

2012-07-10  George Staikos  <staikos@webkit.org>

        Add missing binding type String for IndexedDB.
        https://bugs.webkit.org/show_bug.cgi?id=90351

        Reviewed by Nikolas Zimmermann.

        No new tests because it's already covered by IDB tests.

        * bindings/js/JSIDBAnyCustom.cpp:
        (WebCore::toJS):

2012-07-10  Brian Anderson  <brianderson@chromium.org>

        [chromium] Make full texture updates explicit
        https://bugs.webkit.org/show_bug.cgi?id=90507

        Reviewed by Adrienne Walker.

        Covered by existing tests.

        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        (WebCore::ScrollbarLayerChromium::updatePart):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::updateTiles):
        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:
        (WebCore::CCTextureUpdater::appendFullUpdate):
        (WebCore::CCTextureUpdater::hasMoreUpdates):
        (WebCore::CCTextureUpdater::update):
        (WebCore::CCTextureUpdater::clear):
        * platform/graphics/chromium/cc/CCTextureUpdater.h:
        (CCTextureUpdater):

2012-07-10  Shinya Kawanaka  <shinyak@chromium.org>

        Crash in nextLinePosition() due to accessing a removed root line box.
        https://bugs.webkit.org/show_bug.cgi?id=90484

        Reviewed by Abhishek Arya.

        When <object> element is reattached, the 'content' style is compared to the old style.
        If it is not the same, a flag to recalc style is enabled. Because of this, the recalc style flag
        is not cleared in updateLayoutIgnorePendingStyleSheets() in nextLinePosition(), and it causes
        the second layout in isEditablePosition(p). Then 'RootInlineBox root' is invalidated, but
        it's used after that.

        When the content of the same <object> elements are compared, they should be the same.
        However, operator== for ContentData is not implemented correctly (it compares a pointer instead of
        content). So operator== does not hold for the content of the same <object> elements.

        Test: editing/execCommand/crash-extend-selection-forward.html

        * rendering/style/ContentData.cpp:
        (WebCore::operator==): Compares the instance of data instead of pointer.

2012-07-10  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Ensure transaction abort events are deterministic in multiprocess ports
        https://bugs.webkit.org/show_bug.cgi?id=90412

        Reviewed by Tony Chang.

        In multi-process ports (e.g. Chromium), transaction aborts triggered on the front-end could 
        be initiated while a "success" event was in-flight from the back end. This would lead to 
        apparently flaky behavior when requests would sometimes report success and sometimes report
        an error. Address this by having front-end triggered aborts do the abort steps immediately,
        then send the async abort request to the back end.

        No new tests - behavior in single process ports (and DRT) covered by existing
        tests. Will enable currently disabled Chromium tests to be enabled (crbug.com/83226).

        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::IDBRequest): Initialize a new m_requestAborted flag, used to prevent
        dispatching if an in-flight request comes in after the abort.
        (WebCore::IDBRequest::abort): Set flag to prevent double dispatching.
        (WebCore::IDBRequest::onError): Handle aborted-then-received-event case.
        (WebCore::IDBRequest::onSuccess): Ditto.
        (WebCore::IDBRequest::onSuccessWithContinuation): Ditto.
        (WebCore::IDBRequest::dispatchEvent): On uncaught error, trigger abort on transaction front-end.
        * Modules/indexeddb/IDBRequest.h:
        (IDBRequest):
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::abort): Do abort steps locally first, then notify back-end.
        (WebCore::IDBTransaction::onAbort): If abort wasn't triggered locally, clean up is still necessary.

2012-07-10  Julien Chaffraix  <jchaffraix@webkit.org>

        REGRESSION(r112113): absolutely positioned INPUT boxes with a table cell containing block have a 0px height
        https://bugs.webkit.org/show_bug.cgi?id=89209

        Reviewed by Ojan Vafai.

        Test: fast/forms/input-in-table-cell-no-value.html

        The issue comes from the layout code not properly resetting the overriden heigth between layouts.

        The test case relies on a table cell as it requires a 2 pass layout. Between the 2 passes, different
        code paths would be taken, leading to previous values being used to over-constrain the inner content.

        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::layout):
        Ensure consistent layout by resetting any overriden conditional height.

2012-07-10  Kevin Ellis  <kevers@chromium.org>

        Input elements with type=range do not have default touch handlers.
        https://bugs.webkit.org/show_bug.cgi?id=88807

        Reviewed by Antonio Gomes.

        This patch adds support for touch event handling on input elements
        and dragging a slider with touch start and move events.  Previously,
        manipulating a slider on a touch screen required generation of
        synthetic mouse events.

        Tests: fast/events/touch/touch-slider-no-js-touch-listener.html
               fast/events/touch/touch-slider.html

        * dom/Event.cpp:
        (WebCore::Event::isTouchEvent):
        (WebCore):
        * dom/Event.h:
        (Event):
        * dom/Touch.cpp:
        (WebCore::Touch::Touch):
        * dom/Touch.h:
        (WebCore::Touch::absoluteLocation):
        (Touch):
        * dom/TouchEvent.cpp:
        (WebCore::TouchEvent::isTouchEvent):
        (WebCore):
        * dom/TouchEvent.h:
        (TouchEvent):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::HTMLInputElement):
        (WebCore::HTMLInputElement::~HTMLInputElement):
        (WebCore::HTMLInputElement::updateType):
        (WebCore::HTMLInputElement::defaultEventHandler):
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/InputType.cpp:
        (WebCore):
        (WebCore::InputType::handleTouchEvent):
        (WebCore::InputType::hasTouchEventHandler):
        * html/InputType.h:
        (WebCore):
        (ClickHandlingState):
        (InputType):
        * html/RangeInputType.cpp:
        (WebCore):
        (WebCore::RangeInputType::handleTouchEvent):
        (WebCore::RangeInputType::hasTouchEventHandler):
        * html/RangeInputType.h:
        (RangeInputType):
        * html/shadow/SliderThumbElement.h:
        (SliderThumbElement):

2012-07-10  Pravin D  <pravind.2k4@gmail.com>

        Re-factoring recalcColumn in AutoTableLayout.cpp for readability
        https://bugs.webkit.org/show_bug.cgi?id=89636

        Reviewed by Julien Chaffraix.

        No test case required. Code re-factoring.

        * rendering/AutoTableLayout.cpp:
        Added a const integer place holder for 32760.

        (WebCore::AutoTableLayout::recalcColumn):
         Changes :
         1) Moved the continue statement above the bool cellHasContent for an early return.
         2) Replaced the constant 32760 by a placeholder.
         3) Initialization of columnLayout max and min logical widths is made common for both cells having col span == 1 and span > 1.
         4) Removed redundant check for cell logical width type. 

2012-07-10  Adam Barth  <abarth@webkit.org>

        WebCore::Settings for Hixie76 WebSocket protocol doesn't do anything and should be removed
        https://bugs.webkit.org/show_bug.cgi?id=90910

        Reviewed by Eric Seidel.

        We've already removed the code that implements Hixie76 WebSockets. This
        patch just removes the WebCore::Setting that used to control which
        WebSocket protocol version we'd use.

        I've left the WebKit-layer APIs in place, but they now don't do
        anything.  I'll remove all the Chromium callers shortly.

        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (Settings):

2012-07-10  Philip Rogers  <pdr@google.com>

        Crash due to SVG animation element not removed from target (before reset)
        https://bugs.webkit.org/show_bug.cgi?id=90750

        Reviewed by Abhishek Arya.

        Previously we were not removing an animation element from
        SVGDocumentExtensions::m_animatedElements which led to a crash.
        This change properly removes animation elements in resetTargetElement
        which both fixes this bug and will prevent others from hitting it in
        the future.

        Test: svg/animations/dynamic-modify-attributename-crash2.svg

        * svg/SVGDocumentExtensions.cpp:
        (WebCore::SVGDocumentExtensions::removeAllAnimationElementsFromTarget):

        removeAllAnimationElementsFromTarget now adds all the animation elements
        to a vector and iterates over it because the changes to resetTargetElement
        would have caused us to modify the underlying hashset as we iterated. Note that
        before we deleted animationElementsForTarget in removeAllAnimationElementsFromTarget
        but that logic is now handled in removeAnimationElementFromTarget which is called
        during resetTargetElement.

        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::removedFrom):

        Because of the changes in resetTargetElement, removedFrom was able to be
        refactored. This patch changes removedFrom to call resetTargetElement rather
        than have duplicated logic. There is a very small change in logic here:
        animationAttributeChanged() is now called in removedFrom().

        (WebCore::SVGSMILElement::resetTargetElement):

        resetTargetElement now fully resets the target, including removing it from
        m_animatedElements. This will prevent future instances of this bug.

2012-07-10  Helder Correia  <helder.correia@nokia.com>

        [Qt] Repaint counter for accelerated compositing
        https://bugs.webkit.org/show_bug.cgi?id=90116

        Reviewed by Noam Rosenthal.

        No new tests, just introducing a debug feature.

        For this feature to be enabled, the environment variable
        QT_WEBKIT_SHOW_COMPOSITING_DEBUG_VISUALS must be set to 1. Once enabled,
        both repaint counters and tile borders will be painted.

        Important notes:
        - Only WebKit2 is targetted for now.
        - There is no integration with Preferences. That aproach was
        taken initially but revealed complex and overkill for such a
        debugging-only functionality. Thus, to disable it simply restart with
        the environment variable unset or set to some other value.

        A Qt-specific drawRepaintCounter() function was added to
        TextureMapperGL. A QImage is used as scratch buffer to paint borders and
        counters. It is then uploaded to a BitmapTexture acquired from the pool
        and finally draw by TextureMapper. The actual compositing happens inside
        LayerBackingStore::paintToTextureMapper(). Each LayerBackingStoreTile
        now has a repaint counter which gets incremented in
        LayerBackingStore::updateTile().

        * platform/graphics/texmap/TextureMapper.h:
        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore):
        (WebCore::TextureMapperGL::drawRepaintCounter):
        * platform/graphics/texmap/TextureMapperGL.h:
        * platform/graphics/texmap/TextureMapperImageBuffer.h:

2012-07-09  Dana Jansens  <danakj@chromium.org>

        [chromium] Replace use of ManagedTexture with CCScopedTexture for impl thread and remove implTextureManager from LayerRendererChromium
        https://bugs.webkit.org/show_bug.cgi?id=90841

        Reviewed by Adrienne Walker.

        Remove the TextureManager from LayerRendererChromium, which was the last
        instance of the class in the compositor. Instead of using ManagedTexture
        objects for RenderPass textures, use instances of CCScopedTexture, which
        manage the lifetime of the allocated texture ids. TextureManager will be
        removed entirely once all callers of memoryUseBytes() have been removed.

        No new tests. No change in behaviour.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::LayerRendererChromium):
        (WebCore::LayerRendererChromium::releaseRenderPassTextures):
        (WebCore):
        (WebCore::LayerRendererChromium::renderPassTextureSize):
        (WebCore::LayerRendererChromium::renderPassTextureFormat):
        (WebCore::LayerRendererChromium::decideRenderPassAllocationsForFrame):
        (WebCore::LayerRendererChromium::haveCachedResourcesForRenderPassId):
        (WebCore::LayerRendererChromium::drawQuad):
        (WebCore::applyFilters):
        (WebCore::LayerRendererChromium::drawBackgroundFilters):
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
        (WebCore::LayerRendererChromium::drawHeadsUpDisplay):
        (WebCore::LayerRendererChromium::getFramebufferTexture):
        (WebCore::LayerRendererChromium::isCurrentRenderPass):
        (WebCore::LayerRendererChromium::useRenderPass):
        (WebCore::LayerRendererChromium::useScopedTexture):
        (WebCore::LayerRendererChromium::bindFramebufferToTexture):
        (WebCore::LayerRendererChromium::initializeSharedObjects):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (WebCore):
        (LayerRendererChromium):
        * platform/graphics/chromium/TrackingTextureAllocator.cpp:
        (WebCore::TrackingTextureAllocator::TrackingTextureAllocator):
        (WebCore::TrackingTextureAllocator::createTexture):
        * platform/graphics/chromium/TrackingTextureAllocator.h:
        (WebCore::TrackingTextureAllocator::create):
        (TrackingTextureAllocator):
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
        (WebCore::CCHeadsUpDisplay::draw):
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.h:
        (WebCore):
        (CCHeadsUpDisplay):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (WebCore):
        (CCRenderer):

2012-07-10  Dean Jackson  <dino@apple.com>

        REGRESSION (r109610): Order of values in shorthand animation makes a difference
        https://bugs.webkit.org/show_bug.cgi?id=84533
        <rdar://problem/11831924>
        <rdar://problem/11815787>

        Reviewed by Simon Fraser.

        A previous revision (r109610) updated the parsing of the animation shorthand
        to make sure that animation-name wouldn't clobber other styles. The side effect
        of this was that we'd no longer find animation-name if it wasn't first in the
        list. This commit reverts the change and fixes it in a different way, by always
        parsing animation-name as the last property in the shorthand. This means that
        keywords for timing functions, fill modes and iteration will match before
        animation name. In other words, if you want an animation called "forwards"
        you should use the longhand property, because the shorthand will first match
        that against animation-fill-mode.

        Test: animations/animation-shorthand-name-order.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseAnimationShorthand): make a new array of longhand
        properties to check for, with name as the last entry rather than the first.
        Use this array to test the properties in the shorthand.

2012-07-10  Huang Dongsung  <luxtella@company100.net>

        Fix a potential bug of BitmapImage::frameCount().
        https://bugs.webkit.org/show_bug.cgi?id=90756

        Reviewed by Simon Fraser.

        If an ImageDecoder is not yet initialized, m_source.frameCount() returns 0. This
        does not mean that the frame count is actually 0. So we must set
        m_haveFrameCount to true only when m_frameCount is not 0.

        The current code is okay because BitmapImage::frameCount() is never called
        before the decoder is initialized. However, this no longer holds true once we
        introduce parallel image decoders.

        No new tests, no behavior change.

        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::frameCount):

2012-07-10  Ojan Vafai  <ojan@chromium.org>

        Build fix. Removing unused variable from http://trac.webkit.org/changeset/122264.
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeContentLogicalHeightUsing):

2012-07-10  Ryosuke Niwa  <rniwa@webkit.org>

        HTMLPropertiesCollection should share more code with HTMLCollection
        https://bugs.webkit.org/show_bug.cgi?id=90842

        Reviewed by Anders Carlsson.

        Got rid of HTMLPropertiesCollection::m_cache, and added m_itemRefElements, m_propertyNames, m_propertyCache,
        m_hasPropertyNameCache, and m_hasItemRefElements to HTMLPropertiesCollection itself. These are caches specific
        to HTMLPropertiesCollection. Note that hasNameCache has been renamed to m_hasPropertyNameCache and itemRefElementPosition
        has been replaced by cachedElementsArrayOffset() in HTMLCollectionCacheBase (also used in HTMLFormCollection).

        Also deleted all methods on m_cache except updatePropertyCache since caches can be accessed directly from
        HTMLPropertiesCollection.

        * html/HTMLCollection.cpp:
        (WebCore::HTMLCollection::invalidateCacheIfNeeded):
        (WebCore::HTMLCollection::invalidateCache):
        * html/HTMLCollection.h:
        (HTMLCollection):
        * html/HTMLPropertiesCollection.cpp:
        (WebCore::HTMLPropertiesCollection::HTMLPropertiesCollection):
        (WebCore):
        (WebCore::HTMLPropertiesCollection::updateRefElements):
        (WebCore::HTMLPropertiesCollection::itemAfter):
        (WebCore::HTMLPropertiesCollection::calcLength):
        (WebCore::HTMLPropertiesCollection::cacheFirstItem):
        (WebCore::HTMLPropertiesCollection::item):
        (WebCore::HTMLPropertiesCollection::findProperties):
        (WebCore::HTMLPropertiesCollection::updateNameCache):
        (WebCore::HTMLPropertiesCollection::names):
        (WebCore::HTMLPropertiesCollection::namedItem):
        (WebCore::HTMLPropertiesCollection::hasNamedItem):
        * html/HTMLPropertiesCollection.h:
        (HTMLPropertiesCollection):
        (WebCore::HTMLPropertiesCollection::clearCache):
        (WebCore::HTMLPropertiesCollection::updatePropertyCache):

2012-07-10  Ojan Vafai  <ojan@chromium.org>

        Add support for min-height:auto and min-width:auto
        https://bugs.webkit.org/show_bug.cgi?id=88437

        Reviewed by Tony Chang.

        Right now auto does the same thing as min-height/min-width:0.
        For flex-items it should be the same as min-content (followup patch).
        http://dev.w3.org/csswg/css3-flexbox/#min-size-auto

        Tests: fast/css/auto-min-size.html
               fast/css/deprecated-flexbox-auto-min-size.html

        * WebCore.order:
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        Return 0px for the computed value of auto.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::validWidth):
        (WebCore):
        (WebCore::CSSParser::validHeight):
        (WebCore::CSSParser::parseValue):
        * css/CSSParser.h:
        (CSSParser):
        Restructure width/height parsing to reduce code duplication and make it easier
        to add auto as a valid min value.

        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::adjustSizeConstraints):
        This code was unnecessarily checking intrinsicOrAuto since auto was previously
        not an allowed value for minWidth/minHeight.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeLogicalWidthInRegion):
        (WebCore::RenderBox::computeLogicalWidthInRegionUsing):
        (WebCore::RenderBox::sizesLogicalWidthToFitContent):
        (WebCore::RenderBox::computeLogicalHeight):
        (WebCore::RenderBox::computeLogicalHeightUsing):
        (WebCore::RenderBox::computeContentLogicalHeightUsing):
        (WebCore::RenderBox::computeReplacedLogicalWidth):
        (WebCore::RenderBox::computeReplacedLogicalWidthRespectingMinMaxWidth):
        (WebCore::RenderBox::computeReplacedLogicalWidthUsing):
        (WebCore::RenderBox::computeReplacedLogicalHeight):
        (WebCore::RenderBox::computeReplacedLogicalHeightRespectingMinMaxHeight):
        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
        (WebCore::RenderBox::computePositionedLogicalWidth):
        (WebCore::RenderBox::computePositionedLogicalWidthUsing):
        (WebCore::RenderBox::computePositionedLogicalHeight):
        (WebCore::RenderBox::computePositionedLogicalHeightUsing):
        Need to pass a SizeType to all these methods so that we know if the Length
        we're working with is a min length since auto has a different meaning now
        for min lengths.

        * rendering/RenderBox.h:
        (RenderBox):
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::allowedChildFlex):
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::computePreferredLogicalWidths):
        (WebCore::RenderFlexibleBox::computeAvailableFreeSpace):
        (WebCore::RenderFlexibleBox::lineBreakLength):
        (WebCore::RenderFlexibleBox::adjustChildSizeForMinAndMax):
        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::computeReplacedLogicalWidth):
        (WebCore::RenderReplaced::computeReplacedLogicalHeight):
        * rendering/RenderScrollbarPart.cpp:
        (WebCore::calcScrollbarThicknessUsing):
        (WebCore::RenderScrollbarPart::computeScrollbarWidth):
        (WebCore::RenderScrollbarPart::computeScrollbarHeight):
        * rendering/style/RenderStyle.h:
        Default minHeight/minWidth to auto instead of 0px.

2012-07-10  Xianzhu Wang  <wangxianzhu@chromium.org>

        [Chromium-Android] Use default font rendering styles in FontPlatformData::querySystemForRenderStyle()
        https://bugs.webkit.org/show_bug.cgi?id=90826

        Reviewed by Adam Barth.

        No new tests. The change to this file is refactoring only.

        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp:
        (WebCore::FontPlatformData::querySystemForRenderStyle): Moved the "NoPreference" initialization into PlatformSupport::PlatformSupport::getRenderStyleForStrike().

2012-07-10  Raymond Toy  <rtoy@google.com>

        AudioFIFO not correctly wrapping the write index on push
        https://bugs.webkit.org/show_bug.cgi?id=90901

        Reviewed by Chris Rogers.

        No new tests

        * platform/audio/AudioFIFO.cpp:
        (WebCore::AudioFIFO::push): Wrap the write index, not read index!

2012-07-10  Dana Jansens  <danakj@chromium.org>

        [chromium] Avoid allocating render pass textures that have no content
        https://bugs.webkit.org/show_bug.cgi?id=90702

        Reviewed by Adrienne Walker.

        When OOM conditions are hit, textures are not allocated for some layers
        which can prevent any quads from being present for a render surface.
        This is used as a signal to prevent the RenderPass from allocating a
        texture.

        Replace the CCLayerTreeHostImpl::removePassesWithCachedTextures() method
        with a general removeRenderPasses() which takes a culling control object
        and will remove passes based on the inputs from the control object.

        This new method is used for the old purpose of removing passes with cached
        textures, as well as to remove passes that do not have any quad inputs.

        Test: CCLayerTreeHostTestSurfaceNotAllocatedForLayersOutsideMemoryLimit

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore):
        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithCachedTextures::shouldRemoveRenderPass):
        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithNoQuads::shouldRemoveRenderPass):
        (WebCore::CCLayerTreeHostImpl::removeRenderPasses):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (WebCore):
        (CullRenderPassesWithCachedTextures):
        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithCachedTextures::renderPassListBegin):
        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithCachedTextures::renderPassListEnd):
        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithCachedTextures::renderPassListNext):
        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithCachedTextures::CullRenderPassesWithCachedTextures):
        (CCLayerTreeHostImpl):
        (CullRenderPassesWithNoQuads):
        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithNoQuads::renderPassListBegin):
        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithNoQuads::renderPassListEnd):
        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithNoQuads::renderPassListNext):

2012-07-10  Joshua Netterfield  <jnetterfield@rim.com>
        Make GC3D and E3D more maintainable for GLES platforms
        https://bugs.webkit.org/show_bug.cgi?id=90567

        Reviewed by Rob Buis.

        This patch cleans up code for WebGL on OpenGLES platforms which use 
        GraphicsContext3DOpenGL* and Extensions3DOpenGL*. Although
        GraphicsContext3DOpenGL was already split into GraphicsContext3DOpenGL,
        GraphicsContext3DOpenGLCommon, and  GraphicsContext3DOpenGLES, this patch
        is an attempt to refactor this code in a way that will help BlackBerry and
        other teams support WebGL on mobile platforms with as little use of
        "#IF USE(OPENGL_ES_2)" in common code as possible. Also included is the
        separation of Extensions3DOpenGL into Extensions3DOpenGLCommon,
        Extensions3DOpenGL, and Extensions3DOpenGLES as well as the introduction
        of OpenGLESShims.

        This patch is created in large part by Jonathan Feldstein.

        No new tests: no new behaviour.

        * PlatformBlackBerry.cmake: Recognize BlackBerry as OPENGL ES, add new files to build
        * Target.pri: Add new Extensions3DOpenGL* to WebGL builds
        * platform/graphics/GraphicsContext3D.h: Add validateDepthStencil, make systemAllowsMultisamplingOnATICards a a member function.
        (WebCore):
        * platform/graphics/OpenGLESShims.h: Added.
        * platform/graphics/opengl/Extensions3DOpenGL.cpp: Move code to Extensions3DOpenGLCommon where possible
        (WebCore::Extensions3DOpenGL::Extensions3DOpenGL): Reflect that it is now inherits Extensions3DCommon
        (WebCore::Extensions3DOpenGL::supportsExtension): Contains OpenGL specific code from supports
        (WebCore):
        (WebCore::Extensions3DOpenGL::getExtensions): Returns a list of extensions
        * platform/graphics/opengl/Extensions3DOpenGL.h: Remove functions now in Extensions3DOpenGLCommon
        (WebCore):
        (Extensions3DOpenGL):
        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp: Added.
        (WebCore):
        (WebCore::Extensions3DOpenGLCommon::Extensions3DOpenGLCommon):
        (WebCore::Extensions3DOpenGLCommon::~Extensions3DOpenGLCommon):
        (WebCore::Extensions3DOpenGLCommon::supports):
        (WebCore::Extensions3DOpenGLCommon::ensureEnabled):
        (WebCore::Extensions3DOpenGLCommon::isEnabled):
        (WebCore::Extensions3DOpenGLCommon::getGraphicsResetStatusARB):
        (WebCore::Extensions3DOpenGLCommon::getTranslatedShaderSourceANGLE): Existed before, but did nothing. Now does what is says it does.
        (WebCore::Extensions3DOpenGLCommon::initializeAvailableExtensions): Moved from Extensions3DOpenGL::supports
        * platform/graphics/opengl/Extensions3DOpenGLCommon.h: Copied from Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h.
        (WebCore):
        (Extensions3DOpenGLCommon):
        * platform/graphics/opengl/Extensions3DOpenGLES.cpp: Added.
        (WebCore):
        (WebCore::Extensions3DOpenGLES::Extensions3DOpenGLES):
        (WebCore::Extensions3DOpenGLES::~Extensions3DOpenGLES):
        (WebCore::Extensions3DOpenGLES::framebufferTexture2DMultisampleIMG):
        (WebCore::Extensions3DOpenGLES::renderbufferStorageMultisampleIMG):
        (WebCore::Extensions3DOpenGLES::createVertexArrayOES):
        (WebCore::Extensions3DOpenGLES::deleteVertexArrayOES):
        (WebCore::Extensions3DOpenGLES::isVertexArrayOES):
        (WebCore::Extensions3DOpenGLES::bindVertexArrayOES):
        (WebCore::Extensions3DOpenGLES::supportsExtension): Contains OpenGLES specific code from supports
        (WebCore::Extensions3DOpenGLES::getExtensions):
        * platform/graphics/opengl/Extensions3DOpenGLES.h: Copied from Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h.
        (WebCore):
        (Extensions3DOpenGLES):
        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
        (WebCore::GraphicsContext3D::validateAttributes):
        (WebCore):
        (WebCore::GraphicsContext3D::renderbufferStorage):
        (WebCore::GraphicsContext3D::texImage2D):
        (WebCore::GraphicsContext3D::systemAllowsMultisamplingOnATICards): Now a member function.
        (WebCore::GraphicsContext3D::getExtensions):
        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
        (WebCore::GraphicsContext3D::validateDepthStencil):
        (WebCore::GraphicsContext3D::clear):
        (WebCore::GraphicsContext3D::isTexture):
        (WebCore):
        (WebCore::GraphicsContext3D::lineWidth):
        (WebCore::GraphicsContext3D::linkProgram):
        (WebCore::GraphicsContext3D::pixelStorei):
        (WebCore::GraphicsContext3D::polygonOffset):
        (WebCore::GraphicsContext3D::readPixels):
        (WebCore::GraphicsContext3D::deleteBuffer):
        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
        (WebCore::GraphicsContext3D::releaseShaderCompiler):
        (WebCore::GraphicsContext3D::readPixelsAndConvertToBGRAIfNecessary):
        (WebCore::GraphicsContext3D::validateAttributes):
        (WebCore):
        (WebCore::GraphicsContext3D::getExtensions):
        (WebCore::GraphicsContext3D::systemAllowsMultisamplingOnATICards): Now a member function.
        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        (WebCore):
        (WebCore::GraphicsContext3D::releaseShaderCompiler):

2012-07-06  David Hyatt  <hyatt@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=90646
        <rdar://problem/11648478> 3-pass pagination slows down pagination

        Improve the logical top estimate function for margin collapsing to be more accurate. In particular
        make the basic case of <body><p> or <body><h1> no longer be wrong. This estimate being incorrect
        is not a big deal most of the time, but when paginating it is a very big deal, since you have to
        relayout everything whenever your vertical placement is wrong.

        Improving the estimation exposed a bug in an existing layout test. I had to clean up the buggy
        code written for negative margin-related float detection and fix an invalid layout test to
        actually be correct.

        Reviewed by Simon Fraser.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::collapseMargins):
        (WebCore::RenderBlock::marginBeforeEstimateForChild):
        (WebCore):
        (WebCore::RenderBlock::estimateLogicalTopPosition):
        (WebCore::RenderBlock::marginValuesForChild):
        * rendering/RenderBlock.h:
        (RenderBlock):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::shrinkLogicalWidthToAvoidFloats):
        (WebCore::RenderBox::computeLogicalWidthInRegionUsing):

2012-07-10  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Count inspector memory used to traverse DOM in native memory snapshots.
        https://bugs.webkit.org/show_bug.cgi?id=90456

        Inspector may take significant amount of memory when traversing DOM structure.
        Take it into account and report under inspector memory.

        Reviewed by Pavel Feldman.

        * dom/MemoryInstrumentation.h:
        (MemoryInstrumentation):
        (WebCore::MemoryInstrumentation::calculateContainerSize):
        (WebCore::MemoryInstrumentation::reportHashMap):
        (WebCore::MemoryInstrumentation::reportHashSet):
        (WebCore::MemoryInstrumentation::reportVector):
        * inspector/InspectorMemoryAgent.cpp:
        (MemoryBlockName):
        (WebCore):
        (WebCore::domTreeInfo):
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):

2012-07-10  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>

        [GTK] Fix memory leaks by adopting allocation of GdkPixbuf
        https://bugs.webkit.org/show_bug.cgi?id=90790

        Reviewed by Carlos Garcia Campos.

        Fixed a memory leak in paintGdkPixbuf by adopting an allocation
        of GdkPixbuf.

        No new tests. No change in behavior.

        * platform/gtk/RenderThemeGtk.cpp:
        (WebCore::paintGdkPixbuf):

2012-07-10  Konrad Piascik  <kpiascik@rim.com>

        Web Inspector: Geolocation override
        https://bugs.webkit.org/show_bug.cgi?id=89365

        Reviewed by Yong Li.

        Added a way to override the geoloation of a client using Web
        Inspector.

        New tests added.
        * LayoutTests/inspector/geolocation-success.html:
        * LayoutTests/inspector/getlocation-error.html:

        * Modules/geolocation/GeolocationController.cpp:
        (WebCore::GeolocationController::GeolocationController): Now store and
        save the Page in m_page.
        (WebCore::GeolocationController::positionChanged): Check if position
        is overriden in Web Inspector.
        * Modules/geolocation/GeolocationController.h:
        (GeolocationController): Add member variable m_page for Page*.
        * inspector/Inspector.json: Add new methods for setting and clearing
        the GeoloationPosition and GeolocationError objects in InspectorPageAgent.
        * inspector/InspectorInstrumentation.cpp:
        (WebCore):
        (WebCore::InspectorInstrumentation::checkGeolocationPositionOrErrorImpl):
        Add methods to check whether GeolocationPosition or GeolocationError
        are set in InspectorPageAgent.
        * inspector/InspectorInstrumentation.h:
        (WebCore):
        (InspectorInstrumentation):
        (WebCore::InspectorInstrumentation::checkGeolocationPositionOrError):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::InspectorPageAgent): Initialize new
        member variables of GeolocationPosition and GeolocationError.
        (WebCore::InspectorPageAgent::setGeolocationData): Set Position and
        Error data and call appropriate GeolocaitonController methods.
        (WebCore):
        (WebCore::InspectorPageAgent::clearGeolocationData):
        (WebCore::InspectorPageAgent::sendGeolocationError):
        * inspector/InspectorPageAgent.h:
        (WebCore::InspectorPageAgent::geolocationPosition): Getter for
        GeolocationPosition.
        (InspectorPageAgent):
        * inspector/front-end/Settings.js: Added new settings for
        GeolocationPosition and GeolocationError
        * inspector/front-end/SettingsScreen.js: Added new control for
        Geolocaiton.
        (WebInspector.UserAgentSettingsTab):
        (WebInspector.UserAgentSettingsTab.prototype._createDeviceMetricsElement):
        (WebInspector.UserAgentSettingsTab.prototype._onGeolocationOverrideCheckboxClicked):
        (WebInspector.UserAgentSettingsTab.prototype._applyGeolocationUserInput):
        (WebInspector.UserAgentSettingsTab.prototype._setGeolocationPosition.set if):
        (WebInspector.UserAgentSettingsTab.prototype._setGeolocationPosition):
        (WebInspector.UserAgentSettingsTab.prototype._createGeolocationOverrideElement.createInput):
        (WebInspector.UserAgentSettingsTab.prototype._createGeolocationOverrideElement):
        * inspector/front-end/UserAgentSupport.js: New GeolocationPosition
        Object added along with setting helper methods.  Added new setting
        changed handlers for Position and Error.
        (WebInspector.UserAgentSupport.GeolocationPosition):
        (WebInspector.UserAgentSupport.GeolocationPosition.prototype.toSetting):
        (WebInspector.UserAgentSupport.GeolocationPosition.parseSetting):
        (WebInspector.UserAgentSupport.GeolocationPosition.parseUserInput):
        (WebInspector.UserAgentSupport.prototype.get _onGeolocationErrorChanged):

2012-07-10  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Refactor resource revisions before moving to UISourceCode.
        https://bugs.webkit.org/show_bug.cgi?id=90855

        Reviewed by Pavel Feldman.

        Revisions are now persisted based on mainFrame.loaderId, not resource.loaderId which makes filtering out stale persisted revisions easier.
        Restoring revisions from local storage is separated from filtering out stale persisted revisions.
        Resource._clearRevisionHistory and Resource._restoreRevisions are not static anymore.
        Renamed localStorage field for persisting revisions: "resource-history" -> "revision-history"

        * inspector/front-end/Resource.js:
        (WebInspector.Resource):
        (WebInspector.Resource.prototype.addRevision):
        (WebInspector.Resource.prototype._restoreRevisionHistory):
        (WebInspector.Resource.prototype._clearRevisionHistory):
        (WebInspector.Resource.prototype.revertAndClearHistory.clearHistory):
        (WebInspector.Resource.prototype.revertAndClearHistory):
        (WebInspector.Revision):
        (WebInspector.Revision._revisionHistoryRegistry):
        (WebInspector.Revision._ensureStaleRevisionsFileteredOut.persist):
        (WebInspector.Revision._ensureStaleRevisionsFileteredOut):
        (WebInspector.Revision.prototype._persist):
        * inspector/front-end/ResourceTreeModel.js:
        (WebInspector.ResourceTreeModel.prototype._processCachedResources):
        (WebInspector.ResourceTreeModel.prototype._addFramesRecursively):
        * inspector/front-end/RevisionHistoryView.js:
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode.prototype._revisionAdded):

2012-07-10  Alice Cheng  <alice_cheng@apple.com>

        Editing: Reproducible crasher when pasting a 0x0 image into Mail
        https://bugs.webkit.org/show_bug.cgi?id=90640
        <rdar://problem/11141920>

        Reviewed by Brady Eidson.

        0x0 images don't get a resource representation in the WebArchive, so we need a null check

        Test: TestWebKitAPI/Tests/mac/0.png
              TestWebKitAPI/Tests/mac/WebViewCanPasteZeroPng.mm

        * platform/mac/PasteboardMac.mm:
        (WebCore::documentFragmentWithImageResource):

2012-07-10  Nikita Vasilyev  <me@elv1s.ru>

        Web Inspector: Make the Tab character 4 spaces width
        https://bugs.webkit.org/show_bug.cgi?id=90172

        Reviewed by Pavel Feldman.

        Do it to match most code editors' behavior.

        * inspector/front-end/inspectorCommon.css:
        (body):

2012-07-10  Eric Seidel  <eric@webkit.org>

        REGRESSION (r122168): Layout Test http/tests/misc/script-defer.html is failing
        https://bugs.webkit.org/show_bug.cgi?id=90845

        Reviewed by Alexey Proskuryakov.

        I was a bit overzealous in removing bool returns. This one still makes sense.
        This just reverts the wrong part of my previous change.

        * html/parser/HTMLDocumentParser.cpp:
        (WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd):
        * html/parser/HTMLScriptRunner.cpp:
        (WebCore::HTMLScriptRunner::executeScriptsWaitingForParsing):
        * html/parser/HTMLScriptRunner.h:
        (HTMLScriptRunner):

2012-07-10  Kevin Ellis  <kevers@chromium.org>

        Input type=range issue with events not being raised when value set in js
        https://bugs.webkit.org/show_bug.cgi?id=84674

        Fix dispatching of change and click events for the input slider.
        Prior to the fix, change events were not fired if the new value
        matched the value at last change notification based on expected
        behavior for text fields.  Clicks were not fired if the thumb
        element was repositioned under the cursor on mouse down.

        Reviewed by Kent Tamura.

        Tests: fast/events/click-range-slider.html
               fast/events/onchange-range-slider.html

        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::setPositionFromPoint):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMouseReleaseEvent):

2012-07-10  Huang Dongsung  <luxtella@company100.net>

        Don't destroy the decoded data of an image if WebKit is about to render the image.
        https://bugs.webkit.org/show_bug.cgi?id=90721

        Reviewed by Antti Koivisto.

        When the cache capacity of the MemoryCache is exceeded, the decoded data of all
        the CachedImages are destroyed. Even the images inside the viewport are
        destroyed.  However, if the images need to be rendered again due to scoll events
        or animation, they must be decoded again. As an extreme case, if there is an
        animation with an image when MemoryCache is almost full, the image must be
        decoded every frame. This slows down animation and needlessly consumes CPU
        cycles.

        Therefore, it is better to not destory the decoded data of an image if the image
        is inside the viewport because there is high chance that the image needs to be
        rendered again soon. This patch reduces the unnecessary repetition of image decoding
        on low memory, and also relieves the memory fragmentation because it avoids reallocation
        of image frames.

        In addition, there is another positive side effect. Currently,
        CachedImageClient::willRenderImage() is used only to determine if GIF animation needs
        to be paused or not in CachedImage::shouldPauseAnimation(). This patch makes
        GIF animation outside the viewort be paused.

        This is also a prerequisite for parallel image decoders. Because parallel image
        decoders decode an image asynchronously, clients cannot render the image at the time
        when the request is made. Clients can draw the image later after receiving image
        decoding complete notification. However, there is a problem because MemoryCache can
        destroy the decoded data before clients actually render the image. So parallel image decoders
        must prevent the decoded data from being destroyed if the image will be rendered
        soon.

        This patch may consume a little more memory, but furtunately the peak memory usage
        is almost the same.

        No new tests - no new testable functionality.

        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::likelyToBeUsedSoon):
        (WebCore):
        (WebCore::CachedImage::shouldPauseAnimation):
        * loader/cache/CachedImage.h:
        (CachedImage):
        * loader/cache/CachedResource.h:
        (CachedResource):
        (WebCore::CachedResource::likelyToBeUsedSoon):
        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::pruneLiveResourcesToSize):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::willRenderImage):

2012-07-10  Kent Tamura  <tkent@chromium.org>

        RTL calendar picker for <input type=date> is too narrow and clipped
        https://bugs.webkit.org/show_bug.cgi?id=90864

        Reviewed by Kentaro Hara.

        Tests: ManualTests/forms/calendar-picker.html

        * Resources/calendarPicker.js:
        (fixWindowSize):
        Checks the left edge of elemenets in RTL.
        (layout): Add dir=ltr for the manual test, which re-uses the document.

2012-07-10  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r122178.
        http://trac.webkit.org/changeset/122178
        https://bugs.webkit.org/show_bug.cgi?id=90857

        browser tests, PrerenderBrowserTest.PrerenderFavicon and other
        tests, started to fail (Requested by hayato on #webkit).

        * WebCore.exp.in:
        * dom/Document.cpp:
        (WebCore::Document::iconURLs):
        (WebCore::Document::addIconURL):
        (WebCore::Document::setUseSecureKeyboardEntryWhenActive):
        * dom/Document.h:
        (Document):
        * html/HTMLLinkElement.cpp:
        * html/HTMLLinkElement.h:
        (HTMLLinkElement):
        * testing/Internals.cpp:
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-07-10  Adam Barth  <abarth@webkit.org>

        LayoutTestController.dumpConfigurationForViewport should move to Internals
        https://bugs.webkit.org/show_bug.cgi?id=45652

        Reviewed by Eric Seidel.

        This patch replaces LayoutTestController.dumpConfigurationForViewport
        with Internals.configurationForViewport. The old
        dumpConfigurationForViewport function just ended up calling WebCore
        functions anyway, so there's no benefit in implementing the API in the
        LayoutTestController.

        As a result, these tests can now run on every port.

        * testing/Internals.cpp:
        (WebCore::Internals::configurationForViewport):
        (WebCore):
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-07-10  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix GTK+ build after r122175.

        * platform/graphics/texmap/TextureMapperLayer.cpp: Include
        CString.h when using cairo.

2012-07-10  Yoshifumi Inoue  <yosin@chromium.org>

        [Chromium-Mac] Form related layout tests cause timeout
        https://bugs.webkit.org/show_bug.cgi?id=90851

        Reviewed by Kent Tamura.

        This patch changed to pass a valid argument to LocaleMac
        constructor.

        No new tests. No more timeout in tests listed in the bug.

        * platform/text/mac/LocaleMac.mm:
        (WebCore::LocaleMac::currentLocale): Changed to pass local identifier string
        instead of NSLocale object.

2012-07-10  Yuta Kitamura  <yutak@chromium.org>

        WebSocket: Remove hixie76 protocol implementation
        https://bugs.webkit.org/show_bug.cgi?id=88620

        Reviewed by Adam Barth.

        This change removes code that implements the old hixie-76 WebSocket protocol which
        isn't used anymore.

        No new tests are added, because the code using the current protocol should not be
        affected. Tests for hixie-76 protocol are skipped (these tests will be removed
        eventually).

        * Modules/websockets/ThreadableWebSocketChannel.h:
        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
        (WebCore::ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didCreateWebSocketChannel):
        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:
        (ThreadableWebSocketChannelClientWrapper):
        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::WebSocket):
        (WebCore::WebSocket::connect):
        (WebCore::WebSocket::send):
        (WebCore::WebSocket::protocol):
        (WebCore::WebSocket::extensions):
        (WebCore::WebSocket::binaryType):
        (WebCore::WebSocket::setBinaryType):
        (WebCore::WebSocket::didReceiveMessageError):
        (WebCore::WebSocket::didClose):
        (WebCore::WebSocket::getFramingOverhead):
        * Modules/websockets/WebSocket.h:
        * Modules/websockets/WebSocketChannel.cpp:
        (WebCore::WebSocketChannel::WebSocketChannel):
        (WebCore::WebSocketChannel::connect):
        (WebCore::WebSocketChannel::send):
        (WebCore::WebSocketChannel::fail):
        (WebCore::WebSocketChannel::didCloseSocketStream):
        (WebCore::WebSocketChannel::processBuffer):
        (WebCore::WebSocketChannel::startClosingHandshake):
        (WebCore::WebSocketChannel::enqueueTextFrame):
        (WebCore::WebSocketChannel::enqueueRawFrame):
        (WebCore::WebSocketChannel::enqueueBlobFrame):
        (WebCore::WebSocketChannel::processOutgoingFrameQueue):
        (WebCore::WebSocketChannel::abortOutgoingFrameQueue):
        * Modules/websockets/WebSocketChannel.h:
        (WebSocketChannel):
        * Modules/websockets/WebSocketHandshake.cpp:
        (WebCore::WebSocketHandshake::WebSocketHandshake):
        (WebCore::WebSocketHandshake::clientHandshakeMessage):
        (WebCore::WebSocketHandshake::clientHandshakeRequest):
        (WebCore::WebSocketHandshake::readServerHandshake):
        (WebCore::WebSocketHandshake::checkResponseHeaders):
        * Modules/websockets/WebSocketHandshake.h:
        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
        (WebCore::WorkerThreadableWebSocketChannel::WorkerContextDidInitializeTask::create):
        (WebCore::WorkerThreadableWebSocketChannel::WorkerContextDidInitializeTask::WorkerContextDidInitializeTask):
        (WorkerThreadableWebSocketChannel::WorkerContextDidInitializeTask):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::mainThreadInitialize):
        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
        (WorkerThreadableWebSocketChannel):
        (Peer):
        (Bridge):

2012-07-09  Gavin Barraclough  <barraclough@apple.com>

        Threadsafety issues in WebScriptObject
        https://bugs.webkit.org/show_bug.cgi?id=90849

        Reviewed by Filip Pizlo.

        WebScriptObject maintains a NSMap of wrapper objects. A race condition exists
        between a wrapper being retrieved from the map, and being released - if the
        final release on an object is called between a call to getJSWrapper and the
        subsequent retain, we may end up with a stale object reference.

        We can make this safe by hoisting the removal from the map from delloc up into
        release (if the retainCount is 1), and locking release against retrieval from
        the map. Since release may be called from another thread, and NSMap is not
        threadsafe, we'd better lock around all access to the map (this fix already
        necessitates get & remove to be locked, so this just adds 'add', too).

        * bindings/objc/WebScriptObject.mm:
        (WebCore::createJSWrapper):
            - lock around getJSWrapper, retain.
        (-[WebScriptObject _setImp:originRootObject:rootObject:]):
            - lock around addJSWrapper.
        (-[WebScriptObject release]):
            - Added; removeJSWrapper for last release, lock & synchronized vs. getJSWrapper.
        (-[WebScriptObject dealloc]):
            - removeJSWrapper call hoisted into release.

2012-07-09  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] Battery status code needs refactoring to be reused in WebKit2
        https://bugs.webkit.org/show_bug.cgi?id=90760

        Reviewed by Hajime Morita.

        Rename BatteryClientEfl to BatteryProviderEfl and remove dependency
        on BatteryController by introducing the BatteryProviderEflClient
        interface. This will allow reusing the BatteryProviderEfl class
        in WebKit2.

        No new tests. Already tested by batterystatus/*.

        * PlatformEfl.cmake:
        * platform/efl/BatteryProviderEfl.cpp: Renamed from Source/WebCore/platform/efl/BatteryClientEfl.cpp.
        (WebCore):
        (WebCore::BatteryProviderEfl::BatteryProviderEfl):
        (WebCore::BatteryProviderEfl::batteryStatus):
        (WebCore::BatteryProviderEfl::startUpdating):
        (WebCore::BatteryProviderEfl::stopUpdating):
        (WebCore::BatteryProviderEfl::setBatteryStatus):
        (WebCore::BatteryProviderEfl::timerFired):
        (WebCore::BatteryProviderEfl::getBatteryStatus):
        (WebCore::BatteryProviderEfl::setBatteryClient):
        * platform/efl/BatteryProviderEfl.h: Copied from Source/WebCore/platform/efl/BatteryClientEfl.h.
        (WebCore):
        (BatteryProviderEfl):
        (WebCore::BatteryProviderEfl::~BatteryProviderEfl):
        * platform/efl/BatteryProviderEflClient.h: Added.
        (WebCore):
        (BatteryProviderEflClient):

2012-07-09  Hayato Ito  <hayato@chromium.org>

        Unreviewed gardening.
        Fix a wrong fix of r122194.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::decideRenderPassAllocationsForFrame):

2012-07-09  Matt Falkenhagen  <falken@chromium.org>

        Add ENABLE_DIALOG_ELEMENT and skeleton files
        https://bugs.webkit.org/show_bug.cgi?id=90521

        Reviewed by Kent Tamura.

        This adds the ENABLE_DIALOG_ELEMENT feature flag and dummy implementation files for <dialog>. In addition, a runtime feature flag is added.
        The feature is diabled by default.

        No new tests, as there is no behavior change.

        * CMakeLists.txt:
        * Configurations/FeatureDefines.xcconfig:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * DerivedSources.pri:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/generic/RuntimeEnabledFeatures.cpp:
        (WebCore):
        * bindings/generic/RuntimeEnabledFeatures.h: Added a runtime feature flag for dialog.
        (RuntimeEnabledFeatures):
        (WebCore::RuntimeEnabledFeatures::dialogElementEnabled):
        (WebCore::RuntimeEnabledFeatures::setDialogElementEnabled):
        * dom/ContextFeatures.cpp:
        (WebCore::ContextFeatures::dialogElementEnabled):
        (WebCore):
        * dom/ContextFeatures.h: Added a per-context flag for dialog so that dialog can be disabled in HTMLTagNames.in and DOMWindow.idl when the dialog runtime feature flag is off.
        * html/HTMLDialogElement.cpp: Added.
        (WebCore):
        (WebCore::HTMLDialogElement::HTMLDialogElement):
        (WebCore::HTMLDialogElement::create):
        (WebCore::HTMLDialogElement::close):
        (WebCore::HTMLDialogElement::show):
        * html/HTMLDialogElement.h: Added.
        (WebCore):
        (HTMLDialogElement):
        * html/HTMLDialogElement.idl: Added.
        * html/HTMLElementsAllInOne.cpp:
        * html/HTMLTagNames.in:
        * page/DOMWindow.idl:

2012-07-09  Hayato Ito  <hayato@chromium.org>

        Unreviewed gardening.
        Remove an assertion starting to fail on interactive_ui_tests on Chromium OS.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::decideRenderPassAllocationsForFrame):

2012-07-09  Hayato Ito  <hayato@chromium.org>

        Unreviewed gardening.
        Build fix after r122175

        * WebCore.gypi: Remove Source/WebCore/platform/graphics/qt/Extensions3DQt.{cpp,h}

2012-07-09  Kiran Muppala  <cmuppala@apple.com>

        Improve performance of RenderInline::absoluteQuads for deeply nested inlines.
        https://bugs.webkit.org/show_bug.cgi?id=90715

        Reviewed by Maciej Stachowiak.

        No new tests: functionality unchanged.

        * rendering/RenderInline.cpp: Cache transformation from local to absolute coordinates using a
        RenderGeometryMap and use it for subsequent mappings.
        (WebCore::(anonymous namespace)::AbsoluteQuadsGeneratorContext::AbsoluteQuadsGeneratorContext):
        (WebCore::(anonymous namespace)::AbsoluteQuadsGeneratorContext::operator()):

2012-07-09  Yoshifumi Inoue  <yosin@chromium.org>

        [Chromium-Mac] Implement functions for localized time format information
        https://bugs.webkit.org/show_bug.cgi?id=90237

        Reviewed by Kent Tamura.

        This patch introduces following localized time format related
        functions:
          - localizeTimeFormatText()
          - localizeShortTimeFormatText()
          - timeAMPMLabels
        for Mac OSX in feature flag: ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS.

        These function will be used by input type "time" with multiple input
        fields UI.

        Note: ICU version of localized time format functions are implemented
        in https://bugs.webkit.org/show_bug.cgi?id=89965

        Tests: WebKit/chromium/tests/LocaleMacTest.cpp

        * platform/text/mac/LocaleMac.h:
        (LocaleMac): Added time format related functions and variables.
        * platform/text/mac/LocaleMac.mm:
        (WebCore::createDateTimeFormatter): Added. A helper function for creating date time formatter.
        (WebCore::LocaleMac::createShortDateFormatter): Changed to use createDateTimeFormatter.
        (WebCore::LocaleMac::createTimeFormatter): Added.
        (WebCore::LocaleMac::createShortTimeFormatter): Added.
        (WebCore::LocaleMac::timeFormatText): Added.
        (WebCore::LocaleMac::shortTimeFormatText): Added.
        (WebCore::LocaleMac::timeAMPMLabels): Added.

2012-07-09  Alexandru Chiculita  <achicu@adobe.com>

        [CSS Shaders] The FECustomFilter is not making the GL context active
        https://bugs.webkit.org/show_bug.cgi?id=90840

        Reviewed by Dean Jackson.

        I've added a couple of makeContextCurrent() in the FECustomFilter related classes.
        Also, removed the assumption that GraphicsContext3D::create() never returns 0.

        No new tests, this was crashing on existing tests.

        * platform/graphics/filters/CustomFilterCompiledProgram.cpp:
        (WebCore::CustomFilterCompiledProgram::CustomFilterCompiledProgram):
        (WebCore::CustomFilterCompiledProgram::~CustomFilterCompiledProgram):
        * platform/graphics/filters/CustomFilterGlobalContext.cpp:
        (WebCore::CustomFilterGlobalContext::prepareContextIfNeeded):
        * platform/graphics/filters/CustomFilterMesh.cpp:
        (WebCore::CustomFilterMesh::CustomFilterMesh):
        (WebCore::CustomFilterMesh::~CustomFilterMesh):
        * platform/graphics/filters/FECustomFilter.cpp:
        (WebCore::FECustomFilter::deleteRenderBuffers):
        (WebCore::FECustomFilter::platformApplySoftware):
        (WebCore::FECustomFilter::initializeContext):
        * platform/graphics/filters/FECustomFilter.h:
        (FECustomFilter):

2012-07-09  Kent Tamura  <tkent@chromium.org>

        REGRESSION(r114862-r114886): Fix a crash by switching the input type to hidden.
        https://bugs.webkit.org/show_bug.cgi?id=90774

        Reviewed by Andreas Kling.

        Test: fast/forms/hidden/change-type-to-hidden-after-updating-value.html

        * dom/Element.cpp:
        (WebCore::Element::setAttributeInternal):
        Pass a copy of the existing Attribute object.

2012-07-07  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] cache video dimensions
        https://bugs.webkit.org/show_bug.cgi?id=90733

        Reviewed by Martin Robinson.

        Invalidate the cached video dimensions whenever the video-sink sink pad caps
        change and let ::naturalSize() lazily recalculate them.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::naturalSize):
        (WebCore::MediaPlayerPrivateGStreamer::notifyPlayerOfVideo):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
        (MediaPlayerPrivateGStreamer):

2012-07-09  Eric Penner  <epenner@google.com>

        [chromium] Merge updates and idle updates into one pass
        https://bugs.webkit.org/show_bug.cgi?id=90324

        Reviewed by Adrienne Walker.

        We no longer need to do painting is passes in order
        to allocate memory in the right order. So this merges
        updates and idle updates into one pass.

        Covered by existing unit tests (some of which are
        updated with this patch).

        * platform/graphics/chromium/ContentLayerChromium.cpp:
        (WebCore::ContentLayerChromium::needMoreUpdates):
        * platform/graphics/chromium/ContentLayerChromium.h:
        (ContentLayerChromium):
        * platform/graphics/chromium/LayerChromium.h:
        (WebCore::LayerChromium::needMoreUpdates):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::updateTiles):
        (WebCore::TiledLayerChromium::updateLayerRect):
        * platform/graphics/chromium/TiledLayerChromium.h:
        (TiledLayerChromium):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::compositeAndReadback):
        (WebCore::CCLayerTreeHost::updateLayers):
        (WebCore::CCLayerTreeHost::paintMasksForRenderSurface):
        (WebCore::CCLayerTreeHost::paintLayerContents):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHost):

2012-07-09  Yoshifumi Inoue  <yosin@chromium.org>

        [Platform] Introduce LocaleMac class
        https://bugs.webkit.org/show_bug.cgi?id=90248

        Reviewed by Kent Tamura.

        This patch moves implementation of localized date format related
        functions into LocaleMac class as of LocaleWin class for ease of
        maintain and using specific locale in testing rather than system
        default locale.

        Tests: WebKit/chromium/tests/LocaleMacTest.cpp

        * WebCore.gyp/WebCore.gyp: Include LocaleMac.mm
        * WebCore.gypi:
        * platform/text/mac/LocaleMac.h: Replace LocaleWin to LocaleMac.
        * platform/text/mac/LocaleMac.mm:
        (WebCore::LocaleMac::LocaleMac):
        (WebCore::LocaleMac::~LocaleMac):
        (WebCore::LocaleMac::create):
        (WebCore::LocaleMac::currentLocale):
        (WebCore::LocaleMac::createShortDateFormatter):
        (WebCore::LocaleMac::parseDate):
        (WebCore::LocaleMac::formatDate):
        (WebCore::LocaleMac::dateFormatText):
        (WebCore::LocaleMac::monthLabels):
        (WebCore::LocaleMac::weekDayShortLabels):
        (WebCore::LocaleMac::firstDayOfWeek):
        * platform/text/mac/LocalizedDateMac.cpp:
        (WebCore::parseLocalizedDate):
        (WebCore::formatLocalizedDate):
        (WebCore::localizedDateFormatText):
        (WebCore::monthLabels):
        (WebCore::weekDayShortLabels):
        (WebCore::firstDayOfWeek):
        * platform/text/mac/LocalizedDateMac.mm: Removed.

2012-07-09  Dana Jansens  <danakj@chromium.org>

        [chromium] Create CCScopedTexture class for creating/freeing textures
        https://bugs.webkit.org/show_bug.cgi?id=89485

        Reviewed by Adrienne Walker.

        This class provides a standard way to create texture ids in a way that
        ensures they will be freed later.

        Also includes a CCTexture base class that holds textureId, size, and
        format together in a struct that can be used in place of storing an
        unsigned textureId in other classes.

        Unit tests: CCScopedTexureTest.NewScopedTexture
                    CCScopedTexureTest.CreateScopedTexture
                    CCScopedTexureTest.ScopedTextureIsDeleted
                    CCScopedTexureTest.LoseScopedTexture

        * WebCore.gypi:
        * platform/graphics/chromium/cc/CCScopedTexture.cpp: Added.
        (WebCore):
        (WebCore::CCScopedTexture::CCScopedTexture):
        (WebCore::CCScopedTexture::~CCScopedTexture):
        (WebCore::CCScopedTexture::allocate):
        (WebCore::CCScopedTexture::free):
        (WebCore::CCScopedTexture::leak):
        * platform/graphics/chromium/cc/CCScopedTexture.h: Added.
        (WebCore):
        (CCScopedTexture):
        (WebCore::CCScopedTexture::create):
        * platform/graphics/chromium/cc/CCTexture.cpp: Added.
        (WebCore):
        (WebCore::CCTexture::setDimensions):
        (WebCore::CCTexture::bytes):
        (WebCore::CCTexture::memorySizeBytes):
        * platform/graphics/chromium/cc/CCTexture.h: Added.
        (WebCore):
        (CCTexture):
        (WebCore::CCTexture::CCTexture):
        (WebCore::CCTexture::id):
        (WebCore::CCTexture::size):
        (WebCore::CCTexture::format):
        (WebCore::CCTexture::setId):

2012-07-09  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: deleteDatabase fails if transaction running in other database
        https://bugs.webkit.org/show_bug.cgi?id=90822

        Reviewed by Tony Chang.

        The IDBLevelDBBackingStore was preventing a deleteDatabase() from running
        if any other database was running a transaction. Fix by just creating a scratch
        LevelDBTransaction for the delete steps.

        Test: storage/indexeddb/deletedatabase-transaction.html

        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
        (WebCore::IDBLevelDBBackingStore::deleteDatabase): Use a LevelDBTransaction
        directly.

2012-07-09  Pete Williamson  <petewil@google.com>

        Changed the behavior of iconURLs to always recalculate the list.
        https://bugs.webkit.org/show_bug.cgi?id=88665

        Reviewed by Kent Tamura..

        As it turns out, it can contain stale URLs in the case that some script
        manipulates the DOM, which breaks scripts trying to reset the favicon
        URL. Also added a method in Internals to allow tests to get the list of
        icon

        Tests: fast/dom/icon-url-change.html
               fast/dom/icon-url-list.html

        * WebCore.exp.in: export Document::iconURLs on the mac for the Internals class
        * dom/Document.cpp:
        (WebCore::Document::iconURLs): Changed the method to recalculate the iconURL list every time
        (WebCore::Document::addIconURL): we no longer need to add to the internal list since we recalculate it
        (WebCore::Document::setUseSecureKeyboardEntryWhenActive): removed extra whitespace
        * dom/Document.h:
        (Document): removed the addIconURL method which is no longer used
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::iconType): exposed the icon type with an accessor
        (WebCore):
        (WebCore::HTMLLinkElement::iconSizes): exposed the icon sizes with an accessor
        * html/HTMLLinkElement.h:
        (HTMLLinkElement): declared the icon type and size accessors
        * testing/Internals.cpp:
        (WebCore::Internals::iconURLs): made a method to be used by unit tests for inspecting the icon URL list
        (WebCore):
        * testing/Internals.h:
        (Internals): declared the method for unit testing the icon URL list
        * testing/Internals.idl: exported the Document::iconURLs function

2012-07-09  Ryosuke Niwa  <rniwa@webkit.org>

        Gcc build fix after r122174.

        * storage/StorageAreaImpl.cpp:
        (WebCore::StorageAreaImpl::decrementAccessCount):

2012-07-09  Alice Cheng  <alice_cheng@apple.com>

        Editing: Autocorrection in blockquotes causes text to break out of quote
        https://bugs.webkit.org/show_bug.cgi?id=90487
        <rdar://problem/11769020> 

        Reviewed by Enrica Casucci.

        Test: platform/mac/editing/spelling/autocorrection-blockquote-crash.html

        SpellingCorrectionCommand uses ReplaceSelectionCommand to replace the misspelled word with the auto-corrected word. Specifically, ReplaceSelectionCommand does a smart copy, where it breaks out of blockquotes. Thus, the fix is to substitute ReplaceSelectionCommand with InserTextCommand.

        * editing/SpellingCorrectionCommand.cpp:
        (WebCore::SpellingCorrectionCommand::doApply):

2012-07-09  No'am Rosenthal  <noam.rosenthal@nokia.com>

        Shared code that is guarded with ENABLE(WEBGL) should be guarded with USE()
        https://bugs.webkit.org/show_bug.cgi?id=90506

        Reviewed by Martin Robinson.

        GraphicsContext3D, ANGLEWebKitBridge and Extensions3D are now guarded with USE(3D_GRAPHICS)
        instead of ENABLE(WEBGL).

        No new tests, build changes only.

        * Target.pri:
            Removed references to unused files.

        * WebCore.pri:
            Updated the Qt build so that the basic 3D-graphics sources can be compiled even when
            WebGL is disabled.

        * platform/graphics/ANGLEWebKitBridge.cpp:
        * platform/graphics/GraphicsContext3D.cpp:
        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        * platform/qt/QWebPageClient.h:
        * platform/graphics/OpenGLShims.cpp:
        * platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp:
        * platform/graphics/cairo/DrawingBufferCairo.cpp:
        * platform/graphics/cairo/GLContext.h:
        (GLContext):
        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
        * platform/graphics/cairo/GraphicsContext3DPrivate.cpp:
        * platform/graphics/cg/GraphicsContext3DCG.cpp:
        * platform/graphics/clutter/DrawingBufferClutter.cpp:
        * platform/graphics/clutter/GraphicsContext3DClutter.cpp:
        * platform/graphics/clutter/GraphicsContext3DPrivate.cpp:
        * platform/graphics/efl/GraphicsContext3DEfl.cpp:
        * platform/graphics/efl/GraphicsContext3DPrivate.cpp:
        * platform/graphics/filters/CustomFilterCompiledProgram.cpp:
        * platform/graphics/filters/CustomFilterCompiledProgram.h:
        * platform/graphics/filters/CustomFilterGlobalContext.cpp:
        * platform/graphics/filters/CustomFilterGlobalContext.h:
        * platform/graphics/filters/CustomFilterMesh.cpp:
        * platform/graphics/filters/CustomFilterMesh.h:
        * platform/graphics/filters/CustomFilterProgram.cpp:
        (WebCore):
        * platform/graphics/filters/CustomFilterProgram.h:
        * platform/graphics/filters/FECustomFilter.cpp:
        * platform/graphics/filters/FECustomFilter.h:
        * platform/graphics/glx/GLContextGLX.cpp:
        (WebCore):
        * platform/graphics/glx/GLContextGLX.h:
        (GLContextGLX):
        * platform/graphics/gpu/DrawingBuffer.cpp:
        * platform/graphics/gpu/mac/DrawingBufferMac.mm:
        * platform/graphics/gpu/qt/DrawingBufferQt.cpp:
        * platform/graphics/mac/GraphicsContext3DMac.mm:
        * platform/graphics/qt/Extensions3DQt.cpp: Removed.
        * platform/graphics/qt/Extensions3DQt.h: Removed.
        * platform/graphics/skia/GraphicsContext3DSkia.cpp:
        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
            Chaned ENABLE(WEBGL) to USE(3D_GRAPHICS)

2012-07-09  Yongjun Zhang  <yongjun_zhang@apple.com>

        Consider closing unused localStorage database after a timeout.
        https://bugs.webkit.org/show_bug.cgi?id=90713

        For a localStorage, if there is no active document referencing to it for certain amount of time (300 seconds),
        we can close the underlying sqlite database.

        Reviewed by Brady Eidson.

        Test: storage/domstorage/storage-close-database-on-idle.html

        * storage/Storage.cpp:
        (WebCore::Storage::Storage): increment storageArea access count when a DOMWindow is referencing it.
        (WebCore::Storage::~Storage): decrement storageArea access count when DOMWindow is done with it.
        * storage/StorageArea.h:
        (StorageArea):
        * storage/StorageAreaImpl.cpp:
        (WebCore::StorageAreaImpl::StorageAreaImpl):
        (WebCore::StorageAreaImpl::incrementAccessCount):
        (WebCore):
        (WebCore::StorageAreaImpl::decrementAccessCount): schedule closeDatabaseTimer if there is no active document
            referencing to this storageArea.
        (WebCore::StorageAreaImpl::closeDatabaseTimerFired): close the underlying sqlite database.
        * storage/StorageAreaImpl.h:
        (StorageAreaImpl):
        * storage/StorageAreaSync.cpp:
        (WebCore::StorageAreaSync::sync): if m_syncCloseDatabase flag is set and the database is not opened, bail out.
        * storage/StorageTracker.cpp:
        (WebCore):
        (WebCore::StorageTracker::StorageTracker):
        * storage/StorageTracker.h:
        (WebCore::StorageTracker::storageDatabaseIdleInterval):
        (WebCore::StorageTracker::setStorageDatabaseIdleInterval):  set the timeout value that we will wait before closing the
            database.  This is currently used by DumpRenderTree only.
        (StorageTracker):

2012-07-09  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: A null or undefined storeNames argument to IDBDatabase::transaction() should be coerced to string
        https://bugs.webkit.org/show_bug.cgi?id=90474

        Reviewed by Tony Chang.

        Test: storage/indexeddb/transaction-basics.html

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::transaction):
        * Modules/indexeddb/IDBDatabase.idl:

2012-07-09  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Remove obsolete accessor plumbing
        https://bugs.webkit.org/show_bug.cgi?id=90812

        Reviewed by Tony Chang.

        No new tests - just deleting code.

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::IDBTransaction): Since backend mode() is disconnected, can no
        longer assert that front-end/back-end modes match; not worth it to keeping the plumbing.

2012-07-09  Dana Jansens  <danakj@chromium.org>

        [chromium] Remove HashMap workaround for layers with id=0 in CCDamageTracker
        https://bugs.webkit.org/show_bug.cgi?id=90825

        Reviewed by Adrienne Walker.

        Layer ids are no longer allowed to be 0, and the behaviour is guarded
        with asserts, so this workaround is not needed any longer.

        * platform/graphics/chromium/cc/CCDamageTracker.h:
        (CCDamageTracker):

2012-07-09  Vincent Scheib  <scheib@chromium.org>

        Pointer Lock requestPointerLock rejects locking an element not in a document.
        https://bugs.webkit.org/show_bug.cgi?id=90821

        Reviewed by Adrienne Walker.

        Test: pointer-lock/lock-element-not-in-dom.html

        * page/PointerLockController.cpp:
        (WebCore::PointerLockController::requestPointerLock):

2012-07-09  Eric Seidel  <eric@webkit.org>

        document.write of scripts that also document.write sometimes writes async
        https://bugs.webkit.org/show_bug.cgi?id=89102

        Reviewed by Adam Barth.

        When a script tag is first encountered, the TreeBuilder holds the element and returns
        out to the outer HTMLDocumentParser parse loop.  The HTMLDocumentParser then takes
        the script element and passes it to the HTMLScriptRunner for execution. However, if the
        script is an "external script" the HTMLScriptRunner may have to wait for that parser
        blocking script to load, and may store the script in its own m_parserBlockingScript member.

        While the HTMLScriptRunner has this not-yet-loaded-script the parser is also blocked.
        Because the "paused" state of the parser was held as a separate bool on the TreeBuilder
        we'd have to be careful to update it to reflect the current state of this pending script
        on the HTMLScriptRunner.

        This patch removes this separate "paused" bool and makes the HTMLDocumentParser responsible
        for the "paused" state of the parser through the isWaitingForScripts() function which
        knows how to check both the TreeBuilder and the ScriptRunner for possible parser-blocking scripts.

        I suspect this change may actually fix a bunch of edge cases where we were not
        checking for the HTMLScriptRunner's parser blocking script and thus incorrectly ending
        the parser, or not starting the pre-load scanner, etc.

        As part of this change I also renamed m_haveParsingBlockingScript in HTMLScriptRunner to match
        the naming style used elsewhere in the parser, as well as removed all the "bool" return values
        for these parse/execute functions as they are no longer useful (or correct). The correct way
        is always to check HTMLDocumentParser::isWaitingForScripts().

        Test: fast/parser/cached-script-document-write.html

        * html/parser/HTMLDocumentParser.cpp:
        (WebCore::HTMLDocumentParser::pumpTokenizerIfPossible):
        (WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder):
        (WebCore::HTMLDocumentParser::canTakeNextToken):
        (WebCore::HTMLDocumentParser::isWaitingForScripts):
        (WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution):
        (WebCore::HTMLDocumentParser::notifyFinished):
        (WebCore::HTMLDocumentParser::executeScriptsWaitingForStylesheets):
        * html/parser/HTMLScriptRunner.cpp:
        (WebCore::HTMLScriptRunner::~HTMLScriptRunner):
        (WebCore::HTMLScriptRunner::executeParsingBlockingScript):
        (WebCore::HTMLScriptRunner::execute):
        (WebCore::HTMLScriptRunner::hasParserBlockingScript):
        (WebCore::HTMLScriptRunner::executeParsingBlockingScripts):
        (WebCore::HTMLScriptRunner::executeScriptsWaitingForLoad):
        (WebCore::HTMLScriptRunner::executeScriptsWaitingForParsing):
        (WebCore::HTMLScriptRunner::requestParsingBlockingScript):
        (WebCore::HTMLScriptRunner::runScript):
        * html/parser/HTMLScriptRunner.h:
        (HTMLScriptRunner):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
        (WebCore::HTMLTreeBuilder::takeScriptToProcess):
        (WebCore::HTMLTreeBuilder::processEndTag):
        (WebCore::HTMLTreeBuilder::processTokenInForeignContent):
        * html/parser/HTMLTreeBuilder.h:
        (HTMLTreeBuilder):
        (WebCore::HTMLTreeBuilder::hasParserBlockingScript):

2012-07-09  Ryosuke Niwa  <rniwa@webkit.org>

        Microdata tests are flaky
        https://bugs.webkit.org/show_bug.cgi?id=90830

        Reviewed by Antti Koivisto.

        The bug was caused by SpaceSplitString's not copying on write properly.
        Even if there was exactly one owner of the SpaceSplitString, we should still not modify
        m_data since m_data is associated with a particular m_keyString in sharedDataMap().

        The only situation in which we can safely modify m_data is when m_data's m_keyString is null
        meaning that it had been unique'ed. Furthermore, this optimization had not been used for
        class lists because class list's refCount is always zero as its ref and deref are forwarded
        to the associated Element's ref and deref. This fix re-enables the optimization for class lists.

        This behavior change is tested by existing microdata API tests. Without this patch,
        some tests such as properties-collection-add-remove-property.html fail on the first run
        when several tests were ran in the same WebKit instance.

        * dom/SpaceSplitString.h:
        (WebCore::SpaceSplitStringData::isUnique):
        (WebCore::SpaceSplitString::ensureUnique):

2012-07-09  Dana Jansens  <danakj@chromium.org>

        [chromium] Decouple RenderPass drawing from CCRenderSurface
        https://bugs.webkit.org/show_bug.cgi?id=90573

        Reviewed by Adrienne Walker.

        Removes the managed textures from CCRenderSurface and stores them in a
        HashMap in LayerRendererChromium.

        At the start of a frame, all textures for the frame are reserved, and
        unneeded textures are deleted. After each quad is drawn, evicted textures
        (ie temporary textures used for background filters) are deleted to keep
        within memory limits. At the end of the frame, all surface contents
        textures are kept reserved and thus not deleted.

        We add a numeric identifier to CCRenderPass which can be used to
        identify the pass across serialization in the future, and is used
        in the interface to LayerRendererChromium. Also we add to the
        CCRenderPass a contentsChangedSinceLastFrame() flag so that the
        value does not need to be retrieved from the CCRenderSurface.

        The pointer from CCRenderPass to CCRenderSurface remains for some
        code in the CCLayerTreeHostImpl, and will be addressed in the future, but
        the pointer is no longer used at all while drawing a frame inside
        LayerRendererChromium.

        Covered by existing tests, no intended change in behaviour.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::releaseRenderPassTextures):
        (WebCore::LayerRendererChromium::decideRenderPassAllocationsForFrame):
        (WebCore):
        (WebCore::LayerRendererChromium::haveCachedResourcesForRenderPassId):
        (WebCore::LayerRendererChromium::drawQuad):
        (WebCore::LayerRendererChromium::drawBackgroundFilters):
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
        (WebCore::LayerRendererChromium::finishDrawingFrame):
        (WebCore::LayerRendererChromium::useRenderPass):
        (WebCore::LayerRendererChromium::initializeSharedObjects):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::CCLayerTreeHostImpl::removePassesWithCachedTextures):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::create):
        (WebCore::CCRenderPass::CCRenderPass):
        * platform/graphics/chromium/cc/CCRenderPass.h:
        (CCRenderPass):
        (WebCore::CCRenderPass::id):
        (WebCore::CCRenderPass::setFramebufferOutputRect):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
        (WebCore::CCRenderPassDrawQuad::create):
        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
        (CCRenderPassDrawQuad):
        (WebCore::CCRenderPassDrawQuad::renderPassId):
        (WebCore::CCRenderPassDrawQuad::contentsChangedSinceLastFrame):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::appendQuads):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (WebCore):
        (CCRenderSurface):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (CCRenderer):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
        (WebCore::CCTiledLayerImpl::pushTileProperties):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
        (CCTiledLayerImpl):

2012-07-09  Adam Klein  <adamk@chromium.org>

        Rename WebCore::WebKitMutationObserver to WebCore::MutationObserver
        https://bugs.webkit.org/show_bug.cgi?id=90810

        Reviewed by Ojan Vafai.

        This is in preparation for removing the vendor prefix from the
        MutationObserver constructor on Window (currently it's called
        WebKitMutationObserver). Doing the WebCore-internal rename first
        makes that change a much smaller one, which is especially useful
        because there's ongoing discussion of when the prefix should be
        removed from the web-facing API.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * GNUmakefile.list.am:
        * Target.pri:
        * UseJSC.cmake:
        * UseV8.cmake:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSMainThreadExecState.cpp:
        (WebCore::JSMainThreadExecState::didLeaveScriptContext):
        * bindings/js/JSMutationCallbackCustom.cpp:
        (WebCore::JSMutationCallback::handleEvent):
        * bindings/js/JSMutationObserverCustom.cpp: Renamed from Source/WebCore/bindings/js/JSWebKitMutationObserverCustom.cpp.
        (WebCore):
        (WebCore::JSMutationObserverConstructor::constructJSMutationObserver):
        * bindings/v8/V8RecursionScope.cpp:
        (WebCore::V8RecursionScope::didLeaveScriptContext):
        * bindings/v8/custom/V8MutationCallbackCustom.cpp:
        (WebCore::V8MutationCallback::handleEvent):
        * bindings/v8/custom/V8MutationObserverCustom.cpp: Renamed from Source/WebCore/bindings/v8/custom/V8WebKitMutationObserverCustom.cpp.
        (WebCore):
        (WebCore::V8MutationObserver::constructorCallback):
        * dom/CharacterData.cpp:
        * dom/ChildListMutationScope.h:
        (WebCore::ChildListMutationScope::ChildListMutationScope):
        * dom/DOMAllInOne.cpp:
        * dom/Document.h:
        (WebCore::Document::hasMutationObserversOfType):
        * dom/Element.cpp:
        * dom/MutationCallback.h:
        (WebCore):
        (MutationCallback):
        * dom/MutationCallback.idl:
        * dom/MutationObserver.cpp: Renamed from Source/WebCore/dom/WebKitMutationObserver.cpp.
        (WebCore):
        (WebCore::MutationObserver::ObserverLessThan::operator()):
        (WebCore::MutationObserver::create):
        (WebCore::MutationObserver::MutationObserver):
        (WebCore::MutationObserver::~MutationObserver):
        (WebCore::MutationObserver::validateOptions):
        (WebCore::MutationObserver::observe):
        (WebCore::MutationObserver::takeRecords):
        (WebCore::MutationObserver::disconnect):
        (WebCore::MutationObserver::observationStarted):
        (WebCore::MutationObserver::observationEnded):
        (WebCore::activeMutationObservers):
        (WebCore::MutationObserver::enqueueMutationRecord):
        (WebCore::MutationObserver::setHasTransientRegistration):
        (WebCore::MutationObserver::deliver):
        (WebCore::MutationObserver::deliverAllMutations):
        * dom/MutationObserver.h: Renamed from Source/WebCore/dom/WebKitMutationObserver.h.
        (WebCore):
        (MutationObserver):
        * dom/MutationObserver.idl: Renamed from Source/WebCore/dom/WebKitMutationObserver.idl.
        * dom/MutationObserverInterestGroup.cpp:
        (WebCore::MutationObserverInterestGroup::createIfNeeded):
        (WebCore::MutationObserverInterestGroup::MutationObserverInterestGroup):
        (WebCore::MutationObserverInterestGroup::isOldValueRequested):
        (WebCore::MutationObserverInterestGroup::enqueueMutationRecord):
        * dom/MutationObserverInterestGroup.h:
        (WebCore::MutationObserverInterestGroup::createForChildListMutation):
        (WebCore::MutationObserverInterestGroup::createForCharacterDataMutation):
        (WebCore::MutationObserverInterestGroup::createForAttributesMutation):
        (MutationObserverInterestGroup):
        * dom/MutationObserverRegistration.cpp:
        (WebCore::MutationObserverRegistration::create):
        (WebCore::MutationObserverRegistration::MutationObserverRegistration):
        (WebCore::MutationObserverRegistration::shouldReceiveMutationFrom):
        * dom/MutationObserverRegistration.h:
        (MutationObserverRegistration):
        (WebCore::MutationObserverRegistration::isSubtree):
        (WebCore::MutationObserverRegistration::observer):
        (WebCore::MutationObserverRegistration::deliveryOptions):
        (WebCore::MutationObserverRegistration::mutationTypes):
        * dom/Node.cpp:
        (WebCore::Node::collectMatchingObserversForMutation):
        (WebCore::Node::getRegisteredMutationObserversOfType):
        (WebCore::Node::registerMutationObserver):
        * dom/Node.h:
        (Node):
        * dom/NodeRareData.h:
        * page/DOMWindow.idl:

2012-07-09  Filip Pizlo  <fpizlo@apple.com>

        Unreviewed, rolling out http://trac.webkit.org/changeset/122116 and http://trac.webkit.org/changeset/122119

        * GNUmakefile.list.am:
        * PlatformBlackBerry.cmake:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/GraphicsContext3D.h:
        (WebCore):
        * platform/graphics/OpenGLESShims.h:
        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
        (WebCore):
        * platform/graphics/clutter/GraphicsContext3DClutter.cpp:
        (WebCore):
        * platform/graphics/mac/GraphicsContext3DMac.mm:
        (WebCore):
        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
        (WebCore::Extensions3DOpenGL::Extensions3DOpenGL):
        (WebCore::Extensions3DOpenGL::supports):
        (WebCore):
        (WebCore::Extensions3DOpenGL::ensureEnabled):
        (WebCore::Extensions3DOpenGL::isEnabled):
        (WebCore::Extensions3DOpenGL::getGraphicsResetStatusARB):
        (WebCore::Extensions3DOpenGL::getTranslatedShaderSourceANGLE):
        (WebCore::Extensions3DOpenGL::copyTextureCHROMIUM):
        * platform/graphics/opengl/Extensions3DOpenGL.h:
        (Extensions3DOpenGL):
        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:
        * platform/graphics/opengl/Extensions3DOpenGLCommon.h:
        * platform/graphics/opengl/Extensions3DOpenGLES.cpp:
        * platform/graphics/opengl/Extensions3DOpenGLES.h:
        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
        (WebCore):
        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
        (WebCore::systemAllowsMultisamplingOnATICards):
        (WebCore):
        (WebCore::GraphicsContext3D::validateAttributes):
        (WebCore::GraphicsContext3D::compileShader):
        (WebCore::GraphicsContext3D::readPixels):
        (WebCore::GraphicsContext3D::releaseShaderCompiler):
        (WebCore::GraphicsContext3D::getExtensions):
        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
        (WebCore::GraphicsContext3D::readPixelsAndConvertToBGRAIfNecessary):
        (WebCore::GraphicsContext3D::reshapeFBOs):
        (WebCore):
        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        (WebCore):

2012-07-09  Ryosuke Niwa  <rniwa@webkit.org>

        Build fix after r122115 and some cleanups.

        * html/HTMLCollection.h:
        (HTMLCollection):
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::properties):
        * html/HTMLElement.h:
        (HTMLElement):
        * html/HTMLPropertiesCollection.cpp:
        (WebCore::HTMLPropertiesCollection::HTMLPropertiesCollection):
        * html/HTMLPropertiesCollection.h:
        (HTMLPropertiesCollection):

2012-07-09  Dean Jackson  <dino@apple.com>

        Tiled drawing means some elements can disappear behind the page
        https://bugs.webkit.org/show_bug.cgi?id=88906

        Reviewed by Simon Fraser.

        The compositing layers in the tile cache could become siblings
        of the compositing layers for page elements. This meant that in
        some 3d transforms, the elements could disappear behind the
        page background (which is rendered into the tile cache) or intersect
        with the tile cache tiles.

        Fix this by inserting a flattening layer between the tile cache
        and the page, ensuring that the cache will always be rendered
        first. I was able to reuse the clipping layer for this, because
        the tile cache is attached to the RenderView, so there should never
        be a case where we have both a clipping layer and tiles.

        The unfortunate part of this code is the temporary state variable
        that wraps the call to GraphicsLayer::create. Because that method
        calls back into the object, we need to make sure we don't create
        another tile cache.

        Also added some obvious names to the tile cache layers to
        help with debugging.

        Test: compositing/tile-cache-must-flatten.html

        * platform/graphics/ca/mac/TileCache.mm:
        (WebCore::TileCache::TileCache): give the tile host layer a name.
        (WebCore::TileCache::createTileLayer):
        * platform/graphics/ca/mac/WebTileCacheLayer.mm:
        (WebCore): give each tile layer a name.
        * rendering/RenderLayerBacking.cpp:
        (WebCore):
        (WebCore::RenderLayerBacking::shouldUseTileCache): check if we're in the middle
        of creating the primary graphics layer before answering.
        (WebCore::RenderLayerBacking::createPrimaryGraphicsLayer): wrap our call to
        createGraphicsLayer with a message to indicate we are making the layer that should
        get a tile cache.
        (WebCore::RenderLayerBacking::destroyGraphicsLayers):
        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): needs to make
        sure the flattening layer is in the tree.
        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
        (WebCore::RenderLayerBacking::updateInternalHierarchy):
        (WebCore::RenderLayerBacking::updateClippingLayers):
        (WebCore::RenderLayerBacking::backingStoreMemoryEstimate):
        * rendering/RenderLayerBacking.h: rename m_clippingLayer to m_containmentLayer
        because it can now either be the clip or the tile cache flattener. Also
        a new state property used when creating the main graphics layer.
        (WebCore::RenderLayerBacking::hasClippingLayer):
        (WebCore::RenderLayerBacking::clippingLayer):
        (WebCore::RenderLayerBacking::parentForSublayers):
        (WebCore::RenderLayerBacking::hasTileCacheFlatteningLayer):
        (WebCore::RenderLayerBacking::tileCacheFlatteningLayer):
        (RenderLayerBacking):

2012-07-09  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] Log significant Gamepad API-related events
        https://bugs.webkit.org/show_bug.cgi?id=90595

        Reviewed by Antonio Gomes.

        Log significant Gamepad API-related events in
        GamepadsEfl.

        No new tests, no behavior change.

        * platform/efl/GamepadsEfl.cpp:
        (WebCore::GamepadDeviceEfl::deviceFile):
        (GamepadDeviceEfl):
        (WebCore::GamepadDeviceEfl::GamepadDeviceEfl):
        (WebCore::GamepadDeviceEfl::readCallback):
        (WebCore::GamepadsEfl::registerDevice):
        (WebCore::GamepadsEfl::unregisterDevice):

2012-07-09  Simon Fraser  <simon.fraser@apple.com>

        Reduce the amount of flashing when falling into tiled layers
        https://bugs.webkit.org/show_bug.cgi?id=90808

        Reviewed by Dean Jackson.

        Implement +prefetchedTiles so that CATiledLayer renders more
        tiles at a time, reducing the appearance of flashing.

        * platform/graphics/mac/WebTiledLayer.mm:
        (+[WebTiledLayer prefetchedTiles]):

2012-07-09  Leandro Gracia Gil  <leandrogracia@chromium.org>

        SurroundingText should not advance character iterators if they are at end.
        https://bugs.webkit.org/show_bug.cgi?id=90560

        Reviewed by Ryosuke Niwa.

        CharacterIterator and BackwardsCharacterIterator try to advance their
        internal TextIterator without checking if they already are at end.
        This can cause crashes in TextIterator::advance.

        Test: platform/chromium/editing/surrounding-text/surrounding-text.html

        * editing/SurroundingText.cpp:
        (WebCore::SurroundingText::SurroundingText):
        (WebCore::SurroundingText::rangeFromContentOffsets):

2012-07-09  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>

        [EFL] [WK2] Ecore errors from ecore_evas_screen_geometry_get()
        https://bugs.webkit.org/show_bug.cgi?id=90609

        Reviewed by Daniel Bates.

        Do not call ecore_evas_screen_geometry_get() if ecoreEvas is null.

        No new tests. This patch doesn't change behavior.

        * platform/efl/PlatformScreenEfl.cpp:
        (WebCore::screenRect): Early return if Evas is null.

2012-07-09  Alexandru Chiculita  <achicu@adobe.com>

        [CSS Filters] Blur filter is not repainted correctly when applied on a parent of a fixed element
        https://bugs.webkit.org/show_bug.cgi?id=90087

        Reviewed by Simon Fraser.

        Added a new method, RenderLayer::hasAncestorWithFilterOutsets, to check that there's no filter with outsets (ie. blur) 
        applied on top level fixed positioned elements, nor any of its parent layers. In the event of a blur filter we need to
        disable the fast scrolling optimization, otherwise the outsets of the filter will be carried around the page and 
        repainting will not work correctly.

        Tests: css3/filters/blur-filter-page-scroll-parents.html
               css3/filters/blur-filter-page-scroll-self.html

        * page/FrameView.cpp:
        (WebCore::FrameView::scrollContentsFastPath):
        * rendering/RenderLayer.cpp:
        (WebCore):
        (WebCore::RenderLayer::hasAncestorWithFilterOutsets):
        * rendering/RenderLayer.h:
        (RenderLayer):

2012-07-09  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Empty arrays shouldn't be valid key paths
        https://bugs.webkit.org/show_bug.cgi?id=90798

        Reviewed by Tony Chang.

        Other IDB implementations already enforce this although it is not yet in 
        the spec (see https://www.w3.org/Bugs/Public/show_bug.cgi?id=17657). If an
        empty array is passed as the key path arg to IDBDatabase.createObjectStore()
        or IDBObjectStore.createIndex(), a SYNTAX_ERR DOMException is now thrown.

        Test: storage/indexeddb/keypath-arrays.html
              storage/indexeddb/keypath-basics.html

        * Modules/indexeddb/IDBKeyPath.cpp:
        (WebCore::IDBKeyPath::isValid): Test for empty array.

2012-07-09  Dana Jansens  <danakj@chromium.org>

        [chromium] Create render surfaces on main thread only for the current frame
        https://bugs.webkit.org/show_bug.cgi?id=89793

        Reviewed by Adrienne Walker.

        Previously we would create render surfaces for animating layers
        in the main thread since these layers might have a surface on impl,
        in order to assist culling. This makes it very difficult to estimate
        how much texture memory is needed for RenderSurfaces on the main
        thread, in order to keep contents+surface memory below our limit.

        Here we stop doing this, and create RenderSurfaces on both threads
        under the same conditions, so main thread has surfaces only if the
        layers in its current frame demand them. While this may reduce
        paint culling within an animating subtree, this seems like an edge
        case and knowing the amount of surface memory needed for the frame
        is important.

        Animation tests in CCLayerTreeHostCommonTest used to verify that these
        layers got surfaces, so now no longer do. Creation of surfaces under
        other conditions is covered by other CCLayerTreeHostCommonTests.

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::subtreeShouldRenderToSeparateSurface):

2012-07-09  Ryosuke Niwa  <rniwa@webkit.org>

        Mac build fix after r122116.

        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:

2012-07-09  Ryosuke Niwa  <rniwa@webkit.org>

        EFL build fix after r122115.

        * html/HTMLPropertiesCollection.cpp:
        (WebCore::HTMLPropertiesCollection::create):

2012-07-09  Joshua Netterfield  <jnetterfield@rim.com>
        Make GC3D and E3D more maintainable for GLES platforms
        https://bugs.webkit.org/show_bug.cgi?id=90567

        Reviewed by Rob Buis.

        This patch cleans up code for WebGL on OpenGLES platforms which use 
        GraphicsContext3DOpenGL* and Extensions3DOpenGL*. Although
        GraphicsContext3DOpenGL was already split into GraphicsContext3DOpenGL,
        GraphicsContext3DOpenGLCommon, and  GraphicsContext3DOpenGLES, this patch
        is an attempt to refactor this code in a way that will help BlackBerry and
        other teams support WebGL on mobile platforms with as little use of
        "#IF USE(OPENGL_ES_2)" in common code as possible. Also included is the
        separation of Extensions3DOpenGL into Extensions3DOpenGLCommon,
        Extensions3DOpenGL, and Extensions3DOpenGLES as well as the introduction
        of OpenGLESShims.

        This patch is created in large part by Jonathan Feldstein.

        No new tests: no new behaviour.

        * PlatformBlackBerry.cmake: Recognize BlackBerry as OPENGL ES, add new files to build
        * Target.pri: Add new Extensions3DOpenGL* to WebGL builds
        * platform/graphics/GraphicsContext3D.h: Add validateDepthStencil, make systemAllowsMultisamplingOnATICards a a member function.
        (WebCore):
        * platform/graphics/OpenGLESShims.h: Added.
        * platform/graphics/opengl/Extensions3DOpenGL.cpp: Move code to Extensions3DOpenGLCommon where possible
        (WebCore::Extensions3DOpenGL::Extensions3DOpenGL): Reflect that it is now inherits Extensions3DCommon
        (WebCore::Extensions3DOpenGL::supportsExtension): Contains OpenGL specific code from supports
        (WebCore):
        (WebCore::Extensions3DOpenGL::getExtensions): Returns a list of extensions
        * platform/graphics/opengl/Extensions3DOpenGL.h: Remove functions now in Extensions3DOpenGLCommon
        (WebCore):
        (Extensions3DOpenGL):
        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp: Added.
        (WebCore):
        (WebCore::Extensions3DOpenGLCommon::Extensions3DOpenGLCommon):
        (WebCore::Extensions3DOpenGLCommon::~Extensions3DOpenGLCommon):
        (WebCore::Extensions3DOpenGLCommon::supports):
        (WebCore::Extensions3DOpenGLCommon::ensureEnabled):
        (WebCore::Extensions3DOpenGLCommon::isEnabled):
        (WebCore::Extensions3DOpenGLCommon::getGraphicsResetStatusARB):
        (WebCore::Extensions3DOpenGLCommon::getTranslatedShaderSourceANGLE): Existed before, but did nothing. Now does what is says it does.
        (WebCore::Extensions3DOpenGLCommon::initializeAvailableExtensions): Moved from Extensions3DOpenGL::supports
        * platform/graphics/opengl/Extensions3DOpenGLCommon.h: Copied from Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h.
        (WebCore):
        (Extensions3DOpenGLCommon):
        * platform/graphics/opengl/Extensions3DOpenGLES.cpp: Added.
        (WebCore):
        (WebCore::Extensions3DOpenGLES::Extensions3DOpenGLES):
        (WebCore::Extensions3DOpenGLES::~Extensions3DOpenGLES):
        (WebCore::Extensions3DOpenGLES::framebufferTexture2DMultisampleIMG):
        (WebCore::Extensions3DOpenGLES::renderbufferStorageMultisampleIMG):
        (WebCore::Extensions3DOpenGLES::createVertexArrayOES):
        (WebCore::Extensions3DOpenGLES::deleteVertexArrayOES):
        (WebCore::Extensions3DOpenGLES::isVertexArrayOES):
        (WebCore::Extensions3DOpenGLES::bindVertexArrayOES):
        (WebCore::Extensions3DOpenGLES::supportsExtension): Contains OpenGLES specific code from supports
        (WebCore::Extensions3DOpenGLES::getExtensions):
        * platform/graphics/opengl/Extensions3DOpenGLES.h: Copied from Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h.
        (WebCore):
        (Extensions3DOpenGLES):
        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
        (WebCore::GraphicsContext3D::validateAttributes):
        (WebCore):
        (WebCore::GraphicsContext3D::renderbufferStorage):
        (WebCore::GraphicsContext3D::texImage2D):
        (WebCore::GraphicsContext3D::systemAllowsMultisamplingOnATICards): Now a member function.
        (WebCore::GraphicsContext3D::getExtensions):
        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
        (WebCore::GraphicsContext3D::validateDepthStencil):
        (WebCore::GraphicsContext3D::clear):
        (WebCore::GraphicsContext3D::isTexture):
        (WebCore):
        (WebCore::GraphicsContext3D::lineWidth):
        (WebCore::GraphicsContext3D::linkProgram):
        (WebCore::GraphicsContext3D::pixelStorei):
        (WebCore::GraphicsContext3D::polygonOffset):
        (WebCore::GraphicsContext3D::readPixels):
        (WebCore::GraphicsContext3D::deleteBuffer):
        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
        (WebCore::GraphicsContext3D::releaseShaderCompiler):
        (WebCore::GraphicsContext3D::readPixelsAndConvertToBGRAIfNecessary):
        (WebCore::GraphicsContext3D::validateAttributes):
        (WebCore):
        (WebCore::GraphicsContext3D::getExtensions):
        (WebCore::GraphicsContext3D::systemAllowsMultisamplingOnATICards): Now a member function.
        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        (WebCore):
        (WebCore::GraphicsContext3D::releaseShaderCompiler):

2012-07-02  Ryosuke Niwa  <rniwa@webkit.org>

        Make HTMLCollection RefCounted
        https://bugs.webkit.org/show_bug.cgi?id=90414

        Reviewed by Sam Weinig.

        Make HTMLCollection ref counted and stop forwarding ref and deref to its owner (m_base)
        so as to align its life time management to that of DynamicNodeList.

        After this patch, each HTMLCollection is owned by JSC/V8 and m_cachedCollections in ElementRareData
        and m_collection in Document merely hold raw pointers for the caching purpose. These raw pointers
        are cleared when each HTMLCollection is destructed via corresponding removeCachedHTMLCollection's.

        In the destructor of HTMLCollection, we use the CollectionType to decide whether base() is an element
        or an document, and call the appropriate removeCachedHTMLCollection except for WindowNamedItems and
        DocumentNamedItems. For those two types, we need to know the atomic string name associated with
        the collection just like many DynamicNodeList to remove the cache, so we let HTMLNameCollection
        directly call removeWindowNamedItemCache and removeDocumentNamedItemCache. We'll cleanup this mess in
        a follow up patch using a nice class hierarchy and virtual destructors.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::getDocumentLinks):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::namedItemGetter):
        * bindings/js/JSHTMLDocumentCustom.cpp:
        (WebCore::JSHTMLDocument::nameGetter):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::V8DOMWindow::namedPropertyGetter):
        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore::Document::openSearchDescriptionURL):
        (WebCore):
        (WebCore::Document::cachedCollection):
        (WebCore::Document::removeCachedHTMLCollection):
        (WebCore::Document::images):
        (WebCore::Document::applets):
        (WebCore::Document::embeds):
        (WebCore::Document::plugins):
        (WebCore::Document::objects):
        (WebCore::Document::scripts):
        (WebCore::Document::links):
        (WebCore::Document::forms):
        (WebCore::Document::anchors):
        (WebCore::Document::all):
        (WebCore::Document::windowNamedItems):
        (WebCore::Document::documentNamedItems):
        (WebCore::Document::removeWindowNamedItemCache):
        (WebCore::Document::removeDocumentNamedItemCache):
        * dom/Document.h:
        (Document):
        * dom/Element.cpp:
        (WebCore::Element::ensureCachedHTMLCollection):
        (WebCore::ElementRareData::ensureCachedHTMLCollection):
        (WebCore::Element::removeCachedHTMLCollection):
        (WebCore):
        * dom/Element.h:
        (Element):
        * dom/ElementRareData.h:
        (ElementRareData):
        (WebCore::ElementRareData::cachedHTMLCollection):
        (WebCore::ElementRareData::removeCachedHTMLCollection):
        * html/CollectionType.h:
        (WebCore): Since WindowNamedItems is not a part of UnnamedDocumentCachedType, we shouldn't addd 1.
        (WebCore::isUnnamedDocumentCachedType):
        (WebCore::isNodeCollectionType):
        * html/HTMLAllCollection.cpp:
        (WebCore::HTMLAllCollection::create):
        * html/HTMLAllCollection.h:
        (HTMLAllCollection):
        * html/HTMLCollection.cpp:
        (WebCore::HTMLCollection::create):
        (WebCore::HTMLCollection::~HTMLCollection):
        (WebCore::HTMLCollection::itemAfter):
        * html/HTMLCollection.h:
        (WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase):
        (HTMLCollection):
        (WebCore::HTMLCollection::base):
        * html/HTMLDataListElement.cpp:
        (WebCore::HTMLDataListElement::options):
        * html/HTMLDataListElement.h:
        (HTMLDataListElement):
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::children):
        (WebCore::HTMLElement::properties):
        * html/HTMLElement.h:
        (HTMLElement):
        * html/HTMLFieldSetElement.cpp:
        (WebCore::HTMLFieldSetElement::elements):
        * html/HTMLFieldSetElement.h:
        (HTMLFieldSetElement):
        * html/HTMLFormCollection.cpp:
        (WebCore::HTMLFormCollection::create):
        * html/HTMLFormCollection.h:
        (HTMLFormCollection):
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::elements):
        * html/HTMLFormElement.h:
        (HTMLFormElement):
        * html/HTMLMapElement.cpp:
        (WebCore::HTMLMapElement::imageElement):
        (WebCore::HTMLMapElement::areas):
        * html/HTMLMapElement.h:
        (HTMLMapElement):
        * html/HTMLNameCollection.cpp:
        (WebCore::HTMLNameCollection::HTMLNameCollection):
        (WebCore::HTMLNameCollection::~HTMLNameCollection):
        (WebCore):
        * html/HTMLNameCollection.h:
        (WebCore::HTMLNameCollection::create):
        (HTMLNameCollection):
        * html/HTMLOptionsCollection.cpp:
        (WebCore::HTMLOptionsCollection::create):
        * html/HTMLOptionsCollection.h:
        (HTMLOptionsCollection):
        * html/HTMLPropertiesCollection.h:
        (HTMLPropertiesCollection):
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::selectedOptions):
        (WebCore::HTMLSelectElement::options):
        * html/HTMLSelectElement.h:
        (HTMLSelectElement):
        * html/HTMLTableElement.cpp:
        (WebCore::HTMLTableElement::rows):
        (WebCore::HTMLTableElement::tBodies):
        * html/HTMLTableElement.h:
        (HTMLTableElement):
        * html/HTMLTableRowElement.cpp:
        (WebCore::HTMLTableRowElement::insertCell):
        (WebCore::HTMLTableRowElement::deleteCell):
        (WebCore::HTMLTableRowElement::cells):
        * html/HTMLTableRowElement.h:
        (HTMLTableRowElement):
        * html/HTMLTableRowsCollection.cpp:
        (WebCore::HTMLTableRowsCollection::create):
        * html/HTMLTableRowsCollection.h:
        (HTMLTableRowsCollection):
        * html/HTMLTableSectionElement.cpp:
        (WebCore::HTMLTableSectionElement::insertRow):
        (WebCore::HTMLTableSectionElement::deleteRow):
        (WebCore::HTMLTableSectionElement::rows):
        * html/HTMLTableSectionElement.h:
        (HTMLTableSectionElement):

2012-07-09  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: unindent line ending block upon { hit.
        https://bugs.webkit.org/show_bug.cgi?id=90795

        Reviewed by Vsevolod Vlasov.

        Added block-start / block-end markup into the highlighter.

        * inspector/front-end/SourceCSSTokenizer.js:
        (WebInspector.SourceCSSTokenizer.prototype.nextToken):
        * inspector/front-end/SourceCSSTokenizer.re2js:
        * inspector/front-end/SourceJavaScriptTokenizer.js:
        (WebInspector.SourceJavaScriptTokenizer.prototype.nextToken):
        * inspector/front-end/SourceJavaScriptTokenizer.re2js:
        * inspector/front-end/TextEditor.js:
        (WebInspector.TextEditorMainPanel.prototype._applyDomUpdates):
        (WebInspector.TextEditorMainPanel.prototype._unindentAfterBlock):

2012-07-09  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r122107.
        http://trac.webkit.org/changeset/122107
        https://bugs.webkit.org/show_bug.cgi?id=90794

        Build failure on Mac debug bots (Requested by falken_ on
        #webkit).

        * CMakeLists.txt:
        * Configurations/FeatureDefines.xcconfig:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * DerivedSources.pri:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/generic/RuntimeEnabledFeatures.cpp:
        (WebCore):
        * bindings/generic/RuntimeEnabledFeatures.h:
        (RuntimeEnabledFeatures):
        * dom/ContextFeatures.cpp:
        * dom/ContextFeatures.h:
        * html/HTMLDialogElement.cpp: Removed.
        * html/HTMLDialogElement.h: Removed.
        * html/HTMLDialogElement.idl: Removed.
        * html/HTMLElementsAllInOne.cpp:
        * html/HTMLTagNames.in:
        * page/DOMWindow.idl:

2012-07-09  Andrei Onea  <onea@adobe.com>

        [CSSRegions] Rename NamedFlow::getRegionsByContentNode to NamedFlow::getRegionsByContent
        https://bugs.webkit.org/show_bug.cgi?id=90759

        Reviewed by Andreas Kling.

        Renamed NamedFlow::getRegionsByContentNode to NamedFlow::getRegionsByContent as per CSS Regions spec:
        http://www.w3.org/TR/css3-regions/#dom-named-flow

        Tests: fast/regions/get-regions-by-content-horiz-bt.html
               fast/regions/get-regions-by-content-horiz-tb.html
               fast/regions/get-regions-by-content-vert-lr.html
               fast/regions/get-regions-by-content-vert-rl.html
               fast/regions/get-regions-by-content.html
               fast/regions/get-regions-by-content2.html

        * dom/WebKitNamedFlow.cpp:
        (WebCore::WebKitNamedFlow::getRegionsByContent):
        * dom/WebKitNamedFlow.h:
        (WebKitNamedFlow):
        * dom/WebKitNamedFlow.idl:

2012-07-09  Matt Falkenhagen  <falken@chromium.org>

        Add ENABLE_DIALOG_ELEMENT and skeleton files
        https://bugs.webkit.org/show_bug.cgi?id=90521

        Reviewed by Kent Tamura.

        This adds the ENABLE_DIALOG_ELEMENT feature flag and dummy implementation files for <dialog>. In addition, a runtime feature flag is added.
        The feature is diabled by default.

        No new tests, as there is no behavior change.

        * CMakeLists.txt:
        * Configurations/FeatureDefines.xcconfig:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * DerivedSources.pri:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/generic/RuntimeEnabledFeatures.cpp:
        (WebCore):
        * bindings/generic/RuntimeEnabledFeatures.h: Added a runtime feature flag for dialog.
        (RuntimeEnabledFeatures):
        (WebCore::RuntimeEnabledFeatures::dialogElementEnabled):
        (WebCore::RuntimeEnabledFeatures::setDialogElementEnabled):
        * dom/ContextFeatures.cpp:
        (WebCore::ContextFeatures::dialogElementEnabled):
        (WebCore):
        * dom/ContextFeatures.h: Added a per-context flag for dialog so that dialog can be disabled in HTMLTagNames.in and DOMWindow.idl when the dialog runtime feature flag is off.
        * html/HTMLDialogElement.cpp: Added.
        (WebCore):
        (WebCore::HTMLDialogElement::HTMLDialogElement):
        (WebCore::HTMLDialogElement::create):
        (WebCore::HTMLDialogElement::close):
        (WebCore::HTMLDialogElement::show):
        * html/HTMLDialogElement.h: Added.
        (WebCore):
        (HTMLDialogElement):
        * html/HTMLDialogElement.idl: Added.
        * html/HTMLElementsAllInOne.cpp:
        * html/HTMLTagNames.in:
        * page/DOMWindow.idl:

2012-07-09  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: inspector does not reflect newly created text nodes from contenteditable
        https://bugs.webkit.org/show_bug.cgi?id=90779

        Reviewed by Vsevolod Vlasov.

        We need to report first text node as inserted, otherwise we fail to report character data modified on it.

        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::characterDataModified):

2012-07-09  Andrey Kosyakov  <caseq@chromium.org>

        REGRESSION(r121980) Layout Test inspector/timeline/timeline-frames.html started to crash.
        https://bugs.webkit.org/show_bug.cgi?id=90747

        Reviewed by Pavel Feldman.

        - consider didCancelFrame() call normal if there is no pending frame, remove assertion;
        - always set empty data object for frame records;

        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::didCancelFrame):
        (WebCore::InspectorTimelineAgent::commitFrameRecord):

2012-07-09  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Add FileContentView for FileSystemView
        https://bugs.webkit.org/show_bug.cgi?id=90529

        Adding FileContentView to Inspector.
        This class provides preview of text files in FileSystem.

        Reviewed by Vsevolod Vlasov.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/FileContentView.js: Added.
        * inspector/front-end/FileSystemView.js:
        (WebInspector.FileSystemView.prototype.get visibleView):
        (WebInspector.FileSystemView.EntryTreeElement.prototype.onselect):
        (WebInspector.FileSystemView.EntryTreeElement.prototype._directoryContentReceived):
        (WebInspector.FileSystemView.EntryTreeElement.prototype.refresh):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:

2012-07-09  Carlos Garcia Campos  <cgarcia@igalia.com>

        [SOUP] Use soup_cookie_jar_is_persistent() to set whether cookie is a session one or not
        https://bugs.webkit.org/show_bug.cgi?id=90769

        Reviewed by Gustavo Noronha Silva.

        It's currently set to false, because there were no API to know
        whether cookies were persistent or not. Now that we bumped libsoup
        requirements, we can use soup_cookie_jar_is_persistent().

        * platform/network/soup/CookieJarSoup.cpp:
        (WebCore::getRawCookies):

2012-07-09  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Add text file support for FileSystemAgent::requestFileContent
        https://bugs.webkit.org/show_bug.cgi?id=90439

        Reviewed by Vsevolod Vlasov.

        * inspector/Inspector.json:
        * inspector/InspectorFileSystemAgent.cpp:
        (WebCore):
        (WebCore::InspectorFileSystemAgent::requestFileContent):
        * inspector/InspectorFileSystemAgent.h:
        (InspectorFileSystemAgent):
        * inspector/front-end/FileSystemModel.js:
        (WebInspector.FileSystemModel.prototype.requestFileContent):
        (WebInspector.FileSystemModel.File.prototype.requestFileContent):
        (WebInspector.FileSystemRequestManager.prototype._fileContentReceived):
        (WebInspector.FileSystemDispatcher.prototype.fileContentReceived):

2012-07-09  MORITA Hajime  <morrita@google.com>

        [Chromium] ContextFeaturesClient::isEnabled is slow
        https://bugs.webkit.org/show_bug.cgi?id=90367

        Reviewed by Kent Tamura.

        * dom/ContextFeatures.h:
        (WebCore::ContextFeaturesClient::urlDidChange): Added.
        (WebCore::ContextFeatures::urlDidChange): Added.
        (WebCore):
        * dom/Document.cpp:
        (WebCore::Document::setURL): Added an urlDidChange() call.

2012-07-09  Andrei Onea  <onea@adobe.com>

        [CSSRegions] Implement NamedFlow::firstEmptyRegionIndex attribute
        https://bugs.webkit.org/show_bug.cgi?id=90608

        Reviewed by Andreas Kling.

        Implemented NamedFlow::firstEmptyRegionIndex as per spec: http://www.w3.org/TR/css3-regions/#dom-named-flow

        Test: fast/regions/webkit-named-flow-first-empty-region-index.html

        * dom/WebKitNamedFlow.cpp:
        (WebCore::WebKitNamedFlow::firstEmptyRegionIndex):
        (WebCore):
        * dom/WebKitNamedFlow.h:
        (WebKitNamedFlow):
        * dom/WebKitNamedFlow.idl:

2012-07-08  Yoshifumi Inoue  <yosin@chromium.org>

        [Platform-Mac] Derive LocaleMac.{cpp,h} and LocalizedDateMac.cpp from LocaleWin
        https://bugs.webkit.org/show_bug.cgi?id=90752

        Reviewed by Kent Tamura.

        This patch is preparation of introducing LocaleMac class for localize date form.
        This patch copies LocaleWin and LocalizedDateWin.cpp as below:
         - LocaleMac.h from LocaleWin.h
         - LocaleMac.mm from LocaliedDateMac.mm
         - LocaliedDateMac.cpp from LocalizedDateWin.cpp

        Due by git, diffs are appeared as new thing. I'll do svn copy at landing time.

        No new tests. This patch doesn't change behavior.

        * platform/text/mac/LocaleMac.h: Copied from platform/text/LocaleWin.h
        * platform/text/mac/LocaleMac.mm: Copied from platform/text/mac/LocalizedDateMac.mm
        * platform/text/mac/LocalizedDateMac.cpp: Copied from platform/text/LocalizedDateWin.cpp

2012-07-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Introduce a build flag for low quality JPEG images
        https://bugs.webkit.org/show_bug.cgi?id=90748

        Reviewed by Adam Barth.

        Introduce build options for no JPEG dithering (USE(LOW_QUALITY_IMAGE_NO_JPEG_DITHERING))
        and no JPEG fancy upsampling (USE(LOW_QUALITY_IMAGE_NO_JPEG_FANCY_UPSAMPLING)).

        No new tests as there is no change in functionality.

        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
        (ditherMode):
        (doFancyUpsampling):

2012-07-08  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r121968.
        http://trac.webkit.org/changeset/121968
        https://bugs.webkit.org/show_bug.cgi?id=90749

        Caused a link error on chromium Win dbg. (Requested by hayato
        on #webkit).

        * inspector/InspectorMemoryAgent.cpp:
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.MemoryBlockViewProperties._initialize):
        * platform/MemoryUsageSupport.cpp:
        * platform/MemoryUsageSupport.h:
        (MemoryUsageSupport):
        * platform/chromium/MemoryUsageSupportChromium.cpp:

2012-07-08  Mary Wu  <mary.wu@torchmobile.com.cn>

        [BlackBerry] Make setForceDownload a setter method.
        https://bugs.webkit.org/show_bug.cgi?id=90591

        Reviewed by Rob Buis.

        * platform/network/blackberry/ResourceRequest.h:
        (WebCore::ResourceRequest::setForceDownload):

2012-07-05  MORITA Hajime  <morrita@google.com>

        Heap-use-after-free in WebCore::RenderObject::destroyAndCleanupAnonymousWrappers
        https://bugs.webkit.org/show_bug.cgi?id=90480

        Reviewed by Kent Tamura.

        If <select> has any insertion point, the attachment phase
        unpextedly creates a renderer for distributed node and added to
        the renderer of the <select>, which breaks an assumption and
        results the crash.

        This change tighten the childShouldCreateRenderer() to forbid
        child renderers even from distributed nodes.

        There is an exception as always: ValidationMessage can create a
        ShadowRoot to <select>, which generates usually-forbidden child
        renderers.  This change introduces HTMLFormControlElement::validationMessageContains()
        to let these renderers in.

        Test: fast/dom/shadow/insertion-point-list-menu-crash.html

        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::validationMessageContains):
        (WebCore):
        * html/HTMLFormControlElement.h:
        (HTMLFormControlElement):
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::childShouldCreateRenderer):
        * html/ValidationMessage.cpp:
        (WebCore::ValidationMessage::contains):
        (WebCore):
        * html/ValidationMessage.h:
        (WebCore):
        (ValidationMessage):

2012-07-07  Kwang Yul Seo  <skyul@company100.net>

        Remove unnecessary member HTMLTreeBuilder::m_lastScriptElementStartPosition
        https://bugs.webkit.org/show_bug.cgi?id=90726

        Reviewed by Adam Barth.

        HTMLTreeBuilder::m_lastScriptElementStartPosition is of no use. Currently,
        m_lastScriptElementStartPosition is used to store the text position in
        "script" start tag, and then the stored position is passed to m_scriptToProcessStartPosition
        later in "script" end tag. Because HTMLTreeBuilder handles one script tag at
        a time, we can store the text position directly to m_scriptToProcessStartPosition
        in "script" start tag.

        No behavior change, so no new tests.

        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
        (WebCore::HTMLTreeBuilder::processEndTag):
        (WebCore::HTMLTreeBuilder::processScriptStartTag):
        * html/parser/HTMLTreeBuilder.h:
        (HTMLTreeBuilder):

2012-07-08  Philip Rogers  <pdr@google.com>

        Refactor RenderSVGShape to not contain fallback code
        https://bugs.webkit.org/show_bug.cgi?id=90514

        Reviewed by Nikolas Zimmermann.

        The interaction between RenderSVGShape and {RenderSVGEllipse, RenderSVGRect}
        was too coupled and it was not clear when a path existed or who controlled
        falling back to path codepaths in RenderSVGShape.

        This patch cleans up RenderSVGShape so that it does not track fallback state
        and does not have special handling for creating a shape in strokeContains. Because
        some functions of RenderSVGShape can be called without a path existing, each
        of these functions has switched to using the path() function which asserts that
        a path exists.

        There is only one remaining use of hasPath() in RenderSVGShape which I plan
        to remove in a followup patch.

        This patch also cleans up RenderSVGRect and RenderSVGEllipse. These classes
        now handle fallback tracking themselves and choose when to use their optimized
        strokeContains codepaths.

        No new tests as this is just a refactoring.

        * rendering/svg/RenderSVGEllipse.cpp:
        (WebCore::RenderSVGEllipse::RenderSVGEllipse):
        (WebCore::RenderSVGEllipse::createShape):
        (WebCore::RenderSVGEllipse::objectBoundingBox):
        (WebCore::RenderSVGEllipse::strokeBoundingBox):
        (WebCore::RenderSVGEllipse::fillShape):
        (WebCore::RenderSVGEllipse::strokeShape):
        (WebCore::RenderSVGEllipse::shapeDependentStrokeContains):
        (WebCore::RenderSVGEllipse::shapeDependentFillContains):
        * rendering/svg/RenderSVGEllipse.h:
        (WebCore::RenderSVGEllipse::isEmpty):
        (RenderSVGEllipse):
        * rendering/svg/RenderSVGRect.cpp:
        (WebCore::RenderSVGRect::RenderSVGRect):
        (WebCore::RenderSVGRect::createShape):
        (WebCore::RenderSVGRect::objectBoundingBox):
        (WebCore::RenderSVGRect::strokeBoundingBox):
        (WebCore::RenderSVGRect::fillShape):
        (WebCore::RenderSVGRect::strokeShape):
        (WebCore::RenderSVGRect::shapeDependentStrokeContains):
        (WebCore::RenderSVGRect::shapeDependentFillContains):
        * rendering/svg/RenderSVGRect.h:
        (WebCore::RenderSVGRect::isEmpty):
        (RenderSVGRect):
        * rendering/svg/RenderSVGShape.cpp:
        (WebCore::RenderSVGShape::RenderSVGShape):
        (WebCore::RenderSVGShape::createShape):
        (WebCore::RenderSVGShape::isEmpty):
        (WebCore::RenderSVGShape::objectBoundingBox):
        (WebCore::RenderSVGShape::shapeDependentStrokeContains):
        (WebCore::RenderSVGShape::shapeDependentFillContains):
        (WebCore::RenderSVGShape::strokeContains):
        (WebCore::RenderSVGShape::layout):
        (WebCore::RenderSVGShape::hasSmoothStroke):
        (WebCore):
        * rendering/svg/RenderSVGShape.h:
        (RenderSVGShape):

2012-07-08  Kinuko Yasuda  <kinuko@chromium.org>

        XHR.send should support ArrayBufferView
        https://bugs.webkit.org/show_bug.cgi?id=90536

        XHR.send should support ArrayBufferView according to the latest draft
        and also eventually deprecate ArrayBuffer.
        Spec: http://dvcs.w3.org/hg/xhr/raw-file/tip/Overview.html#dom-xmlhttprequest-send

        Reviewed by Kenneth Russell.

        Test: http/tests/xmlhttprequest/send-array-buffer.html
              http/tests/xmlhttprequest/send-data-view.html

        * bindings/js/JSXMLHttpRequestCustom.cpp:
        (WebCore::JSXMLHttpRequest::send):
        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
        (WebCore::V8XMLHttpRequest::sendCallback):
        * xml/XMLHttpRequest.cpp:
        (WebCore):
        (WebCore::XMLHttpRequest::send):
        * xml/XMLHttpRequest.h:
        (XMLHttpRequest):
        * xml/XMLHttpRequest.idl:

2012-07-08  Vivek Galatage  <vivekgalatage@gmail.com>

        Web Inspector: CodeGeneratorInspector.py should not generate statements with no effect
        https://bugs.webkit.org/show_bug.cgi?id=90697

        Reviewed by Vsevolod Vlasov.

        Fix to remove the statements with no effect. The check for errors is added only when some valid
        statements exist.

        No new tests as generator related patch.

        * inspector/CodeGeneratorInspector.py:
        (Generator.process_command):

2012-07-06  Lauro Neto  <lauro.neto@openbossa.org>

        [Qt] Avoid deep copy of QImage in GraphicsContext3D::getImageData()
        https://bugs.webkit.org/show_bug.cgi?id=90705

        Reviewed by Noam Rosenthal.

        Use QImage.constBits() as argument to packPixels instead of bits() to avoid
        deep copying it.

        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        (WebCore::GraphicsContext3D::getImageData):

2012-07-06  Andy Estes  <aestes@apple.com>

        Fix errors reported by generate-bindings.pl after r121882.

        * DerivedSources.make: Specify the correct path for notifications idl
        files now that notifications/ lives in WebCore/Modules/.

2012-07-06  Justin Novosad  <junov@chromium.org>

        Drawing to accelerated 2D canvas causes compositor to recompute layer tree
        https://bugs.webkit.org/show_bug.cgi?id=90630

        Reviewed by Simon Fraser.

        No new tests: covered by existing canvas/compositing layout tests

        Before this change, there was no distinction between canvas changes
        that require recomputing the compositor tree and canvas changes that
        only require re-display. The new CanvasPixelsChanged member of enum
        ContentChangeType requests re-display without re-layout.

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::didDraw):
        * rendering/RenderBoxModelObject.h:
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::contentChanged):

2012-07-06  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: get rid of this._lastMarkedRange in TextEditor.
        https://bugs.webkit.org/show_bug.cgi?id=90691

        Reviewed by Vsevolod Vlasov.

        We don't need it, should use setSelection instead.

        * inspector/front-end/TextEditor.js:
        (WebInspector.TextEditor.prototype.markAndRevealRange):
        (WebInspector.TextEditor.prototype._handleSelectionChange):
        (WebInspector.TextEditor.prototype.setSelection):
        (WebInspector.TextEditor.prototype._handleFocused):

2012-07-06  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Snippet renaming behavior is not correct.
        https://bugs.webkit.org/show_bug.cgi?id=90689

        Reviewed by Pavel Feldman.

        Navigator overlay is now not closed when editing is canceled.
        Esc handler in NavigatorOverlayController is not installed as a shortcut anymore since
        it should not be called until all underlying DOM elements handled the key down event.

        * inspector/front-end/NavigatorOverlayController.js:
        (WebInspector.NavigatorOverlayController.prototype.set showNavigatorOverlay):
        (WebInspector.NavigatorOverlayController.prototype._keyDown):
        (WebInspector.NavigatorOverlayController.prototype._innerHideNavigatorOverlay):
        * inspector/front-end/NavigatorView.js:
        (WebInspector.NavigatorView.prototype.rename.commitHandler):
        (WebInspector.NavigatorView.prototype.rename.cancelHandler):
        (WebInspector.NavigatorView.prototype.rename.afterEditing):
        * inspector/front-end/ScriptsNavigator.js:
        (WebInspector.ScriptsNavigator):
        (WebInspector.ScriptsNavigator.prototype._itemRenamingRequested):
        (WebInspector.SnippetsNavigatorView.prototype._handleRenameSnippet):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._itemRenamingRequested.callback):
        (WebInspector.ScriptsPanel.prototype._itemRenamingRequested):

2012-07-06  Andreas Kling  <kling@webkit.org>

        Separate mutating CSSStyleDeclaration operations.
        <http://webkit.org/b/89945>

        Reviewed by Antti Koivisto.

        Use separate paths for mutating the StylePropertySet wrapped by a CSSStyleDeclaration.
        PropertySetCSSStyleDeclaration now has:

            - propertySet() const
            - ensureMutablePropertySet()

        This is prep work for supporting immutable ElementAttributeData objects, the idea being
        that calling ensureMutablePropertySet() may cause the element to convert its internal
        attribute storage (which also holds the inline StylePropertySet.)

        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::length):
        (WebCore::PropertySetCSSStyleDeclaration::item):
        (WebCore::PropertySetCSSStyleDeclaration::cssText):
        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValue):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValue):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyPriority):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyShorthand):
        (WebCore::PropertySetCSSStyleDeclaration::isPropertyImplicit):
        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValueInternal):
        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
        (WebCore::PropertySetCSSStyleDeclaration::copy):
        (WebCore::PropertySetCSSStyleDeclaration::makeMutable):
        (WebCore::PropertySetCSSStyleDeclaration::cssPropertyMatches):
        (WebCore::InlineCSSStyleDeclaration::didMutate):
        (WebCore::InlineCSSStyleDeclaration::ensureMutablePropertySet):
        * css/PropertySetCSSStyleDeclaration.h:
        (PropertySetCSSStyleDeclaration):
        (WebCore::PropertySetCSSStyleDeclaration::propertySet):
        (WebCore::PropertySetCSSStyleDeclaration::ensureMutablePropertySet):

2012-07-06  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: text editor scrolls 2px horizontally as one navigates the source code.
        https://bugs.webkit.org/show_bug.cgi?id=90682

        Reviewed by Vsevolod Vlasov.

        Removing the hack that is glueing the scroller to the left.

        * inspector/front-end/TextEditor.js:
        (WebInspector.TextEditor.prototype._updatePanelOffsets):
        (WebInspector.TextEditorChunkedPanel.prototype._scroll):
        * inspector/front-end/textEditor.css:

2012-07-06  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: get rid of cancellable records in Timeline, manage frame records explicitly
        https://bugs.webkit.org/show_bug.cgi?id=90684

        Reviewed by Pavel Feldman.

        - drop handling of "cancelable" records;
        - keep frame record until other records come (or frame is canceled)

        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::didBeginFrame):
        (WebCore::InspectorTimelineAgent::didCancelFrame):
        (WebCore::InspectorTimelineAgent::addRecordToTimeline):
        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
        (WebCore::InspectorTimelineAgent::commitFrameRecord):
        (WebCore::InspectorTimelineAgent::clearRecordStack):
        * inspector/InspectorTimelineAgent.h:
        (WebCore::InspectorTimelineAgent::TimelineRecordEntry::TimelineRecordEntry):
        (TimelineRecordEntry):
        (InspectorTimelineAgent):

2012-07-06  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Add native memory used by GlyphCache to the snapshot
        https://bugs.webkit.org/show_bug.cgi?id=90615

        Reviewed by Yury Semikhatsky.

        * inspector/InspectorMemoryAgent.cpp:
        (MemoryBlockName):
        (WebCore):
        (WebCore::addPlatformComponentsInfo):
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.MemoryBlockViewProperties._initialize):
        * platform/MemoryUsageSupport.cpp:
        (WebCore::MemoryUsageSupport::memoryUsageByComponents):
        (WebCore):
        * platform/MemoryUsageSupport.h:
        (MemoryUsageSupport):
        (ComponentInfo):
        (WebCore::MemoryUsageSupport::ComponentInfo::ComponentInfo):
        * platform/chromium/MemoryUsageSupportChromium.cpp:
        (WebCore::glyphCacheVisitor):
        (WebCore):
        (WebCore::MemoryUsageSupport::memoryUsageByComponents):

2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>

        [Qt] Switch to new-style Qt 5 configure tests

        Use explicit project file action instead of syncqt magic.

        https://bugs.webkit.org/show_bug.cgi?id=90461

        Reviewed by Tor Arne Vestbø.

        * WebCore.pri:

2012-07-06  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: start searching from the cursor position in the Sources panel.
        https://bugs.webkit.org/show_bug.cgi?id=90677

        Reviewed by Vsevolod Vlasov.

        Web Inspector: start searching from the cursor position in the Sources panel.
        Drive-by: select whole match upon search cancel.

        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.performSearch.finishedCallback):
        (WebInspector.ScriptsPanel.prototype.performSearch):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame.prototype.performSearch.doFindSearchMatches):
        (WebInspector.SourceFrame.prototype.performSearch):
        * inspector/front-end/TextEditor.js:
        (WebInspector.TextEditor.prototype.lastSelection):
        (WebInspector.TextEditor.prototype._handleFocused):
        * inspector/front-end/TextEditorModel.js:
        (WebInspector.TextRange.prototype.serializeToObject):
        (WebInspector.TextRange.prototype.compareTo):

2012-07-06  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Snippets should be correctly (re)loaded when inspector is open and on navigation.
        https://bugs.webkit.org/show_bug.cgi?id=90672

        Reviewed by Pavel Feldman.

        Snippets are now reloaded from the storage on ScriptSnippetMapping reset.
        Fixed snippets storage.

        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.ScriptSnippetModel):
        (WebInspector.ScriptSnippetModel.prototype._loadSnippets):
        (WebInspector.ScriptSnippetModel.prototype._reset):
        * inspector/front-end/SnippetStorage.js:
        (WebInspector.Snippet.fromObject):

2012-07-06  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Implement snippets removing.
        https://bugs.webkit.org/show_bug.cgi?id=90674

        Reviewed by Pavel Feldman.

        * inspector/front-end/NavigatorView.js:
        (WebInspector.NavigatorView.prototype.rename.afterEditing):
        * inspector/front-end/ScriptsNavigator.js:
        (WebInspector.ScriptsNavigator.prototype.removeUISourceCode):
        (WebInspector.SnippetsNavigatorView.prototype._handleRemoveSnippet):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._addUISourceCode):
        (WebInspector.ScriptsPanel.prototype._uiSourceCodeRemoved):
        (WebInspector.ScriptsPanel.prototype._revealExecutionLine):
        * inspector/front-end/TabbedEditorContainer.js:

2012-07-06  'Pavel Feldman'  <pfeldman@chromium.org>

        Not reviewed: fix inspector front-end compilation.

        * inspector/front-end/ElementsTreeOutline.js:
        * inspector/front-end/SearchController.js:

2012-07-06  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add memory reporting routine to Document
        https://bugs.webkit.org/show_bug.cgi?id=90668

        Reviewed by Pavel Feldman.

        Added methods for reporting HashSet, ListHashSet and Vector memory
        footprint. Made Document report its size along with its internal
        collections sizes.

        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        (WebCore):
        * dom/Document.h:
        (Document):
        * dom/MemoryInstrumentation.h:
        (MemoryInstrumentation):
        (MemoryObjectInfo):
        (WebCore::MemoryObjectInfo::reportHashMap):
        (WebCore::MemoryObjectInfo::reportHashSet):
        (WebCore::MemoryObjectInfo::reportListHashSet):
        (WebCore::MemoryObjectInfo::reportVector):
        (WebCore::MemoryObjectInfo::memoryInstrumentation):
        (WebCore::MemoryInstrumentation::reportHashMap):
        (WebCore):
        (WebCore::MemoryInstrumentation::reportHashSet):
        (WebCore::MemoryInstrumentation::reportListHashSet):
        (WebCore::MemoryInstrumentation::reportVector):
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):

2012-07-06  Gabor Rapcsanyi  <rgabor@webkit.org>

        Fixing defines for NEON intrinsics.
        https://bugs.webkit.org/show_bug.cgi?id=90666

        Reviewed by Zoltan Herczeg.

        Existing tests cover this issue.

        * platform/graphics/filters/FEGaussianBlur.cpp:
        (WebCore::FEGaussianBlur::platformApplyGeneric):
        * platform/graphics/filters/arm/FEGaussianBlurNEON.h:
        * platform/graphics/filters/arm/NEONHelpers.h:

2012-07-05  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Workspace should dispatch WorkspaceReset event on navigation.
        https://bugs.webkit.org/show_bug.cgi?id=90616

        Reviewed by Pavel Feldman.

        Workspace UISourceCodeProviders are now reset on navigation.
        UISourceCodeRemoved event is not dispatched from UISourceCodeProviders on reset (page navigation) anymore.

        * inspector/front-end/CompilerScriptMapping.js:
        (WebInspector.CompilerScriptMapping.prototype.reset):
        * inspector/front-end/DebuggerScriptMapping.js:
        (WebInspector.DebuggerScriptMapping):
        * inspector/front-end/ResourceScriptMapping.js:
        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeRemoved):
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.ScriptSnippetModel.prototype._reset):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._loadUISourceCodes):
        (WebInspector.ScriptsPanel.prototype._reset):
        (WebInspector.ScriptsPanel.prototype.canShowAnchorLocation):
        (WebInspector.ScriptsPanel.prototype._toggleFormatSource):
        (WebInspector.ScriptsPanel.prototype.showGoToSourceDialog):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StylesUISourceCodeProvider):
        (WebInspector.StylesUISourceCodeProvider.prototype.reset):
        * inspector/front-end/Workspace.js:
        (WebInspector.CompositeUISourceCodeProvider.prototype.uiSourceCodeProviders):
        (WebInspector.Workspace):
        (WebInspector.Workspace.prototype.registerUISourceCodeProvider):
        (WebInspector.Workspace.prototype._reset):

2012-07-05  Arnaud Renevier  <arno@renevier.net>

        [GTK] Showing the context menu in the Web Inspector can crash the browser
        https://bugs.webkit.org/show_bug.cgi?id=88800

        Reviewed by Carlos Garcia Campos.

        Remove ContextMenuItem from its parent before appending it again to a
        new parent

        No new tests, behavior is unchanged.

        * platform/gtk/ContextMenuGtk.cpp:
        (WebCore::ContextMenu::appendItem):

2012-07-05  Dongwoo Im  <dw.im@samsung.com>

        [EFL] Unreviewed, Fix build break when WEB_AUDIO is enabled.
        https://bugs.webkit.org/show_bug.cgi?id=90653

        Unreviewed build fix.

        A new file, AudioFIFO.cpp, is added for the Web Audio fearure.
        This file should be included into the CMakeLists.txt file.

        * CMakeLists.txt: Add the newly created file into the CMakeLists.txt

2012-07-05  Mike West  <mkwst@chromium.org>

        Multiple Content Security Policy headers are correctly processed as separate headers.
        https://bugs.webkit.org/show_bug.cgi?id=90629

        Headers of the same name are normalized into a single, comma-separated
        string as per RFC2616, section 4.2. We didn't correctly account for this
        in ContentSecurityPolicy::didReceiveHeader. Now we do by walking through
        the header string, looking for commas and processing each block in turn.

        This oversight bit Firefox as well, and was patched in February:
        https://bugzilla.mozilla.org/show_bug.cgi?id=717511

        Reviewed by Adam Barth.

        Test: http/tests/security/contentSecurityPolicy/directive-parsing-multiple-headers.html

        * page/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::didReceiveHeader):

2012-07-05  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r121921.
        http://trac.webkit.org/changeset/121921
        https://bugs.webkit.org/show_bug.cgi?id=90648

        caused hundreds of crashes on Mac (Requested by pizlo on
        #webkit).

        * editing/SurroundingText.cpp:
        (WebCore::SurroundingText::SurroundingText):
        * editing/TextIterator.cpp:
        (WebCore::CharacterIterator::advance):
        (WebCore::BackwardsCharacterIterator::advance):

2012-07-05  Anders Carlsson  <andersca@apple.com>

        Type-ahead doesn't work in options inside optgroups
        https://bugs.webkit.org/show_bug.cgi?id=90647
        <rdar://problem/5604894>

        Reviewed by Dan Bernstein.

        Set the title of the menu item to a string that doesn't contain any leading or trailing whitespace.

        * platform/mac/PopupMenuMac.mm:
        (WebCore::PopupMenuMac::populate):

2012-07-05  Hayato Ito  <hayato@chromium.org>

        [Crash] Click an element which will be 'display: none' on focus.
        https://bugs.webkit.org/show_bug.cgi?id=90516

        Reviewed by Hajime Morita.

        EventHandler::handleMousePressEventSingleClick checks whether
        innerNode has a renderer in the beginning of the function.  But
        the renderer may disappear in the middle of the function since its
        style has just become 'display:none'.  As a result, it touches null renderer
        in EventHandler.cpp:517:
            VisiblePosition visiblePos(innerNode->renderer()->positionForPoint(event.localPoint()));
        In the case of 'display:none', we don't have to continue.  So call
        updateLayoutIgnorePendingStylesheets() in the beginning so that we
        can early exit and do not touch null renderer.

        Test: fast/events/display-none-on-focus-crash.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMousePressEventSingleClick):

2012-07-05  Benjamin Poulain  <bpoulain@apple.com>

        Double release of resources if the load is canceled in a callback of ResourceLoader::didFinishLoading
        https://bugs.webkit.org/show_bug.cgi?id=90431

        Reviewed by Anders Carlsson.

        In ResourceLoader::didFinishLoadingOnePart(), we invoke didFinishLoad() on the WebKit client. If WebKit
        causes the current frame to cancel the load synchronously, the resources are already freed when
        ResourceLoader::didFinishLoadingOnePart() ends.
        When ResourceLoader::didFinishLoading() subsequently invokes releaseResources(), we are releasing the
        resources a second time.

        This patch add a second check for cancellation after invoking ResourceLoader::didFinishLoadingOnePart() to
        avoid such issues.

        The previous check at the beginning of ResourceLoader::didFinishLoading() has been removed because it is
        redundant with ResourceLoader::didFinishLoadingOnePart().

        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::didFinishLoading):
        (WebCore::ResourceLoader::didFinishLoadingOnePart):

2012-07-05  Simon Fraser  <simon.fraser@apple.com>

        Add a utility method for hasOverflowClip() or hasClip()
        https://bugs.webkit.org/show_bug.cgi?id=90635

        Reviewed by Dean Jackson.
        
        Add RenderObject::hasClipOrOverflowClip() as a convenience method
        since we end up calling hasOverfFlowClip() || hasClip() a lot in the layer code.

        No new tests; refactoring only.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::calculateClipRects):
        (WebCore::RenderLayer::calculateRects):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::enclosingNonStackingClippingLayer):
        (WebCore::RenderLayerCompositor::clipsCompositingDescendants):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::hasClipOrOverflowClip):

2012-07-05  Yongjun Zhang  <yongjun_zhang@apple.com>

        Code refactoring: move mimeTypeFromUTITree to a separate file.
        https://bugs.webkit.org/show_bug.cgi?id=90619

        We should move UTI handling related code to a separate file.

        Reviewed by David Kilzer.

        * WebCore.xcodeproj/project.pbxproj: Add UTIUtilities.h/UTIUtilities.mm to xcode project, and drive-by fix
            that happened when editing the Xcode project file.
        * platform/network/mac/UTIUtilities.h: Added.
        (WebCore):
        * platform/network/mac/UTIUtilities.mm: Added.  move mimeTypeFromUTITree to UTIUtilities.mm.
        (WebCore):
        (WebCore::mimeTypeFromUTITree):
        * platform/network/mac/WebCoreURLResponse.mm: include UTIUtilities.h to use mimeTypeFromUTITree.
        (WebCore):

2012-07-05  Leandro Gracia Gil  <leandrogracia@chromium.org>

        Character iterators should not advance if they are at end
        https://bugs.webkit.org/show_bug.cgi?id=90560

        Reviewed by Ryosuke Niwa.

        CharacterIterator and BackwardsCharacterIterator try to advance their
        internal TextIterator without checking if they already are at end.
        This can cause crashes in TextIterator::advance.

        Test: platform/chromium/editing/surrounding-text/surrounding-text.html

        * editing/SurroundingText.cpp:
        (WebCore::SurroundingText::SurroundingText):
        * editing/TextIterator.cpp:
        (WebCore::CharacterIterator::advance):
        (WebCore::BackwardsCharacterIterator::advance):

2012-07-05  John Mellor  <johnme@chromium.org>

        Text Autosizing: Add basic framework
        https://bugs.webkit.org/show_bug.cgi?id=88655

        Follow-up patch tweaking method signatures.

        Reviewed by Simon Fraser.

        No functional change, so no new tests.

        * page/FrameView.cpp:
        (WebCore::FrameView::layout):
        * rendering/TextAutosizer.cpp:
        (WebCore::TextAutosizer::processSubtree):
        (WebCore::TextAutosizer::processBlock):
        (WebCore::TextAutosizer::processText):
        (WebCore):
        * rendering/TextAutosizer.h:
        (TextAutosizer):

2012-07-05  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: move cursor to the current search match.
        https://bugs.webkit.org/show_bug.cgi?id=90621

        Reviewed by Vsevolod Vlasov.

        After closing the search dialog, the cursor should be at the latest search match location.

        * inspector/front-end/TextEditor.js:
        (WebInspector.TextEditor.prototype.markAndRevealRange):
        (WebInspector.TextEditor.prototype._handleFocused):

2012-07-05  Behdad Esfahbod  <behdad@behdad.org>

        Subpixel layout broken with spans with CSS position other than static
        https://bugs.webkit.org/show_bug.cgi?id=90097

        Reviewed by Eric Seidel.

        In InlineBox, don't truncate size to integers when returning.

        In RenderBlock, don't round-up width to next integer.  Round-up to
        next LayoutUnit instead.

        Test: Added fast/sub-pixel/size-of-span-with-different-positions.html
        Adjust expected outputs affected by the rounding changes.

        * platform/FractionalLayoutUnit.h:
        (WebCore::FractionalLayoutUnit::fromFloatCeil):
        (FractionalLayoutUnit):
        * rendering/InlineBox.h:
        (WebCore::InlineBox::size):
        * rendering/RenderBlock.cpp:
        (WebCore::updatePreferredWidth):

2012-07-05  Nate Chapin  <japhet@chromium.org>

        REGRESSION (r115654): Sometimes does not replace content for multipart/x-mixed-replace
        https://bugs.webkit.org/show_bug.cgi?id=88436

        Reviewed by Brady Eidson.

        Test: http/tests/multipart/multipart-replace-non-html-content.php

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::commitData): We should only send receivedFirstData() once per main resource load,
            rather than multiple times in a multipart load. 
        (WebCore::DocumentLoader::setupForReplaceByMIMEType): m_gotFirstByte isn't set to true until data is
            actually committed, and multipart data is often not committed until the part is finished. Check
            whether the SharedBuffer is non-null instead.
        * testing/js/WebCoreTestSupport.cpp:
        (WebCoreTestSupport::resetInternalsObject): The JSInternals object my have already been cleared if the window shell
            was cleared as part of creation of a new Document. Check it before using it.

2012-07-05  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: move search field to the bottom of the page.
        https://bugs.webkit.org/show_bug.cgi?id=90610

        Reviewed by Vsevolod Vlasov.

        This is the first step in the Search/replace implementation. This change moves search
        field from the inspector toolbar to the inspector view footer that is visible upon Cmd/Ctrl+F.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/InspectorView.js:
        (WebInspector.InspectorView):
        (WebInspector.InspectorView.prototype._pushToHistory):
        (WebInspector.InspectorView.prototype.panelsElement):
        (WebInspector.InspectorView.prototype.setFooterElement):
        * inspector/front-end/Panel.js:
        (WebInspector.Panel.prototype.show):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype._reset):
        * inspector/front-end/SearchController.js:
        (WebInspector.SearchController):
        (WebInspector.SearchController.prototype.updateSearchLabel):
        (WebInspector.SearchController.prototype.cancelSearch):
        (WebInspector.SearchController.prototype._updateSearchNavigationButtonState):
        (WebInspector.SearchController.prototype.focusSearchField):
        (WebInspector.SearchController.prototype._onKeyDown):
        (WebInspector.SearchController.prototype._onNextButtonSearch):
        (WebInspector.SearchController.prototype._onPrevButtonSearch):
        (WebInspector.SearchController.prototype._performSearch):
        * inspector/front-end/inspector.css:
        (#search):
        (.toolbar-search-container):
        (.toolbar-search-navigation):
        (.toolbar-search-navigation:hover):
        (.toolbar-search-navigation.toolbar-search-navigation-prev):
        (.toolbar-search-navigation.toolbar-search-navigation-next):
        (.toolbar-search-navigation-hidden):
        (.status-bar):
        (.search-drawer-header input[type="search"].search-config-search):
        (.inspector-footer):
        (.inspector-footer > div):
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:
        (WebInspector.get _setCompactMode):
        (WebInspector.postDocumentKeyDown):

2012-07-05  Sergey Rogulenko  <rogulenko@google.com>

        Web Inspector: added low-level instrumentation support for TimelineAgent
        https://bugs.webkit.org/show_bug.cgi?id=90264

        Reviewed by Pavel Feldman.

        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::timelineAgentForOrphanEvents):
        (WebCore::InspectorInstrumentation::setTimelineAgentForOrphanEvents):
        (WebCore::InspectorInstrumentation::threadSpecificTimelineAgentForOrphanEvents):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
        * inspector/InspectorTimelineAgent.h:
        (InspectorTimelineAgent):

2012-07-05  John Mellor  <johnme@chromium.org>

        Text Autosizing: Add test framework and simple test.
        https://bugs.webkit.org/show_bug.cgi?id=90561

        Exposes methods allowing Layout Tests to enable Text Autosizing and
        get the same results as if they were running on a mobile device.

        Reviewed by Adam Barth.

        Test: fast/text-autosizing/simple-paragraph.html

        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        (WebCore):
        (WebCore::Settings::setTextAutosizingWindowSizeOverride):
        * page/Settings.h:
        (Settings):
        (WebCore::Settings::textAutosizingWindowSizeOverride):
        * rendering/TextAutosizer.cpp:
        (WebCore::TextAutosizer::boostSubtree):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::InternalSettings):
        (WebCore::InternalSettings::restoreTo):
        (WebCore::InternalSettings::setTextAutosizingEnabled):
        (WebCore):
        (WebCore::InternalSettings::setTextAutosizingWindowSizeOverride):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-07-04  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: timeline events in the vicinity of event dividers some times are tricky to expand
        https://bugs.webkit.org/show_bug.cgi?id=90572

        Reviewed by Pavel Feldman.

        - do not use resources-event-divider-padding;
        - make dividers larger and use border-color to visualize them;
        - move resources-<color>-divider to timelinePanel.css, as they're not used outside of timeline;

        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.createEventDivider):
        * inspector/front-end/inspectorCommon.css:
        * inspector/front-end/timelinePanel.css:
        (.timeline .resources-event-divider):
        (.resources-red-divider):
        (.resources-blue-divider):
        (.resources-orange-divider):
        (.resources-divider.last):
        (.timeline .resources-event-divider.timeline-frame-divider):

2012-07-04  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: incorrect height of main timeline pane after switching to memory mode
        https://bugs.webkit.org/show_bug.cgi?id=90387

        Reviewed by Pavel Feldman.

        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype._splitterDragging):
        (WebInspector.TimelinePanel.prototype.set _setSplitterPosition):
        (WebInspector.TimelinePanel.prototype._overviewModeChanged):

2012-07-05  Vivek Galatage  <vivekgalatage@gmail.com>

        Web Inspector: Add support for keyboard increment / decrement on numbers in attributes in Elements Panel
        https://bugs.webkit.org/show_bug.cgi?id=89586

        Reviewed by Pavel Feldman

        Refactoring the key events while editing style property values. Migrated the code to UIUtils.js and referred
        from StylesSidebarPane.js, ElementsTreeOutline.js and MetricsSidebarPane.js.

        No new tests as code refactoring and UI feature added to ElementsTreeOutline.js

        * inspector/front-end/ElementsTreeOutline.js:
        (WebInspector.ElementsTreeElement.prototype._startEditingAttribute.handleKeyDownEvents):
        (WebInspector.ElementsTreeElement.prototype._startEditingAttribute):
        * inspector/front-end/MetricsSidebarPane.js:
        (WebInspector.MetricsSidebarPane.prototype._handleKeyDown.finishHandler):
        (WebInspector.MetricsSidebarPane.prototype._handleKeyDown.customNumberHandler):
        (WebInspector.MetricsSidebarPane.prototype._handleKeyDown):
        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylesSidebarPane.prototype._handleNameOrValueUpDown.finishHandler):
        (WebInspector.StylesSidebarPane.prototype._handleNameOrValueUpDown):
        * inspector/front-end/UIUtils.js:
        (WebInspector._modifiedHexValue):
        (WebInspector._modifiedFloatNumber):
        (WebInspector.handleElementValueModifications):

2012-07-05  Gabor Rapcsanyi  <rgabor@webkit.org>

        NEON intrinsics should be used with gaussian blur filter
        https://bugs.webkit.org/show_bug.cgi?id=90166

        Reviewed by Zoltan Herczeg.

        Rewrite inline assembly to NEON intrinsics for better portabilty 
        and readibility. Remove unnecessary FEGaussianBlurNEON.cpp and add
        NEONHelpers.h to the project which will contains the shared
        NEON code of the filters.

        Existing tests cover this issue.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/filters/FEGaussianBlur.cpp:
        (WebCore::FEGaussianBlur::platformApplyGeneric):
        (WebCore::FEGaussianBlur::platformApplyWorker):
        * platform/graphics/filters/FEGaussianBlur.h:
        (FEGaussianBlur):
        * platform/graphics/filters/arm/FEGaussianBlurNEON.cpp: Removed.
        * platform/graphics/filters/arm/FEGaussianBlurNEON.h:
        (WebCore::boxBlurNEON):
        * platform/graphics/filters/arm/NEONHelpers.h: Added.
        (WebCore):
        (WebCore::loadRGBA8AsFloat):
        (WebCore::storeFloatAsRGBA8):

2012-07-05  Sam D  <dsam2912@gmail.com>

        Web Inspector: Having a "Scroll into view" for nodes through web inspector.
        https://bugs.webkit.org/show_bug.cgi?id=89554

        Added options for scrolling-into-view the  element node through web
        inspector.

        Reviewed by Pavel Feldman.

        No new tests. UI change.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/ElementsTreeOutline.js:
        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
        (.):
        * inspector/front-end/RemoteObject.js:
        (WebInspector.RemoteObject.prototype.callFunction):

2012-07-05  Zan Dobersek  <zandobersek@gmail.com>

        Add Gamepad logging channel
        https://bugs.webkit.org/show_bug.cgi?id=90570

        Reviewed by Carlos Garcia Campos.

        Add a new logging channel for logging significant
        events that are related to Gamepad API implementation.

        No new tests - no new testable functionality.

        * platform/Logging.cpp:
        (WebCore):
        (WebCore::getChannelFromName):
        * platform/Logging.h:
        (WebCore):
        * platform/gtk/GamepadsGtk.cpp: Log when a device is
        registered or unregistered.
        (WebCore::GamepadsGtk::registerDevice):
        (WebCore::GamepadsGtk::unregisterDevice):

2012-07-05  Peter Wang  <peter.wang@torchmobile.com.cn>

        Web Inspector: [JSC] support JS execution in the context of an isolated world
        https://bugs.webkit.org/show_bug.cgi?id=85709

        Reviewed by Gavin Barraclough.

        No new test case for this bug. 

        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::collectIsolatedContexts):
        (WebCore):

2012-07-04  Huang Dongsung  <luxtella@company100.net>

        Add virtual keyword to ~BitmapImage and ~StillImage because ~Image is virtual.
        https://bugs.webkit.org/show_bug.cgi?id=90447

        Reviewed by Alexey Proskuryakov.

        No new tests. This patch doesn't change behavior.

        * platform/graphics/BitmapImage.h:
        (BitmapImage):
        * platform/graphics/qt/StillImageQt.h:
        (StillImage):

2012-07-04  Mike West  <mkwst@chromium.org>

        Implement the script-nonce Content Security Policy directive.
        https://bugs.webkit.org/show_bug.cgi?id=89577

        Reviewed by Adam Barth.

        This patch implements the (experimental) script-nonce Content Security
        Policy directive from the 1.1 spec, which allows for selective
        execution of script by specifying a "nonce" attribute for the
        script tag. Script is only loaded and executed if it both matches the
        nonce and matches the script-src whitelist (if present).

        The implementation is gated on the ENABLE_CSP_NEXT flag, which is
        currently disabled for all ports other than Chromium.

        Spec: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#script-nonce--experimental

        Tests: http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed.html
               http/tests/security/contentSecurityPolicy/1.1/scriptnonce-badnonce.html
               http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked.html
               http/tests/security/contentSecurityPolicy/1.1/scriptnonce-emptynonce.html
               http/tests/security/contentSecurityPolicy/1.1/scriptnonce-scriptsrc-blocked.html

        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::requestScript):
        (WebCore::ScriptElement::executeScript):
            Passing the nonce attribute through to check against CSP.
        * html/HTMLAttributeNames.in:
        * html/HTMLScriptElement.idl:
            Adding the `nonce` attribute to the script tag.
        * page/ContentSecurityPolicy.cpp:
        (CSPDirectiveList):
        (WebCore::CSPDirectiveList::logInvalidNonce):
        (WebCore):
        (WebCore::CSPDirectiveList::checkNonceAndReportViolation):
        (WebCore::CSPDirectiveList::allowJavaScriptURLs):
        (WebCore::CSPDirectiveList::allowInlineEventHandlers):
            If a nonce is set, deny JavaScript URLs and inline event handlers.
        (WebCore::CSPDirectiveList::allowScriptNonce):
        (WebCore::CSPDirectiveList::parseScriptNonce):
        (WebCore::CSPDirectiveList::addDirective):
        (WebCore::isAllowedByAllWithNonce):
        (WebCore::ContentSecurityPolicy::allowScriptNonce):
        * page/ContentSecurityPolicy.h:
        (WebCore):

2012-07-04  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Notifications should be in Modules/notifications
        https://bugs.webkit.org/show_bug.cgi?id=82121

        Reviewed by Adam Barth.

        The notifications directory is now self-contained. This patch moves it to the Modules directory.

        No new tests, covered by existing tests.

        * CMakeLists.txt:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.am:
        * GNUmakefile.list.am:
        * Modules/notifications/DOMWindowNotifications.cpp: Renamed from Source/WebCore/notifications/DOMWindowNotifications.cpp.
        (WebCore):
        (WebCore::DOMWindowNotifications::DOMWindowNotifications):
        (WebCore::DOMWindowNotifications::~DOMWindowNotifications):
        (WebCore::DOMWindowNotifications::from):
        (WebCore::DOMWindowNotifications::webkitNotifications):
        (WebCore::DOMWindowNotifications::disconnectFrameForPageCache):
        (WebCore::DOMWindowNotifications::reconnectFrameFromPageCache):
        (WebCore::DOMWindowNotifications::willDestroyGlobalObjectInCachedFrame):
        (WebCore::DOMWindowNotifications::willDestroyGlobalObjectInFrame):
        (WebCore::DOMWindowNotifications::willDetachGlobalObjectFromFrame):
        * Modules/notifications/DOMWindowNotifications.h: Renamed from Source/WebCore/notifications/DOMWindowNotifications.h.
        (WebCore):
        (DOMWindowNotifications):
        * Modules/notifications/DOMWindowNotifications.idl: Renamed from Source/WebCore/notifications/DOMWindowNotifications.idl.
        * Modules/notifications/Notification.cpp: Renamed from Source/WebCore/notifications/Notification.cpp.
        (WebCore):
        (WebCore::Notification::Notification):
        (WebCore::Notification::~Notification):
        (WebCore::Notification::create):
        (WebCore::getAndAddEventListener):
        (WebCore::Notification::interfaceName):
        (WebCore::Notification::show):
        (WebCore::Notification::close):
        (WebCore::Notification::eventTargetData):
        (WebCore::Notification::ensureEventTargetData):
        (WebCore::Notification::contextDestroyed):
        (WebCore::Notification::finalize):
        (WebCore::Notification::dispatchShowEvent):
        (WebCore::Notification::dispatchClickEvent):
        (WebCore::Notification::dispatchCloseEvent):
        (WebCore::Notification::dispatchErrorEvent):
        (WebCore::Notification::taskTimerFired):
        (WebCore::Notification::permissionLevel):
        (WebCore::Notification::permissionString):
        (WebCore::Notification::requestPermission):
        * Modules/notifications/Notification.h: Renamed from Source/WebCore/notifications/Notification.h.
        (WebCore):
        (Notification):
        (WebCore::Notification::cancel):
        (WebCore::Notification::isHTML):
        (WebCore::Notification::setHTML):
        (WebCore::Notification::url):
        (WebCore::Notification::setURL):
        (WebCore::Notification::iconURL):
        (WebCore::Notification::title):
        (WebCore::Notification::body):
        (WebCore::Notification::dir):
        (WebCore::Notification::setDir):
        (WebCore::Notification::replaceId):
        (WebCore::Notification::setReplaceId):
        (WebCore::Notification::tag):
        (WebCore::Notification::setTag):
        (WebCore::Notification::direction):
        (WebCore::Notification::scriptExecutionContext):
        (WebCore::Notification::detachPresenter):
        (WebCore::Notification::setBody):
        (WebCore::Notification::refEventTarget):
        (WebCore::Notification::derefEventTarget):
        * Modules/notifications/Notification.idl: Renamed from Source/WebCore/notifications/Notification.idl.
        * Modules/notifications/NotificationCenter.cpp: Renamed from Source/WebCore/notifications/NotificationCenter.cpp.
        (WebCore):
        (WebCore::NotificationCenter::create):
        (WebCore::NotificationCenter::NotificationCenter):
        (WebCore::NotificationCenter::checkPermission):
        (WebCore::NotificationCenter::requestPermission):
        (WebCore::NotificationCenter::stop):
        (WebCore::NotificationCenter::requestTimedOut):
        (WebCore::NotificationCenter::NotificationRequestCallback::createAndStartTimer):
        (WebCore::NotificationCenter::NotificationRequestCallback::NotificationRequestCallback):
        (WebCore::NotificationCenter::NotificationRequestCallback::startTimer):
        (WebCore::NotificationCenter::NotificationRequestCallback::timerFired):
        * Modules/notifications/NotificationCenter.h: Renamed from Source/WebCore/notifications/NotificationCenter.h.
        (WebCore):
        (NotificationCenter):
        (WebCore::NotificationCenter::createHTMLNotification):
        (WebCore::NotificationCenter::createNotification):
        (WebCore::NotificationCenter::client):
        (NotificationRequestCallback):
        * Modules/notifications/NotificationCenter.idl: Renamed from Source/WebCore/notifications/NotificationCenter.idl.
        * Modules/notifications/NotificationClient.h: Renamed from Source/WebCore/notifications/NotificationClient.h.
        (WebCore):
        (NotificationClient):
        (WebCore::NotificationClient::clearNotifications):
        (WebCore::NotificationClient::~NotificationClient):
        * Modules/notifications/NotificationController.cpp: Renamed from Source/WebCore/notifications/NotificationController.cpp.
        (WebCore):
        (WebCore::NotificationController::NotificationController):
        (WebCore::NotificationController::~NotificationController):
        (WebCore::NotificationController::create):
        (WebCore::NotificationController::clientFrom):
        (WebCore::NotificationController::supplementName):
        (WebCore::provideNotification):
        * Modules/notifications/NotificationController.h: Renamed from Source/WebCore/notifications/NotificationController.h.
        (WebCore):
        (NotificationController):
        (WebCore::NotificationController::from):
        (WebCore::NotificationController::client):
        * Modules/notifications/NotificationPermissionCallback.h: Renamed from Source/WebCore/notifications/NotificationPermissionCallback.h.
        (WebCore):
        (NotificationPermissionCallback):
        (WebCore::NotificationPermissionCallback::~NotificationPermissionCallback):
        * Modules/notifications/NotificationPermissionCallback.idl: Renamed from Source/WebCore/notifications/NotificationPermissionCallback.idl.
        * Modules/notifications/WorkerContextNotifications.cpp: Renamed from Source/WebCore/notifications/WorkerContextNotifications.cpp.
        (WebCore):
        (WebCore::WorkerContextNotifications::WorkerContextNotifications):
        (WebCore::WorkerContextNotifications::~WorkerContextNotifications):
        (WebCore::WorkerContextNotifications::from):
        (WebCore::WorkerContextNotifications::webkitNotifications):
        * Modules/notifications/WorkerContextNotifications.h: Renamed from Source/WebCore/notifications/WorkerContextNotifications.h.
        (WebCore):
        (WorkerContextNotifications):
        * Modules/notifications/WorkerContextNotifications.idl: Renamed from Source/WebCore/notifications/WorkerContextNotifications.idl.
        * Target.pri:
        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * WebCore.pri:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.vcproj/WebCoreCommon.vsprops:
        * WebCore.vcproj/copyForwardingHeaders.cmd:
        * WebCore.xcodeproj/project.pbxproj:

2012-07-04  Hayato Ito  <hayato@chromium.org>

        Remove inline keywords from functions which can not be inlined in ComposedShadowTreeWalker
        https://bugs.webkit.org/show_bug.cgi?id=90432

        Reviewed by Hajime Morita.

        No new tests - no functional changes.

        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::ComposedShadowTreeWalker::traverseParent):
        (WebCore::ComposedShadowTreeWalker::traverseParentBackToYoungerShadowRootOrHost):

2012-07-04  Luke Macpherson  <macpherson@chromium.org>

        Inspector crashes when trying to inspect a page with CSS variables
        https://bugs.webkit.org/show_bug.cgi?id=89818

        Reviewed by Antti Koivisto.

        Patch works by fixing treating handling of CSSPropertyID == CSSPropertyVariable as a special case,
        and looking up the author-defined property name from the CSSValue.

        Added test inspector/styles/variables/css-variables.html that inspects an element using CSS variables.
        Test is skipped when variables are compiled out.

        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::cssName):
        (WebCore):
        (WebCore::CSSProperty::cssText):
        * css/CSSProperty.h:
        (CSSProperty):
        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::item):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::asText):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyle::populateAllProperties):

2012-07-04  Anthony Scian  <ascian@rim.com>

        Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
        https://bugs.webkit.org/show_bug.cgi?id=40118

        Reviewed by Yong Li.

        Implemented stub for createScriptCallStack to call into
        Interpreter and extract the current stack frames, iterate
        through the frames and create the return result required.

        No new tests, manually tested thrown exception and inspector
        tracebacks.

        * bindings/js/ScriptCallStackFactory.cpp:
        (WebCore::createScriptCallStack):

2012-07-04  Dana Jansens  <danakj@chromium.org>

        [chromium] Respect memory needed for RenderSurfaces when reserving contents textures
        https://bugs.webkit.org/show_bug.cgi?id=89901

        Reviewed by Adrienne Walker.

        Treat the memory allocation given to a tab as an allocation for its
        contents and surfaces. Then only use up contents memory such that
        the surface textures will still fit within the limit. Report histograms
        for the amount of contents and surface texture memory used by each
        frame generated by the main thread.

        In the context of ubercomp, each nested compositor will use less memory
        for contents ensuring that the root compositor has space for surfaces
        caused by that nested compositor.

        Since surface memory can no longer be taken by contents, we remove the
        preferred memory limit from the texture manager.

        Tests: TiledLayerChromiumTest.dontAllocateContentsWhenTargetSurfaceCantBeAllocated
               CCPrioritizedTextureTest.renderSurfacesReduceMemoryAvailableOutsideRootSurface
               CCPrioritizedTextureTest.renderSurfacesReduceMemoryAvailableForRequestLate
               CCPrioritizedTextureTest.whenRenderSurfaceNotAvailableTexturesAlsoNotAvailable

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawBackgroundFilters):
        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        (WebCore::ScrollbarLayerChromium::setTexturePriorities):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::setTexturePrioritiesInRect):
        * platform/graphics/chromium/TiledLayerChromium.h:
        (TiledLayerChromium):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
        (WebCore::CCLayerTreeHost::updateLayers):
        (WebCore::CCLayerTreeHost::prioritizeTextures):
        (WebCore::CCLayerTreeHost::paintLayerContents):
        * platform/graphics/chromium/cc/CCOverdrawMetrics.cpp:
        (WebCore::CCOverdrawMetrics::CCOverdrawMetrics):
        (WebCore::CCOverdrawMetrics::didUseContentsTextureMemoryBytes):
        (WebCore):
        (WebCore::CCOverdrawMetrics::didUseRenderSurfaceTextureMemoryBytes):
        (WebCore::CCOverdrawMetrics::recordMetricsInternal):
        * platform/graphics/chromium/cc/CCOverdrawMetrics.h:
        (CCOverdrawMetrics):
        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.cpp:
        (WebCore::CCPrioritizedTextureManager::CCPrioritizedTextureManager):
        (WebCore::CCPrioritizedTextureManager::prioritizeTextures):
        (WebCore::CCPrioritizedTextureManager::requestLate):
        (WebCore::CCPrioritizedTextureManager::acquireBackingTextureIfNeeded):
        (WebCore::CCPrioritizedTextureManager::reduceMemory):
        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.h:
        (WebCore::CCPrioritizedTextureManager::create):
        (WebCore::CCPrioritizedTextureManager::memoryForRenderSurfacesBytes):
        (CCPrioritizedTextureManager):
        * platform/graphics/chromium/cc/CCPriorityCalculator.cpp:
        (WebCore::CCPriorityCalculator::uiPriority):
        (WebCore::CCPriorityCalculator::visiblePriority):
        (WebCore):
        (WebCore::CCPriorityCalculator::renderSurfacePriority):
        (WebCore::CCPriorityCalculator::priorityFromDistance):
        (WebCore::CCPriorityCalculator::priorityFromVisibility):
        * platform/graphics/chromium/cc/CCPriorityCalculator.h:
        (CCPriorityCalculator):

2012-07-04  John Mellor  <johnme@chromium.org>

        Text Autosizing: Add basic framework
        https://bugs.webkit.org/show_bug.cgi?id=88655

        This adds a highly simplified foundation that subsequent Text Autosizing patches
        can build upon. I've refactored this code (since the earlier combined diff
        uploaded to http://webkit.org/b/84186) to touch as few files as possible.

        Reviewed by Adam Barth.

        No new tests. I plan to add a test framework as my next Text Autosizing patch.

        * WebCore.gypi:
        * dom/Document.cpp:
        (WebCore::Document::Document):
        * dom/Document.h:
        (WebCore):
        (Document):
        (WebCore::Document::textAutosizer):
        * page/FrameView.cpp:
        (WebCore::FrameView::layout):
        * rendering/TextAutosizer.cpp: Added.
        (WebCore):
        (WebCore::TextAutosizer::TextAutosizer):
        (WebCore::TextAutosizer::~TextAutosizer):
        (WebCore::TextAutosizer::create):
        (WebCore::TextAutosizer::boostSubtree):
        (WebCore::TextAutosizer::boostBlock):
        (WebCore::TextAutosizer::boostText):
        (WebCore::TextAutosizer::treatAsInline):
        (WebCore::TextAutosizer::traverseNext):
        (WebCore::TextAutosizer::cloneRenderStyleWithState):
        * rendering/TextAutosizer.h: Added.
        (WebCore):
        (TextAutosizer):

2012-07-04  Andrey Kosyakov  <caseq@chromium.org>

        Unreviewed, rolling out r121767.
        http://trac.webkit.org/changeset/121767
        https://bugs.webkit.org/show_bug.cgi?id=89584

        Crashes inspected page while recording timeline due to
        conflict with BeginFrame in record stack

        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
        (WebCore::InspectorTimelineAgent::willProcessTask):
        (WebCore::InspectorTimelineAgent::didProcessTask):
        (WebCore::InspectorTimelineAgent::innerAddRecordToTimeline):
        (WebCore::InspectorTimelineAgent::setHeapSizeStatistic):
        * inspector/InspectorTimelineAgent.h:
        (InspectorTimelineAgent):
        * inspector/front-end/MemoryStatistics.js:
        (WebInspector.MemoryStatistics.prototype._onRecordAdded):
        * inspector/front-end/TimelineFrameController.js:
        (WebInspector.TimelineFrameController.prototype._addRecord):
        * inspector/front-end/TimelineModel.js:
        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineCategoryStrips.prototype.update.appendRecord):
        (WebInspector.TimelineCategoryStrips.prototype.update):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.categories):
        (WebInspector.TimelinePresentationModel.recordStyle):
        (WebInspector.TimelinePresentationModel.categoryForRecord):
        (WebInspector.TimelinePresentationModel.forAllRecords):
        (WebInspector.TimelinePresentationModel.prototype.addRecord):

2012-07-04  Dana Jansens  <danakj@chromium.org>

        [chromium] Clear RenderSurfaces still when no idle paint will be done
        https://bugs.webkit.org/show_bug.cgi?id=90553

        Reviewed by Adrienne Walker.

        Currently if idle painting is disabled, updateLayers() will early-out.
        But this prevents it from doing cleanup and clearing all RenderSurface
        pointers, leaving the layer tree in an unexpected state.

        Tests: CCLayerTreeHostTestCompositeAndReadbackCleanup

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::updateLayers):

2012-07-04  John Mellor  <johnme@chromium.org>

        Text Autosizing: Add compile flag and runtime setting
        https://bugs.webkit.org/show_bug.cgi?id=87394

        This patch renames Font Boosting to Text Autosizing and adds compile guards around the runtime setting.

        Reviewed by Adam Barth.

        No functionality yet, so no new tests.

        * Configurations/FeatureDefines.xcconfig:
        * GNUmakefile.am:
        * Target.pri:
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        (WebCore::Settings::setTextAutosizingEnabled):
        * page/Settings.h:
        (Settings):
        (WebCore::Settings::textAutosizingEnabled):

2012-07-03  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Emulate pseudo styles (hover etc.) of non-selected elements
        https://bugs.webkit.org/show_bug.cgi?id=86630

        Reviewed by Pavel Feldman.

        - A map of pseudo-states for all bound DOM nodes is maintained in the backend and queried whenever StyleResolver
        calculates the effective element style.
        - In the frontend, markers are introduced to distinguish elements that have forced pseudo styles set for them.
        Additionally, dimmed markers are added for collapsed nodes, whose descendants have forced pseudo styles.
        More ElementDecorator subtypes will be added for other types of markers.

        Test: inspector/styles/force-pseudo-state.html

        * English.lproj/localizedStrings.js:
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::InspectorCSSAgent):
        (WebCore::InspectorCSSAgent::clearFrontend):
        (WebCore::InspectorCSSAgent::reset):
        (WebCore::InspectorCSSAgent::forcePseudoState):
        (WebCore::InspectorCSSAgent::recalcStyleForPseudoStateIfNeeded):
        (WebCore::InspectorCSSAgent::elementForId):
        (WebCore::InspectorCSSAgent::didRemoveDocument):
        (WebCore::InspectorCSSAgent::didRemoveDOMNode):
        (WebCore::InspectorCSSAgent::resetPseudoStates):
        * inspector/InspectorCSSAgent.h:
        (InspectorCSSAgent):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::unbind):
        (WebCore::InspectorDOMAgent::didRemoveDOMNode):
        * inspector/front-end/ElementsPanel.js:
        (WebInspector.ElementsPanel.get this):
        (WebInspector.ElementsPanel):
        (WebInspector.ElementsPanel.prototype._setPseudoClassForNodeId):
        * inspector/front-end/ElementsTreeOutline.js:
        (WebInspector.ElementsTreeOutline):
        (WebInspector.ElementsTreeOutline.prototype._createNodeDecorators):
        (WebInspector.ElementsTreeOutline.prototype.updateOpenCloseTags):
        (WebInspector.ElementsTreeOutline.ElementDecorator):
        (WebInspector.ElementsTreeOutline.ElementDecorator.prototype.decorate):
        (WebInspector.ElementsTreeOutline.ElementDecorator.prototype.decorateAncestor):
        (WebInspector.ElementsTreeOutline.PseudoStateDecorator):
        (WebInspector.ElementsTreeOutline.PseudoStateDecorator.prototype.decorate):
        (WebInspector.ElementsTreeOutline.PseudoStateDecorator.prototype.decorateAncestor):
        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
        (WebInspector.ElementsTreeElement.prototype._populateForcedPseudoStateItems):
        (WebInspector.ElementsTreeElement.prototype.updateTitle):
        (WebInspector.ElementsTreeElement.prototype._createDecoratorElement):
        (WebInspector.ElementsTreeElement.prototype._updateDecorations):
        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylesSidebarPane):
        (WebInspector.StylesSidebarPane.prototype.get forcedPseudoClasses):
        (WebInspector.StylesSidebarPane.prototype._updateForcedPseudoStateInputs):
        (WebInspector.StylesSidebarPane.prototype.update):
        (WebInspector.StylesSidebarPane.prototype._refreshUpdate):
        (WebInspector.StylesSidebarPane.prototype._rebuildUpdate):
        (WebInspector.StylesSidebarPane.prototype._toggleElementStatePane):
        (WebInspector.StylesSidebarPane.prototype._createElementStatePane.clickListener):
        * inspector/front-end/elementsPanel.css:
        (#elements-content .elements-gutter-decoration):
        (#elements-content .elements-gutter-decoration.elements-has-decorated-children):

2012-07-04  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: fix search on the network panel.
        https://bugs.webkit.org/show_bug.cgi?id=90557

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/NetworkPanel.js:
        (WebInspector.NetworkLogView.prototype._highlightNthMatchedRequest):

2012-07-04  Kwang Yul Seo  <skyul@company100.net>

        Stop tracking line number in tokenizer
        https://bugs.webkit.org/show_bug.cgi?id=90544

        Reviewed by Adam Barth.

        Because SegmentedString knows how to track the current line and column,
        a tokenizer does not need to keep track of the current line by itself.
        No behavior change, so no new tests.

        * html/parser/HTMLDocumentParser.cpp:
        (WebCore::HTMLDocumentParser::pumpTokenizer):
        (WebCore::HTMLDocumentParser::lineNumber):
        (WebCore::HTMLDocumentParser::textPosition):
        * html/parser/HTMLTokenizer.cpp:
        (WebCore::HTMLTokenizer::reset):
        (WebCore::HTMLTokenizer::flushBufferedEndTag):
        (WebCore):
        (WebCore::HTMLTokenizer::nextToken):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::processScriptStartTag):
        * html/track/WebVTTTokenizer.cpp:
        (WebCore::WebVTTTokenizer::reset):
        (WebCore::WebVTTTokenizer::nextToken):
        * platform/text/SegmentedString.cpp:
        (WebCore::SegmentedString::advanceAndUpdateLineNumberSlowCase):
        * platform/text/SegmentedString.h:
        (WebCore::SegmentedString::advancePastNewlineAndUpdateLineNumber):
        (WebCore::SegmentedString::advanceAndUpdateLineNumber):
        (SegmentedString):
        * xml/parser/MarkupTokenizerBase.h:
        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::peek):
        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::advance):
        (WebCore::MarkupTokenizerBase::emitAndResumeIn):
        (WebCore::MarkupTokenizerBase::emitEndOfFile):
        (WebCore::MarkupTokenizerBase::reset):
        (MarkupTokenizerBase):
        * xml/parser/MarkupTokenizerInlineMethods.h:
        (WebCore):
        * xml/parser/XMLTokenizer.cpp:
        (WebCore::XMLTokenizer::nextToken):

2012-07-04  Ryuan Choi  <ryuan.choi@samsung.com>

        [CMAKE] Add GENERATE_BINDINGS macro to share the codes which use generate-bindings.pl.
        https://bugs.webkit.org/show_bug.cgi?id=90258

        Reviewed by Rob Buis.

        Use GENERATE_BINDINGS instead of using generate-bindings.pl directly.

        * UseJSC.cmake:
        * UseV8.cmake:
        * PlatformBlackBerry.cmake:

2012-07-04  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: UISourceCode should take care of adding revision after committing working copy.
        https://bugs.webkit.org/show_bug.cgi?id=90549

        Reviewed by Pavel Feldman.

        Revision is now added in UISourceCode.commitWorkingCopy synchronously even if saving to JS VM or CSS model failed.

        * inspector/front-end/CSSStyleModel.js:
        (WebInspector.CSSStyleModelResourceBinding.prototype.setStyleContent):
        * inspector/front-end/ExtensionServer.js:
        (WebInspector.ExtensionServer.prototype._handleOpenURL):
        (WebInspector.ExtensionServer.prototype._onGetResourceContent):
        (WebInspector.ExtensionServer.prototype._onSetResourceContent):
        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource.prototype.workingCopyCommitted):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StyleSource.prototype._callOrSetTimeout):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode.prototype.commitWorkingCopy):
        * inspector/front-end/Workspace.js:
        (WebInspector.CompositeUISourceCodeProvider.prototype.uiSourceCodeForURL):

2012-07-04  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: move settings button back to the right.
        https://bugs.webkit.org/show_bug.cgi?id=90552

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/inspector.css:
        (button.status-bar-item:active, button.status-bar-item.emulate-active):
        (button.settings-status-bar-item):

2012-07-04  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Get rid of ResourceDomainModelBinding and DebuggerResourceBinding, make Resource.setContent private.
        https://bugs.webkit.org/show_bug.cgi?id=90531

        Reviewed by Pavel Feldman.

        Resource.setContent made private. It is delegating now to UISourceCodes which take care of domain specific actions.
        DebuggerResourceBinding was be removed and DebuggerResourceBinding.setScriptSource was moved to JavaScriptSource.
        ResourceDomainModelBinding was removed as well.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/CSSStyleModel.js:
        (WebInspector.CSSStyleModelResourceBinding):
        * inspector/front-end/DebuggerResourceBinding.js: Removed.
        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource.prototype.workingCopyCommitted):
        (WebInspector.JavaScriptSource.prototype._setScriptSource.didEditScriptSource):
        (WebInspector.JavaScriptSource.prototype._setScriptSource):
        * inspector/front-end/Resource.js:
        (WebInspector.Resource.prototype._setContent):
        (WebInspector.Resource.prototype.revertToOriginal):
        (WebInspector.Resource.prototype.revertAndClearHistory):
        (WebInspector.ResourceRevision.prototype.revertToThis):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StyleSource.prototype.isEditable):
        * inspector/front-end/UISourceCode.js:
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/Workspace.js:
        (WebInspector.Workspace):
        * inspector/front-end/inspector.html:

2012-07-04  'Pavel Feldman'  <pfeldman@chromium.org>

        Not reviewed: follow up to r121843, reduce inspector dock timeout to 200ms.

        * inspector/front-end/StatusBarButton.js:
        (WebInspector.StatusBarButton.prototype.makeLongClickEnabled.mouseDown):

2012-07-04  Ian Vollick  <vollick@chromium.org>

        [chromium] Correctly reject accelerated animations with certain rotations.
        https://bugs.webkit.org/show_bug.cgi?id=89768

        Reviewed by James Robinson.

        UnitTests:
          GraphicsLayerChromiumTest.createTransformAnimationWithBigRotation
          GraphicsLayerChromiumTest.createTransformAnimationWithRotationInvolvingNegativeAngles
          GraphicsLayerChromiumTest.createTransformAnimationWithSmallRotationInvolvingLargeAngles

        * platform/graphics/chromium/AnimationTranslationUtil.cpp:
        (WebCore::appendKeyframe):
        (WebCore::isRotationType):
        (WebCore):
        (WebCore::causesRotationOfAtLeast180Degrees):
        (WebCore::CCKeyframedTransformAnimationCurve):
        (WebCore::createActiveAnimation):
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::addAnimation):

2012-07-04  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: "Dock to right" shouldn't be in the settings dialog
        https://bugs.webkit.org/show_bug.cgi?id=76917

        Reviewed by Vsevolod Vlasov.

        Introduced 'long click-enabled' options for status bar buttons. Made dock/undock one of them.

        * inspector/front-end/Images/statusbarButtonGlyphs.png:
        * inspector/front-end/StatusBarButton.js:
        (WebInspector.StatusBarButton.prototype._clicked):
        (WebInspector.StatusBarButton.prototype.set visible):
        (WebInspector.StatusBarButton.prototype.makeLongClickEnabled.mouseDown):
        (WebInspector.StatusBarButton.prototype.makeLongClickEnabled.mouseUp):
        (WebInspector.StatusBarButton.prototype.makeLongClickEnabled):
        (WebInspector.StatusBarButton.prototype._showOptions.mouseOver):
        (WebInspector.StatusBarButton.prototype._showOptions.mouseOut):
        (WebInspector.StatusBarButton.prototype._showOptions.mouseUp):
        (WebInspector.StatusBarButton.prototype._showOptions):
        * inspector/front-end/UIUtils.js:
        (WebInspector.elementDragStart):
        (WebInspector.elementDragEnd):
        (WebInspector.GlassPane):
        (WebInspector.GlassPane.prototype.dispose):
        * inspector/front-end/inspector.css:
        (.long-click-glyph):
        (.long-click-glyph.shadow):
        (button.status-bar-item:active:not(.emulate-inactive), button.status-bar-item.emulate-active):
        (.alternate-status-bar-buttons-bar):
        (.alternate-status-bar-buttons-bar .status-bar-item):
        * inspector/front-end/inspector.js:
        (WebInspector._createGlobalStatusBarItems):
        (WebInspector._createDockOptions.onClick.set else):
        (WebInspector._createDockOptions.onClick):

2012-07-04  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r121813.
        http://trac.webkit.org/changeset/121813
        https://bugs.webkit.org/show_bug.cgi?id=90522

        Causes browser_tests failure:
        ErrorPageTest.DNSError_GoBack2{Forward2,AndForward} on
        Chromium {Linux,Mac,Win} (Requested by yosin on #webkit).

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::commitData):
        (WebCore::DocumentLoader::setupForReplaceByMIMEType):
        * testing/js/WebCoreTestSupport.cpp:
        (WebCoreTestSupport::resetInternalsObject):

2012-07-04  Kihong Kwon  <kihong.kwon@samsung.com>

        [EFL] Change format of return value of navigator.language
        https://bugs.webkit.org/show_bug.cgi?id=89639

        Reviewed by Kenneth Rohde Christiansen.

        Remove encoding type from return value of navigator.language.
        For example, from en-US.UTF-8 to en-US.

        Use exist test case (fast/js/navigator-language.html).

        * platform/efl/LanguageEfl.cpp:
        (WebCore::platformLanguage):

2012-07-03  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Don't show accel labels in context menu items
        https://bugs.webkit.org/show_bug.cgi?id=90437

        Reviewed by Martin Robinson.

        When a context menu item is created with a GtkMenuItem that has
        been created from a GtkAction, if the action has an accelerator,
        it's shown in the menu item label, like menu items in a menu
        bar. In that case we should reset the accel closure of the menu
        item label, like GtkUIManager does for popup menus, to make sure
        the accelerator is not shown. This isn't needed for all other
        ContextMenuIem constructors, because the GtkAction is created
        without accelerator by webkit in those cases.

        * platform/gtk/ContextMenuItemGtk.cpp:
        (WebCore::ContextMenuItem::ContextMenuItem):

2012-07-03  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] Move BatteryClientEfl from WebKit to WebCore
        https://bugs.webkit.org/show_bug.cgi?id=90063

        Reviewed by Kenneth Rohde Christiansen.

        Move BatteryClientEfl class from WebKit to WebCore
        so that it can be reused in WebKit2.

        No new tests, no behavior change.

        * PlatformEfl.cmake:
        * platform/efl/BatteryClientEfl.cpp: Renamed from Source/WebKit/efl/WebCoreSupport/BatteryClientEfl.cpp.
        (WebCore):
        (WebCore::BatteryClientEfl::BatteryClientEfl):
        (WebCore::BatteryClientEfl::setController):
        (WebCore::BatteryClientEfl::startUpdating):
        (WebCore::BatteryClientEfl::stopUpdating):
        (WebCore::BatteryClientEfl::batteryControllerDestroyed):
        (WebCore::BatteryClientEfl::setBatteryStatus):
        (WebCore::BatteryClientEfl::timerFired):
        (WebCore::BatteryClientEfl::getBatteryStatus):
        (WebCore::BatteryClientEfl::setBatteryClient):
        * platform/efl/BatteryClientEfl.h: Renamed from Source/WebKit/efl/WebCoreSupport/BatteryClientEfl.h.
        (WebCore):
        (BatteryClientEfl):
        (WebCore::BatteryClientEfl::~BatteryClientEfl):
        (WebCore::BatteryClientEfl::batteryStatus):

2012-07-03  Huang Dongsung  <luxtella@company100.net>

        Add a comment in order to clarify why
        BitmapImage::frameHasAlphaAtIndex returns true as default.
        https://bugs.webkit.org/show_bug.cgi?id=90445

        Reviewed by Eric Seidel.

        No new tests. This patch doesn't change behavior.

        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::frameHasAlphaAtIndex):
        (WebCore):

2012-07-03  Alex Sakhartchouk  <alexst@chromium.org>

        [chromium] Avoid calling getUniformLocation??() in the compositor startup
        https://bugs.webkit.org/show_bug.cgi?id=90217

        Reviewed by Adrienne Walker.

        This change allows chrome compositor to bind uniform locations instead of querying 
        them from the graphics context by using GL_CHROMIUM_bind_uniform_location.

        The extention itself is tested in chromium and the change in webkit simply adds
        plumbing to allow its usage. Existing pixel tests would be able to verify proper behaviour.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::LayerRendererChromium):
        (WebCore::LayerRendererChromium::initialize):
        (WebCore::LayerRendererChromium::initializeSharedObjects):
        (WebCore::LayerRendererChromium::tileCheckerboardProgram):
        (WebCore::LayerRendererChromium::solidColorProgram):
        (WebCore::LayerRendererChromium::headsUpDisplayProgram):
        (WebCore::LayerRendererChromium::renderPassProgram):
        (WebCore::LayerRendererChromium::renderPassProgramAA):
        (WebCore::LayerRendererChromium::renderPassMaskProgram):
        (WebCore::LayerRendererChromium::renderPassMaskProgramAA):
        (WebCore::LayerRendererChromium::tileProgram):
        (WebCore::LayerRendererChromium::tileProgramOpaque):
        (WebCore::LayerRendererChromium::tileProgramAA):
        (WebCore::LayerRendererChromium::tileProgramSwizzle):
        (WebCore::LayerRendererChromium::tileProgramSwizzleOpaque):
        (WebCore::LayerRendererChromium::tileProgramSwizzleAA):
        (WebCore::LayerRendererChromium::textureProgram):
        (WebCore::LayerRendererChromium::textureProgramFlip):
        (WebCore::LayerRendererChromium::textureIOSurfaceProgram):
        (WebCore::LayerRendererChromium::videoYUVProgram):
        (WebCore::LayerRendererChromium::videoStreamTextureProgram):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        * platform/graphics/chromium/ProgramBinding.cpp:
        (WebCore::ProgramBindingBase::ProgramBindingBase):
        (WebCore::ProgramBindingBase::~ProgramBindingBase):
        (WebCore::ProgramBindingBase::init):
        (WebCore::ProgramBindingBase::link):
        (WebCore):
        (WebCore::ProgramBindingBase::cleanup):
        (WebCore::ProgramBindingBase::createShaderProgram):
        (WebCore::ProgramBindingBase::cleanupShaders):
        * platform/graphics/chromium/ProgramBinding.h:
        (ProgramBindingBase):
        (WebCore::ProgramBinding::initialize):
        * platform/graphics/chromium/ShaderChromium.cpp:
        (WebCore::VertexShaderPosTex::init):
        (WebCore::VertexShaderPosTexYUVStretch::init):
        (WebCore::VertexShaderPos::init):
        (WebCore::VertexShaderPosTexTransform::init):
        (WebCore::VertexShaderQuad::init):
        (WebCore::VertexShaderTile::init):
        (WebCore::VertexShaderVideoTransform::init):
        (WebCore::FragmentTexAlphaBinding::init):
        (WebCore::FragmentTexOpaqueBinding::init):
        (WebCore::FragmentShaderOESImageExternal::init):
        (WebCore::FragmentShaderRGBATexAlphaAA::init):
        (WebCore::FragmentTexClampAlphaAABinding::init):
        (WebCore::FragmentShaderRGBATexAlphaMask::init):
        (WebCore::FragmentShaderRGBATexAlphaMaskAA::init):
        (WebCore::FragmentShaderYUVVideo::init):
        (WebCore::FragmentShaderColor::init):
        (WebCore::FragmentShaderCheckerboard::init):
        * platform/graphics/chromium/ShaderChromium.h:
        (VertexShaderPosTex):
        (VertexShaderPosTexYUVStretch):
        (VertexShaderPos):
        (WebCore::VertexShaderPosTexIdentity::init):
        (VertexShaderPosTexTransform):
        (VertexShaderQuad):
        (VertexShaderTile):
        (VertexShaderVideoTransform):
        (FragmentTexAlphaBinding):
        (FragmentTexOpaqueBinding):
        (FragmentShaderOESImageExternal):
        (FragmentShaderRGBATexAlphaAA):
        (FragmentTexClampAlphaAABinding):
        (FragmentShaderRGBATexAlphaMask):
        (FragmentShaderRGBATexAlphaMaskAA):
        (FragmentShaderYUVVideo):
        (FragmentShaderColor):
        (FragmentShaderCheckerboard):
        * platform/graphics/chromium/TextureCopier.cpp:
        (WebCore::AcceleratedTextureCopier::AcceleratedTextureCopier):
        (WebCore::AcceleratedTextureCopier::copyTexture):
        * platform/graphics/chromium/TextureCopier.h:
        (WebCore::AcceleratedTextureCopier::create):
        (AcceleratedTextureCopier):

2012-07-03  Erik Arvidsson  <arv@chromium.org>

        [V8] Remove enableFasterDOMStoreAccess which is never used
        https://bugs.webkit.org/show_bug.cgi?id=90489

        Reviewed by Adam Barth.

        No new tests. Dead code removal.

        * bindings/v8/V8DOMMap.cpp:
        * bindings/v8/V8DOMMap.h:
        (WebCore):

2012-07-03  Joshua Bell  <jsbell@chromium.org>

        Binding: IDL type DOMString[] shouldn't match null
        https://bugs.webkit.org/show_bug.cgi?id=84217

        Reviewed by Kentaro Hara.

        Similar to r121714, IDL overloads with T[] (which is only minimally supported)
        were being treated as Nullable by default during overloaded method dispatching,
        which deviates from the WebIDL specification. Extend the previous change to
        look for Nullable (specified by "?" type suffix in the IDL) for array types.

        Also, after inspection of the spec, use a strict "is this an Array?" test in
        the JS generator rather than an "inherits from Array.prototype?" test, to
        match the WebIDL spec.

        IDL files with affected overloads are modified to include the "?" suffix
        so that no behavior changes are introduced by this patch - the JS and V8
        generator results before/after the change show no diffs apart from the stricter
        isJSArray() test.

        Test: bindings/scripts/test/TestObj.idl (a non-Nullable T[] overload)

        * Modules/indexeddb/IDBDatabase.idl: Tag T[] overloads with ? suffix.
        * Modules/indexeddb/IDBObjectStore.idl: Ditto.
        * Modules/vibration/NavigatorVibration.idl: Ditto.
        * bindings/scripts/CodeGeneratorJS.pm: Check isNullable for T[].
        (GenerateParametersCheckExpression):
        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
        (GenerateParametersCheckExpression):
        * bindings/scripts/test/JS/JSTestObj.cpp: Rebaselined.
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod9):
        (WebCore):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod):
        * bindings/scripts/test/TestObj.idl: Tag existing T[] with ?, add non-? T[].
        * bindings/scripts/test/V8/V8TestObj.cpp: Rebaselined.
        (WebCore::TestObjV8Internal::overloadedMethod9Callback):
        (TestObjV8Internal):
        (WebCore::TestObjV8Internal::overloadedMethodCallback):

2012-07-03  Nate Chapin  <japhet@chromium.org>

        REGRESSION (r115654): Sometimes does not replace content for multipart/x-mixed-replace
        https://bugs.webkit.org/show_bug.cgi?id=88436

        Reviewed by Brady Eidson.

        Test: http/tests/multipart/multipart-replace-non-html-content.php

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::commitData): We should only send receivedFirstData() once per main resource load,
            rather than multiple times in a multipart load. 
        (WebCore::DocumentLoader::setupForReplaceByMIMEType): m_gotFirstByte isn't set to true until data is
            actually committed, and multipart data is often not committed until the part is finished. Check
            whether the SharedBuffer is non-null instead.
        * testing/js/WebCoreTestSupport.cpp:
        (WebCoreTestSupport::resetInternalsObject): The JSInternals object my have already been cleared if the window shell
            was cleared as part of creation of a new Document. Check it before using it.

2012-07-03  Raymond Toy  <rtoy@google.com>

        Add AudioFIFO class and simplify AudioPullFIFO
        https://bugs.webkit.org/show_bug.cgi?id=90398

        Reviewed by Chris Rogers.

        No new tests. This code will be used in audio back-end implementation.

        Add AudioFIFO class to implement main parts of FIFO.  Simplify
        implementation of AudioPushFIFO by using AudioFIFO.
        
        * WebCore.gypi: Add new files.

        New AudioFIFO class
        * platform/audio/AudioFIFO.cpp: Copied from Source/WebCore/platform/audio/AudioPullFIFO.cpp.
        (WebCore):
        (WebCore::AudioFIFO::AudioFIFO):
        (WebCore::AudioFIFO::consume):
        (WebCore::AudioFIFO::push):
        (WebCore::AudioFIFO::findWrapLengths):
        * platform/audio/AudioFIFO.h: Copied from Source/WebCore/platform/audio/AudioPullFIFO.h.
        (WebCore):
        (AudioFIFO):
        (WebCore::AudioFIFO::framesInFifo):
        (WebCore::AudioFIFO::updateIndex):

        Use AudioFIFO
        * platform/audio/AudioPullFIFO.cpp:
        (WebCore::AudioPullFIFO::AudioPullFIFO):
        (WebCore::AudioPullFIFO::consume):
        (WebCore::AudioPullFIFO::fillBuffer):
        * platform/audio/AudioPullFIFO.h:
        (AudioPullFIFO):

2012-07-03  Nate Chapin  <japhet@chromium.org>

        Protect this DocumentThreadableLoader in cancel() to handle reentrancy properly.
        https://bugs.webkit.org/show_bug.cgi?id=90483

        Reviewed by Abhishek Arya.

        No new tests, covered by http/tests/xmlhttprequest/reentrant-cancel.html

        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::cancel):

2012-07-03  Tony Chang  <tony@chromium.org>

        [chromium] Unreviewed, update .gitignore to handle VS2010 files.

        * WebCore.gyp/.gitignore:

2012-07-03  Zan Dobersek  <zandobersek@gmail.com>

        [Gtk][Gamepads] 'warning: comparison is always true due to limited range of data type [-Wtype-limits]' in GamepadsGtk.cpp
        https://bugs.webkit.org/show_bug.cgi?id=90477

        Reviewed by Martin Robinson.

        Vector::find() returns value of type size_t, springing errors when
        assigning the value to a variable of type unsigned. Use size_t type
        for that variable instead.

        No new tests - no changed functionality.

        * platform/gtk/GamepadsGtk.cpp:
        (WebCore::GamepadsGtk::unregisterDevice):

2012-07-03  Dominik Röttsches  <dominik.rottsches@intel.com>

        Fix LayoutUnit usage in RenderImage::imageDimensionsChanged
        https://bugs.webkit.org/show_bug.cgi?id=90173

        Reviewed by Eric Seidel.

        The appropriate type should be used for storing width() and height() into local temporary variables.

        No new tests, no change in behavior.

        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::imageDimensionsChanged):

2012-07-03  Sergio Villar Senin  <svillar@igalia.com>

        [TextureMapper] Typo in edge-distance anti-aliasing code
        https://bugs.webkit.org/show_bug.cgi?id=90475

        Reviewed by Martin Robinson.

        No new tests. This just fixes a typo.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::drawQuad):

2012-06-27  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: [Extensions API] Resource manipulations should be based on UISourceCode thus extending Sources Panel.
        https://bugs.webkit.org/show_bug.cgi?id=89868

        Reviewed by Pavel Feldman.

        Extensions API is now based on both ScriptsPanel acting as a UISourceCodeProvider and ResourceTreeModel.
        Extensions API resource could be for any content provider now.
        Extensions API resource.setContent implementation is now based on UISourceCode editing methods.
        Drive-by StyleSource insremental editing timeout fix.

        * inspector/front-end/ExtensionServer.js:
        (WebInspector.ExtensionServer.prototype._handleOpenURL):
        (WebInspector.ExtensionServer.prototype._makeResource):
        (WebInspector.ExtensionServer.prototype._onGetPageResources):
        (WebInspector.ExtensionServer.prototype._getResourceContent):
        (WebInspector.ExtensionServer.prototype._onGetResourceContent):
        (WebInspector.ExtensionServer.prototype._onSetResourceContent):
        (WebInspector.ExtensionServer.prototype._notifyResourceAdded):
        (WebInspector.ExtensionServer.prototype._notifyResourceContentCommitted):
        * inspector/front-end/JavaScriptSource.js:
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.uiSourceCodes):
        (WebInspector.ScriptsPanel.prototype.uiSourceCodeForURL):
        (WebInspector.ScriptsPanel.prototype._addUISourceCode):
        (WebInspector.ScriptsPanel.prototype._reset):
        (WebInspector.ScriptsPanel.prototype.canShowAnchorLocation):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StyleSource.prototype.workingCopyCommitted):
        (WebInspector.StyleSource.prototype.workingCopyChanged):
        (WebInspector.StyleSource.prototype._callOrSetTimeout):
        (WebInspector.StyleSource.prototype._commitIncrementalEdit):
        (WebInspector.StyleSource.prototype._clearIncrementalUpdateTimer):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode.prototype.requestContent):
        (WebInspector.UISourceCode.prototype.workingCopy):
        (WebInspector.UISourceCode.prototype.setWorkingCopy):
        (WebInspector.UISourceCode.prototype.isDirty):

2012-07-03  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Anonymous scripts (evals) should not be added to Workspace.
        https://bugs.webkit.org/show_bug.cgi?id=90467

        Reviewed by Pavel Feldman.

        * inspector/front-end/ResourceScriptMapping.js:
        (WebInspector.ResourceScriptMapping.prototype.rawLocationToUILocation):
        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeAdded):
        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeReplaced):
        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeRemoved):
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.ScriptSnippetModel.prototype._createUISourceCodeForScript):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._uiSourceCodeAdded):

2012-07-03  Robert Hogan  <robert@webkit.org>

        CSS 2.1 failure: floats-wrap-top-below-inline-* fail
        https://bugs.webkit.org/show_bug.cgi?id=88171

        Reviewed by Eric Seidel.

        When shifting a line or element left or right to avoid a float use the height
        of the line or element to determine whether the float is inside the element or
        if it overlaps the bottom of the element. 

        Do this by passing the height of the element to the interval tree used to detect
        the overlap with it's containing block's floats. The height is zero by default so
        callers to logical[Left|Right]OffsetForLine will need to pass the height if they
        want to use it to detect floats to avoid.

        Tests: css2.1/20110323/floats-wrap-top-below-bfc-001l.htm
               css2.1/20110323/floats-wrap-top-below-bfc-001r.htm
               css2.1/20110323/floats-wrap-top-below-bfc-002l.htm
               css2.1/20110323/floats-wrap-top-below-bfc-002r.htm
               css2.1/20110323/floats-wrap-top-below-bfc-003l.htm
               css2.1/20110323/floats-wrap-top-below-bfc-003r.htm
               css2.1/20110323/floats-wrap-top-below-inline-001l.htm
               css2.1/20110323/floats-wrap-top-below-inline-001r.htm
               css2.1/20110323/floats-wrap-top-below-inline-002l.htm
               css2.1/20110323/floats-wrap-top-below-inline-002r.htm
               css2.1/20110323/floats-wrap-top-below-inline-003l.htm
               css2.1/20110323/floats-wrap-top-below-inline-003r.htm
               css2.1/20110323/floats-zero-height-wrap-001.htm
               css2.1/20110323/floats-zero-height-wrap-002.htm
               fast/block/float/floats-wrap-inside-inline-001.htm
               fast/block/float/floats-wrap-inside-inline-002.htm
               fast/block/float/floats-wrap-inside-inline-003.htm
               fast/block/float/floats-wrap-inside-inline-004.htm
               fast/block/float/floats-wrap-inside-inline-005.htm

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeStartPositionDeltaForChildAvoidingFloats):
        (WebCore::::collectIfNeeded):
        (WebCore::RenderBlock::logicalLeftOffsetForLine):
        (WebCore::RenderBlock::logicalRightOffsetForLine):
        (WebCore::RenderBlock::getClearDelta):
        * rendering/RenderBlock.h:
        (WebCore::RenderBlock::availableLogicalWidthForLine):
        (WebCore::RenderBlock::logicalRightOffsetForLine):
        (WebCore::RenderBlock::logicalLeftOffsetForLine):
        (WebCore::RenderBlock::startOffsetForLine):
        (WebCore::RenderBlock::endOffsetForLine):
        (WebCore::RenderBlock::pixelSnappedLogicalLeftOffsetForLine):
        (WebCore::RenderBlock::pixelSnappedLogicalRightOffsetForLine):
        (RenderBlock):
        (WebCore::RenderBlock::FloatIntervalSearchAdapter::FloatIntervalSearchAdapter):
        (WebCore::RenderBlock::FloatIntervalSearchAdapter::lowValue):
        (WebCore::RenderBlock::FloatIntervalSearchAdapter::highValue):
        (FloatIntervalSearchAdapter):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::logicalBottomForLine):
        (WebCore):
        (WebCore::LineWidth::updateAvailableWidth):
        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::containingBlockAvailableLineWidthInRegion):

2012-07-03  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Introduce Workspace make it UISourceCode provider for ScriptsPanel.
        https://bugs.webkit.org/show_bug.cgi?id=90466

        Reviewed by Pavel Feldman.

        Introduced WebInspector.Workspace as a model (UISourceCode provider) behind ScriptsPanel.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/ScriptsPanel.js:
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/Workspace.js: Added.
        (WebInspector.CompositeUISourceCodeProvider):
        (WebInspector.CompositeUISourceCodeProvider.prototype._registerUISourceCodeProvider):
        (WebInspector.CompositeUISourceCodeProvider.prototype._handleUISourceCodeAdded):
        (WebInspector.CompositeUISourceCodeProvider.prototype._handleUISourceCodeReplaced):
        (WebInspector.CompositeUISourceCodeProvider.prototype._handleUISourceCodeRemoved):
        (WebInspector.CompositeUISourceCodeProvider.prototype.uiSourceCodes):
        (WebInspector.Workspace):
        (WebInspector.Workspace.prototype.registerUISourceCodeProvider):
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:

2012-07-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>

        [Qt] Make use of .qmake.cache for caching features

        Instead of loading() features from the files that need them (and re-running
        a bunch of checks), we now run feature detection as part of configure.pro,
        and have build-webkit write the computed feature-defines and CONFIG to
        .qmake.cache, which is then loaded by qmake _before_ even defaults_pre
        when building WebKit.pro.

        At some point we'll be able to selectivly prevent running of config tests
        in configure.pro, which means we don't need a separate code-path for
        the build-webkit --help case.

        We should also move the code in build-webkit that now uses .webkit.config
        to detect clean builds, to use .qmake.cache, since we now store the same
        thing there.

        Original patch by Oswald Buddenhagen <oswald.buddenhagen@nokia.com>

        https://bugs.webkit.org/show_bug.cgi?id=90461

        Reviewed by Tor Arne Vestbø.

        * DerivedSources.pri:
        * WebCore.pri:

2012-07-03  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r121766.
        http://trac.webkit.org/changeset/121766
        https://bugs.webkit.org/show_bug.cgi?id=90465

        It caused flakey build errors on the bots (Requested by Ossy
        on #webkit).

        * DerivedSources.pri:
        * WebCore.pri:

2012-07-03  George Staikos  <staikos@webkit.org>

        [BlackBerry] Enable Custom Scheme Handlers for BlackBerry.
        https://bugs.webkit.org/show_bug.cgi?id=90422

        Reviewed by Rob Buis.

        * page/NavigatorRegisterProtocolHandler.cpp:
        (WebCore::initProtocolHandlerWhitelist): Disable the overrides as
                                                 they're undesired by BlackBerry

2012-07-03  Eugene Klyuchnikov  <eustas.bug@gmail.com>

        Web Inspector: Forward message loop instrumentation data to frontend.
        https://bugs.webkit.org/show_bug.cgi?id=89584

        Reviewed by Yury Semikhatsky.

        Transmit collected message loop tasks to inspector frontend.
        Now "Program" should be a top-level event on browsers that
        support message loop instrumentation.
        Frontend was changed so that user will not see any changes.

        * inspector/InspectorTimelineAgent.cpp:
        (TimelineRecordType):
        Added new event type - "Program"
        (WebCore::InspectorTimelineAgent::willProcessTask):
        Begin "Program" event.
        (WebCore::InspectorTimelineAgent::didProcessTask):
        Finish "Program" event.
        (WebCore::InspectorTimelineAgent::setHeapSizeStatistic):
        Do not add counters to "Program" events.
        (WebCore):
        (WebCore::InspectorTimelineAgent::innerSetHeapSizeStatistic):
        Renamed from "setHeapSizeStatistic"
        * inspector/InspectorTimelineAgent.h:
        (InspectorTimelineAgent):
        * inspector/front-end/MemoryStatistics.js:
        (WebInspector.MemoryStatistics.prototype._onRecordAdded):
        Unwraps "Program" events.
        (WebInspector.MemoryStatistics.prototype._innerRecordAdded):
        Renamed from "_onRecordAdded"
        * inspector/front-end/TimelineFrameController.js:
        (WebInspector.TimelineFrameController.prototype._addRecord):
        Unwraps "Program" events.
        (WebInspector.TimelineFrameController.prototype._innerAddRecord):
        Renamed from "_addRecord"
        * inspector/front-end/TimelineModel.js:
        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineCategoryStrips.prototype.update.appendRecord):
        Filter out "Program" category.
        (WebInspector.TimelineCategoryStrips.prototype.update):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
        Filter out "Program" category.
        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
        Unwraps "Program" events.
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.categories):
        Added "Program" category.
        (WebInspector.TimelinePresentationModel.recordStyle):
        Ditto.
        (WebInspector.TimelinePresentationModel.prototype.addRecord):
        Unwraps "Program" events.
        (WebInspector.TimelinePresentationModel.prototype._addRecord):
        Renamed from "addRecord"

2012-07-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>

        [Qt] Make use of .qmake.cache for caching features

        Instead of loading() features from the files that need them (and re-running
        a bunch of checks), we now run feature detection as part of configure.pro,
        and have build-webkit write the computed feature-defines and CONFIG to
        .qmake.cache, which is then loaded by qmake _before_ even defaults_pre
        when building WebKit.pro.

        At some point we'll be able to selectivly prevent running of config tests
        in configure.pro, which means we don't need a separate code-path for
        the build-webkit --help case.

        We should also move the code in build-webkit that now uses .webkit.config
        to detect clean builds, to use .qmake.cache, since we now store the same
        thing there.

        Original patch by Oswald Buddenhagen <oswald.buddenhagen@nokia.com>

        https://bugs.webkit.org/show_bug.cgi?id=90461

        Reviewed by Tor Arne Vestbø.

        * DerivedSources.pri:
        * WebCore.pri:

2012-07-03  Vsevolod Vlasov  <vsevik@chromium.org>

        inspector/debugger/script-snippet-model.html fails
        https://bugs.webkit.org/show_bug.cgi?id=90385

        Reviewed by Pavel Feldman.

        * inspector/front-end/ScriptSnippetModel.js:

2012-07-03  Alexander Pavlov  <apavlov@chromium.org>

        [REGRESSION] Crash when copying a StyleRuleMedia with a NULL m_mediaQueries
        https://bugs.webkit.org/show_bug.cgi?id=90459

        Reviewed by Andreas Kling.

        Create StyleRuleMedia with a non-NULL MediaQuerySet. The respective NULL checks for it were all over the code,
        except the copy constructor. Added the check, just in case.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::createMediaRule):
        * css/StyleRule.cpp:
        (WebCore::StyleRuleMedia::StyleRuleMedia):

2012-07-03  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: display time intervals measured with console.time() and console.timeEnd() in Timeline
        https://bugs.webkit.org/show_bug.cgi?id=90442

        Reviewed by Pavel Feldman.

        - added Time and TimeEnd record types produced by console.time() and console.timeEnd()
        - connect Time to TimeEnd in "glue" mode to better visualize the interval;
        - always make Time a top-level record;

        * English.lproj/localizedStrings.js:
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::startConsoleTimingImpl):
        (WebCore::InspectorInstrumentation::stopConsoleTimingImpl):
        * inspector/InspectorTimelineAgent.cpp:
        (TimelineRecordType):
        (WebCore::InspectorTimelineAgent::didStartTiming):
        (WebCore):
        (WebCore::InspectorTimelineAgent::didStopTiming):
        * inspector/InspectorTimelineAgent.h:
        (InspectorTimelineAgent):
        * inspector/front-end/TimelineModel.js:
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.recordStyle):
        (WebInspector.TimelinePresentationModel.categoryForRecord):
        (WebInspector.TimelinePresentationModel.prototype.reset):
        (WebInspector.TimelinePresentationModel.prototype.addRecord):
        (WebInspector.TimelinePresentationModel.prototype._findParentRecord):
        (WebInspector.TimelinePresentationModel.Record):
        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):

2012-07-03  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>  Joel Dillon <joel.dillon@codethink.co.uk>

        [Qt][Win] Fix broken QtWebKit5.lib linking
        https://bugs.webkit.org/show_bug.cgi?id=88321

        Reviewed by Kenneth Rohde Christiansen.

        * platform/PlatformExportMacros.h:

2012-07-03  Philip Rogers  <pdr@google.com>

        Fix text positioning with non-bmp characters.
        https://bugs.webkit.org/show_bug.cgi?id=87681

        Reviewed by Nikolas Zimmermann.

        Previously when constructing metrics for tspans with non-bmp characters,
        each non-bmp character treated as a skipped character in the same way that
        spaces are ignored.
        This made sense because the initial SVGCharacterDataMap for <text> is
        indexed by character index (not string length) so the high portion of a
        non-bmp character was treated as a skipped space. Unfortunately, this
        led to a bug because skipped spaces lead to an offset in the positioning
        values list but non-bmp characters do not.

        This change switches the code to use a new offset for non-bmp characters,
        surrogatePairCharacters, which does not affect the positioning values list.

        Tests: svg/text/non-bmp-tspans-expected.svg
               svg/text/non-bmp-tspans.svg

        * rendering/svg/SVGTextMetricsBuilder.cpp:
        (WebCore::SVGTextMetricsBuilder::measureTextRenderer):

2012-07-03  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Improve test cases for network information APIs
        https://bugs.webkit.org/show_bug.cgi?id=90162

        Reviewed by Adam Barth.

        Existing implementation doesn't test port implementation in network info APIs.
        This patch lets test cases use bandwidth and metered functions implemented by port layer.

        In addition, expected results need to check return type instead of property name.

        No new tests. Covered by existing tests.

        * Modules/networkinfo/NetworkInfoConnection.cpp:
        (WebCore::NetworkInfoConnection::bandwidth):
        (WebCore::NetworkInfoConnection::metered):

2012-07-03  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>

        [EFL] [WK2] Don't call eina_iterator_free() if iterator is NULL
        https://bugs.webkit.org/show_bug.cgi?id=90076

        Reviewed by Kenneth Rohde Christiansen.

        Add a null check to prevent calling eina_iterator_free() when
        iterator is NULL.

        No new tests. This patch doesn't change behavior.

        * platform/efl/FileSystemEfl.cpp:
        (WebCore::listDirectory): Early return when iterator is NULL.

2012-07-03  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: [Elements] Text formatting is not retained when editing <script> or <style> contents as text
        https://bugs.webkit.org/show_bug.cgi?id=90440

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/ElementsTreeOutline.js:
        (WebInspector.ElementsTreeElement.prototype._startEditingTextNode):

2012-07-03  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Save scroll selection and cursor position of SourceFrames in sources panel.
        https://bugs.webkit.org/show_bug.cgi?id=90294

        Reviewed by Yury Semikhatsky.

        Scroll and selection change handling is now delegated from TextViewer to SourceFrame.
        SourceFrame now dispatches ScrollChanged and SelectionChanged events.
        TabbedEditorContainer now saves scroll and selection information together
        with the url history and restores scroll and selection on resource opening.

        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.setExecutionLine):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame.prototype.wasShown):
        (WebInspector.SourceFrame.prototype.highlightLine):
        (WebInspector.SourceFrame.prototype._innerHighlightLineIfNeeded):
        (WebInspector.SourceFrame.prototype._clearLineHighlight):
        (WebInspector.SourceFrame.prototype.revealLine):
        (WebInspector.SourceFrame.prototype._innerRevealLineIfNeeded):
        (WebInspector.SourceFrame.prototype._clearLineToReveal):
        (WebInspector.SourceFrame.prototype.scrollToLine):
        (WebInspector.SourceFrame.prototype._innerScrollToLineIfNeeded):
        (WebInspector.SourceFrame.prototype._clearLineToScrollTo):
        (WebInspector.SourceFrame.prototype.setSelection):
        (WebInspector.SourceFrame.prototype._innerSetSelectionIfNeeded):
        (WebInspector.SourceFrame.prototype._wasShownOrLoaded):
        (WebInspector.SourceFrame.prototype.setContent):
        (WebInspector.SourceFrame.prototype.commitEditing):
        (WebInspector.SourceFrame.prototype.selectionChanged):
        (WebInspector.SourceFrame.prototype.scrollChanged):
        (WebInspector.TextViewerDelegateForSourceFrame.prototype.selectionChanged):
        (WebInspector.TextViewerDelegateForSourceFrame.prototype.scrollChanged):
        * inspector/front-end/TabbedEditorContainer.js:
        (WebInspector.TabbedEditorContainer):
        (WebInspector.TabbedEditorContainer.prototype._addScrollAndSelectionListeners):
        (WebInspector.TabbedEditorContainer.prototype._removeScrollAndSelectionListeners):
        (WebInspector.TabbedEditorContainer.prototype._scrollChanged):
        (WebInspector.TabbedEditorContainer.prototype._selectionChanged):
        (WebInspector.TabbedEditorContainer.prototype._appendFileTab):
        (WebInspector.TabbedEditorContainer.prototype._tabClosed):
        (WebInspector.TabbedEditorContainer.HistoryItem):
        (WebInspector.TabbedEditorContainer.HistoryItem.fromObject):
        (WebInspector.TabbedEditorContainer.HistoryItem.prototype.serializeToObject):
        (WebInspector.TabbedEditorContainer.History):
        (WebInspector.TabbedEditorContainer.History.fromObject):
        (WebInspector.TabbedEditorContainer.History.prototype.index):
        (WebInspector.TabbedEditorContainer.History.prototype.selectionRange):
        (WebInspector.TabbedEditorContainer.History.prototype.updateSelectionRange):
        (WebInspector.TabbedEditorContainer.History.prototype.scrollLineNumber):
        (WebInspector.TabbedEditorContainer.History.prototype.updateScrollLineNumber):
        (WebInspector.TabbedEditorContainer.History.prototype.update):
        (WebInspector.TabbedEditorContainer.History.prototype.remove):
        (WebInspector.TabbedEditorContainer.History.prototype.save):
        (WebInspector.TabbedEditorContainer.History.prototype.set _serializeToObject):
        * inspector/front-end/TextEditorModel.js:
        (WebInspector.TextRange.fromObject):
        (WebInspector.TextRange.prototype.clone):
        (WebInspector.TextRange.prototype.serializeToObject):
        * inspector/front-end/TextViewer.js:
        (WebInspector.TextViewer.prototype._handleScrollChanged):
        (WebInspector.TextViewer.prototype.scrollToLine):
        (WebInspector.TextViewer.prototype._handleSelectionChange):
        (WebInspector.TextViewer.prototype.setSelection):
        (WebInspector.TextViewer.prototype.wasShown):
        (WebInspector.TextViewer.prototype._handleFocused):
        (WebInspector.TextViewer.prototype.willHide):
        (WebInspector.TextViewerDelegate.prototype.selectionChanged):
        (WebInspector.TextViewerDelegate.prototype.scrollChanged):
        (WebInspector.TextEditorChunkedPanel.prototype.scrollToLine):

2012-07-03  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Make DirectoryContentView sortable
        https://bugs.webkit.org/show_bug.cgi?id=90361

        Reviewed by Vsevolod Vlasov.

        * inspector/Inspector.json:
        * inspector/InspectorFileSystemAgent.cpp:
        (WebCore):
        * inspector/front-end/DirectoryContentView.js:
        (WebInspector.DirectoryContentView):
        (WebInspector.DirectoryContentView.prototype.showEntries):
        (WebInspector.DirectoryContentView.prototype._sort):
        (WebInspector.DirectoryContentView.Node.comparator.isDirectoryCompare):
        (WebInspector.DirectoryContentView.Node.comparator.nameCompare):
        (WebInspector.DirectoryContentView.Node.comparator.typeCompare):
        (WebInspector.DirectoryContentView.Node.comparator.sizeCompare):
        (WebInspector.DirectoryContentView.Node.comparator):
        (WebInspector.DirectoryContentView.Node.prototype._metadataReceived):

2012-07-03  Jan Keromnes  <janx@linux.com>

        Web Inspector: WebInspector.TextViewer should be renamed WebInspector.TextEditor
        https://bugs.webkit.org/show_bug.cgi?id=89939

        Reviewed by Vsevolod Vlasov.

        Fixed LayoutTests and PerformanceTests accordingly.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/AdvancedSearchController.js:
        (WebInspector.SearchView):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame):
        (WebInspector.JavaScriptSourceFrame.prototype._onHidePopover):
        (WebInspector.JavaScriptSourceFrame.prototype._addBreakpointDecoration):
        (WebInspector.JavaScriptSourceFrame.prototype._removeBreakpointDecoration):
        (WebInspector.JavaScriptSourceFrame.prototype._editBreakpointCondition.finishEditing):
        (WebInspector.JavaScriptSourceFrame.prototype._editBreakpointCondition):
        (WebInspector.JavaScriptSourceFrame.prototype.setExecutionLine):
        (WebInspector.JavaScriptSourceFrame.prototype.clearExecutionLine):
        (WebInspector.JavaScriptSourceFrame.prototype.onTextEditorContentLoaded):
        (WebInspector.JavaScriptSourceFrame.prototype.toggleBreakpointOnCurrentLine):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame):
        (WebInspector.SourceFrame.prototype.wasShown):
        (WebInspector.SourceFrame.prototype.willHide):
        (WebInspector.SourceFrame.prototype.defaultFocusedElement):
        (WebInspector.SourceFrame.prototype.get textEditor):
        (WebInspector.SourceFrame.prototype.clearMessages):
        (WebInspector.SourceFrame.prototype.highlightLine):
        (WebInspector.SourceFrame.prototype._clearLineHighlight):
        (WebInspector.SourceFrame.prototype.revealLine):
        (WebInspector.SourceFrame.prototype.setSelection):
        (WebInspector.SourceFrame.prototype.setContent):
        (WebInspector.SourceFrame.prototype.onTextEditorContentLoaded):
        (WebInspector.SourceFrame.prototype._setTextEditorDecorations):
        (WebInspector.SourceFrame.prototype.searchCanceled):
        (WebInspector.SourceFrame.prototype.jumpToSearchResult):
        (WebInspector.SourceFrame.prototype.addMessageToSource):
        (WebInspector.SourceFrame.prototype.removeMessageFromSource):
        (WebInspector.SourceFrame.prototype.inheritScrollPositions):
        (WebInspector.TextEditorDelegateForSourceFrame):
        * inspector/front-end/TextViewer.js: Removed.
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:
        * inspector/front-end/textViewer.css: Removed.

2012-07-03  Charles Wei  <charles.wei@torchmobile.com.cn>

        IndexedDB: should make the LevelDB persistant to the directory indicated in PageGroupSettings::indexedDBDataBasePath
        https://bugs.webkit.org/show_bug.cgi?id=88338

        Reviewed by David Levin.

        If the indexedDB runs in main thread it can access the GroupSettings via the document;
        otherwise, we need to pass the page GroupSettings to the worker thread so that accessible
        to the indexedDB running in WorkerContext. 

        * Modules/indexeddb/IDBFactory.cpp:
        (WebCore::IDBFactory::open):
        * workers/DedicatedWorkerThread.cpp:
        (WebCore::DedicatedWorkerThread::create):
        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
        * workers/DedicatedWorkerThread.h:
        (DedicatedWorkerThread):
        * workers/DefaultSharedWorkerRepository.cpp:
        (SharedWorkerProxy):
        (WebCore::SharedWorkerProxy::groupSettings):
        (WebCore):
        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
        * workers/SharedWorkerThread.cpp:
        (WebCore::SharedWorkerThread::create):
        (WebCore::SharedWorkerThread::SharedWorkerThread):
        * workers/SharedWorkerThread.h:
        (SharedWorkerThread):
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::startWorkerContext):
        * workers/WorkerThread.cpp:
        (WebCore::WorkerThreadStartupData::create):
        (WorkerThreadStartupData):
        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
        (WebCore::WorkerThread::WorkerThread):
        (WebCore::WorkerThread::groupSettings):
        (WebCore):
        * workers/WorkerThread.h:
        (WorkerThread):

2012-07-03  Balazs Kelemen  <kbalazs@webkit.org>

        [Qt][WK2] fast/viewport/viewport-91.html still fails after r121555 and r121661
        https://bugs.webkit.org/show_bug.cgi?id=90376

        Reviewed by Csaba Osztrogonác.

        No new tests, this is only a build alignment.

        Export ViewportArguments::deprecatedTargetDPI since it is used in WebKit2.
        * WebCore.exp.in:

2012-07-02  Martin Robinson  <mrobinson@igalia.com>

        [TextureMapper] The TextureMapper should support edge-distance anti-antialiasing
        https://bugs.webkit.org/show_bug.cgi?id=90308

        Reviewed by Noam Rosenthal.

        Add an edge-distance anti-aliasing implementation for the TextureMapper. Currently
        this implementation is not active for tiled layers. This implementation is based
        on the one in the Chromium compositor originally written by David Raveman.

        When a layer is transformed in a way that leaves its edge dimensions across pixel
        boundaries, edge distance anti-aliasing will do a cheaper form of anti-aliasing
        than full-scene anti-aliasing to make the transition from the layer pixel
        to the background pixel smoother.

        No new tests. This will be covered by pixel tests for Qt and GTK+ accelerated
        compositing and 3D transforms, when those test harnesses are capable of
        producing pixel output (in progress).

        * platform/graphics/texmap/TextureMapper.h: Add an enum which is used to tell
        the texture mapper what edges of a texture are exposed. This will be used for
        properly dealing with tiled layers in the future.
        * platform/graphics/texmap/TextureMapperBackingStore.cpp: Properly pass information
        about exposed layer edges to the TextureMapper while painting.
        * platform/graphics/texmap/TextureMapperBackingStore.h:
        (TextureMapperTile): Modified arguments include exposed edges.
        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::drawQuad): Renamed from drawRect, this method can now
        draw quads that have non unit-rect texture coordinates. This is necessary because
        the edge distance approach draws such quad.
        (WebCore::TextureMapperGL::drawBorder): Call drawQuad now instead of drawRect.
        (WebCore::TextureMapperGL::drawTexture): Pass the exposedEdges argument down.
        (WebCore::TextureMapperGL::drawTextureRectangleARB): Call drawQuad now instead of
        drawRect.
        (WebCore::viewportMatrix): Added this helper which can calculate the viewport
        transform based on the current OpenGL viewport settings.
        (WebCore::scaleLineEquationCoeffecientsToOptimizeDistanceCalculation): Added this
        helper which optimizes the fragment shader by precalculating some constant parts
        of the distance calculation.
        (WebCore::getStandardEquationCoeffecientsForLine): Given two end points of line segment
        get the coeffecients of the line in the standard form of the line equation.
        (WebCore::quadToEdgeArray): Converts a FloatQuad to an array of four sets of pre-scaled
        line coefficients so that they can be passed to OpenGL.
        (WebCore::scaledVectorDifference): Helper which helps expand a quad of arbitrary
        orientation.
        (WebCore::inflateQuad): Inflate a quad of arbitrary orientation. The transform may
        flip it so we have to look at neighboring points to expand the quad.
        (WebCore::TextureMapperGL::drawTextureWithAntialiasing): Activate the anti-aliasing
        program and set up all uniforms.
        (WebCore::TextureMapperGL::drawTexturedQuadWithProgram): Abstract out common operations
        from drawTexture to be used with drawTextureWithAntialiasing.
        * platform/graphics/texmap/TextureMapperGL.h:
        (WebCore::TextureMapperGL::DrawQuad::DrawQuad): Add this small type which stores information
        necessary to draw a quad -- it's original destination rect and the final size mapped to
        texture coordinates.
        (TextureMapperGL):
        * platform/graphics/texmap/TextureMapperImageBuffer.cpp: Add the new exposedEdges argument.
        * platform/graphics/texmap/TextureMapperImageBuffer.h: Ditto.
        * platform/graphics/texmap/TextureMapperShaderManager.cpp: Add the new fragment shader for
        doing edge-distance AA and a program which uses that shader.
        * platform/graphics/texmap/TextureMapperShaderManager.h: Ditto.

2012-07-02  Dan Bernstein  <mitz@apple.com>

        Column height and count calculation ignores most overflow
        https://bugs.webkit.org/show_bug.cgi?id=90392

        Reviewed by Dean Jackson.

        Test: fast/multicol/overflow-content.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::relayoutForPagination): Changed to compute the overflow from children
        and use the layout overflow height rather the content height.

2012-07-02  Chris Guan  <chris.guan@torchmobile.com.cn>

        [BlackBerry] Refactor : move the implementation of getMIMETypeForExtension and getPreferredExtensionForMIMEType into BlackBerry platform
        https://bugs.webkit.org/show_bug.cgi?id=90360

        Reviewed by Antonio Gomes.

        We should have one implementation for getMIMETypeForExtension
        and getPreferredExtensionForMIMEType for both webkit and platform,
        so I move this implementation to BlackBerry platform.
        
        No new test cases , because no behavior changed.

        * platform/blackberry/MIMETypeRegistryBlackBerry.cpp:
        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
        (WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType):

2012-07-02  Emil A Eklund  <eae@chromium.org>

        Position replaced elements on pixel bounds
        https://bugs.webkit.org/show_bug.cgi?id=90354

        Reviewed by Eric Seidel.

        To avoid sizing and repaint issues we should layout replaced elements on
        pixel bounds. We already ensure that replaced elements are sized in full
        pixels and that they are painted on pixel bounds. By also ensuring that
        they are placed on pixel bounds we avoid pixel having the size be
        expanded by pixel snapping and repainting/invalidation rect issues when
        scrolling.

        Test: fast/repaint/repaint-during-scroll-with-zoom.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computePositionedLogicalWidthReplaced):
        (WebCore::RenderBox::computePositionedLogicalHeightReplaced):

2012-07-02  Nico Weber  <thakis@chromium.org>

        Fix new -Wunused-private-field violations
        https://bugs.webkit.org/show_bug.cgi?id=90417

        Reviewed by Ryosuke Niwa.

        No intended behavior change.

        * inspector/InspectorFileSystemAgent.cpp:
        (WebCore):
        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.cpp:
        (WebCore::CCPrioritizedTextureManager::CCPrioritizedTextureManager):
        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.h:
        (CCPrioritizedTextureManager):

2012-07-02  Yoshifumi Inoue  <yosin@chromium.org>

        Build fix for Chromimum

        r121710 removed WebCore/platform/qt/GraphicsLayerQt.{cpp,h}.
        However, that patch didn't remove them from WebCore.gypi.

        * WebCore.gypi: Removed GraphicsLayerQt.{cpp,h}

2012-07-02  Joshua Bell  <jsbell@chromium.org>

        IDL overloads should not treat wrapper types as nullable by default
        https://bugs.webkit.org/show_bug.cgi?id=90218

        Reviewed by Kentaro Hara.

        Wrapper types were being treated as Nullable by default during overloaded
        method dispatching, which deviates from the WebIDL specification. This change
        introduces the "?" type suffix into the parser, and treats wrapper types
        only nullable if specified. (The behavior of array types and other non-wrapper
        types are not changed, and only overloaded methods are checked.)

        IDL files with affected overloads are modified to include the "?" suffix
        so that no behavior changes are introduced by this patch - the JS and V8
        generator results before/after the change show no diffs.

        Test: bindings/scripts/test/TestObj.idl (a non-nullable overload)

        * Modules/indexeddb/IDBDatabase.idl: Added "?" where necessary.
        * Modules/indexeddb/IDBIndex.idl: Added "?" where necessary.
        * Modules/indexeddb/IDBObjectStore.idl: Added "?" where necessary.
        * Modules/webaudio/AudioContext.idl: Added "?" where necessary.
        * Modules/webaudio/AudioNode.idl: Added "?" where necessary.
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheckExpression): Add isNullable check.
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateParametersCheckExpression): Add isNullable check.
        * bindings/scripts/IDLParser.pm: Parse/set isNullable.
        (parseParameters):
        * bindings/scripts/IDLStructure.pm: Add basic type suffix parsing.
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod8):
        (WebCore):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod):
        * bindings/scripts/test/TestObj.idl: Mark previous overload params with ?, add new one without.
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::overloadedMethod8Callback):
        (TestObjV8Internal):
        (WebCore::TestObjV8Internal::overloadedMethodCallback):
        * dom/DataTransferItemList.idl: Added "?" where necessary.
        * fileapi/WebKitBlobBuilder.idl: Added "?" where necessary.
        * html/DOMURL.idl: Added "?" where necessary.
        * html/canvas/CanvasRenderingContext2D.idl: Added "?" where necessary.
        * html/canvas/WebGLRenderingContext.idl: Added "?" where necessary.

2012-07-02  No'am Rosenthal  <noam.rosenthal@nokia.com>

        [Qt] Get rid of GraphicsLayerQt
        https://bugs.webkit.org/show_bug.cgi?id=78598

        Reviewed by Luiz Agostini.

        Remove GraphicsLayerQt.h/cpp, as well as references to the non-TextureMapper code paths
        in GraphicsContext3DQt and MediaPlayerPrivateQt.

        No new tests, removing unused code paths.

        * Target.pri:
        * platform/graphics/PlatformLayer.h:
        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        (GraphicsContext3DPrivate):
        (WebCore):
        * platform/graphics/qt/GraphicsContextQt.cpp:
        (WebCore):
        * platform/graphics/qt/GraphicsLayerQt.cpp: Removed.
        * platform/graphics/qt/GraphicsLayerQt.h: Removed.
        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
        (WebCore):
        * platform/graphics/qt/MediaPlayerPrivateQt.h:
        (MediaPlayerPrivateQt):
        * plugins/qt/PluginViewQt.cpp:
        (WebCore::PluginView::invalidateRect):
        (WebCore::PluginView::platformStart):

2012-07-02  Behdad Esfahbod  <behdad@behdad.org>

        LayoutUnit::epsilon() is wrong
        https://bugs.webkit.org/show_bug.cgi?id=90083

        Reviewed by Eric Seidel.

        Do division in floats, not integers.

        No new tests. No code using the affected function.

        * platform/FractionalLayoutUnit.h:
        (WebCore::FractionalLayoutUnit::epsilon):

2012-07-02  Tim Horton  <timothy_horton@apple.com>

        Compositing layer sync should cause deferred repaints to be fired immediately
        https://bugs.webkit.org/show_bug.cgi?id=90401
        <rdar://problem/11792028>

        Reviewed by Simon Fraser and Antti Koivisto.

        If we sync compositing layers and allow the repaint to be deferred, there is time for a
        visible flash to occur. Instead, stop the deferred repaint timer and repaint immediately.

        No new tests, configuration and timing dependent.

        * page/FrameView.cpp:
        (WebCore::FrameView::syncCompositingStateForThisFrame):
        (WebCore::FrameView::checkStopDelayingDeferredRepaints):
        (WebCore::FrameView::stopDelayingDeferredRepaints): Split off from checkStopDelayingDeferredRepaints.
        * page/FrameView.h:
        (FrameView): Add stopDelayingDeferredRepaints.

2012-07-02  Benjamin Poulain  <bpoulain@apple.com>

        Do not do any logging initialization when logging is disabled
        https://bugs.webkit.org/show_bug.cgi?id=90228

        Reviewed by Simon Fraser.

        Initializating of the logging channels was taking time on startup. When logging is disabled
        (and the LOG macro does nothing), we should aslo disable logging channels and initialization.

        This patch #ifdef the Logging initialization with the macro LOG_DISABLED.

        * WebCore.exp.in:
        * make-export-file-generator: Explicitely adds Assertions.h so that LOG_DISABLED is defined.
        * platform/Logging.cpp:
        * platform/Logging.h:
        * platform/blackberry/LoggingBlackBerry.cpp:
        * platform/efl/LoggingEfl.cpp:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        * platform/gtk/LoggingGtk.cpp:
        * platform/mac/LoggingMac.mm:
        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::ensureSessionIsInitialized):
        * platform/qt/LoggingQt.cpp:
        * platform/win/LoggingWin.cpp:
        * platform/wx/LoggingWx.cpp:

2012-07-02  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/11787030> In vertical writing modes, child following float-clearing block has incorrect logical top
        https://bugs.webkit.org/show_bug.cgi?id=90359

        Reviewed by Anders Carlsson.

        Test: fast/writing-mode/logical-height-after-clear.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::clearFloatsIfNeeded): Changed to use logicalTop() and logicalHeight()
        instead of y() and height().

2012-07-02  Arko Saha  <arko@motorola.com>

        Microdata: Fix build failure after r121580.
        https://bugs.webkit.org/show_bug.cgi?id=90378

        Reviewed by Ryosuke Niwa.

        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::properties):
        * html/HTMLElement.h:

2012-07-02  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: Update MediaStreamTrackList to match the specification
        https://bugs.webkit.org/show_bug.cgi?id=90171

        Reviewed by Adam Barth.

        The latest update to the specification added add and remove methods with corresponding callbacks.
        The callbacks can be triggered both from JS and from the platform layer.

        Test: fast/mediastream/MediaStreamTrackList.html

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Modules/mediastream/MediaStream.cpp:
        (WebCore::MediaStream::MediaStream):
        (WebCore::MediaStream::~MediaStream):
        (WebCore::MediaStream::streamEnded):
        (WebCore::MediaStream::addTrack):
        (WebCore):
        (WebCore::MediaStream::removeTrack):
        * Modules/mediastream/MediaStream.h:
        (MediaStream):
        * Modules/mediastream/MediaStreamTrackEvent.cpp: Copied from Source/WebCore/Modules/mediastream/MediaStreamTrackList.cpp.
        (WebCore):
        (WebCore::MediaStreamTrackEvent::create):
        (WebCore::MediaStreamTrackEvent::MediaStreamTrackEvent):
        (WebCore::MediaStreamTrackEvent::~MediaStreamTrackEvent):
        (WebCore::MediaStreamTrackEvent::track):
        (WebCore::MediaStreamTrackEvent::interfaceName):
        * Modules/mediastream/MediaStreamTrackEvent.h: Copied from Source/WebCore/Modules/mediastream/MediaStreamTrackList.h.
        (WebCore):
        (MediaStreamTrackEvent):
        * Modules/mediastream/MediaStreamTrackEvent.idl: Copied from Source/WebCore/Modules/mediastream/MediaStreamTrackList.idl.
        * Modules/mediastream/MediaStreamTrackList.cpp:
        (WebCore::MediaStreamTrackList::create):
        (WebCore::MediaStreamTrackList::MediaStreamTrackList):
        (WebCore::MediaStreamTrackList::detachOwner):
        (WebCore):
        (WebCore::MediaStreamTrackList::add):
        (WebCore::MediaStreamTrackList::remove):
        (WebCore::MediaStreamTrackList::stop):
        (WebCore::MediaStreamTrackList::interfaceName):
        (WebCore::MediaStreamTrackList::scriptExecutionContext):
        (WebCore::MediaStreamTrackList::eventTargetData):
        (WebCore::MediaStreamTrackList::ensureEventTargetData):
        * Modules/mediastream/MediaStreamTrackList.h:
        (MediaStreamTrackList):
        * Modules/mediastream/MediaStreamTrackList.idl:
        * WebCore.gypi:
        * dom/EventNames.h:
        (WebCore):
        * dom/EventNames.in:
        * dom/EventTargetFactory.in:
        * platform/mediastream/MediaStreamCenter.cpp:
        (WebCore::MediaStreamCenter::addMediaStreamTrack):
        (WebCore):
        (WebCore::MediaStreamCenter::removeMediaStreamTrack):
        * platform/mediastream/MediaStreamCenter.h:
        (MediaStreamCenter):
        * platform/mediastream/MediaStreamDescriptor.h:
        (MediaStreamDescriptorOwner):
        * platform/mediastream/chromium/MediaStreamCenterChromium.cpp:
        (WebCore::MediaStreamCenterChromium::didAddMediaStreamTrack):
        (WebCore):
        (WebCore::MediaStreamCenterChromium::didRemoveMediaStreamTrack):
        (WebCore::MediaStreamCenterChromium::addMediaStreamTrack):
        (WebCore::MediaStreamCenterChromium::removeMediaStreamTrack):
        * platform/mediastream/chromium/MediaStreamCenterChromium.h:
        (WebKit):
        (MediaStreamCenterChromium):
        * platform/mediastream/gstreamer/MediaStreamCenterGStreamer.cpp:
        (WebCore::MediaStreamCenterGStreamer::didAddMediaStreamTrack):
        (WebCore):
        (WebCore::MediaStreamCenterGStreamer::didRemoveMediaStreamTrack):
        * platform/mediastream/gstreamer/MediaStreamCenterGStreamer.h:
        (MediaStreamCenterGStreamer):

2012-07-02  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: incorrect height of main timeline pane after switching to memory mode
        https://bugs.webkit.org/show_bug.cgi?id=90387

        Reviewed by Pavel Feldman.

        - update cached container height when setting vertical splitter position.

        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype.set _setSplitterPosition):

2012-07-02  Christophe Dumez  <christophe.dumez@intel.com>

        [MICRODATA] Build failure in html/HTMLPropertiesCollection.h
        https://bugs.webkit.org/show_bug.cgi?id=90379

        Reviewed by Ryosuke Niwa.

        Switch HTMLCollection::append() visibility from private
        to protected so that HTMLPropertiesCollection subclass
        can call it. This fixes build when MICRODATA flag is
        turned on.

        No new tests, build fix.

        * html/HTMLCollection.h:
        (HTMLCollectionCacheBase):

2012-07-02  Kwang Yul Seo  <skyul@company100.net>

        A start "body" tag in the "in body" insertion mode is a parse error
        https://bugs.webkit.org/show_bug.cgi?id=90373

        Reviewed by Eric Seidel.

        According to HTML5 specification (http://www.w3.org/TR/html5/tree-construction.html#parsing-main-inbody),
        a start "body" tag in the "in body" insertion mode is a parse error. So parseError(token) is required here.
        No behavior change because parseError(token) is just a marker.

        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::processStartTagForInBody):

2012-07-02  Raphael Kubo da Costa  <rakuco@webkit.org>

        [EFL] Unreviewed build fix with ENABLE_NETSCAPE_PLUGIN_API after r121467.

        * plugins/efl/PluginPackageEfl.cpp:
        (WebCore::PluginPackage::load): Move the declaration of `err'
        before the first `goto' statement.

2012-07-02  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: replace recursion with a stack in DOM nodes snapshot traversal.
        https://bugs.webkit.org/show_bug.cgi?id=89889

        Number of DOM nodes native snapshots can handle was limited
        by the process stack size because of recursion used to traverse the nodes.
        The patch changes the recursion to a stack based algorithm.

        Reviewed by Yury Semikhatsky.

        * dom/MemoryInstrumentation.h:
        (MemoryInstrumentation):
        (InstrumentedPointerBase):
        (WebCore::MemoryInstrumentation::InstrumentedPointerBase::~InstrumentedPointerBase):
        (InstrumentedPointer):
        (WebCore::MemoryInstrumentation::InstrumentedPointer::InstrumentedPointer):
        (WebCore::MemoryInstrumentation::reportInstrumentedPointer):
        (WebCore):
        (WebCore::::process):
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):

2012-07-02  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Add requestFileContent command and fileContentReceived event
        https://bugs.webkit.org/show_bug.cgi?id=89642

        Reviewed by Vsevolod Vlasov.

        Test: http/tests/inspector/filesystem/read-file.html

        * inspector/Inspector.json:
        * inspector/InspectorFileSystemAgent.cpp:
        (WebCore):
        (WebCore::InspectorFileSystemAgent::requestFileContent):
        * inspector/InspectorFileSystemAgent.h:
        (InspectorFileSystemAgent):
        * inspector/front-end/FileSystemModel.js:
        (WebInspector.FileSystemModel.prototype.requestMetadata):
        (WebInspector.FileSystemModel.prototype.requestFileContent):
        (WebInspector.FileSystemModel.File.prototype.get resourceType):
        (WebInspector.FileSystemModel.File.prototype.requestFileContent):
        (WebInspector.FileSystemRequestManager):
        (WebInspector.FileSystemRequestManager.prototype._metadataReceived):
        (WebInspector.FileSystemRequestManager.prototype.requestFileContent.requestAccepted):
        (WebInspector.FileSystemRequestManager.prototype.requestFileContent):
        (WebInspector.FileSystemRequestManager.prototype._fileContentReceived):
        (WebInspector.FileSystemDispatcher.prototype.metadataReceived):
        (WebInspector.FileSystemDispatcher.prototype.fileContentReceived):

2012-07-02  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Add refresh button to FileSystemView status bar
        https://bugs.webkit.org/show_bug.cgi?id=90244

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/FileSystemView.js:
        (WebInspector.FileSystemView):
        (WebInspector.FileSystemView.prototype.get statusBarItems):
        (WebInspector.FileSystemView.prototype.showView):
        (WebInspector.FileSystemView.prototype._refresh):
        (WebInspector.FileSystemView.EntryTreeElement.prototype._directoryContentReceived):

2012-06-22  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Implement snippets evaluation.
        https://bugs.webkit.org/show_bug.cgi?id=88707

        Reviewed by Pavel Feldman.

        Implemented snippet evaluation and adjusted breakpoints behavior when editing snippet.
        Snippets are evaluated using separate compile and run.
        Breakpoints are updated after compilation (once scriptId is available they can be set in debugger).
        If separate compile and run is not supported by port or debugger is paused we fall back to evaluation in console.

        * inspector/front-end/ConsoleView.js:
        (WebInspector.ConsoleView.prototype.runScript.runCallback):
        (WebInspector.ConsoleView.prototype.runScript):
        (WebInspector.ConsoleView.prototype._printResult):
        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource.prototype.supportsEnabledBreakpointsWhileEditing):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.afterTextChanged):
        (WebInspector.JavaScriptSourceFrame.prototype.beforeTextChanged):
        (WebInspector.JavaScriptSourceFrame.prototype._didEditContent):
        (WebInspector.JavaScriptSourceFrame.prototype._removeBreakpointsBeforeEditing):
        (WebInspector.JavaScriptSourceFrame.prototype._restoreBreakpointsAfterEditing):
        (WebInspector.JavaScriptSourceFrame.prototype._addBreakpointDecoration):
        (WebInspector.JavaScriptSourceFrame.prototype._onMouseDown):
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.ScriptSnippetModel.prototype.deleteScriptSnippet):
        (WebInspector.ScriptSnippetModel.prototype._setScriptSnippetContent):
        (WebInspector.ScriptSnippetModel.prototype.evaluateScriptSnippet.compileCallback):
        (WebInspector.ScriptSnippetModel.prototype.evaluateScriptSnippet):
        (WebInspector.ScriptSnippetModel.prototype._rawLocationToUILocation):
        (WebInspector.ScriptSnippetModel.prototype._removeBreakpoints):
        (WebInspector.ScriptSnippetModel.prototype._restoreBreakpoints):
        (WebInspector.ScriptSnippetModel.prototype._evaluationSourceURL):
        (WebInspector.SnippetJavaScriptSource.prototype.isDivergedFromVM):
        (WebInspector.SnippetJavaScriptSource.prototype.workingCopyCommitted):
        (WebInspector.SnippetJavaScriptSource.prototype.workingCopyChanged):
        (WebInspector.SnippetJavaScriptSource.prototype.evaluate):
        (WebInspector.SnippetJavaScriptSource.prototype.supportsEnabledBreakpointsWhileEditing):
        (WebInspector.SnippetJavaScriptSource.prototype.breakpointStorageId):
        * inspector/front-end/ScriptsNavigator.js:
        (WebInspector.SnippetsNavigatorView.prototype._handleEvaluateSnippet):

2012-06-26  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: StyleSource should set content using CSSStyleModelResourceBinding directly.
        https://bugs.webkit.org/show_bug.cgi?id=89891

        Reviewed by Pavel Feldman.

        StyleSource now calls CSS resource binding directly.
        CSS resource binding now adds resource revision only after setStyleSheetText call returns from backend.
        Resource.revertAndClearHistory is now clearing history asynchronously
        since Resource.setContent adds revision that should be removed as well.

        * inspector/front-end/CSSStyleModel.js:
        (WebInspector.CSSStyleModel.prototype.getViaInspectorResourceForRule):
        (WebInspector.CSSStyleModel.prototype.resourceBinding):
        (WebInspector.CSSStyleModelResourceBinding.prototype.setStyleContent.innerCallback):
        (WebInspector.CSSStyleModelResourceBinding.prototype.setStyleContent):
        (WebInspector.CSSStyleModelResourceBinding.prototype.setContent):
        * inspector/front-end/Resource.js:
        (WebInspector.Resource.prototype.revertAndClearHistory):
        (WebInspector.Resource.prototype.revertAndClearHistory.clearHistory):
        * inspector/front-end/RevisionHistoryView.js:
        (WebInspector.RevisionHistoryView.prototype._createResourceItem):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StyleSource.prototype.workingCopyCommitted):
        (WebInspector.StyleSource.prototype.workingCopyChanged):

2012-07-02  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Add DirectoryContentView for FileSystemView
        https://bugs.webkit.org/show_bug.cgi?id=89961

        Reviewed by Vsevolod Vlasov.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/DirectoryContentView.js: Added.
        * inspector/front-end/FileSystemView.js:
        (WebInspector.FileSystemView):
        (WebInspector.FileSystemView.EntryTreeElement.prototype.onattach):
        (WebInspector.FileSystemView.EntryTreeElement.prototype.onselect):
        (WebInspector.FileSystemView.EntryTreeElement.prototype._directoryContentReceived):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:

2012-07-02  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] Fix compilation error in GamepadsEfl.cpp in debug mode
        https://bugs.webkit.org/show_bug.cgi?id=90369

        Unreviewed, EFL build fix.

        * platform/efl/GamepadsEfl.cpp:
        (WebCore::GamepadsEfl::registerDevice):
        (WebCore::GamepadsEfl::unregisterDevice):

2012-07-02  Nikita Vasilyev  <me@elv1s.ru>

        Web Inspector: Design WebSockets panel
        https://bugs.webkit.org/show_bug.cgi?id=89461

        Use DataGrid to display the data.
        Put "Data" column first. Make it wider.
        Remove "Mask" column since it appears to be always true for outgoing frames,
        and false for incoming.

        Reviewed by Pavel Feldman.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/NetworkItemView.js:
        (WebInspector.NetworkItemView): Don't show Preview, Response, Cookies
        and Timing tabs for succefuly established WebSocket connection.

        * inspector/front-end/ResourceWebSocketFrameView.js:
        (WebInspector.ResourceWebSocketFrameView):
        * inspector/front-end/networkPanel.css:
        (.resource-websocket):
        (.resource-websocket, .resource-websocket .data-grid):
        (.resource-websocket .data-grid .data):
        (.resource-websocket td):
        (.resource-websocket .data-column div):
        (.resource-websocket-row-outcoming):
        (.resource-websocket-row-outcoming:not(.selected) td):
        (.resource-websocket-row-outcoming:not(.selected) td, .resource-websocket-row-outcoming:not(.selected) + tr td):
        (.resource-websocket-row-opcode):
        (.resource-websocket-row-opcode td):
        (.resource-websocket-row-opcode td, .resource-websocket-row-opcode + tr td):
        (.resource-websocket-row-error):

2012-07-02  Vineet Chaudhary  <rgf748@motorola.com>

        [V8Binding] Merging v8NumberArray()/v8NumberArrayToVector() to v8Array()/toNativeArray() respectively.
        https://bugs.webkit.org/show_bug.cgi?id=90338

        Reviewed by Kentaro Hara.

        We can remove v8NumberArray() and v8NumberArrayToVector() implementaion
        merging them to current v8Array() and toNativeArray() traits.

        Tests: TestObj.idl
        Shouldn't cause any behavioural changes.

        * bindings/scripts/CodeGeneratorV8.pm: Removed float[]/double[] specific binding code.
        (IsRefPtrType):
        (GetNativeType):
        (JSValueToNative):
        (NativeToJSValue):
        * bindings/scripts/test/V8/V8TestObj.cpp: Rebased binding test.
        (WebCore::TestObjV8Internal::floatArrayAttrGetter):
        (WebCore::TestObjV8Internal::floatArrayAttrSetter):
        (WebCore::TestObjV8Internal::doubleArrayAttrGetter):
        (WebCore::TestObjV8Internal::doubleArrayAttrSetter):
        * bindings/v8/V8Binding.h: Added templates for float and double.
        (WebCore::v8Array):
        (WebCore::toNativeArray):

2012-07-02  Konrad Piascik  <kpiascik@rim.com>

        [EFL] [GTK] [QT] fast/viewport/viewport-91.html is failing after r121555
        https://bugs.webkit.org/show_bug.cgi?id=90286

        Reviewed by Daniel Bates.

        Since the deprecatedTargetDPI was an int and the deviceDPI was also an int the result
        was truncated.  Changed deprecatedTargetDPI to a float value. Viewport test 91 now passes.

        * dom/ViewportArguments.h:
        (ViewportArguments):

2012-06-28  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add v8 bindings memory info to the native memory graph
        https://bugs.webkit.org/show_bug.cgi?id=90149

        Reviewed by Pavel Feldman.

        Size of V8 binding maps is now reported on the memory chart.

        * bindings/js/ScriptProfiler.h:
        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
        * bindings/v8/DOMDataStore.cpp:
        (WebCore::DOMDataStore::reportMemoryUsage):
        (WebCore):
        * bindings/v8/DOMDataStore.h:
        (WebCore):
        (DOMDataStore):
        * bindings/v8/IntrusiveDOMWrapperMap.h:
        (WebCore::ChunkedTable::reportMemoryUsage):
        (ChunkedTable):
        * bindings/v8/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
        (WebCore):
        * bindings/v8/ScriptProfiler.h:
        (WebCore):
        (ScriptProfiler):
        * bindings/v8/V8Binding.cpp:
        (WebCore::V8BindingPerIsolateData::reportMemoryUsage):
        (WebCore):
        (WebCore::StringCache::reportMemoryUsage):
        * bindings/v8/V8Binding.h:
        (WebCore):
        (StringCache):
        (V8BindingPerIsolateData):
        * bindings/v8/V8DOMMap.h:
        (WebCore):
        (AbstractWeakReferenceMap):
        * dom/MemoryInstrumentation.h:
        (MemoryInstrumentation):
        (WebCore):
        (WebCore::MemoryInstrumentation::reportHashMap): added a method for reporting
        size of a HashMap.
        * inspector/InspectorMemoryAgent.cpp:
        (MemoryBlockName):
        (WebCore):
        (WebCore::domTreeInfo):

2012-07-01  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] Add Gamepad support
        https://bugs.webkit.org/show_bug.cgi?id=90170

        Reviewed by Kenneth Rohde Christiansen.

        Add support for the Gamepad feature on the EFL port.

        The implementation of this class relies on the Linux
        kernel joystick API.

        Gamepad devices are recognized through the GamepadsEfl
        class, of which implementation is based on Eeze
        library. This way devices are properly registered on
        connection as objects of the GamepadDeviceEfl class
        which inherits GamepadDeviceLinux. GamepadDeviceEfl
        reads the joystick data through an Ecore_Fd_Handler
        and updates the device state accordingly. The
        GamepadsEfl object is then polled for gamepads data
        through the sampleGamepads method.

        No new tests - already tested by gamepad/*

        * CMakeLists.txt:
        * PlatformEfl.cmake:
        * platform/efl/GamepadsEfl.cpp: Added.
        (WebCore):
        (GamepadDeviceEfl):
        (WebCore::GamepadDeviceEfl::create):
        (WebCore::GamepadDeviceEfl::GamepadDeviceEfl):
        (WebCore::GamepadDeviceEfl::~GamepadDeviceEfl):
        (WebCore::GamepadDeviceEfl::readCallback):
        (GamepadsEfl):
        (WebCore::GamepadsEfl::onGamePadChange):
        (WebCore::GamepadsEfl::GamepadsEfl):
        (WebCore::GamepadsEfl::~GamepadsEfl):
        (WebCore::GamepadsEfl::registerDevice):
        (WebCore::GamepadsEfl::unregisterDevice):
        (WebCore::GamepadsEfl::updateGamepadList):
        (WebCore::sampleGamepads):

2012-07-01  James Robinson  <jamesr@chromium.org>

        Unreviewed, rolling out r121635.
        http://trac.webkit.org/changeset/121635
        https://bugs.webkit.org/show_bug.cgi?id=90286

        Breaks compile on clang error: in-class initializer for static
        data member of type 'const float' is a GNU extension
        [-Werror,-Wgnu]

        * dom/ViewportArguments.h:
        (ViewportArguments):

2012-07-01  Timothy Hatcher  <timothy@apple.com>

        Make the "Inspect Element" context menu item appear in nightly builds again.

        rdar://problem/11702613
        https://webkit.org/b/89323

        Reviewed by Dan Bernstein.

        * platform/ContextMenuItem.h:
        Fix the order of the ContextMenuAction enum to be binary compatible with
        older versions of WebKit.

2012-07-01  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/11785743> [mac] Non-BMP characters in vertical text appear as missing glyphs
        https://bugs.webkit.org/show_bug.cgi?id=90349

        Reviewed by Dean Jackson.

        Test: platform/mac/fast/text/vertical-surrogate-pair.html

        * platform/graphics/mac/GlyphPageTreeNodeMac.cpp:
        (WebCore::GlyphPage::fill): When calling wkGetVerticalGlyphsForCharacters or
        CTFontGetGlyphsForCharacters with a buffer consisting of surrogate pair, account for those
        functions’ behavior of placing glyphs at indices corresponding to the first character of
        each pair.

2012-07-01  Kenichi Ishibashi  <bashi@chromium.org>

        Arabic shaping is incorrect if ZWNJ exist
        https://bugs.webkit.org/show_bug.cgi?id=89843

        Reviewed by Dan Bernstein.

        mac port treats ZWJ (zero-width-joiner) and ZWNJ (zero-width-non-joiner) as a part of combining
        character sequence. This could cause a problem when the font doesn't have glyph mapping of ZWJ and ZWNJ.
        Suppose the text to be rendered is "U+0645(MEEM) U+06CC(FARSI YEH) U+200C(ZWNJ)". In this case, U+0645
        and U+06CC are rendered in isolated form if the font doesn't have a glyph for ZWNJ. They should be joined.

        This patch changes handling of ZWJ and ZWNJ. Treats ZWJ and ZWNJ as base characters so that a complex text
        run isn't separate at the point of ZWJ and ZWNJ even the font doesn't contain glyphs for them.
        If ComplexTextController finds ZWJ, it doesn't split the current complex text run.

        Test: platform/mac/fast/text/arabic-zwj-and-zwnj.html

        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::advanceByCombiningCharacterSequence): Don't treat ZWJ and ZWNJ as a part of combining character sequence.
        (WebCore::ComplexTextController::collectComplexTextRuns): Set fontData to nextFontData if the baseCharacter is ZWJ.

2012-07-01  Konrad Piascik  <kpiascik@rim.com>

        [EFL] [GTK] [QT] fast/viewport/viewport-91.html is failing after r121555
        https://bugs.webkit.org/show_bug.cgi?id=90286

        Reviewed by Daniel Bates.

        Since the deprecatedTargetDPI was an int and the deviceDPI was also an int the result
        was truncated.  Changed deprecatedTargetDPI to a float value. Viewport test 91 now passes.

        * dom/ViewportArguments.h:
        (ViewportArguments):

2012-06-30  Ian Vollick  <vollick@chromium.org>

        [chromium] CanvasLayerTextureUpdater needs to convert opaque rects back to content space.
        https://bugs.webkit.org/show_bug.cgi?id=90092

        The CanvasLayerTextureUpdater currently receives its opaque rects in
        layer space, but is expected to return them in content space and does
        not convert them. This patch adds this conversion. To avoid numerical
        errors, this patch also switches to using float rects to store opaque
        rects where appropriate.

        Reviewed by Adrienne Walker.

        Unit test: ContentLayerTest.ContentLayerPainterWithDeviceScale

        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
        (WebCore::CanvasLayerTextureUpdater::paintContents):
        * platform/graphics/chromium/ContentLayerChromium.cpp:
        (WebCore::ContentLayerPainter::ContentLayerPainter):
        (WebCore::ContentLayerPainter::create):
        (WebCore::ContentLayerPainter::paint):
        * platform/graphics/chromium/ContentLayerChromium.h:
        (WebCore):
        (ContentLayerDelegate):
        (ContentLayerPainter):
        * platform/graphics/chromium/LayerPainterChromium.h:
        (WebCore):
        (LayerPainterChromium):
        * platform/graphics/chromium/LinkHighlight.cpp:
        (WebCore::LinkHighlight::paintContents):
        * platform/graphics/chromium/LinkHighlight.h:
        (LinkHighlight):
        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp:
        (WebCore::OpaqueRectTrackingContentLayerDelegate::paintContents):
        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h:
        (OpaqueRectTrackingContentLayerDelegate):
        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:

2012-06-30  Kwang Yul Seo  <skyul@company100.net>

        Unreviewed. Remove unused declaration.
        HTMLDocumentParser::begin() has no method definition.

        * html/parser/HTMLDocumentParser.h:

2012-06-29  No'am Rosenthal  <noam.rosenthal@nokia.com>

        Unreviewed, rolling out r121569.
        http://trac.webkit.org/changeset/121569
        https://bugs.webkit.org/show_bug.cgi?id=90082

        It broke a couple of tests in Qt Linux Release

        * platform/graphics/qt/GraphicsContextQt.cpp:
        (WebCore::GraphicsContext::fillRect):

2012-06-29  Simon Fraser  <simon.fraser@apple.com>

        updateDescendantDependentFlags() is inside #if USE(ACCELERATED_COMPOSITING)
        https://bugs.webkit.org/show_bug.cgi?id=90245

        Reviewed by Dan Bernstein.

        updateDescendantDependentFlags() and updateTransform() should be
        outside the USE(ACCELERATED_COMPOSITING) #ifdef. They do work
        that is needed even if accelerated compositing is disabled.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::styleChanged):

2012-06-29  Erik Arvidsson  <arv@chromium.org>

        [V8] HTMLCollection wrappers are not retained
        https://bugs.webkit.org/show_bug.cgi?id=90208

        Reviewed by Adam Barth.

        Generate visitDOMWrapper for HTMLCollection and HTMLAllCollection so that we add an implicit reference from the owner
        to the collection.

        Tests: fast/dom/htmlallcollection-reachable.html
               fast/dom/htmlcollection-reachable.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation): Instead of hard coding to use base() for HTMLAllCollection and HTMLCollection we now
        annotate the IDL file to use GenerateIsReachable=ImplBaseRoot.
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateVisitDOMWrapper): Generate visitDOMWrapper if GenerateIsReachable is ImplBaseRoot.
        * bindings/scripts/IDLAttributes.txt: Added ImplBaseRoot.
        * html/HTMLAllCollection.idl: Added annotations.
        * html/HTMLCollection.idl: Ditto.

2012-06-29  Tony Chang  <tony@chromium.org>

        All child elements of a flex container should be turned into a flex item
        https://bugs.webkit.org/show_bug.cgi?id=90323

        Reviewed by Ojan Vafai.

        We used to only convert some elements to blocks, but now we convert everything except text nodes.
        This was recently changed here:
        http://wiki.csswg.org/topics/css3-flexbox-flexbox-replaced-children

        Tests: css3/flexbox/anonymous-block.html : Add new test case.
               css3/flexbox/flexitem.html: Update results.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-06-29  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Keep direction on IDBCursor to avoid calls to back end
        https://bugs.webkit.org/show_bug.cgi?id=90114

        Reviewed by Tony Chang.

        Let IDBCursor handle direction() accessor locally, without a call to
        the IDBCursorBackendImpl which (in some ports) may reside in a different
        process. Not a heavily called function, but further reduces the surface
        area exposed by the XXXInterface classes.

        No new tests - no functional changes.

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::create): Accept direction, known at creation time.
        (WebCore::IDBCursor::IDBCursor): Stash in member.
        (WebCore::IDBCursor::direction): Use local copy
        (WebCore::IDBCursor::stringToDirection): Return enum value, not int.
        * Modules/indexeddb/IDBCursor.h:
        (IDBCursor):
        * Modules/indexeddb/IDBCursorBackendImpl.cpp: Remove accessor.
        * Modules/indexeddb/IDBCursorBackendImpl.h:
        (IDBCursorBackendImpl):
        * Modules/indexeddb/IDBCursorBackendInterface.h: Remove accessor.
        * Modules/indexeddb/IDBCursorWithValue.cpp:
        (WebCore::IDBCursorWithValue::create):
        (WebCore::IDBCursorWithValue::IDBCursorWithValue):
        * Modules/indexeddb/IDBCursorWithValue.h:
        (IDBCursorWithValue):
        * Modules/indexeddb/IDBIndex.cpp: Prep IDBRequest with cursor direction too.
        (WebCore::IDBIndex::openCursor):
        (WebCore::IDBIndex::openKeyCursor):
        * Modules/indexeddb/IDBObjectStore.cpp: Ditto.
        (WebCore::IDBObjectStore::openCursor):
        * Modules/indexeddb/IDBRequest.cpp: Stash direction for pending cursor too.
        (WebCore::IDBRequest::IDBRequest):
        (WebCore::IDBRequest::setCursorDetails):
        (WebCore::IDBRequest::onSuccess): Apply stashed direction to new cursor.
        * Modules/indexeddb/IDBRequest.h:
        (IDBRequest):

2012-06-29  Tony Chang  <tony@chromium.org>

        Allow align-self: stretch to cause the item size to shrink below its intrinsic size
        https://bugs.webkit.org/show_bug.cgi?id=90304

        Reviewed by Ojan Vafai.

        The spec used to say that stretch could only make items grow, but now
        it allows items to shrink.
        http://dev.w3.org/csswg/css3-flexbox/#align-items-stretch

        Tests: css3/flexbox/flex-align-stretch.html Updated expectations.
               css3/flexbox/child-overflow.html Updated expectations.

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::applyStretchAlignmentToChild):

2012-06-29  James Weatherall  <wez@chromium.org>

        NPObjectWrapper may not address all window script object lifetime issues
        https://bugs.webkit.org/show_bug.cgi?id=85679

        The ScriptController implementations force-deallocate the window script object to ensure that DOM objects are not leaked if an NPAPI plugin fails to release a reference to it before being destroyed. The NPObjectWrapper was added to ensure that NPAPI scripting could not touch the real window script object after it had been deallocated, by providing the plugin with a small wrapper which will leak if the plugin fails to dereference it.

        This patch removes NPObjectWrapper and instead drops the window script NPObject's reference to the underlying V8Object in ScriptController::clearScriptObjects(). If a plugin fails to dereference the object then the NPV8Object wrapper will be leaked but the DOM objects it references will not.

        Reviewed by Nate Chapin.

        Test: plugins/npruntime/leak-window-scriptable-object.html

        * WebCore.gypi:
        * bindings/v8/NPObjectWrapper.cpp: Removed.
        * bindings/v8/NPObjectWrapper.h: Removed.
        * bindings/v8/NPV8Object.cpp:
        (WebCore::disposeUnderlyingV8Object):
        (WebCore):
        (WebCore::freeV8NPObject):
        (_NPN_Invoke):
        (_NPN_InvokeDefault):
        (_NPN_EvaluateHelper):
        (_NPN_GetProperty):
        (_NPN_SetProperty):
        (_NPN_RemoveProperty):
        (_NPN_HasProperty):
        (_NPN_HasMethod):
        (_NPN_Enumerate):
        (_NPN_Construct):
        * bindings/v8/NPV8Object.h:
        (WebCore):
        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::ScriptController):
        (WebCore::ScriptController::clearScriptObjects):
        (WebCore::ScriptController::windowScriptNPObject):
        * bindings/v8/ScriptController.h:
        (ScriptController):

2012-06-29  Adam Barth  <abarth@webkit.org>

        Update complex fonts on Android to use fonts from a newer SDK
        https://bugs.webkit.org/show_bug.cgi?id=90296

        Reviewed by Nate Chapin.

        These fonts are available in the Jelly Bean SDK.

        * platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp:
        (WebCore::ComplexTextController::ComplexTextController):
        (WebCore::ComplexTextController::getComplexFontPlatformData):

2012-06-29  Ryosuke Niwa  <rniwa@webkit.org>

        HTMLCollection's caches should be owned by either ElementRareData or Document
        https://bugs.webkit.org/show_bug.cgi?id=90322

        Reviewed by Anders Carlsson.

        Removed all instances of OwnPtr<HTMLCollection> except ones on ElementRareData and Document.
        ElementRareData::ensureCachedHTMLCollection then polymorphically creates HTMLCollection or
        its subclass as deemed necessary.

        This refactoring allows us to move HTMLCollection to use the same invalidation model as
        DynamicNodeList (invalidated during DOM mutations) in a follow up.

        * dom/Document.cpp:
        (WebCore::Document::all):
        * dom/Document.h:
        (Document):
        * dom/Element.cpp:
        (WebCore::ElementRareData::ensureCachedHTMLCollection):
        (WebCore):
        (WebCore::Element::cachedHTMLCollection):
        * dom/Element.h:
        (Element):
        * dom/ElementRareData.h:
        (WebCore):
        (ElementRareData):
        (WebCore::ElementRareData::cachedHTMLCollection):
        * dom/Node.cpp:
        (WebCore):
        * dom/Node.h:
        (Node):
        * dom/NodeRareData.h:
        (WebCore::NodeRareData::setItemType):
        (NodeRareData):
        * html/CollectionType.h:
        * html/HTMLCollection.cpp:
        (WebCore::shouldIncludeChildren):
        (WebCore::HTMLCollection::isAcceptableElement):
        * html/HTMLElement.cpp:
        (WebCore):
        (WebCore::HTMLElement::properties):
        * html/HTMLElement.h:
        (HTMLElement):
        * html/HTMLFieldSetElement.cpp:
        (WebCore::HTMLFieldSetElement::elements):
        * html/HTMLFieldSetElement.h:
        (HTMLFieldSetElement):
        * html/HTMLFormCollection.cpp:
        (WebCore::HTMLFormCollection::HTMLFormCollection):
        (WebCore::HTMLFormCollection::create):
        * html/HTMLFormCollection.h:
        (HTMLFormCollection):
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::elements):
        * html/HTMLFormElement.h:
        * html/HTMLOptionsCollection.cpp:
        (WebCore::HTMLOptionsCollection::HTMLOptionsCollection):
        (WebCore::HTMLOptionsCollection::create):
        * html/HTMLOptionsCollection.h:
        (HTMLOptionsCollection):
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::selectedOptions):
        (WebCore::HTMLSelectElement::options):
        (WebCore::HTMLSelectElement::invalidateSelectedItems):
        (WebCore::HTMLSelectElement::setRecalcListItems):
        * html/HTMLSelectElement.h:
        * html/HTMLTableElement.cpp:
        (WebCore::HTMLTableElement::rows):
        * html/HTMLTableElement.h:
        * html/HTMLTableRowsCollection.cpp:
        (WebCore::HTMLTableRowsCollection::HTMLTableRowsCollection):
        (WebCore::HTMLTableRowsCollection::create):
        * html/HTMLTableRowsCollection.h:
        (HTMLTableRowsCollection):

2012-06-29  Ojan Vafai  <ojan@chromium.org>

        Add FIXMEs for vertical writing mode and override sizes.
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::overrideLogicalContentWidth):
        (WebCore::RenderBox::overrideLogicalContentHeight):

2012-06-29  James Robinson  <jamesr@chromium.org>

        [chromium] Use CCThread::Task in compositor's RateLimiter instead of Timer
        https://bugs.webkit.org/show_bug.cgi?id=90300

        Reviewed by Adrienne Walker.

        * platform/graphics/chromium/RateLimiter.cpp:
        (RateLimiter::Task):
        (WebCore::RateLimiter::Task::create):
        (WebCore::RateLimiter::Task::~Task):
        (WebCore::RateLimiter::Task::Task):
        (WebCore):
        (WebCore::RateLimiter::RateLimiter):
        (WebCore::RateLimiter::start):
        (WebCore::RateLimiter::stop):
        (WebCore::RateLimiter::rateLimitContext):
        * platform/graphics/chromium/RateLimiter.h:
        (WebCore):
        (RateLimiter):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::~CCLayerTreeHost):

2012-06-29  Tony Payne  <tpayne@chromium.org>

        Remove type from screenColorProfile API
        https://bugs.webkit.org/show_bug.cgi?id=90299

        Reviewed by Adam Barth.

        Covered by existing tests.

        * platform/PlatformScreen.h:
        (WebCore): Removed type from screenColorProfile().
        * platform/blackberry/PlatformScreenBlackBerry.cpp:
        (WebCore::screenColorProfile):
        * platform/chromium/PlatformScreenChromium.cpp:
        (WebCore::screenColorProfile):
        * platform/efl/PlatformScreenEfl.cpp:
        (WebCore::screenColorProfile):
        * platform/gtk/PlatformScreenGtk.cpp:
        (WebCore::screenColorProfile):
        * platform/image-decoders/ImageDecoder.h:
        (WebCore::ImageDecoder::qcmsOutputDeviceProfile): Updated call to
        screenColorProfile() to not pass type param.
        * platform/mac/PlatformScreenMac.mm:
        (WebCore::screenColorProfile):
        * platform/qt/PlatformScreenQt.cpp:
        (WebCore::screenColorProfile):
        * platform/win/PlatformScreenWin.cpp:
        (WebCore::screenColorProfile):

2012-06-29  Emil A Eklund  <eae@chromium.org>

        Allow non-borders to be adjusted to less than 1 when zoomed out
        https://bugs.webkit.org/show_bug.cgi?id=90104

        Reviewed by Eric Seidel.

        Change CSSPrimitiveValue::computeLengthDouble to allow values to be
        adjusted to less than 1.0 when zoomed out. This avoids an off by one
        error for floats with margins when zoomed out that can cause floats to
        wrap and break pages.

        The logic that prevents the value from being adjusted to less than 1 was
        added to ensure that borders are still painted even when zoomed out.
        By moving the logic to ApplyPropertyComputeLength::applyValue, which is
        used for borders and outlines, that functionality is preserved.

        Test: fast/sub-pixel/float-with-margin-in-container.html

        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::computeLengthDouble):
        * css/StyleBuilder.cpp:
        (WebCore::ApplyPropertyComputeLength::applyValue):

2012-06-29  Ryosuke Niwa  <rniwa@webkit.org>

        Let Xcode have its own way after r121513.

        * WebCore.xcodeproj/project.pbxproj:

2012-06-29  Mihai Balan  <mibalan@adobe.com>

        [CSS Regions] Adding feature defines for CSS Regions for Windows
        https://bugs.webkit.org/show_bug.cgi?id=88645

        Reviewed by Tony Chang.

        Re-trying to enable CSS regions on Windows. This time only enabling
        regions (not exclusions) because of some strange compilation/linking
        issues.

        * css/CSSPropertyNames.in: Touched file to make sure property names get properly rebuilt.

2012-06-29  Hanna Ma  <Hanma@rim.com>

        Web Inspector: Add data length to resource events on timeline to
        keep track of the amount of data loaded and the total data length
        https://bugs.webkit.org/show_bug.cgi?id=89244

        Reviewed by Pavel Feldman.

        Added data length to inspector timeline popup
        content for resources to keep track of the amount of data loaded.
        Tests: inspector/timeline/timeline-network-received-data.html

        * English.lproj/localizedStrings.js:
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::willReceiveResourceDataImpl):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        (WebCore::InspectorInstrumentation::willReceiveResourceData):
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::willReceiveResourceData):
        * inspector/InspectorTimelineAgent.h:
        (InspectorTimelineAgent):
        * inspector/TimelineRecordFactory.cpp:
        (WebCore::TimelineRecordFactory::createReceiveResourceData):
        * inspector/TimelineRecordFactory.h:
        (TimelineRecordFactory):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype._showPopover):
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.prototype.reset):
        (WebInspector.TimelinePresentationModel.Record):
        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::didReceiveData):
        * inspector/timeline/timeline-network-received-data.html: Added.
        * inspector/timeline/timeline-network-received-data-expected.txt: Added.
        * inspector/timeline/timeline-test.js:

2012-06-29  Shawn Singh  <shawnsingh@chromium.org>

        Unreviewed build fix after 121580.

        WebKit Linux debug bots was complaining about signed vs unsigned integer comparison.

        * html/HTMLCollection.h:
        (WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase):

2012-06-28  James Robinson  <jamesr@chromium.org>

        [chromium] Remove mapRect and mapQuad from WebTransformationMatrix
        https://bugs.webkit.org/show_bug.cgi?id=90230

        Reviewed by Adrienne Walker.

        Replaces calls to WebTransformationMatrix::mapRect/mapQuad with clipping-aware calls to CCMathUtils. In most
        cases, we do not expect clipping to happen. For others (such as area calculations in CCOverdrawMetrics) we can
        handle a clipped quad easily.

        * platform/chromium/support/WebTransformationMatrix.cpp:
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
        (WebCore::LayerRendererChromium::drawTileQuad):
        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
        (WebCore::RenderSurfaceChromium::drawableContentRect):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::getDrawRect):
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::transformSurfaceOpaqueRegion):
        (WebCore::addOcclusionBehindLayer):
        * platform/graphics/chromium/cc/CCOverdrawMetrics.cpp:
        (WebCore):
        (WebCore::polygonArea):
        (WebCore::areaOfMappedQuad):
        (WebCore::CCOverdrawMetrics::didUpload):
        (WebCore::CCOverdrawMetrics::didCullForDrawing):
        (WebCore::CCOverdrawMetrics::didDraw):
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::appendQuadsToFillScreen):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::drawableContentRect):
        * platform/graphics/chromium/cc/CCSharedQuadState.cpp:
        (WebCore::CCSharedQuadState::isLayerAxisAlignedIntRect):

2012-06-29  Ryosuke Niwa  <rniwa@webkit.org>

        Mac build fix after r121575. It rolls out r121547 but didn't roll out the follow up build fix r121553.

        * platform/graphics/mac/FontCustomPlatformData.h:
        (FontCustomPlatformData):

2012-06-29  Ryosuke Niwa  <rniwa@webkit.org>

        Share the same cache in HTMLCollection and DynamicNodeLists
        https://bugs.webkit.org/show_bug.cgi?id=90118

        Reviewed by Anders Carlsson.

        This patch introduces two new base classes DynamicNodeListCacheBase and HTMLCollectionCacheBase to share
        the cache object between DynamicNodeList and HTMLCollection. HTMLCollectionCacheBase inherits from
        DynamicNodeListCacheBase and contains extra caches and bit flags for HTMLCollection. DynamicNodeList::Cache
        and HTMLCollection::Cache had been removed and flattened into these two classes for the easy inheritance.

        In DynamicNodeList, we have a very straight forward one-to-one mapping from old Caches member variables:

        m_caches.lastItem -> cachedItem()
        m_caches.lastItemOffset -> cachedItemOffset()
        m_caches.cachedLength -> cachedLength()
        m_caches.isItemCacheValid -> isItemCacheValid()
        m_caches.isLengthCacheValid -> isLengthCacheValid()
        m_caches.type -> removed because it was never used.
        m_caches.rootedAtDocument -> isRootedAtDocument()
        m_caches.shouldInvalidateOnAttributeChange -> shouldInvalidateOnAttributeChange()

        In HTMLCollection, there is one semantic change in the way item cache is managed. Previously, we only had
        m_cache.current which was used as both cachedItem() and isItemCacheValid() (not valid when current is null).
        There are some asymmetric code changes due to one-to-many relationship. Also, all method names have been updated
        to use that of DynamicNodeList terminology. Thus we have the following correspondence:

        m_cache.current -> cachedItem() / isItemCacheValid()
        m_cache.position -> cachedItemOffset()
        m_cache.length -> cachedLength()
        m_cache.elementsArrayPosition -> cachedElementsArrayOffset()
        m_cache.hasLength -> isLengthCacheValid()
        m_cache.hasNameCache -> hasNameCache() / setHasNameCache()
        m_cache.idCache -> idCache() / addIdCache()
        m_cache.nameCache -> idCache() / addNameCache()

        In addition, we had to rename HTMLCollection::clearCache to invalidateCache to avoid the name collision with
        HTMLCollectionCacheBase::clearCache.

        * dom/ChildNodeList.cpp:
        (WebCore::ChildNodeList::length):
        (WebCore::ChildNodeList::item):
        * dom/DynamicNodeList.cpp:
        (WebCore::DynamicSubtreeNodeList::length):
        (WebCore::DynamicSubtreeNodeList::itemForwardsFromCurrent):
        (WebCore::DynamicSubtreeNodeList::itemBackwardsFromCurrent):
        (WebCore::DynamicSubtreeNodeList::item):
        * dom/DynamicNodeList.h:
        (DynamicNodeListCacheBase):
        (WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase):
        (WebCore::DynamicNodeListCacheBase::isRootedAtDocument):
        (WebCore::DynamicNodeListCacheBase::shouldInvalidateOnAttributeChange):
        (WebCore::DynamicNodeListCacheBase::isItemCacheValid):
        (WebCore::DynamicNodeListCacheBase::cachedItem):
        (WebCore::DynamicNodeListCacheBase::cachedItemOffset):
        (WebCore::DynamicNodeListCacheBase::isLengthCacheValid):
        (WebCore::DynamicNodeListCacheBase::cachedLength):
        (WebCore::DynamicNodeListCacheBase::setLengthCache):
        (WebCore::DynamicNodeListCacheBase::setItemCache):
        (WebCore::DynamicNodeListCacheBase::clearCache):
        (WebCore):
        (WebCore::DynamicNodeList::DynamicNodeList):
        (WebCore::DynamicNodeList::invalidateCache):
        (WebCore::DynamicNodeList::rootNode):
        (DynamicNodeList):
        * html/HTMLAllCollection.cpp:
        (WebCore::HTMLAllCollection::namedItemWithIndex):
        * html/HTMLCollection.cpp:
        (WebCore::HTMLCollection::HTMLCollection):
        (WebCore::HTMLCollection::invalidateCacheIfNeeded):
        (WebCore::HTMLCollection::invalidateCache):
        (WebCore::HTMLCollection::isAcceptableElement):
        (WebCore::HTMLCollection::itemAfter):
        (WebCore::HTMLCollection::length):
        (WebCore::HTMLCollection::item):
        (WebCore::HTMLCollection::checkForNameMatch):
        (WebCore::HTMLCollection::namedItem):
        (WebCore::HTMLCollection::updateNameCache):
        (WebCore::HTMLCollection::hasNamedItem):
        (WebCore::HTMLCollection::namedItems):
        (WebCore::HTMLCollectionCacheBase::append):
        * html/HTMLCollection.h:
        (HTMLCollectionCacheBase):
        (WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase):
        (WebCore::HTMLCollectionCacheBase::type):
        (WebCore::HTMLCollectionCacheBase::clearCache):
        (WebCore::HTMLCollectionCacheBase::setItemCache):
        (WebCore::HTMLCollectionCacheBase::cachedElementsArrayOffset):
        (WebCore::HTMLCollectionCacheBase::includeChildren):
        (WebCore::HTMLCollectionCacheBase::cacheTreeVersion):
        (WebCore::HTMLCollectionCacheBase::idCache):
        (WebCore::HTMLCollectionCacheBase::nameCache):
        (WebCore::HTMLCollectionCacheBase::appendIdCache):
        (WebCore::HTMLCollectionCacheBase::appendNameCache):
        (WebCore::HTMLCollectionCacheBase::hasNameCache):
        (WebCore::HTMLCollectionCacheBase::setHasNameCache):
        (WebCore):
        (WebCore::HTMLCollection::isEmpty):
        (WebCore::HTMLCollection::hasExactlyOneItem):
        (WebCore::HTMLCollection::base):
        (HTMLCollection):
        * html/HTMLFormCollection.cpp:
        (WebCore::HTMLFormCollection::item):
        (WebCore::HTMLFormCollection::updateNameCache):
        * html/HTMLNameCollection.cpp:
        (WebCore::HTMLNameCollection::itemAfter):
        * html/HTMLNameCollection.h:
        (HTMLNameCollection):
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::invalidateSelectedItems):
        * html/HTMLTableRowsCollection.cpp:
        (WebCore::HTMLTableRowsCollection::itemAfter):
        * html/HTMLTableRowsCollection.h:
        (HTMLTableRowsCollection):

2012-06-29  Tony Chang  <tony@chromium.org>

        Unreviewed, rolling out r121572.
        http://trac.webkit.org/changeset/121572
        https://bugs.webkit.org/show_bug.cgi?id=90249

        Breaks Mac build since it depends on r121547, which was rolled
        out

        * WebCore.exp.in:
        * page/AlternativeTextClient.h:
        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::populate):
        * platform/graphics/cg/ImageBufferDataCG.h:
        * platform/graphics/mac/GraphicsContextMac.mm:
        (WebCore::GraphicsContext::drawLineForDocumentMarker):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::setClosedCaptionsVisible):
        * platform/mac/WebCoreSystemInterface.h:
        * platform/network/Credential.h:
        * platform/network/cf/ResourceRequestCFNet.cpp:
        (WebCore):
        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
        * platform/text/TextChecking.h:
        (WebCore):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::containsPaintedContent):

2012-06-29  Tony Chang  <tony@chromium.org>

        Unreviewed, rolling out r121547.
        http://trac.webkit.org/changeset/121547
        https://bugs.webkit.org/show_bug.cgi?id=90256

        Breaks Chromium Mac build

        * platform/LocalizedStrings.cpp:
        (WebCore::imageTitle):
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::setAllowsFontSmoothing):
        * platform/graphics/cg/ImageCG.cpp:
        (WebCore::Image::drawPattern):
        * platform/graphics/cg/ImageSourceCG.cpp:
        (WebCore::ImageSource::clear):
        * platform/graphics/cg/PathCG.cpp:
        (WebCore::Path::boundingRect):
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        (WebCore):
        (WebCore::canSetCascadeListForCustomFont):
        (WebCore::FontPlatformData::ctFont):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        * platform/graphics/mac/ComplexTextController.cpp:
        * platform/graphics/mac/FontCacheMac.mm:
        (WebCore):
        (WebCore::fontCacheATSNotificationCallback):
        (WebCore::FontCache::platformInit):
        * platform/graphics/mac/FontCustomPlatformData.cpp:
        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
        (WebCore::createFontCustomPlatformData):
        * platform/graphics/mac/FontCustomPlatformData.h:
        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
        * platform/graphics/mac/SimpleFontDataMac.mm:
        (WebCore::SimpleFontData::platformInit):
        * platform/graphics/mac/WebLayer.h:
        * platform/mac/CursorMac.mm:
        (WebCore::Cursor::ensurePlatformCursor):
        * platform/mac/DisplaySleepDisabler.cpp:
        (WebCore::DisplaySleepDisabler::DisplaySleepDisabler):
        (WebCore):
        (WebCore::DisplaySleepDisabler::systemActivityTimerFired):
        * platform/mac/DisplaySleepDisabler.h:
        (DisplaySleepDisabler):
        * platform/mac/HTMLConverter.h:
        * platform/mac/HTMLConverter.mm:
        * platform/mac/PopupMenuMac.mm:
        (WebCore::PopupMenuMac::populate):
        * platform/mac/ScrollElasticityController.mm:

2012-06-29  Eric Penner  <epenner@google.com>

        [chromium] Adding PrioritizedTexture and replacing ContentsTextureManager
        https://bugs.webkit.org/show_bug.cgi?id=84308

        Reviewed by Adrienne Walker.

        PrioritizedTextures have a priority such that all texture requests can be
        prioritized. There are three steps involved:
            - Call setRequestPriority()
            - Check if the request succeeded with canAcquireBackingTexture()
            - Call acquireBackingTexture() when uploading a new texture.

        Internally both the texture requests and the backing textures get sorted.
        Requests are sorted so they can be prioritized. Backing textures are sorted
        so that they can be recycled/evicted in the right order (lowest priority first).

        Prioritizing textures doesn't assign backing textures to texture requests but
        rather just marks which textures can have a backing texture "when needed". This
        allows us to keep the old textures in use as long as possible.

        The unit tests support all the use cases from the original texture manager
        but also adds assumptions about priority order throughout all the tests. The
        function assertInvariants() is added to test the validity of the manager
        and all textures/allocations within it.

        The TiledLayerChromium tests are updated to request textures first with
        prioritizeTextures(), and update them with the updater (such that allocate
        gets called) before pushPropertiesTo is called (when they need to be valid).

        * WebCore.gypi:
        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
        (WebCore::BitmapCanvasLayerTextureUpdater::Texture::Texture):
        (WebCore::BitmapCanvasLayerTextureUpdater::createTexture):
        (WebCore::BitmapCanvasLayerTextureUpdater::updateTextureRect):
        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h:
        (WebCore):
        (Texture):
        (BitmapCanvasLayerTextureUpdater):
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::Texture::Texture):
        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::createTexture):
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
        (Texture):
        (BitmapSkPictureCanvasLayerTextureUpdater):
        * platform/graphics/chromium/ContentLayerChromium.cpp:
        (WebCore::ContentLayerChromium::setTexturePriorities):
        (WebCore):
        (WebCore::ContentLayerChromium::update):
        * platform/graphics/chromium/ContentLayerChromium.h:
        (ContentLayerChromium):
        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::createAcceleratedCanvas):
        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::Texture::Texture):
        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::createTexture):
        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h:
        (Texture):
        (FrameBufferSkPictureCanvasLayerTextureUpdater):
        * platform/graphics/chromium/ImageLayerChromium.cpp:
        (WebCore::ImageLayerTextureUpdater::Texture::Texture):
        (WebCore::ImageLayerTextureUpdater::createTexture):
        (WebCore::ImageLayerTextureUpdater::updateTextureRect):
        (WebCore::ImageLayerChromium::setTexturePriorities):
        (WebCore):
        * platform/graphics/chromium/ImageLayerChromium.h:
        (ImageLayerChromium):
        * platform/graphics/chromium/LayerChromium.h:
        (LayerChromium):
        (WebCore::LayerChromium::setTexturePriorities):
        * platform/graphics/chromium/LayerTextureUpdater.h:
        (WebCore::LayerTextureUpdater::Texture::texture):
        (WebCore::LayerTextureUpdater::Texture::swapTextureWith):
        (WebCore::LayerTextureUpdater::Texture::Texture):
        (Texture):
        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        (WebCore::ScrollbarLayerChromium::pushPropertiesTo):
        (WebCore::ScrollbarLayerChromium::createTextureUpdaterIfNeeded):
        (WebCore::ScrollbarLayerChromium::updatePart):
        (WebCore):
        (WebCore::ScrollbarLayerChromium::setTexturePriorities):
        * platform/graphics/chromium/ScrollbarLayerChromium.h:
        (ScrollbarLayerChromium):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::UpdatableTile::managedTexture):
        (WebCore::TiledLayerChromium::pushPropertiesTo):
        (WebCore::TiledLayerChromium::textureManager):
        (WebCore::TiledLayerChromium::createTile):
        (WebCore::TiledLayerChromium::tileNeedsBufferedUpdate):
        (WebCore::TiledLayerChromium::updateTiles):
        (WebCore::TiledLayerChromium::setTexturePriorities):
        (WebCore):
        (WebCore::TiledLayerChromium::setTexturePrioritiesInRect):
        (WebCore::TiledLayerChromium::resetUpdateState):
        (WebCore::TiledLayerChromium::updateLayerRect):
        (WebCore::TiledLayerChromium::idleUpdateLayerRect):
        (WebCore::TiledLayerChromium::needsIdlePaint):
        (WebCore::TiledLayerChromium::idlePaintRect):
        * platform/graphics/chromium/TiledLayerChromium.h:
        (TiledLayerChromium):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
        (WebCore::CCLayerTreeHost::deleteContentsTexturesOnImplThread):
        (WebCore::CCLayerTreeHost::beginCommitOnImplThread):
        (WebCore::CCLayerTreeHost::commitComplete):
        (WebCore::CCLayerTreeHost::evictAllContentTextures):
        (WebCore::CCLayerTreeHost::contentsTextureManager):
        (WebCore::CCLayerTreeHost::updateLayers):
        (WebCore::CCLayerTreeHost::prioritizeTextures):
        (WebCore::CCLayerTreeHost::deleteTextureAfterCommit):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore):
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCPrioritizedTexture.cpp: Added.
        (WebCore):
        (WebCore::CCPrioritizedTexture::CCPrioritizedTexture):
        (WebCore::CCPrioritizedTexture::~CCPrioritizedTexture):
        (WebCore::CCPrioritizedTexture::setTextureManager):
        (WebCore::CCPrioritizedTexture::setDimensions):
        (WebCore::CCPrioritizedTexture::requestLate):
        (WebCore::CCPrioritizedTexture::acquireBackingTexture):
        (WebCore::CCPrioritizedTexture::textureId):
        (WebCore::CCPrioritizedTexture::bindTexture):
        (WebCore::CCPrioritizedTexture::framebufferTexture2D):
        (WebCore::CCPrioritizedTexture::setCurrentBacking):
        * platform/graphics/chromium/cc/CCPrioritizedTexture.h: Added.
        (WebCore):
        (CCPrioritizedTexture):
        (WebCore::CCPrioritizedTexture::create):
        (WebCore::CCPrioritizedTexture::textureManager):
        (WebCore::CCPrioritizedTexture::format):
        (WebCore::CCPrioritizedTexture::size):
        (WebCore::CCPrioritizedTexture::memorySizeBytes):
        (WebCore::CCPrioritizedTexture::setRequestPriority):
        (WebCore::CCPrioritizedTexture::requestPriority):
        (WebCore::CCPrioritizedTexture::canAcquireBackingTexture):
        (WebCore::CCPrioritizedTexture::haveBackingTexture):
        (Backing):
        (WebCore::CCPrioritizedTexture::Backing::size):
        (WebCore::CCPrioritizedTexture::Backing::format):
        (WebCore::CCPrioritizedTexture::Backing::memorySizeBytes):
        (WebCore::CCPrioritizedTexture::Backing::textureId):
        (WebCore::CCPrioritizedTexture::Backing::currentTexture):
        (WebCore::CCPrioritizedTexture::Backing::setCurrentTexture):
        (WebCore::CCPrioritizedTexture::Backing::Backing):
        (WebCore::CCPrioritizedTexture::Backing::~Backing):
        (WebCore::CCPrioritizedTexture::isAbovePriorityCutoff):
        (WebCore::CCPrioritizedTexture::setAbovePriorityCutoff):
        (WebCore::CCPrioritizedTexture::setManagerInternal):
        (WebCore::CCPrioritizedTexture::currentBacking):
        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.cpp: Added.
        (WebCore):
        (WebCore::CCPrioritizedTextureManager::CCPrioritizedTextureManager):
        (WebCore::CCPrioritizedTextureManager::~CCPrioritizedTextureManager):
        (WebCore::CCPrioritizedTextureManager::setMemoryAllocationLimitBytes):
        (WebCore::CCPrioritizedTextureManager::prioritizeTextures):
        (WebCore::CCPrioritizedTextureManager::clearPriorities):
        (WebCore::CCPrioritizedTextureManager::requestLate):
        (WebCore::CCPrioritizedTextureManager::acquireBackingTextureIfNeeded):
        (WebCore::CCPrioritizedTextureManager::reduceMemory):
        (WebCore::CCPrioritizedTextureManager::clearAllMemory):
        (WebCore::CCPrioritizedTextureManager::allBackingTexturesWereDeleted):
        (WebCore::CCPrioritizedTextureManager::unlink):
        (WebCore::CCPrioritizedTextureManager::link):
        (WebCore::CCPrioritizedTextureManager::registerTexture):
        (WebCore::CCPrioritizedTextureManager::unregisterTexture):
        (WebCore::CCPrioritizedTextureManager::returnBackingTexture):
        (WebCore::CCPrioritizedTextureManager::createBacking):
        (WebCore::CCPrioritizedTextureManager::destroyBacking):
        (WebCore::CCPrioritizedTextureManager::assertInvariants):
        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.h: Added.
        (WebCore):
        (CCPrioritizedTextureManager):
        (WebCore::CCPrioritizedTextureManager::create):
        (WebCore::CCPrioritizedTextureManager::createTexture):
        (WebCore::CCPrioritizedTextureManager::memoryUseBytes):
        (WebCore::CCPrioritizedTextureManager::memoryAboveCutoffBytes):
        (WebCore::CCPrioritizedTextureManager::setMaxMemoryLimitBytes):
        (WebCore::CCPrioritizedTextureManager::maxMemoryLimitBytes):
        (WebCore::CCPrioritizedTextureManager::setPreferredMemoryLimitBytes):
        (WebCore::CCPrioritizedTextureManager::preferredMemoryLimitBytes):
        (WebCore::CCPrioritizedTextureManager::setMaxMemoryPriorityCutoff):
        (WebCore::CCPrioritizedTextureManager::maxMemoryPriorityCutoff):
        (WebCore::CCPrioritizedTextureManager::compareTextures):
        (WebCore::CCPrioritizedTextureManager::compareBackings):
        * platform/graphics/chromium/cc/CCPriorityCalculator.cpp: Added.
        (WebCore):
        (WebCore::CCPriorityCalculator::uiPriority):
        (WebCore::CCPriorityCalculator::visiblePriority):
        (WebCore::CCPriorityCalculator::lingeringPriority):
        (WebCore::CCPriorityCalculator::priorityFromDistance):
        (WebCore::CCPriorityCalculator::priorityFromVisibility):
        * platform/graphics/chromium/cc/CCPriorityCalculator.h: Added.
        (WebCore):
        (CCPriorityCalculator):
        (WebCore::CCPriorityCalculator::highestPriority):
        (WebCore::CCPriorityCalculator::lowestPriority):
        (WebCore::CCPriorityCalculator::priorityIsLower):
        (WebCore::CCPriorityCalculator::priorityIsHigher):
        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:

2012-06-29  Eric Seidel  <eric@webkit.org>

        Remove BUILDING_ON_LEOPARD now that no ports build on Leopard
        https://bugs.webkit.org/show_bug.cgi?id=90249

        Reviewed by Ryosuke Niwa.

        I don't think I quite got it all yet, but this is another step towards
        removing Leopard support in WebCore.

        * WebCore.exp.in:
        * page/AlternativeTextClient.h:
        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::populate):
        * platform/graphics/cg/ImageBufferDataCG.h:
        * platform/graphics/mac/GraphicsContextMac.mm:
        (WebCore::GraphicsContext::drawLineForDocumentMarker):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::setClosedCaptionsVisible):
        * platform/mac/WebCoreSystemInterface.h:
        * platform/network/Credential.h:
        * platform/network/cf/ResourceRequestCFNet.cpp:
        (WebCore):
        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
        * platform/text/TextChecking.h:
        (WebCore):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::containsPaintedContent):

2012-06-29  Andreas Kling  <kling@webkit.org>

        Unreviewed, rolling out r121562.
        http://trac.webkit.org/changeset/121562
        https://bugs.webkit.org/show_bug.cgi?id=89945

        Broke a couple of editing/pasteboard tests.

        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::length):
        (WebCore::PropertySetCSSStyleDeclaration::item):
        (WebCore::PropertySetCSSStyleDeclaration::cssText):
        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValue):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValue):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyPriority):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyShorthand):
        (WebCore::PropertySetCSSStyleDeclaration::isPropertyImplicit):
        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValueInternal):
        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
        (WebCore::PropertySetCSSStyleDeclaration::copy):
        (WebCore::PropertySetCSSStyleDeclaration::makeMutable):
        (WebCore::PropertySetCSSStyleDeclaration::cssPropertyMatches):
        (WebCore::InlineCSSStyleDeclaration::didMutate):
        (WebCore::InlineCSSStyleDeclaration::parentStyleSheet):
        * css/PropertySetCSSStyleDeclaration.h:
        (WebCore::PropertySetCSSStyleDeclaration::clearParentElement):
        (PropertySetCSSStyleDeclaration):
        (WebCore::InlineCSSStyleDeclaration::InlineCSSStyleDeclaration):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::ensureInlineCSSStyleDeclaration):
        (WebCore::StylePropertySet::clearParentElement):
        (WebCore):
        * css/StylePropertySet.h:
        (StylePropertySet):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::destroyInlineStyle):
        (WebCore):
        * dom/ElementAttributeData.h:
        (ElementAttributeData):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::~StyledElement):
        (WebCore):
        (WebCore::StyledElement::styleAttributeChanged):
        * dom/StyledElement.h:
        (StyledElement):
        (WebCore::StyledElement::destroyInlineStyle):

2012-06-29  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>

        [Qt] Add missing support for tiled shadow blur on fillRect
        https://bugs.webkit.org/show_bug.cgi?id=90082

        Reviewed by Noam Rosenthal.

        This overloaded fillRect implementation also supports this optimization in
        certain situations.

        * platform/graphics/qt/GraphicsContextQt.cpp:
        (WebCore::GraphicsContext::fillRect):

2012-06-29  Brady Eidson  <beidson@apple.com>

        Build fix - These should not be executable!

        Rubberstamped by Jessie Berlin.

        * loader/cache/CachedSVGDocument.cpp: Removed property svn:executable.
        * loader/cache/CachedSVGDocument.h: Removed property svn:executable.

2012-06-29  Kwang Yul Seo  <skyul@company100.net>

        Update FIXME comment in XMLDocumentParser::wellFormed
        https://bugs.webkit.org/show_bug.cgi?id=90223

        Reviewed by Adam Barth.

        XMLDocumentParser::wellFormed is still used by the XMLHttpRequest to check if the responseXML was well formed.
        So it can't be removed.

        * xml/parser/XMLDocumentParser.h:
        (XMLDocumentParser):

2012-06-29  Andreas Kling  <kling@webkit.org>

        Separate mutating CSSStyleDeclaration operations.
        <http://webkit.org/b/89945>

        Reviewed by Antti Koivisto.

        Use separate paths for mutating the StylePropertySet wrapped by a CSSStyleDeclaration.
        PropertySetCSSStyleDeclaration now has:

            - propertySet() const
            - ensureMutablePropertySet()

        This is prep work for supporting immutable ElementAttributeData objects, the idea being
        that calling ensureMutablePropertySet() may cause the element to convert its internal
        attribute storage (which also holds the inline StylePropertySet.)

        To that end, also removed the weird logic that allowed you to kill the inline style object
        by removing the 'style' attribute. We now simply clear out all the properties in that case
        which saves us a bunch of hassle (no need for a ~StyledElement anymore.)
        Note that InlineCSSStyleDeclaration now refs the element rather than the inline style.

        There should be no web-facing behavior change from any of this.

        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::length):
        (WebCore::PropertySetCSSStyleDeclaration::item):
        (WebCore::PropertySetCSSStyleDeclaration::cssText):
        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValue):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValue):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyPriority):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyShorthand):
        (WebCore::PropertySetCSSStyleDeclaration::isPropertyImplicit):
        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValueInternal):
        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
        (WebCore::PropertySetCSSStyleDeclaration::copy):
        (WebCore::PropertySetCSSStyleDeclaration::makeMutable):
        (WebCore::PropertySetCSSStyleDeclaration::cssPropertyMatches):
        (WebCore::InlineCSSStyleDeclaration::InlineCSSStyleDeclaration):
        (WebCore::InlineCSSStyleDeclaration::ref):
        (WebCore::InlineCSSStyleDeclaration::deref):
        (WebCore::InlineCSSStyleDeclaration::didMutate):
        (WebCore::InlineCSSStyleDeclaration::parentStyleSheet):
        (WebCore::InlineCSSStyleDeclaration::ensureMutablePropertySet):
        * css/PropertySetCSSStyleDeclaration.h:
        (PropertySetCSSStyleDeclaration):
        (WebCore::PropertySetCSSStyleDeclaration::propertySet):
        (WebCore::PropertySetCSSStyleDeclaration::ensureMutablePropertySet):
        (InlineCSSStyleDeclaration):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::ensureInlineCSSStyleDeclaration):
        * css/StylePropertySet.h:
        (StylePropertySet):
        * dom/ElementAttributeData.cpp:
        * dom/ElementAttributeData.h:
        (ElementAttributeData):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::styleAttributeChanged):
        * dom/StyledElement.h:
        (WebCore::StyledElement::~StyledElement):
        (StyledElement):

2012-06-29  Kwang Yul Seo  <skyul@company100.net>

        Don't call SegmentedString::toString() twice in XMLDocumentParser::append(const SegmentedString&)
        https://bugs.webkit.org/show_bug.cgi?id=90254

        Reviewed by Adam Barth.

        We can reuse the local variable parseString instead of calling s.toString() again.
        No behavior change, so no new tests.

        * xml/parser/XMLDocumentParser.cpp:
        (WebCore::XMLDocumentParser::append):

2012-06-29  Mihnea Ovidenie  <mihnea@adobe.com>

        Crash when flowing a fixed positioned element into a region.
        https://bugs.webkit.org/show_bug.cgi?id=88133

        Reviewed by Julien Chaffraix and Abhishek Arya.

        When a fixed positioned element is collected into a named flow, we have to make sure
        that such element has the RenderFlowThread as containing block instead of RenderView,
        so that the fixed positioned element is laid out properly.
        Making the RenderFlowThread the top most containing block for named flow elements required the
        modification of RenderLayer::convertToLayerCoords so that the fixed positioned elements inside the
        named flow take the same code path as the absolute positioned elements inside the named flow.
        I also added a method, checkBlockPositionedObjectsNeedLayout, in order to verify that a block
        that is ending its layout, setNeedsLayout(false), has all the positioned children laid out.
        This way, we will hit an assertion if an out-of-flow positioned child inside a RenderFlowThread
        is not laid out after the RenderFlowThread is laid out.

        Tests: fast/regions/absolute-pos-elem-in-named-flow.html
               fast/regions/absolute-pos-elem-in-region.html
               fast/regions/fixed-pos-elem-in-named-flow.html
               fast/regions/fixed-pos-elem-in-named-flow2.html
               fast/regions/fixed-pos-elem-in-region.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::checkPositionedObjectsNeedLayout):
        * rendering/RenderBlock.h:
        (RenderBlock):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::convertToLayerCoords):
        * rendering/RenderObject.cpp:
        (WebCore):
        (WebCore::RenderObject::checkBlockPositionedObjectsNeedLayout):
        (WebCore::RenderObject::containingBlock):
        (WebCore::RenderObject::container):
        * rendering/RenderObject.h:
        (RenderObject):
        (WebCore::RenderObject::setNeedsLayout):

2012-06-29  Konrad Piascik  <kpiascik@rim.com>

        Don't hardcode target dpi of 160 (it should be 96 on desktop)
        https://bugs.webkit.org/show_bug.cgi?id=88114

        Reviewed by Adam Barth.

        No behavioural change, current tests in fast/viewport cover all
        functionality.

        * WebCore.exp.in: Updated symbol for computeViewportAttributes.
        * dom/ViewportArguments.cpp: Use new parameter for devicePixelRatio
                                     and don't calculate it anymore.
        (WebCore::computeViewportAttributes):
        * dom/ViewportArguments.h: Change the deviceDPI parameter to
                                   devicePixelRatio and put the onus
                                   on the embedder to supply the
                                   correct value.  Add temporary constant.
        (WebCore):

2012-06-29  Vineet Chaudhary  <rgf748@motorola.com>

        JS binding code generator doesn't handle "attribute unsigned long[]" well.
        https://bugs.webkit.org/show_bug.cgi?id=84540

        Reviewed by Kentaro Hara.

        In JS/V8 Bindings using traits instead of specialised functions.
        Also added support for "unsigned long" in JSDOMBinding and V8Binding.

        No new tests, as no behavioural changes.

        * bindings/js/JSDOMBinding.h:
        (WebCore::Traits::arrayJSValue):
        (WebCore::jsArray):
        * bindings/v8/V8Binding.h:
        (WebCore::Traits::arrayV8Value):
        (WebCore::v8Array):

2012-06-29  Andreas Kling  <kling@webkit.org>

        Unreviewed mac build fix after r121547.
        Remove the now-unused FontCustomPlatformData::m_atsContainer.

        * platform/graphics/mac/FontCustomPlatformData.h:
        (FontCustomPlatformData):

2012-06-29  Kent Tamura  <tkent@chromium.org>

        <textarea> unnecessarily saves the value in some cases
        https://bugs.webkit.org/show_bug.cgi?id=90259

        Reviewed by Hajime Morita.

        Test: fast/forms/textarea/textarea-state-restore.html

        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::saveFormControlState):
        We apply EOL normalization to value(), but don't apply it to
        defaultValue(). Also value() can return a null string, which never
        equals to any strings. To check m_isDirty is what we need..

2012-06-25  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Provide source data for all known rule types in CSSParser, except "keyframe" and "region"
        https://bugs.webkit.org/show_bug.cgi?id=88420

        Reviewed by Antti Koivisto.

        This change transitions the CSS source code model from a flat list of style rules to a tree of all types of CSS rules
        (some of them lack actual source code data), which is crucial to model-based CSS stylesheet source editing
        (add/remove CSS rule) and navigation.
        As a side effect, the CSS parsing performance on PerformanceTests/Parser/css-parser-yui.html is improved roughly by 2%:
        - originally: median= 282.051282051 runs/s, stdev= 1.51236798322 runs/s, min= 278.481012658 runs/s, max= 283.870967742 runs/s
        - with patch applied: median= 287.206266319 runs/s, stdev= 1.31518320219 runs/s, min= 282.051282051 runs/s, max= 288.713910761 runs/s

        No new tests, as there is no client-visible behavior change. Existing Inspector tests will be modified
        to test the new data provided, along with the necessary Inspector plumbing.

        * css/CSSGrammar.y:
        * css/CSSMediaRule.cpp:
        (WebCore::CSSMediaRule::reattach): Check for mediaQueries() validity before reattaching.
        * css/CSSParser.cpp: Unless explicitly specified below, the method changes are related to the extension of the
        source-based CSS model provided by the parser.
        (WebCore::CSSParser::CSSParser):
        (WebCore::CSSParser::setupParser):
        (WebCore::CSSParser::parseDeclaration): Accept a CSSRuleSourceData for filling, since it now contains
        the related style source range.
        (WebCore::CSSParser::createImportRule):
        (WebCore::CSSParser::createMediaRule): Create CSSMediaRule even if media and rules are empty,
        which is consistent with Mozilla.
        (WebCore::CSSParser::processAndAddNewRuleToSourceTreeIfNeeded):
        (WebCore):
        (WebCore::CSSParser::addNewRuleToSourceTree):
        (WebCore::CSSParser::createKeyframesRule):
        (WebCore::CSSParser::createStyleRule):
        (WebCore::CSSParser::createFontFaceRule):
        (WebCore::CSSParser::createPageRule):
        (WebCore::CSSParser::createRegionRule):
        (WebCore::CSSParser::fixUnparsedPropertyRanges):
        (WebCore::CSSParser::markRuleHeaderStart):
        (WebCore::CSSParser::markRuleHeaderEnd):
        (WebCore::CSSParser::markRuleBodyStart):
        (WebCore::CSSParser::markRuleBodyEnd):
        (WebCore::CSSParser::markPropertyStart):
        (WebCore::CSSParser::markPropertyEnd):
        * css/CSSParser.h:
        (CSSParser):
        * css/CSSPropertySourceData.h: Extend the model to handle more types of rules and their containments.
        (WebCore):
        (WebCore::CSSRuleSourceData::create):
        (WebCore::CSSRuleSourceData::createUnknown):
        (CSSRuleSourceData):
        (WebCore::CSSRuleSourceData::CSSRuleSourceData):
        * inspector/InspectorStyleSheet.cpp: Follow the CSSParser API changes but retain the flat stored CSS rules structure.
        (ParsedStyleSheet):
        (flattenSourceData): Flatten the rule tree to retain the existing rule-handling code intact.
        (ParsedStyleSheet::setSourceData):
        (ParsedStyleSheet::ruleSourceDataAt):
        (WebCore::InspectorStyle::buildObjectForStyle):
        (WebCore::InspectorStyle::setPropertyText):
        (WebCore::InspectorStyle::styleText):
        (WebCore::InspectorStyleSheet::setRuleSelector):
        (WebCore::InspectorStyleSheet::deleteRule):
        (WebCore::InspectorStyleSheet::buildObjectForRule):
        (WebCore::InspectorStyleSheet::buildObjectForStyle):
        (WebCore::InspectorStyleSheet::ensureSourceData):
        (WebCore::InspectorStyleSheet::styleSheetTextWithChangedStyle):
        (WebCore::InspectorStyleSheetForInlineStyle::ensureParsedDataReady):
        (WebCore::InspectorStyleSheetForInlineStyle::getStyleAttributeRanges):
        * inspector/InspectorStyleSheet.h:

2012-06-29  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Annotate TextViewer.js
        https://bugs.webkit.org/show_bug.cgi?id=90266

        Reviewed by Yury Semikhatsky.

        Annotated TextViewer.js and fixed found errors.
        Drive-by: Fixed NativeMemorySnapshotView.js compilation.
        Drive-by: Fixed protocol-externs.js compilation.
        Drive-by: Removed unused platform parameter from TextViewer constructor.

        * inspector/Inspector.json:
        * inspector/InspectorDebuggerAgent.cpp:
        (WebCore::InspectorDebuggerAgent::runScript):
        * inspector/InspectorDebuggerAgent.h:
        (InspectorDebuggerAgent):
        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.NativeMemoryBarChart.prototype._updateView):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame):
        * inspector/front-end/TextViewer.js:
        (WebInspector.TextEditorMainPanel.prototype._updateHighlightsForRange):

2012-06-29  Eric Seidel  <eric@webkit.org>

        Remove still more BUILDING_ON_LEOPARD branches now that no port supports leopard
        https://bugs.webkit.org/show_bug.cgi?id=90256

        Reviewed by Ryosuke Niwa.

        * platform/LocalizedStrings.cpp:
        (WebCore::imageTitle):
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::setAllowsFontSmoothing):
        * platform/graphics/cg/ImageCG.cpp:
        (WebCore::Image::drawPattern):
        * platform/graphics/cg/ImageSourceCG.cpp:
        (WebCore::ImageSource::clear):
        * platform/graphics/cg/PathCG.cpp:
        (WebCore::Path::boundingRect):
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        (WebCore::FontPlatformData::ctFont):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        * platform/graphics/mac/ComplexTextController.cpp:
        * platform/graphics/mac/FontCacheMac.mm:
        (WebCore::fontCacheRegisteredFontsChangedNotificationCallback):
        (WebCore::FontCache::platformInit):
        * platform/graphics/mac/FontCustomPlatformData.cpp:
        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
        (WebCore::createFontCustomPlatformData):
        * platform/graphics/mac/FontCustomPlatformData.h:
        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
        * platform/graphics/mac/SimpleFontDataMac.mm:
        (WebCore::SimpleFontData::platformInit):
        * platform/graphics/mac/WebLayer.h:
        * platform/mac/CursorMac.mm:
        (WebCore::Cursor::ensurePlatformCursor):
        * platform/mac/DisplaySleepDisabler.cpp:
        (WebCore::DisplaySleepDisabler::DisplaySleepDisabler):
        (WebCore::DisplaySleepDisabler::~DisplaySleepDisabler):
        * platform/mac/DisplaySleepDisabler.h:
        (DisplaySleepDisabler):
        * platform/mac/HTMLConverter.h:
        * platform/mac/HTMLConverter.mm:
        * platform/mac/PopupMenuMac.mm:
        (WebCore::PopupMenuMac::populate):
        * platform/mac/ScrollElasticityController.mm:

2012-06-29  Zan Dobersek  <zandobersek@gmail.com>

        Unreviewed attempt at a build fix for 64-bit debug build,
        touch InsertionPoint.cpp to try to get it rebuilt.

        * html/shadow/InsertionPoint.cpp:
        (WebCore):

2012-06-29  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>

        [Qt] Don't add Qt module dependencies in features.prf

        The required dependencies are already added in WebCore.pri.

        Reviewed by Tor Arne Vestbø.

        * WebCore.pri:

2012-06-29  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Add FileSystemView
        https://bugs.webkit.org/show_bug.cgi?id=73301

        This patch introduce a split view as FileSystemView. Including directory tree as sidebar tree.

        Reviewed by Vsevolod Vlasov.

        Test: http/tests/inspector/filesystem/directory-tree.html

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/FileSystemModel.js:
        (WebInspector.FileSystemModel.Entry.compare):
        * inspector/front-end/FileSystemView.js: Added.
        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.ResourcesPanel.prototype.showFileSystem):
        (WebInspector.FileSystemTreeElement.prototype.get itemURL):
        (WebInspector.FileSystemTreeElement.prototype.onattach):
        (WebInspector.FileSystemTreeElement.prototype._handleContextMenuEvent):
        (WebInspector.FileSystemTreeElement.prototype._refreshFileSystem):
        (WebInspector.FileSystemTreeElement.prototype.onselect):
        (WebInspector.FileSystemTreeElement.prototype.clear):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:

2012-06-29  Kentaro Hara  <haraken@chromium.org>

        [V8] Replace v8::Integer::New() with v8Integer() in custom bindings
        https://bugs.webkit.org/show_bug.cgi?id=90242

        Reviewed by Yury Semikhatsky.

        v8Integer() is a fast wrapper of v8::Integer::New().
        This patch replaces v8::Integer::New() with v8Integer() in custom bindings,
        and pass isolates.

        No tests. No change in behavior.

        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
        (WebCore::V8CSSStyleDeclaration::namedPropertyEnumerator):
        (WebCore::V8CSSStyleDeclaration::namedPropertyQuery):
        * bindings/v8/custom/V8ClipboardCustom.cpp:
        (WebCore::V8Clipboard::typesAccessorGetter):
        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        (WebCore::V8DOMStringMap::namedPropertyQuery):
        (WebCore::V8DOMStringMap::namedPropertyEnumerator):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::WindowSetTimeoutImpl):
        * bindings/v8/custom/V8DataViewCustom.cpp:
        (WebCore::V8DataView::getInt8Callback):
        (WebCore::V8DataView::getUint8Callback):
        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
        (WebCore::V8HTMLInputElement::selectionStartAccessorGetter):
        (WebCore::V8HTMLInputElement::selectionEndAccessorGetter):
        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
        (WebCore::V8HTMLOptionsCollection::lengthAccessorGetter):
        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
        (WebCore::V8InjectedScriptHost::functionDetailsCallback):
        * bindings/v8/custom/V8MessageEventCustom.cpp:
        (WebCore::V8MessageEvent::portsAccessorGetter):
        * bindings/v8/custom/V8MutationCallbackCustom.cpp:
        (WebCore::V8MutationCallback::handleEvent):
        * bindings/v8/custom/V8NodeListCustom.cpp:
        (WebCore::V8NodeList::namedPropertyGetter):
        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
        (WebCore::V8SQLTransaction::executeSqlCallback):
        * bindings/v8/custom/V8SQLTransactionSyncCustom.cpp:
        (WebCore::V8SQLTransactionSync::executeSqlCallback):
        * bindings/v8/custom/V8StorageCustom.cpp:
        (WebCore::V8Storage::namedPropertyEnumerator):
        (WebCore::V8Storage::indexedPropertyGetter):
        (WebCore::V8Storage::namedPropertyQuery):
        (WebCore::V8Storage::indexedPropertySetter):
        (WebCore::V8Storage::indexedPropertyDeleter):
        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
        (WebCore::toV8Object):
        (WebCore::V8WebGLRenderingContext::getAttachedShadersCallback):
        (WebCore::V8WebGLRenderingContext::getSupportedExtensionsCallback):
        * bindings/v8/custom/V8WorkerContextCustom.cpp:
        (WebCore::SetTimeoutOrInterval):

2012-06-29  Kentaro Hara  <haraken@chromium.org>

        Unreviewed, rolling out r121520.
        http://trac.webkit.org/changeset/121520
        https://bugs.webkit.org/show_bug.cgi?id=90246

        the performance optimization needs more investigation

        * dom/DatasetDOMStringMap.cpp:
        (WebCore::convertPropertyNameToAttributeName):
        * dom/Element.cpp:
        (WebCore::Element::getAttributeNS):
        (WebCore::Element::removeAttribute):
        (WebCore::Element::removeAttributeNS):
        (WebCore::Element::getAttributeNode):
        (WebCore::Element::getAttributeNodeNS):
        (WebCore::Element::hasAttribute):
        (WebCore::Element::hasAttributeNS):
        * dom/Element.h:
        (Element):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::getAttributeNode):
        * dom/ElementAttributeData.h:
        (ElementAttributeData):

2012-06-29  Kentaro Hara  <haraken@chromium.org>

        [V8] Replace v8::Integer::New() with v8Integer() in bindings/v8/*.{h,cpp}
        https://bugs.webkit.org/show_bug.cgi?id=90238

        Reviewed by Yury Semikhatsky.

        v8Integer() is a fast wrapper of v8::Integer::New().
        We can replace v8::Integer::New() with v8Integer()
        in bindings/v8/*.{h,cpp}. In addition, we pass isolate
        to v8Integer() where possible.

        No tests. No change in behavior.

        * bindings/v8/Dictionary.cpp:
        (WebCore::Dictionary::get):
        * bindings/v8/NPV8Object.cpp:
        (_NPN_Enumerate): Changed v8::None to 0, for consistency with other code.
        * bindings/v8/PageScriptDebugServer.cpp:
        (WebCore::PageScriptDebugServer::addListener):
        * bindings/v8/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::setBreakpoint):
        (WebCore::ScriptDebugServer::compileScript):
        * bindings/v8/SerializedScriptValue.cpp:
        * bindings/v8/V8Binding.cpp:
        (WebCore::v8Array):
        (WebCore::v8ValueToWebCoreDOMStringList):
        * bindings/v8/V8Binding.h:
        (WebCore::v8Array):
        (WebCore::v8NumberArrayToVector):
        * bindings/v8/V8Collection.h:
        (WebCore::nodeCollectionIndexedPropertyEnumerator):
        (WebCore::collectionIndexedPropertyEnumerator):
        * bindings/v8/V8LazyEventListener.cpp:
        (WebCore::V8LazyEventListener::prepareListenerObject):
        * bindings/v8/V8NPObject.cpp:
        (WebCore::npObjectQueryProperty):
        (WebCore::npObjectPropertyEnumerator):
        * bindings/v8/V8NPUtils.cpp:
        (WebCore::convertNPVariantToV8Object):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::batchConfigureConstants):
        (WebCore::V8Proxy::compileScript):
        * bindings/v8/V8Utilities.cpp:
        (WebCore::createHiddenDependency):
        (WebCore::removeHiddenDependency):
        * bindings/v8/V8WindowErrorHandler.cpp:
        (WebCore::V8WindowErrorHandler::callListenerFunction):
        * bindings/v8/V8WorkerContextErrorHandler.cpp:
        (WebCore::V8WorkerContextErrorHandler::callListenerFunction):
        * bindings/v8/WorkerScriptDebugServer.cpp:
        (WebCore::WorkerScriptDebugServer::addListener):

2012-06-28  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Resource content is not loaded if Resource.requestContent method is called before network request is finished.
        https://bugs.webkit.org/show_bug.cgi?id=90153

        Reviewed by Yury Semikhatsky.

        Test: http/tests/inspector/resource-tree/resource-request-content-while-loading.html

        * inspector/front-end/NetworkRequest.js:
        * inspector/front-end/Resource.js:
        (WebInspector.Resource):
        (WebInspector.Resource.prototype.requestContent):
        (WebInspector.Resource.prototype._requestFinished):

2012-06-29  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r121529.
        http://trac.webkit.org/changeset/121529
        https://bugs.webkit.org/show_bug.cgi?id=90260

        Failed to compile on Chromium WebKitMacBuilder (Requested by
        keishi on #webkit).

        * platform/LocalizedStrings.cpp:
        (WebCore):
        * platform/graphics/cg/PathCG.cpp:
        (WebCore::Path::platformAddPathForRoundedRect):
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        (WebCore::FontPlatformData::FontPlatformData):
        (WebCore::FontPlatformData::setFont):
        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersCoreText):
        * platform/graphics/mac/FontMac.mm:
        (WebCore::showGlyphsWithAdvances):
        * platform/graphics/mac/SimpleFontDataMac.mm:
        (WebCore):
        * platform/mac/CursorMac.mm:
        (WebCore::Cursor::ensurePlatformCursor):
        * platform/mac/MemoryPressureHandlerMac.mm:
        (WebCore):
        * platform/mac/PlatformEventFactoryMac.mm:
        (WebCore::momentumPhaseForEvent):
        (WebCore::phaseForEvent):
        * platform/mac/WebCoreSystemInterface.h:
        * platform/mac/WebCoreSystemInterface.mm:
        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
        * platform/network/mac/ResourceRequestMac.mm:
        (WebCore::ResourceRequest::doUpdateResourceRequest):
        (WebCore::ResourceRequest::doUpdatePlatformRequest):
        * platform/text/cf/HyphenationCF.cpp:
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::shouldShowPlaceholderWhenFocused):

2012-06-28  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Add toggle breakpoint shortcut.
        https://bugs.webkit.org/show_bug.cgi?id=90188

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype._onMouseDown):
        (WebInspector.JavaScriptSourceFrame.prototype._toggleBreakpoint):
        (WebInspector.JavaScriptSourceFrame.prototype.toggleBreakpointOnCurrentLine):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._toggleBreakpoint):
        (WebInspector.ScriptsPanel.prototype._showOutlineDialog):
        * inspector/front-end/TextViewer.js:
        (WebInspector.TextViewer.prototype.selection):

2012-06-28  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Cursor should follow execution line when debugging.
        https://bugs.webkit.org/show_bug.cgi?id=90184

        Reviewed by Yury Semikhatsky.

        Added TextViewer.setSelection public method to set cursor selection in the editor.
        Added TextRange.createFromLocation method to create TextRanges with the same start and end points.
        Drive-by: removed unused _setCaretLocation() method in TextViewer.js

        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.setExecutionLine):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._revealExecutionLine):
        (WebInspector.ScriptsPanel.prototype._editorSelected):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame.prototype.setSelection):
        (WebInspector.SourceFrame.prototype.setContent):
        * inspector/front-end/TextEditorModel.js:
        (WebInspector.TextRange.createFromLocation):
        * inspector/front-end/TextViewer.js:
        (WebInspector.TextViewer.prototype.setSelection):
        (WebInspector.TextEditorMainPanel.prototype.highlightLine):

2012-06-27  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: IDBObjectStore.autoIncrement flag not exposed
        https://bugs.webkit.org/show_bug.cgi?id=89701

        Reviewed by Yury Semikhatsky.

        Plumbed objectStore.autoIncrement to inspector front-end and added it to tooltip.

        * English.lproj/localizedStrings.js:
        * inspector/Inspector.json:
        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore):
        * inspector/front-end/IndexedDBModel.js:
        (WebInspector.IndexedDBModel.prototype._loadDatabase.callback):
        (WebInspector.IndexedDBModel.prototype._loadDatabase):
        (WebInspector.IndexedDBModel.ObjectStore):
        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.IDBObjectStoreTreeElement.prototype._updateTooltip):

2012-06-28  Alexander Pavlov  <apavlov@chromium.org>

        Use floating keyframe rule list when parsing @-webkit-keyframes and allow abrupt rule termination
        https://bugs.webkit.org/show_bug.cgi?id=90073

        Reviewed by Antti Koivisto.

        - The grammar is changed to allow abruptly terminated stylesheet in the @-webkit-keyframes (use closing_brace, not '}').
        - A floating StyleKeyframe vector is introduced to separate the creation and filling of StyleRuleKeyframes, as other rules do.

        Test: fast/css/css-keyframe-unexpected-end.html

        * css/CSSGrammar.y:
        * css/CSSParser.cpp:
        (WebCore::CSSParser::createFloatingKeyframeVector):
        (WebCore):
        (WebCore::CSSParser::sinkFloatingKeyframeVector):
        (WebCore::CSSParser::createKeyframesRule):
        * css/CSSParser.h:

2012-06-26  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add character data to the DOM section of native memory view
        https://bugs.webkit.org/show_bug.cgi?id=89968

        Reviewed by Vsevolod Vlasov.

        Count strings referenced from CharacterData node and its descendants
        as part of the DOM tree structures in the native memory view.

        * dom/CharacterData.cpp:
        (WebCore::CharacterData::reportMemoryUsage):
        (WebCore):
        * dom/CharacterData.h:
        (CharacterData):
        * dom/MemoryInstrumentation.h:
        (MemoryInstrumentation):
        (WebCore::MemoryObjectInfo::reportString):
        (MemoryObjectInfo):
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):
        (WebCore::domTreeInfo):
        (WebCore::jsExternalResourcesInfo):
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.MemoryBlockViewProperties._initialize):

2012-06-29  Eric Seidel  <eric@webkit.org>

        Remove more BUILDING_ON_LEOPARD branches now that no port builds on Leopard
        https://bugs.webkit.org/show_bug.cgi?id=90252

        Reviewed by Ryosuke Niwa.

        * platform/LocalizedStrings.cpp:
        (WebCore):
        * platform/graphics/cg/PathCG.cpp:
        (WebCore::Path::platformAddPathForRoundedRect):
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        (WebCore::FontPlatformData::FontPlatformData):
        (WebCore::FontPlatformData::setFont):
        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersCoreText):
        * platform/graphics/mac/FontMac.mm:
        (WebCore::showGlyphsWithAdvances):
        * platform/graphics/mac/SimpleFontDataMac.mm:
        (WebCore):
        * platform/mac/CursorMac.mm:
        (WebCore::Cursor::ensurePlatformCursor):
        * platform/mac/MemoryPressureHandlerMac.mm:
        (WebCore):
        * platform/mac/PlatformEventFactoryMac.mm:
        (WebCore::momentumPhaseForEvent):
        (WebCore::phaseForEvent):
        * platform/mac/WebCoreSystemInterface.h:
        * platform/mac/WebCoreSystemInterface.mm:
        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
        * platform/network/mac/ResourceRequestMac.mm:
        (WebCore::ResourceRequest::doUpdateResourceRequest):
        (WebCore::ResourceRequest::doUpdatePlatformRequest):
        * platform/text/cf/HyphenationCF.cpp:
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::shouldShowPlaceholderWhenFocused):

2012-06-27  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: showConsole() should close previous view in drawer.
        https://bugs.webkit.org/show_bug.cgi?id=90070

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/inspector.js:
        (WebInspector.showConsole):
        (WebInspector.showPanel):

2012-06-29  Ryosuke Niwa  <rniwa@webkit.org>

        Remove a #include erroneously added in r120896.

        * editing/VisibleSelection.h:

2012-06-29  Yoshifumi Inoue  <yosin@chromium.org>

        [Platform] Implement Date Time format parser
        https://bugs.webkit.org/show_bug.cgi?id=89963

        Reviewed by Kent Tamura.

        This patch introduces Unicode TR35 LDML date time format parser for
        input type "time" if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS) is true.

        Test: WebKit/chromium/tests/DateTimeFormatTest.cpp

        * CMakeLists.txt: Added DateTimeFormat.cpp
        * GNUmakefile.list.am: Added DateTimeFormat.{cpp,h}
        * Target.pri: ditto
        * WebCore.gypi: ditto
        * WebCore.vcproj/WebCore.vcproj: ditto
        * WebCore.xcodeproj/product.pbxproj: ditto
        * platform/text/DateTimeFormat.cpp: Added.
        (WebCore::mapCharacterToFieldTypeInternal):
        (WebCore::DateTimeFormat::DateTimeFormat):
        (WebCore::DateTimeFormat::mapCharacterToFieldType):
        (WebCore::DateTimeFormat::parse):
        * platform/text/DateTimeFormat.h: Added.
        (DateTimeFormat):
        (TokenHandler):
        (WebCore::DateTimeFormat::TokenHandler::~TokenHandler):

2012-06-29  Eric Seidel  <eric@webkit.org>

        Remove more BUILDING_ON_LEOPARD usage in PLATFORM(MAC) code
        https://bugs.webkit.org/show_bug.cgi?id=85846

        Reviewed by Adam Barth.

        PLATFORM(MAC) has not supported Leopard for several months now.
        This change removes about 1/3 of the remaining BUILDING_ON_LEOPARD
        uses in the PLATFORM(MAC) codepaths.  PLATFORM(CHROMIUM) still
        supports BUILDING_ON_LEOPARD for now.

        * WebCore.exp.in:
        * dom/Document.cpp:
        (WebCore::Document::updateRangesAfterChildrenChanged):
        (WebCore::Document::nodeChildrenWillBeRemoved):
        (WebCore::Document::nodeWillBeRemoved):
        (WebCore::Document::textInserted):
        (WebCore::Document::textRemoved):
        (WebCore::Document::textNodesMerged):
        (WebCore::Document::textNodeSplit):
        * editing/Editor.cpp:
        (WebCore::Editor::respondToChangedSelection):
        * editing/TypingCommand.cpp:
        (WebCore::TypingCommand::markMisspellingsAfterTyping):
        (WebCore::TypingCommand::typingAddedToOpenCommand):
        * editing/mac/EditorMac.mm:
        (WebCore::Editor::pasteWithPasteboard):
        * loader/EmptyClients.h:
        (EmptyEditorClient):
        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::contextMenuItemSelected):
        (WebCore::ContextMenuController::createAndAppendSpellingAndGrammarSubMenu):
        (WebCore):
        (WebCore::ContextMenuController::populate):
        (WebCore::ContextMenuController::checkOrEnableIfNeeded):
        * page/EditorClient.h:
        (EditorClient):
        * platform/LocalizedStrings.cpp:
        (WebCore::contextMenuItemTagSearchWeb):
        * platform/MemoryPressureHandler.cpp:
        (WebCore):
        * platform/SuddenTermination.h:
        (WebCore):
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::updateContentsImage):
        (WebCore::GraphicsLayerCA::constrainedSize):
        * platform/graphics/ca/PlatformCALayer.h:
        (PlatformCALayer):
        * platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
        (fromCAValueFunctionType):
        (PlatformCAAnimation::valueFunction):
        (PlatformCAAnimation::setValueFunction):
        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
        (toCAFilterType):
        (PlatformCALayer::anchorPoint):
        (PlatformCALayer::setAnchorPoint):
        (PlatformCALayer::contentsTransform):
        (PlatformCALayer::setContentsTransform):
        (PlatformCALayer::isGeometryFlipped):
        (PlatformCALayer::setGeometryFlipped):
        (PlatformCALayer::acceleratesDrawing):
        (PlatformCALayer::setAcceleratesDrawing):
        (PlatformCALayer::setMinificationFilter):
        (PlatformCALayer::setMagnificationFilter):
        (PlatformCALayer::contentsScale):
        (PlatformCALayer::setContentsScale):
        * platform/graphics/ca/mac/TileCache.mm:
        (WebCore::TileCache::setScale):
        (WebCore::TileCache::setAcceleratesDrawing):
        (WebCore::TileCache::createTileLayer):

2012-06-29  Kwang Yul Seo  <skyul@company100.net>

        Use StringBuilder in SegmentedString::toString()
        https://bugs.webkit.org/show_bug.cgi?id=90247

        Reviewed by Adam Barth.

        Use a StringBuilder instead of String concatenation because StringBuilder is generally faster.
        No new tests. Covered by existing tests.

        * platform/text/SegmentedString.cpp:
        (WebCore::SegmentedString::toString):
        * platform/text/SegmentedString.h:
        (WebCore::SegmentedSubstring::appendTo):

2012-06-28  Ryosuke Niwa  <rniwa@webkit.org>

        Mac build fix after r121518.

        * WebCore.exp.in:

2012-06-28  Ryosuke Niwa  <rniwa@webkit.org>

        DOMHTMLCollection::item may return a wrong element after namedItem is called
        https://bugs.webkit.org/show_bug.cgi?id=90240

        Reviewed by Antti Koivisto.

        The bug was caused by namedItem updating m_cache.current without updating m_cache.position.
        Fixed the bug by updating both. This is similar to the bug I fixed in r121478.

        WebKit API Test: WebKit1.HTMLCollectionNamedItemTest

        * html/HTMLCollection.cpp:
        (WebCore::HTMLCollection::namedItem):

2012-06-28  Kentaro Hara  <haraken@chromium.org>

        Change argument types of Element::getAttribute*() from String to AtomicString
        https://bugs.webkit.org/show_bug.cgi?id=90246

        Reviewed by Ryosuke Niwa.

        This is a follow-up patch for r121439. r121439 changed an argument type of
        Element::getAttribute() from String to AtomicString, which optimized
        performance of Dromaeo/dom-attr.html. This patch changes other argument types
        of Element::getAttribute*() from String to AtomicString. See the ChangeLog in
        http://trac.webkit.org/changeset/121439 for more details about why this change
        optimizes performance.

        No tests. No change in behavior.

        * dom/DatasetDOMStringMap.cpp:
        (WebCore::convertPropertyNameToAttributeName):
        * dom/Element.cpp:
        (WebCore::Element::getAttributeNS):
        (WebCore::Element::removeAttribute):
        (WebCore::Element::removeAttributeNS):
        (WebCore::Element::getAttributeNode):
        (WebCore::Element::getAttributeNodeNS):
        (WebCore::Element::hasAttribute):
        (WebCore::Element::hasAttributeNS):
        * dom/Element.h:
        (Element):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::getAttributeNode):
        * dom/ElementAttributeData.h:
        (ElementAttributeData):

2012-06-28  Kent Tamura  <tkent@chromium.org>

        REGRESSION(r106388): Form hidden element values being restored
        incorrectly for dynamically generated content
        https://bugs.webkit.org/show_bug.cgi?id=88685

        Reviewed by Hajime Morita.

        We should not save value attribute updated during parsing.

        Test: fast/forms/state-restore-to-non-edited-controls.html

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::HTMLInputElement):
        Initialize m_valueAttributeWasUpdatedAfterParsing.
        (WebCore::HTMLInputElement::parseAttribute):
        Set true to m_valueAttributeWasUpdatedAfterParsing if value
        attribute is updated and it's not in parsing.
        * html/HTMLInputElement.h:
        (WebCore::HTMLInputElement::valueAttributeWasUpdatedAfterParsing):
        Added for HiddenInputType.
        * html/HiddenInputType.cpp:
        (WebCore::HiddenInputType::saveFormControlState):
        Save the value only if valueAttributeWasUpdatedAfterParsing() is true.

2012-06-28  MORITA Hajime  <morrita@google.com>

        [Refactoring] NodeRenderingContext ctor could be built on top of the ComposedShadowTreeWalker
        https://bugs.webkit.org/show_bug.cgi?id=89732

        Reviewed by Dimitri Glazkov.

        The constructor of NodeRenderingContext implements almost same
        logic as ComposedShadowTreeWalker::parent().  This change
        eliminates the duplication by employing ComposedShadowTreeWalker in the constructor.

        ComposedShadowTreeWalker has same difference from
        NodeRenderingContext though. So this change also extends
        ComposedShadowTreeWalker to support these missing pieces, which
        are encapsulated in newly introduced ParentTranversalDetails
        class where:

        - not only the parent, but also the insertion point of the child is returned,
        - resetStyleInheritance from the child-parent traversal is computed and
        - if the starting point is out of the composition, it returns null as a parent.

        This change also inlines some ComposedShadowTreeWalker methods for speed.

        No new tests. Covered by existing tests.

        * WebCore.exp.in:
        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::shadowOfParent):
        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::didTraverseInsertionPoint):
        (WebCore):
        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::didTraverseShadowRoot):
        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::didFindNode):
        (WebCore::ComposedShadowTreeWalker::findParent):
        (WebCore::ComposedShadowTreeWalker::escapeFallbackContentElement):
        (WebCore::ComposedShadowTreeWalker::traverseNodeEscapingFallbackContents):
        (WebCore::ComposedShadowTreeWalker::traverseParent):
        (WebCore::ComposedShadowTreeWalker::traverseParentInCurrentTree):
        (WebCore::ComposedShadowTreeWalker::traverseParentBackToYoungerShadowRootOrHost):
        * dom/ComposedShadowTreeWalker.h:
        (ParentTranversalDetails):
        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::ParentTranversalDetails):
        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::node):
        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::insertionPoint):
        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::resetStyleInheritance):
        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::outOfComposition):
        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::childWasOutOfComposition):
        (ComposedShadowTreeWalker):
        (WebCore::ComposedShadowTreeWalker::ComposedShadowTreeWalker):
        (WebCore):
        * dom/NodeRenderingContext.cpp:
        (WebCore::NodeRenderingContext::NodeRenderingContext):
        (WebCore::NodeRenderingContext::nextRenderer):
        (WebCore::NodeRenderingContext::previousRenderer):
        (WebCore::NodeRenderingContext::parentRenderer):
        (WebCore::NodeRenderingContext::shouldCreateRenderer):
        (WebCore::NodeRenderingContext::isOnEncapsulationBoundary):
        * dom/NodeRenderingContext.h:
        (NodeRenderingContext):
        (WebCore::NodeRenderingContext::parentNodeForRenderingAndStyle):
        (WebCore::NodeRenderingContext::resetStyleInheritance):
        (WebCore::NodeRenderingContext::insertionPoint):

2012-06-28  Stephen White  <senorblanco@chromium.org>

        Implement filter url() function.
        https://bugs.webkit.org/show_bug.cgi?id=72443

        url() references can be internal, in which case the DOM nodes are
        retrieved directly from the current document, or external, in which
        case a CachedSVGDocument request is made, and the filter node build is
        deferred until the document is loaded.  WebKitSVGDocumentValue
        holds the CachedSVGDocument (if any) and the URL as a CSSValue,
        and is stored in the CSSValue chain as the argument to the reference
        filter.

        One notable difference between internal and external references is
        that internal references will automatically update on an SVG filter node
        attribute change, while external references will not, since they live
        in a separate document.  This is consistent with the Mozilla
        implementation.  In order to make this work, the RenderLayer is made a
        client of the RenderSVGResourceContainer, and calls
        filterNeedsRepaint() when the SVG nodes are invalidated.

        Some plumbing:  The CSS StyleResolver was refactored to load all
        all external resources (images, shaders and (now) SVG filters) in a
        single function, loadPendingResources().  The PlatformLayer typedef
        was moved out into its own file, in order to break a cyclic
        dependency.  SVGFilterBuilder was modified to accept the SourceGraphic
        and SourceAlpha FilterEffects in its constructor and factory function,
        rather than extracting them from the parent Filter.  (This is necessary
        so that the url() filter can correctly hook up its inputs from
        previous CSS filters.)

        Reviewed by Dean Jackson.

        Tests: css3/filters/effect-reference-external.html
               css3/filters/effect-reference-hw.html
               css3/filters/effect-reference-ordering.html
               css3/filters/effect-reference.html

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        Add WebKitCSSSVGDocumentValue to the various build files.
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::valueForFilter):
        Use the reference filter's url when getting the computed style for
        a reference filter.
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseFilter):
        Create the referenceFilterValue's argument as a
        WebKitCSSSVGDocumentValue instead of a CSS string.
        * css/CSSValue.cpp:
        (WebCore::CSSValue::cssText):
        Add support for WebKitCSSSVGDocumentValue.
        (WebCore::CSSValue::destroy):
        Add support for WebKitCSSSVGDocumentValue.
        * css/CSSValue.h:
        (WebCore::CSSValue::isWebKitCSSSVGDocumentValue):
        Add support for WebKitCSSSVGDocumentValue.
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        Keep track of pending SVG document references, and load them when
        necessary.
        * css/StyleResolver.h:
        * css/WebKitCSSSVGDocumentValue.cpp: Added.
        New CSSValue subclass for holding SVG document references.
        (WebCore::WebKitCSSSVGDocumentValue::WebKitCSSSVGDocumentValue):
        (WebCore::WebKitCSSSVGDocumentValue::~WebKitCSSSVGDocumentValue):
        (WebCore::WebKitCSSSVGDocumentValue::load):
        (WebCore::WebKitCSSSVGDocumentValue::customCssText):
        * css/WebKitCSSSVGDocumentValue.h: Added.
        (WebCore::WebKitCSSSVGDocumentValue::create):
        (WebCore::WebKitCSSSVGDocumentValue::cachedSVGDocument):
        (WebCore::WebKitCSSSVGDocumentValue::url):
        (WebCore::WebKitCSSSVGDocumentValue::loadRequested):
        * platform/graphics/GraphicsLayer.h:
        Refactor PlatformLayer out into its own file, to avoid circular
        includes.
        * platform/graphics/ImageBuffer.h:
        Include PlatformLayer.h instead of GraphicsLayer.h.
        * platform/graphics/PlatformLayer.h: Added.
        Refactor PlatformLayer out into its own file, to avoid circular
        includes.
        * platform/graphics/filters/FilterOperation.h:
        (WebCore::ReferenceFilterOperation::create):
        (WebCore::ReferenceFilterOperation::clone):
        (WebCore::ReferenceFilterOperation::url):
        (WebCore::ReferenceFilterOperation::fragment):
        (ReferenceFilterOperation):
        (WebCore::ReferenceFilterOperation::data):
        (WebCore::ReferenceFilterOperation::setData):
        (WebCore::ReferenceFilterOperation::operator==):
        (WebCore::ReferenceFilterOperation::ReferenceFilterOperation):
        Augment ReferenceFilterOperation to maintain a data pointer,
        in order to preserve context while loading external SVG documents.
        Replace "reference" with "url" and "fragment" members, in order to
        ease retrieval of the appropriate DOM objects.
        * platform/graphics/filters/FilterOperations.cpp:
        (WebCore::FilterOperations::hasReferenceFilter):
        Convenience function for finding reference filters.
        * platform/graphics/filters/FilterOperations.h:
        (FilterOperations):
        * platform/mac/ScrollbarThemeMac.mm:
        Include GraphicsLayer.h explicitly, since ImageBuffer.h no longer
        includes it (and only includes PlatformLayer.h).
        * rendering/FilterEffectRenderer.cpp:
        (WebCore::FilterEffectRenderer::buildReferenceFilter):
        Utility function to build a FilterEffect node graph for a
        ReferenceFilterOperation.
        (WebCore::FilterEffectRenderer::build):
        Call the above builder function for ReferenceFilterOperations.
        * rendering/FilterEffectRenderer.h:
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::updateOrRemoveFilterEffect):
        If we have reference filters, update them along with other filters.
        (WebCore::RenderLayer::filterNeedsRepaint):
        * rendering/RenderLayerFilterInfo.cpp:
        (WebCore::RenderLayerFilterInfo::~RenderLayerFilterInfo):
        (WebCore::RenderLayerFilterInfo::notifyFinished):
        Implement callback function when external SVGDocuments are loaded.
        (WebCore::RenderLayerFilterInfo::updateReferenceFilterClients):
        Add the FilterInfo as a client to be called when SVGDocuments are
        loaded.
        (WebCore::RenderLayerFilterInfo::removeReferenceFilterClients):
        Remove this from the list of notified clients.
        * rendering/RenderLayerFilterInfo.h:
        Add new member vars for tracking internal and external SVG
        references, so we can remove ourselves as a client when done.
        * rendering/svg/RenderSVGResourceContainer.cpp:
        (WebCore::RenderSVGResourceContainer::markAllClientsForInvalidation):
        When marking client DOM nodes for repaint, also mark any RenderLayers
        referring to this DOM tree via filters as needing repaint.
        (WebCore::RenderSVGResourceContainer::addClientRenderLayer):
        (WebCore::RenderSVGResourceContainer::removeClientRenderLayer):
        * rendering/svg/RenderSVGResourceContainer.h:
        Maintain a list of RenderLayer clients on each SVG resource container,
        and turn SVG DOM repaint notifications into filter repaint (CSS)
        notifications.
        * rendering/svg/RenderSVGResourceFilter.cpp:
        (WebCore::RenderSVGResourceFilter::buildPrimitives):
        Construct a SourceGraphic and SourceAlpha node explicitly for the
        SVG builder case.
        * svg/graphics/filters/SVGFilterBuilder.cpp:
        (WebCore::SVGFilterBuilder::SVGFilterBuilder):
        * svg/graphics/filters/SVGFilterBuilder.h:
        (WebCore::SVGFilterBuilder::create):
        Add the SourceGraphic and SourceAlpha as parameters to the constructor
        and create() methods, so they can be supplied by the caller.

2012-06-28  Kenichi Ishibashi  <bashi@chromium.org>

        [Chromium] CTFontCopyTable of MacOSX10.5 SDK doesn't work for layout tables
        https://bugs.webkit.org/show_bug.cgi?id=90235

        Reviewed by Kent Tamura.

        Use CGFontCopyTableForTag instead.

        No new tests. css3/font-feature-settings-rendering.html should pass. I'll rebase expectations once bots get the result.

        * platform/graphics/harfbuzz/ng/HarfBuzzFaceCoreText.cpp:
        (WebCore::harfbuzzCoreTextGetTable):

2012-06-28  Philip Rogers  <pdr@google.com>

        Add preventative assert in SVGTRefElement
        https://bugs.webkit.org/show_bug.cgi?id=90203

        Reviewed by Abhishek Arya.

        SVGTRefElement::detachTarget() adds a pending resource via addPendingResource.
        Due to some recent bugs in this area, an assert is being added to prevent
        users from calling detachTarget when not in a document. Doing
        so would create a bug such as in WK90042.

        This assert will not fire currently because detachTarget is only called after
        a DOMNodeRemovedFromDocumentEvent event fires, which only comes from
        dispatchChildRemovalEvents when the node is in a document.

        * svg/SVGTRefElement.cpp:
        (WebCore::SVGTRefElement::detachTarget):

2012-06-28  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>

        [Qt] Remove unnecessary AffineTransform calls
        https://bugs.webkit.org/show_bug.cgi?id=90178

        Reviewed by Noam Rosenthal.

        Qt currently ignores the const AffineTransform& parameter on
        Pattern::createPlatformPattern, so removing it from all its Qt calls and
        changing the function signature if platform is Qt.

        * platform/graphics/Pattern.h:
        (Pattern):
        * platform/graphics/qt/FontQt.cpp:
        (WebCore::fillPenForContext):
        (WebCore::strokePenForContext):
        * platform/graphics/qt/FontQt4.cpp:
        (WebCore::fillPenForContext):
        (WebCore::strokePenForContext):
        * platform/graphics/qt/GraphicsContextQt.cpp:
        (WebCore::GraphicsContext::fillPath):
        (WebCore::GraphicsContext::strokePath):
        (WebCore::drawRepeatPattern):
        * platform/graphics/qt/PatternQt.cpp:
        (WebCore::Pattern::createPlatformPattern):

2012-06-28  No'am Rosenthal  <noam.rosenthal@nokia.com>

        [Qt] When uploading an opaque image to a texture for TextureMapper, unnecessary alpha operations take place
        https://bugs.webkit.org/show_bug.cgi?id=90229

        Reviewed by Luiz Agostini.

        For opaque web content in WebKit2, we use the RGB32 image format. When we special-case
        it in GraphicsContext3DQt, we can avoid any alpha operations and perform a regular copy.

        Covered existing API tests, as this code path is always used when rendering.

        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        (WebCore::GraphicsContext3D::getImageData):

2012-06-28  James Robinson  <jamesr@chromium.org>

        [chromium] Compile chromium compositor implementation files into separate .lib
        https://bugs.webkit.org/show_bug.cgi?id=90233

        Reviewed by Adam Barth.

        * WebCore.gyp/WebCore.gyp:

2012-06-28  Erik Arvidsson  <arv@chromium.org>

        [V8] NodeList wrappers are not kept alive as needed
        https://bugs.webkit.org/show_bug.cgi?id=90194

        Reviewed by Ojan Vafai.

        We need to add custom reachability code for DynamicNodeLists. If the owner of
        a DynamicNodeList is reachable then the DynamicNodeList must also be reachable.

        Test: fast/dom/NodeList/nodelist-reachable.html

        * bindings/v8/custom/V8NodeListCustom.cpp:
        (WebCore::V8NodeList::visitDOMWrapper): AddImplicitReferences from the owner wrapper.
        (WebCore):
        * dom/NodeList.idl:

2012-06-28  Elliott Sprehn  <esprehn@gmail.com>

        frameborder="no" on frameset is ignored if border attribute set
        https://bugs.webkit.org/show_bug.cgi?id=17767

        Reviewed by Tony Chang.

        Fixes <frameset> frameborder and border handling. Previously we'd
        override the frameborder=no setting if border was set. We also
        treated frameborder="anything" the same as frameborder=0 since we
        we just converted it to a number so frameborder=yes was incorrectly
        treated the same as frameborder=no.

        Tests: fast/frames/frameset-frameborder-boolean-values.html
               fast/frames/frameset-frameborder-inheritance.html
               fast/frames/frameset-frameborder-overrides-border.html

        * html/HTMLFrameSetElement.cpp: Proper parsing of yes,no,1,0 values.
        (WebCore::HTMLFrameSetElement::parseAttribute):
        * html/HTMLFrameSetElement.h:
        (WebCore::HTMLFrameSetElement::border): Border should be 0 if frameborder=no.

2012-06-28  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Implement IDBTransaction internal active flag
        https://bugs.webkit.org/show_bug.cgi?id=89379

        Reviewed by Tony Chang.

        IDB transactions should only be "active" during IDB success/error callbacks;
        attempts to make new requests otherwise (e.g. in a setTimeout callback)
        should fail even if the transaction has not yet finished. Implement this logic,
        and the closely related requirement that transactions are deactivated when
        the context they were created in returns to the event loop, and finally that
        when so deactivated they should commit rather than abort (as previously
        implemented) if no requests have been filed.

        Tests: storage/indexeddb/transaction-active-flag.html
               storage/indexeddb/transaction-complete-with-js-recursion-cross-frame.html
               storage/indexeddb/transaction-complete-with-js-recursion.html
               storage/indexeddb/transaction-complete-workers.html

        * Modules/indexeddb/IDBPendingTransactionMonitor.cpp: Simplify API.
        (WebCore::transactions):
        (WebCore::IDBPendingTransactionMonitor::addNewTransaction):
        (WebCore::IDBPendingTransactionMonitor::deactivateNewTransactions):
        * Modules/indexeddb/IDBPendingTransactionMonitor.h:
        (WebCore):
        (IDBPendingTransactionMonitor):
        * Modules/indexeddb/IDBRequest.cpp: Unregisters from transaction when done,
        not on destruction. No longer responsible for working with the pending monitor.
        (WebCore::IDBRequest::IDBRequest):
        (WebCore::IDBRequest::~IDBRequest):
        (WebCore::IDBRequest::markEarlyDeath):
        (WebCore::IDBRequest::resetReadyState):
        (WebCore::IDBRequest::onSuccess):
        (WebCore::IDBRequest::dispatchEvent): Set active flag on transaction during callback.
        * Modules/indexeddb/IDBTransaction.cpp: Use state enum to better track lifecycle, and
        take ownership of relationship with pending monitor.
        (WebCore::IDBTransaction::IDBTransaction): Special cases for version change
        transactions.
        (WebCore::IDBTransaction::~IDBTransaction):
        (WebCore::IDBTransaction::error):
        (WebCore::IDBTransaction::setError):
        (WebCore::IDBTransaction::objectStore):
        (WebCore::IDBTransaction::objectStoreCreated):
        (WebCore::IDBTransaction::objectStoreDeleted):
        (WebCore::IDBTransaction::setActive): Let IDBRequest and IDBPendingTransactionMonitor
        toggle the active state. Needs some smarts because (1) state may move to Finishing during
        the request's dispatch phase due to an implicit/explicit abort, and (2) a monitor call
        will only trigger a commit if the transaction hasn't had any requests filed.
        (WebCore):
        (WebCore::IDBTransaction::abort):
        (WebCore::IDBTransaction::registerRequest):
        (WebCore::IDBTransaction::unregisterRequest):
        (WebCore::IDBTransaction::onAbort):
        (WebCore::IDBTransaction::onComplete):
        (WebCore::IDBTransaction::hasPendingActivity):
        (WebCore::IDBTransaction::dispatchEvent):
        (WebCore::IDBTransaction::canSuspend):
        (WebCore::IDBTransaction::enqueueEvent):
        * Modules/indexeddb/IDBTransaction.h:
        (WebCore::IDBTransaction::isFinished):
        (IDBTransaction):
        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
        (WebCore::IDBTransactionBackendImpl::commit): Allow explicit commit() calls from the front end
        if no requests have been filed.
        * Modules/indexeddb/IDBTransactionBackendInterface.h:
        (IDBTransactionBackendInterface): Expose commit() method.
        * bindings/js/JSMainThreadExecState.cpp:
        (WebCore::JSMainThreadExecState::didLeaveScriptContext): Change target function name.
        * bindings/v8/V8RecursionScope.cpp:
        (WebCore::V8RecursionScope::didLeaveScriptContext): Change target function name.

2012-06-28  Philip Rogers  <pdr@google.com>

        Prevent crash in animate resource handling
        https://bugs.webkit.org/show_bug.cgi?id=90042

        Reviewed by Abhishek Arya.

        This patch adds a check that we are in a document before registering animation
        resources and creating a target element in SVGSMILElement. This prevents a crash where
        we would register resources and create the target when we were not in a document
        but fail to deregister / reset the target when we were removed from a document.
        In failing to reset the target, we can crash when trying to deregister resources that
        were not created after being inserted into a document and then removed.

        The existence of m_targetResources and registered animation resources is now
        tied to being in a document.

        Test: svg/custom/animate-reference-crash.html

        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::targetElement):

2012-06-28  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: IDBDatabase should have a close pending field.
        https://bugs.webkit.org/show_bug.cgi?id=71129

        Reviewed by Tony Chang.

        Handle the IDB spec case that "versionchange" events should not be fired 
        against connections that have the internal "closePending" flag set but 
        are not yet closed due to running transactions.

        Test: storage/indexeddb/database-closepending-flag.html

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::onVersionChange):

2012-06-28  Adrienne Walker  <enne@google.com>

        [chromium] Split WebScrollbar into WebPluginScrollbar and WebScrollbar
        https://bugs.webkit.org/show_bug.cgi?id=90117

        Reviewed by James Robinson.

        Make WebCore also depend on Platform.

        * WebCore.gyp/WebCore.gyp:

2012-06-28  Hayato Ito  <hayato@chromium.org>

        CompositeShadowTreeWalker should use InsertionPoint::hasDistribution() instead of InsertionPoint::isActive().
        https://bugs.webkit.org/show_bug.cgi?id=89177

        Reviewed by Dimitri Glazkov.

        Prevents ComposedShadowTreeWalker from escaping out of an
        insertion point (which has distributed nodes) from a non-used
        fallback element in the insertion point.  Such a fallback element
        should be treated as in an orphaned subtree.

        ComposedShadowTreeParentWalker will be also fixed in a follow-up patch.

        Test: fast/dom/shadow/composed-shadow-tree-walker.html

        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::ComposedShadowTreeWalker::traverseNodeEscapingFallbackContents):

2012-06-27  Ryosuke Niwa  <rniwa@webkit.org>

        Cleanup HTMLFormCollection
        https://bugs.webkit.org/show_bug.cgi?id=90111

        Reviewed by Andreas Kling.

        Got rid of getNamedItem and renamed getNamedFormItem to firstNamedItem and got rid of duplicateNumber argument since
        it's always 0. Also made it a static local function. In addition, removed nextItem() since it's not used anywhere.

        WebKit API Test: WebKit1.HTMLFormCollectionNamedItemTest

        * html/HTMLFormCollection.cpp:
        (WebCore::firstNamedItem):
        (WebCore):
        (WebCore::HTMLFormCollection::namedItem):
        * html/HTMLFormCollection.h:
        (HTMLFormCollection):

2012-06-28  Alec Flett  <alecflett@chromium.org>

        IndexedDB: Hook up render-side key ASSERTing for get()
        https://bugs.webkit.org/show_bug.cgi?id=90001

        Reviewed by Tony Chang.

        Hook up the new onSuccess and add it to the interface. For now,
        simply assert that the right value is set. Add the same assertion
        logic in the value-construction logic when the cursor advances.

        No new tests, existing tests verify this refactor is correct.

        * Modules/indexeddb/IDBCallbacks.h:
        (IDBCallbacks):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::getInternal):
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore):
        (WebCore::IDBRequest::onSuccess):
        * Modules/indexeddb/IDBRequest.h:
        * bindings/v8/IDBBindingUtilities.cpp:
        (WebCore::createIDBKeyFromSerializedValueAndKeyPath):
        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore):

2012-06-28  Gregg Tavares  <gman@google.com>

        Add support for DEPTH_STENCIL to WEBGL_depth_texture
        https://bugs.webkit.org/show_bug.cgi?id=90109

        Reviewed by Kenneth Russell.

        * html/canvas/WebGLDepthTexture.idl:
        * html/canvas/WebGLFramebuffer.cpp:
        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore):
        (WebCore::WebGLRenderingContext::validateTexFuncFormatAndType):

2012-06-28  James Robinson  <jamesr@chromium.org>

        [chromium] Move chromium compositor implementation files into separate section in WebCore.gypi
        https://bugs.webkit.org/show_bug.cgi?id=90201

        Reviewed by Adam Barth.

        This moves the chromium compositor implementation files to a separate gyp variable to make future changes
        easier. The files still all link into webcore_platform.lib, as before.

        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:

2012-06-28  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] Use Eina_Module API instead of dlopen in PluginPackageEfl
        https://bugs.webkit.org/show_bug.cgi?id=89972

        Reviewed by Antonio Gomes.

        Use convenience helpers in Eina_Module to load plugins instead
        of POSIX dlopen().

        No new tests, behavior has not changed.

        * platform/FileSystem.h:
        (WebCore):
        * platform/efl/FileSystemEfl.cpp:
        (WebCore::unloadModule):
        * plugins/efl/PluginPackageEfl.cpp:
        (WebCore::PluginPackage::load):

2012-06-28  Jocelyn Turcotte  <turcotte.j@gmail.com>

        [Qt] Fix TextureMapper rendering of GraphicsSurface on Mac
        https://bugs.webkit.org/show_bug.cgi?id=90154

        Reviewed by Noam Rosenthal.

        Fix a regression introduced in r120608.
        texture2DRect takes texel coordinates, unlike texture2D which needs normalized coordinates.

        Pass an additional textureSize uniform and multiply it by the normalized coordinates.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::drawTextureRectangleARB):
        * platform/graphics/texmap/TextureMapperShaderManager.cpp:
        (WebCore::TextureMapperShaderProgram::TextureMapperShaderProgram):
        (WebCore::TextureMapperShaderProgramRectSimple::TextureMapperShaderProgramRectSimple):
        * platform/graphics/texmap/TextureMapperShaderManager.h:
        (WebCore::TextureMapperShaderProgram::textureSizeLocation):
        (TextureMapperShaderProgram):

2012-06-28  Simon Fraser  <simon.fraser@apple.com>

        Improve compositing logging output
        https://bugs.webkit.org/show_bug.cgi?id=90199

        Reviewed by Tim Horton (w00t!).

        Improve the compositing logging channel output in a few
        useful ways:
        1. Report memory use, rather than megapixels
        2. Show element class names

        * platform/graphics/GraphicsLayer.cpp:
        (WebCore::GraphicsLayer::backingStoreMemoryEstimate):
        * platform/graphics/GraphicsLayer.h:
        (GraphicsLayer):
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::backingStoreMemoryEstimate):
        * platform/graphics/ca/GraphicsLayerCA.h:
        (GraphicsLayerCA):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::nameForLayer):
        (WebCore::RenderLayerBacking::backingStoreMemoryEstimate):
        * rendering/RenderLayerBacking.h:
        (RenderLayerBacking):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
        (WebCore::RenderLayerCompositor::updateCompositingLayers):
        (WebCore::RenderLayerCompositor::logLayerInfo):
        (WebCore::RenderLayerCompositor::updateOverflowControlsLayers):
        * rendering/RenderLayerCompositor.h:
        (RenderLayerCompositor):

2012-06-28  James Robinson  <jamesr@chromium.org>

        [chromium] Fix up more includes in compositor code
        https://bugs.webkit.org/show_bug.cgi?id=90200

        Reviewed by Adrienne Walker.

        Adds includes we are using and removes ones that we aren't using.

        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/ContentLayerChromium.cpp:
        * platform/graphics/chromium/ProgramBinding.cpp:
        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
        * platform/graphics/chromium/cc/CCGraphicsContext.h:
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:

2012-06-28  Andrei Onea  <onea@adobe.com>

        [CSSRegions]Rename NamedFlow::contentNodes to NamedFlow::getContent()
        https://bugs.webkit.org/show_bug.cgi?id=90163

        Reviewed by Andreas Kling.

        Latest CSS Regions spec defines the NamedFlow interface as having a function named getContent,
        rather than an attribute named contentNodes.
        http://www.w3.org/TR/css3-regions/#the-namedflow-interface

        Test: fast/regions/webkit-named-flow-get-content.html

        * dom/WebKitNamedFlow.cpp:
        (WebCore::WebKitNamedFlow::getContent):
        * dom/WebKitNamedFlow.h:
        (WebKitNamedFlow):
        * dom/WebKitNamedFlow.idl:

2012-06-28  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r121232): named properties on document and window may return wrong object
        https://bugs.webkit.org/show_bug.cgi?id=90133

        Reviewed by Andreas Kling.

        Fixed the bug. Also replaced hasAnyItem by isEmpty (hasAnyItem() is equivalent to !isEmpty()).

        Test: fast/dom/HTMLDocument/named-item-multiple-match.html

        * bindings/js/JSHTMLDocumentCustom.cpp:
        (WebCore::JSHTMLDocument::nameGetter):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::V8DOMWindow::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::V8HTMLDocument::GetNamedProperty):
        * html/HTMLCollection.h:
        (WebCore::HTMLCollection::isEmpty):
        (WebCore::HTMLCollection::hasExactlyOneItem):

2012-06-28  Zeev Lieber  <zlieber@chromium.org>

        [Skia] Computing the resampling mode ignores scale applied to the canvas
        https://bugs.webkit.org/show_bug.cgi?id=72073

        Reviewed by Stephen White.

        Re-basing earlier patch by Daniel Sievers; updated tests.

        Take into account canvas scale when computing image resampling mode.

        When drawing a bitmap and computing the best resampling mode based
        on the requested scale, take into account CSS scale and page scale
        that are applied to the canvas. This allows for single-pass scaling
        in potentially better quality (RESAMPLE_AWESOME) and also takes
        better advantage of the scaled image cache in that codepath.

        Existing tests updated to expect different resampling method (and
        therefore a different image) whenever canvas scaling changes.

        * platform/graphics/skia/ImageSkia.cpp:
        (WebCore::paintSkBitmap):

2012-06-28  James Robinson  <jamesr@chromium.org>

        [chromium] Should schedule a commit when dropping contents textures
        https://bugs.webkit.org/show_bug.cgi?id=90031

        Reviewed by Adrienne Walker.

        If we're dropping contents textures on the impl thread, we need to schedule a commit to pick up new contents at
        the next commit opportunity. Also adds some traces to make debugging issues like this easier.

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::commitComplete):
        (WebCore::CCLayerTreeHostImpl::canDraw):
        (WebCore::CCLayerTreeHostImpl::releaseContentsTextures):
        * platform/graphics/chromium/cc/CCScheduler.cpp:
        (WebCore::CCScheduler::processScheduledActions):

2012-06-28  Antti Koivisto  <antti@apple.com>

        Don't malloc RenderGeometryMap steps individually
        https://bugs.webkit.org/show_bug.cgi?id=90074

        Reviewed by Simon Fraser.

        Mallocs and frees for steps under RenderGeometryMap::pus/popMappingsToAncestor can total ~2% of the profile when animating transforms.

        * rendering/RenderGeometryMap.cpp:
        (WebCore):
        (WebCore::RenderGeometryMap::absolutePoint):
        (WebCore::RenderGeometryMap::absoluteRect):
        (WebCore::RenderGeometryMap::mapToAbsolute):
        (WebCore::RenderGeometryMap::push):
        (WebCore::RenderGeometryMap::pushView):
        (WebCore::RenderGeometryMap::popMappingsToAncestor):
        * rendering/RenderGeometryMap.h:
        (WebCore):
        (WebCore::RenderGeometryMapStep::RenderGeometryMapStep):
        
            Move to header.

        (RenderGeometryMapStep):
        (RenderGeometryMap):
        
            Make the step vector hold RenderGeometryMapSteps instead of RenderGeometryMapStep*'s.

        (WTF):
        
            Give RenderGeometryMapSteps SimpleClassVectorTraits. This is needed for dealing with OwnPtr in the struct (and makes it faster too).
            The type is simple enought to move by memcpy.

2012-06-28  Kalev Lember  <kalevlember@gmail.com>

        [GTK] Remove Windows support from plugins/gtk/
        https://bugs.webkit.org/show_bug.cgi?id=89501

        Reviewed by Martin Robinson.

        The GTK+ port now uses plugins/gtk/ on Windows, which leaves
        PluginPackageGtk.cpp and PluginViewGtk.cpp solely for XP_UNIX platforms.

        * plugins/gtk/PluginPackageGtk.cpp:
        (WebCore::PluginPackage::fetchInfo):
        (WebCore::webkitgtkXError):
        (WebCore::PluginPackage::load):
        * plugins/gtk/PluginViewGtk.cpp:
        (WebCore::getRootWindow):
        (WebCore::PluginView::updatePluginWidget):
        (WebCore::PluginView::paint):
        (WebCore::PluginView::handleKeyboardEvent):
        (WebCore::setXCrossingEventSpecificFields):
        (WebCore::PluginView::handleMouseEvent):
        (WebCore::PluginView::handleFocusOutEvent):
        (WebCore::PluginView::setNPWindowIfNeeded):
        (WebCore::PluginView::platformGetValueStatic):
        (WebCore::PluginView::platformGetValue):
        (WebCore::getPluginDisplay):
        (WebCore::getVisualAndColormap):
        (WebCore::PluginView::platformStart):
        (WebCore::PluginView::platformDestroy):

2012-06-28  Simon Fraser  <simon.fraser@apple.com>

        Change FrameView::scrollContentsFastPath to use m_fixedObjects
        https://bugs.webkit.org/show_bug.cgi?id=90045

        Reviewed by James Robinson.
        
        FrameView now has a hash set of fixed-position objects, so use
        that instead of RenderBlock::positionedObjects(); we'll avoid traversing
        through absolutely positioned objects, and this will work better for sticky
        positioning in future.

        No behavior change, so no new tests.

        * page/FrameView.cpp:
        (WebCore::FrameView::scrollContentsFastPath):

2012-06-28  Tony Chang  <tony@chromium.org>

        Split flex into flex-grow/flex-shrink/flex-basis
        https://bugs.webkit.org/show_bug.cgi?id=86525

        Reviewed by Ojan Vafai.

        Split flex into 3 separate properties per the spec:
        http://dev.w3.org/csswg/css3-flexbox/#flex-components

        Tests: css3/flexbox/flex-longhand-parsing.html
               css3/flexbox/flex-property-parsing.html: Updated test results.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore): -webkit-flex is no longer enumerable.
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Add new css property names and use
        getCSSPropertyValuesForShorthandProperties for WebkitFlex. Also sort flex propery names.
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue): Fix indent.
        (WebCore::CSSParser::parseValue): Add parsing for new properties and handle -webkit-flex: none.
        (WebCore::CSSParser::parseFlex): Switch to new names (positive -> grow, negative -> shrink,
        preferred size -> basis) and assign to longhand properties.
        * css/CSSParser.h:
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty): Add new properties.
        * css/CSSPropertyNames.in: Add new properties.
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder): Delete special handling of applying flex and just use shorthand handlers.
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::getPropertyValue): Add new shorthand.
        (WebCore::StylePropertySet::asText):
        * css/StylePropertyShorthand.cpp:
        (WebCore::webkitFlexShorthand): Add new shorthand.
        (WebCore::shorthandForProperty):
        * css/StylePropertyShorthand.h:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList): Add to list of properties applied by StyleBuilder.
        Handle initial and inherit for flex.

2012-06-28  Kalev Lember  <kalevlember@gmail.com>

        [GTK][Win]: Fix plugin drawing to an offscreen buffer
        https://bugs.webkit.org/show_bug.cgi?id=89499

        Reviewed by Brent Fulgham.

        Take into account that the GTK+ port draws to a backing store and adjust
        the target rectangle calculation accordingly.

        * plugins/win/PluginViewWin.cpp:
        (WebCore::PluginView::paint):
        (WebCore::PluginView::setNPWindowRect):

2012-06-28  Kentaro Hara  <haraken@chromium.org>

        Optimize Dromaeo/dom-attr.html by speeding up Element::getAttribute()
        https://bugs.webkit.org/show_bug.cgi?id=90174

        Reviewed by Adam Barth.

        This patch improves performance of Dromaeo/dom-attr.html by 4.0%.
        The patch improves performance of getAttribute() and JavaScript
        property setter for DOM objects (e.g. 'div.foo = 123').
        The performance improvement becomes larger, as the number of
        attributes defined on the DOM object increases.

        Without the patch in Chromium/Linux (runs/s)
        7679.4, 7739.7, 7634.0, 7726.4, 7663.9

        With the patch in Chromium/Linux (runs/s)
        7977.7, 8032.2, 8112.8, 7948.1, 7924.5

        This patch just changes a type of 'name' of Element::getAttribute(String& name)
        from String& to AtomicString&.

        The key observation is that AtomicString(String& x) is faster than
        operator==(String& x, AtomicString& y). AtomicString(String& x) calculates
        a hash of a given String and adds it to a hash table. The calculation
        complexity is O(the length of x). On the other hand,
        operator==(String& x, AtomicString& y) compares a String and an AtomicString by
        StringImpl::equal(StringImpl*, StringImpl*), the calculation complexity of
        which is O(2 * min(the length of x, the length of y)).
        In addition, the comparison logic is more complicated than the logic
        of calculating the hash. Consequently, AtomicString(String& x) is
        faster than operator==(String& x, AtomicString& y).

        Keeping that in mind, let's estimate the performance of
        Element::getAttribute("class") for <div id="A" lang="B" title="C" class="D" dir="E">.
        Here "id", "lang", "title", "class" and "dir" are stored as AtomicStrings
        in QualifiedName::localName(). Initially, "class" in Element::getAttribute("class")
        is a String.

        If we use Element::getAttribute(String& name) (i.e. without the patch),
        ElementAttributeData::getAttributeItemIndex() executes four
        operator==(String&, AtomicString&) by the time it finds the "class" attribute:

        (1) if ("class" == "id")       // operator==(String&, AtomicString&)
        (2) if ("class" == "lang")     // operator==(String&, AtomicString&)
        (3) if ("class" == "title")    // operator==(String&, AtomicString&)
        (4) if ("class" == "class")    // operator==(String&, AtomicString&)

        On the other hand, if we use Element::getAttribute(AtomicString& name)
        (i.e. with the patch), ElementAttributeData::getAttributeItemIndex()
        executes one AtomicString(String&) and four operator==(AtomicString&, AtomicString&)
        by the time it finds the "class" attribute:

        (1) AtomicString("class")      // AtomicString(String&)
        (2) if ("class" == "id")       // operator==(AtomicString&, AtomicString&)
        (3) if ("class" == "lang")     // operator==(AtomicString&, AtomicString&)
        (4) if ("class" == "title")    // operator==(AtomicString&, AtomicString&)
        (5) if ("class" == "class")    // operator==(AtomicString&, AtomicString&)

        Considering that the overhead of operator==(AtomicString&, AtomicString&) is close
        to 0 since it is just a pointer comparison, the latter approach is faster than
        the former approach.

        Performance improvement will be large for elements that have multiple attributes,
        but it is faster even for elements that have only one attribute.
        For exmaple, Dromaeo/dom-attr.html tests getAttribute() for an element that has
        only one attribute, the result shows 4.0% improvement.

        Another example optimized by this patch is 'div.foo = 123', where foo is not
        an attribute of div. In this case, before 123 is set, JavaScript calls back
        Element::getAttribute() to check whether 'foo' is defined on div by
        scanning all the attributes of div.

        No tests. No change in behavior.

        * dom/Element.cpp:
        (WebCore::Element::getAttribute):
        * dom/Element.h:
        (Element):
        (WebCore::Element::getAttributeItemIndex):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::getAttributeItemIndexSlowCase):
        * dom/ElementAttributeData.h:
        (ElementAttributeData):
        (WebCore::ElementAttributeData::getAttributeItem):
        (WebCore::ElementAttributeData::getAttributeItemIndex):

2012-06-28  Hans Wennborg  <hans@chromium.org>

        Speech JavaScript API: Don't dispatch end event after ActiveDOMObject::stop()
        https://bugs.webkit.org/show_bug.cgi?id=90176

        Reviewed by Adam Barth.

        It is probably not safe to dispatch an event on an object that has
        been ActiveDOMObject::stop()'ed.

        This used to happen in the navigate-away.html test, which I believe
        then caused speechgrammar-basics.html (which was typically run
        afterwards, by the same worker), to crash flakily. See Bug 89717.

        Test: speechgrammar-basics.html should no longer be flaky.

        * Modules/speech/SpeechRecognition.cpp:
        (WebCore::SpeechRecognition::didEnd):
        (WebCore::SpeechRecognition::stop):
        (WebCore::SpeechRecognition::SpeechRecognition):
        * Modules/speech/SpeechRecognition.h:

2012-06-28  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>

        [GTK] [WK2] Memory leak in ResourceHandleSoup.cpp
        https://bugs.webkit.org/show_bug.cgi?id=90168

        Reviewed by Martin Robinson.

        Fixed a memory leak in WebCoreSynchronousLoader by using adoptGRef
        instead of just getting new reference of GMainLoop.

        No new tests. No change in behavior.

        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):

2012-06-27  Dana Jansens  <danakj@chromium.org>

        [chromium] Do not multiply bounds by contentsScale in TiledLayerChromium and CanvasLayerTextureUpdater
        https://bugs.webkit.org/show_bug.cgi?id=90103

        Reviewed by Adrienne Walker.

        Non-integer scale factors can scale the bounds of a layer such that
        different rounding is applied to the width and height in the content
        bounds. We should never multiply bounds by contentsScale in order to
        work correctly with non-integer scale factors. Instead, always use the
        contentBounds/bounds ratio for width and height independently.

        Tests: TiledLayerChromiumTest.nonIntegerContentsScaleIsNotDistortedDuringPaint
               TiledLayerChromiumTest.nonIntegerContentsScaleIsNotDistortedDuringInvalidation

        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
        (WebCore::BitmapCanvasLayerTextureUpdater::prepareToUpdate):
        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h:
        (BitmapCanvasLayerTextureUpdater):
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::prepareToUpdate):
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
        (BitmapSkPictureCanvasLayerTextureUpdater):
        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
        (WebCore::CanvasLayerTextureUpdater::paintContents):
        * platform/graphics/chromium/CanvasLayerTextureUpdater.h:
        (CanvasLayerTextureUpdater):
        * platform/graphics/chromium/LayerTextureUpdater.h:
        (WebCore::LayerTextureUpdater::prepareToUpdate):
        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        (WebCore::ScrollbarLayerChromium::updatePart):
        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::SkPictureCanvasLayerTextureUpdater::prepareToUpdate):
        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h:
        (SkPictureCanvasLayerTextureUpdater):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::setNeedsDisplayRect):
        (WebCore::TiledLayerChromium::updateTiles):

2012-06-28  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>

        [Qt] Make GC's fill{Rounded}Rect use optimized shadow blur code
        https://bugs.webkit.org/show_bug.cgi?id=90082

        Reviewed by Noam Rosenthal.

        ShadowBlur::drawRectShadow makes use of optimized tiles-based drawPattern, which
        is not present when using {begin/end}shadowLayer.

        * platform/graphics/qt/GraphicsContextQt.cpp:
        (WebCore::GraphicsContext::fillRect):
        (WebCore::GraphicsContext::fillRoundedRect):
        (WebCore::GraphicsContext::pushTransparencyLayerInternal):

2012-06-28  Rahul Tiwari  <rahultiwari.cse.iitr@gmail.com>

        Web Inspector: Provide context menu 'Delete all watch expressions.'
        https://bugs.webkit.org/show_bug.cgi?id=89735

        Reviewed by Yury Semikhatsky.

        Added context menu delete and delete all watch expressions.

        No new tests required as its a minor UI related change.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/WatchExpressionsSidebarPane.js:
        (WebInspector.WatchExpressionsSection.prototype.updateExpression):
        (WebInspector.WatchExpressionsSection.prototype._deleteAllExpressions):
        (WebInspector.WatchExpressionsSection.prototype.findAddedTreeElement):
        (WebInspector.WatchExpressionTreeElement.prototype.update):
        (WebInspector.WatchExpressionTreeElement.prototype._contextMenu):
        (WebInspector.WatchExpressionTreeElement.prototype._deleteAllButtonClicked):

2012-06-28  Christophe Dumez  <christophe.dumez@intel.com>

        m_cssVariablesEnabled member is not initialized in Page Settings
        https://bugs.webkit.org/show_bug.cgi?id=90147

        Reviewed by Simon Hausmann.

        Properly initialize the m_cssVariablesEnabled member in Page
        Settings.

        No new tests, no behavior change.

        * page/Settings.cpp:
        (WebCore::Settings::Settings):

2012-06-28  Balazs Kelemen  <kbalazs@webkit.org>

        [Qt] plugin is loaded to the web process via MainResourceLoader::substituteMIMETypeFromPluginDatabase
        https://bugs.webkit.org/show_bug.cgi?id=86489

        Reviewed by Simon Hausmann.

        Removed the substituteMIMETypeFromPluginDatabase quirk from
        MainResourceLoader. It would be possible to fix it in a way
        that is compatible with WebKit2, but given that it was a Qt
        only fix, and that it's not clear that we still need it, and
        it's not even work currently, I decided to remove it. At least
        it is -1 platform ifdef in common code.

        Just removed a non-tested quirk, no test needed.

        * loader/MainResourceLoader.cpp:
        (WebCore::MainResourceLoader::didReceiveResponse):

2012-06-28  Kentaro Hara  <haraken@chromium.org>

        [V8] Optimize Integer::New() by caching persistent handles for small integers
        https://bugs.webkit.org/show_bug.cgi?id=90043

        Reviewed by Adam Barth.

        The patch improves performance of Dromaeo/dom-query.html by 3.6%,
        and Bindings/scroll-top.html by 17.3%.

        The performance results in my Chromium/Linux:

        [Dromaeo/dom-query.html]
        796310.4 runs/s => 824745.4 runs/s (+3.6%)

        [Bindings/scroll-top.html]
        204.68 runs/s => 240.15 runs/s (+17.3%)

        This patch introduces V8BindingPerIsolateData::IntegerCache (just like
        V8BindingPerIsolateData::StringCache) to cache persistent handles
        for small integers.

        No new tests. No change in behavior.

        * bindings/v8/V8Binding.h: Implemented v8Integer() and v8UnsignedInteger(),
        which returns cached persistent handles for integers smaller than 64.
        (WebCore):
        (IntegerCache):
        (WebCore::IntegerCache::IntegerCache):
        (WebCore::IntegerCache::v8Integer):
        (WebCore::IntegerCache::v8UnsignedInteger):
        (WebCore::V8BindingPerIsolateData::integerCache):
        (V8BindingPerIsolateData):
        (WebCore::v8Integer):
        (WebCore::v8UnsignedInteger):
        * bindings/v8/V8Binding.cpp:
        (WebCore):
        (WebCore::IntegerCache::createSmallIntegers):
        * bindings/v8/WorkerScriptController.cpp:
        (~WorkerScriptController): ~V8BindingPerIsolateData() should be called before
        isolate->Exit(), since ~V8BindingPerIsolateData() calls V8 APIs that requires
        the current isolate.

        * bindings/scripts/CodeGeneratorV8.pm: Replaced Integer::New() and Integer::NewFromUnsigned()
        with v8Integer() and v8UnsignedInteger().
        (GenerateNormalAttrGetter):
        (NativeToJSValue):

        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp: Updated run-bindings-tests results.
        (WebCore::TestActiveDOMObjectV8Internal::excitingAttrAttrGetter):
        * bindings/scripts/test/V8/V8TestObj.cpp: Ditto.
        (WebCore::TestObjV8Internal::readOnlyIntAttrAttrGetter):
        (WebCore::TestObjV8Internal::shortAttrAttrGetter):
        (WebCore::TestObjV8Internal::unsignedShortAttrAttrGetter):
        (WebCore::TestObjV8Internal::intAttrAttrGetter):
        (WebCore::TestObjV8Internal::reflectedIntegralAttrAttrGetter):
        (WebCore::TestObjV8Internal::reflectedUnsignedIntegralAttrAttrGetter):
        (WebCore::TestObjV8Internal::reflectedCustomIntegralAttrAttrGetter):
        (WebCore::TestObjV8Internal::attrWithGetterExceptionAttrGetter):
        (WebCore::TestObjV8Internal::attrWithSetterExceptionAttrGetter):
        (WebCore::TestObjV8Internal::withScriptStateAttributeAttrGetter):
        (WebCore::TestObjV8Internal::conditionalAttr1AttrGetter):
        (WebCore::TestObjV8Internal::conditionalAttr2AttrGetter):
        (WebCore::TestObjV8Internal::conditionalAttr3AttrGetter):
        (WebCore::TestObjV8Internal::enabledAtRuntimeAttr1AttrGetter):
        (WebCore::TestObjV8Internal::enabledAtRuntimeAttr2AttrGetter):
        (WebCore::TestObjV8Internal::enabledAtContextAttr1AttrGetter):
        (WebCore::TestObjV8Internal::enabledAtContextAttr2AttrGetter):
        (WebCore::TestObjV8Internal::strawberryAttrGetter):
        (WebCore::TestObjV8Internal::descriptionAttrGetter):
        (WebCore::TestObjV8Internal::idAttrGetter):
        (WebCore::TestObjV8Internal::intMethodCallback):
        (WebCore::TestObjV8Internal::intMethodWithArgsCallback):
        (WebCore::TestObjV8Internal::classMethodWithOptionalCallback):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp: Ditto.
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::portsAttrGetter):

2012-06-28  Kent Tamura  <tkent@chromium.org>

        Classify form control states by their owner forms
        https://bugs.webkit.org/show_bug.cgi?id=89950

        Reviewed by Hajime Morita.

        To improve robustness of the form state restore feature, we classify
        form control states by their owner forms. Owner forms are identified by
        their action URLs and index numbers in forms with the same action URLs.

        Implementation approach:
        Extend FormElementKey class to have "formKey" string, which is a
        combination of the action URL and an index number, or a fixed string for
        no form owner.
        FormKeyGenerator class is responsible to generate the "formKey" strings

        Test: fast/forms/state-restore-per-form.html

        * html/FormController.cpp:
        (FormKeyGenerator):
        (WebCore::FormKeyGenerator::create): A factory function.
        (WebCore::FormKeyGenerator::FormKeyGenerator): A private constructor.
        (WebCore::createKey):
        A helper for formKey(). This makes strings like "<action URL> #<index>".
        (WebCore::FormKeyGenerator::formKey):
        Returns a formKey for the specified HTMLFormElement*.
        (WebCore::FormKeyGenerator::willDeleteForm):
        Unregister HTMLFormElement*. This function is necessary because form
        restore feature works during parsing and a script might delete form
        elements.
        (WebCore::formStateSignature): Bump the version.
        (WebCore::FormController::formElementsState):
        Records a formKey string for each of control state.
        (WebCore::FormController::setStateForNewFormElements):
        Loads formKeys from stateVector, and uses them for FormElementKey.
        (WebCore::FormController::takeStateForFormElement):
        - Construct and destruct FormKeyGenerator if needed.
        - Passing a formKey for the specified form control to FormElementKey.
        (WebCore::FormController::willDeleteForm):
        Delegate to FormKeyGenerator::willDeleteForm.

        (WebCore::FormElementKey::FormElementKey): Add formKey argument and member.
        (WebCore::FormElementKey::operator=): ditto.
        (WebCore::FormElementKey::ref): ditto.
        (WebCore::FormElementKey::deref): ditto.
        * html/FormController.h:
        (FormElementKey): Add formKey argument and member.
        (FormController): Add a FormKeyGenerator member which is used during restoring.

        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::~HTMLFormElement): Notify the death to FormController.

2012-06-28  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r121395.
        http://trac.webkit.org/changeset/121395
        https://bugs.webkit.org/show_bug.cgi?id=90143

        Patch causes crashes in fast/workers/worker-context-gc.html
        (Requested by zdobersek on #webkit).

        * Modules/indexeddb/IDBFactory.cpp:
        (WebCore::IDBFactory::open):
        * workers/DedicatedWorkerThread.cpp:
        (WebCore::DedicatedWorkerThread::create):
        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
        * workers/DedicatedWorkerThread.h:
        (DedicatedWorkerThread):
        * workers/DefaultSharedWorkerRepository.cpp:
        (SharedWorkerProxy):
        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
        * workers/SharedWorkerThread.cpp:
        (WebCore::SharedWorkerThread::create):
        (WebCore::SharedWorkerThread::SharedWorkerThread):
        * workers/SharedWorkerThread.h:
        (SharedWorkerThread):
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::startWorkerContext):
        * workers/WorkerThread.cpp:
        (WebCore::WorkerThreadStartupData::create):
        (WorkerThreadStartupData):
        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
        (WebCore::WorkerThread::WorkerThread):
        * workers/WorkerThread.h:
        (WorkerThread):

2012-06-28  Yoshifumi Inoue  <yosin@chromium.org>

        [Platform] Implement functions for localized time format information
        https://bugs.webkit.org/show_bug.cgi?id=89965

        Reviewed by Kent Tamura.

        This patch introduces three functions for time format:
          1. localizedTimeFormatText()
          2. localizedShortTimeFormatText()
          2. timeAMPMLabels()
        for input type "time" if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS) is true.

        Having both localizedTimeFormat and localizedShortTimeFormat is for
        displaying only two fields hour and minute when step >= 60. There is
        no way to remove second field from "h:m:s" pattern string. We don't
        know whether ":" after "m" belongs minute or second field.

        Test: WebKit/chromium/tests/LocalizedDateICUTest.cpp

        * platform/text/LocaleICU.cpp:
        (WebCore::LocaleICU::LocaleICU):
        (WebCore::createFallbackAMPMLabels): Added.
        (WebCore::LocaleICU::initializeDateTimeFormat):  Added.
        (WebCore::LocaleICU::localizedTimeFormatText):  Added.
        (WebCore::LocaleICU::localizedShortTimeFormatText):  Added.
        (WebCore::LocaleICU::timeAMPMLabels):  Added.
        * platform/text/LocaleICU.h:
        (LocaleICU):
        * platform/text/LocalizedDate.h:
        * platform/text/LocalizedDateICU.cpp:
        (WebCore::localizedTimeFormatText):  Added.
        (WebCore::localizedShortTimeFormatText):  Added.
        (WebCore::timeAMPMLabels):  Added.

2012-06-27  Kentaro Hara  <haraken@chromium.org>

        Performance: Optimize Dromaeo/dom-query.html by caching NodeRareData on Document
        https://bugs.webkit.org/show_bug.cgi?id=90059

        Reviewed by Ryosuke Niwa.

        This patch improves performance of document.getElementsBy*().
        e.g. the patch makes Dromaeo/dom-query.html 5.4% faster.

        Dromaeo/dom-query.html without the patch (Chromium/Linux):
        784714 runs/s, 765947 runs/s, 803109 runs/s, 804450 runs/s

        Dromaeo/dom-query.html with the patch (Chromium/Linux):
        839245 runs/s, 829867 runs/s, 811032 runs/s, 847486 runs/s

        Based on the assumption that document.getElementsByClassName(),
        document.getElementsByTagName() and document.getElementsByName()
        would be used frequently in the real world, this patch implements
        a fast path for Document methods that require to access NodeRareData.
        Specifically, this patch caches a pointer to NodeRareData on Document,
        by which Document can access NodeRareData without looking up a HashMap.

        The only performance concern is the overhead of the isDocumentNode() check
        that this patch added to Node::ensureRareData. However, I could not
        observe any performance regression caused by the overhead.

        No tests. No change in behavior.

        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore::Document::setCachedRareData): I didn't inline this method,
        since the inlining slightly regressed performance for some reason.
        (WebCore):
        * dom/Document.h:
        (WebCore):
        (WebCore::Document::cachedRareData):
        (Document):
        (~Document): Moved 'm_document = 0' to the tail of the destructor,
        since isDocumentNode() has to return true in clearRareData() that is called
        in ~Document().
        * dom/Node.cpp:
        (WebCore::Node::ensureRareData):
        (~Node): Moved the assertion into clearRareData().

2012-06-27  Mary Wu  <mary.wu@torchmobile.com.cn>

        [BlackBerry] 0-length response with no content-type shouldn't download
        https://bugs.webkit.org/show_bug.cgi?id=89860

        Reviewed by Rob Buis.

        RIM PR# 168419

        For 0-length response, if we can't get its mimetype from the filename,
        we set the mimetype to "text/plain" instead of "application/octet-stream",
        so it won't go to download.

        Reviewed internally by Charles Wei.

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::sendResponseIfNeeded):

2012-06-27  Yoshifumi Inoue  <yosin@chromium.org>

        [Platform] Implement localizedDecimalSeparator function
        https://bugs.webkit.org/show_bug.cgi?id=90036

        Reviewed by Kent Tamura.

        This patch introduces new function localizedDecimalSeparator() when
        ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS). It will be used for
        displaying millisecond for time fields UI.

        Test: WebKit/chromium/tests/LocalizedNumberICUTest.cpp

        * platform/text/LocaleICU.cpp:
        (WebCore::LocaleICU::localizedDecimalSeparator): Added
        * platform/text/LocaleICU.h:
        (LocaleICU): Added localizedDecimalSeparator.
        * platform/text/LocalizedNumber.h:
        * platform/text/LocalizedNumberICU.cpp:
        (WebCore::localizedDecimalSeparator): Added.
        * platform/text/LocalizedNumberNone.cpp:
        (WebCore::localizedDecimalSeparator): Added.
        * platform/text/mac/LocalizedNumberMac.mm:
        (WebCore::localizedDecimalSeparator): Added.

2012-06-27  Lu Guanqun  <guanqun.lu@intel.com>

        Add OVERRIDE to functions in UnthrottledTextureUploader class
        https://bugs.webkit.org/show_bug.cgi?id=90130

        Reviewed by James Robinson.

        No new tests required.

        * platform/graphics/chromium/LayerRendererChromium.cpp:

2012-06-27  Pablo Flouret  <pablof@motorola.com>

        pattern="" should only accept the empty string
        https://bugs.webkit.org/show_bug.cgi?id=89569

        Reviewed by Kent Tamura.

        An empty pattern attribute was being treated essentially as if the
        pattern wasn't present.

        No new tests. Covered by existing tests (plus a modified one).

        * html/BaseTextInputType.cpp:
        (WebCore::BaseTextInputType::patternMismatch):
            Check if the pattern attribute is present. If it is then use the
            pattern as is (in the particular case of this bug, an empty pattern
            will only match an empty value).

2012-06-27  James Robinson  <jamesr@chromium.org>

        [chromium] Use SkColor in compositor internals
        https://bugs.webkit.org/show_bug.cgi?id=90108

        Reviewed by Adrienne Walker.

        As the title says, cutting dependencies. If we support color spaces in the compositor we will probably need to
        use a more sophisticated type, but for our current use SkColor is sufficient and matches our API better.

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::LayerChromium):
        (WebCore::LayerChromium::setBackgroundColor):
        (WebCore::LayerChromium::setDebugBorderColor):
        * platform/graphics/chromium/LayerChromium.h:
        (LayerChromium):
        (WebCore::LayerChromium::backgroundColor):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawDebugBorderQuad):
        (WebCore::LayerRendererChromium::drawSolidColorQuad):
        * platform/graphics/chromium/cc/CCDebugBorderDrawQuad.cpp:
        (WebCore::CCDebugBorderDrawQuad::create):
        (WebCore::CCDebugBorderDrawQuad::CCDebugBorderDrawQuad):
        * platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h:
        (CCDebugBorderDrawQuad):
        (WebCore::CCDebugBorderDrawQuad::color):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::CCLayerImpl):
        (WebCore::CCLayerImpl::setBackgroundColor):
        (WebCore::CCLayerImpl::setDebugBorderColor):
        (WebCore::CCLayerImpl::hasDebugBorders):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):
        (WebCore::CCLayerImpl::backgroundColor):
        (WebCore::CCLayerImpl::debugBorderColor):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::CCLayerTreeHost::setBackgroundColor):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (WebCore::CCLayerTreeHostImpl::backgroundColor):
        (WebCore::CCLayerTreeHostImpl::setBackgroundColor):
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
        (WebCore::appendQuadInternal):
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::appendQuadsToFillScreen):
        * platform/graphics/chromium/cc/CCRenderPass.h:
        (WebCore):
        (CCRenderPass):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::appendQuads):
        * platform/graphics/chromium/cc/CCSolidColorDrawQuad.cpp:
        (WebCore::CCSolidColorDrawQuad::create):
        (WebCore::CCSolidColorDrawQuad::CCSolidColorDrawQuad):
        * platform/graphics/chromium/cc/CCSolidColorDrawQuad.h:
        (CCSolidColorDrawQuad):
        (WebCore::CCSolidColorDrawQuad::color):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
        (WebCore::CCTiledLayerImpl::appendQuads):

2012-06-27  Charles Wei  <charles.wei@torchmobile.com.cn>

        IndexedDB: should make the LevelDB persistant to the directory indicated in PageGroupSettings::indexedDBDataBasePath
        https://bugs.webkit.org/show_bug.cgi?id=88338

        Reviewed by David Levin.

        If the indexedDB runs in main thread it can access the GroupSettings via the document;
        otherwise, we need to pass the page GroupSettings to the worker thread so that accessible
        to the indexedDB running in WorkerContext.

        * Modules/indexeddb/IDBFactory.cpp:
        (WebCore::IDBFactory::open):
        * workers/DedicatedWorkerThread.cpp:
        (WebCore::DedicatedWorkerThread::create):
        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
        * workers/DedicatedWorkerThread.h:
        (DedicatedWorkerThread):
        * workers/DefaultSharedWorkerRepository.cpp:
        (SharedWorkerProxy):
        (WebCore::SharedWorkerProxy::groupSettings):
        (WebCore):
        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
        * workers/SharedWorkerThread.cpp:
        (WebCore::SharedWorkerThread::create):
        (WebCore::SharedWorkerThread::SharedWorkerThread):
        * workers/SharedWorkerThread.h:
        (SharedWorkerThread):
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::startWorkerContext):
        * workers/WorkerThread.cpp:
        (WebCore::WorkerThreadStartupData::create):
        (WorkerThreadStartupData):
        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
        (WebCore::WorkerThread::WorkerThread):
        (WebCore::WorkerThread::groupSettings):
        (WebCore):
        * workers/WorkerThread.h:
        (WorkerThread):

2012-06-27  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r121359.
        http://trac.webkit.org/changeset/121359
        https://bugs.webkit.org/show_bug.cgi?id=90115

        Broke many inspector tests (Requested by jpfau on #webkit).

        * bindings/js/ScriptCallStackFactory.cpp:
        (WebCore::createScriptCallStack):

2012-06-27  Alexis Menard  <alexis.menard@openbossa.org>

        Implement selectedOptions attribute of HTMLSelectElement.
        https://bugs.webkit.org/show_bug.cgi?id=80631

        Reviewed by Ryosuke Niwa.

        Add a new collection as a member of HTMLSelectElement which is
        used to store the selected elements. Extend HTMLCollection to
        support the new collection type needed by this feature. Make sure
        that we invalidate the collection when the select state of an
        option changes as the select state change does not trigger a dom
        tree version change.

        Reference : http://www.whatwg.org/specs/web-apps/current-work/multipage/the-button-element.html#dom-select-selectedoptions

        Test: fast/dom/HTMLSelectElement/select-selectedOptions.html

        * html/CollectionType.h:
        * html/HTMLCollection.cpp:
        (WebCore::shouldIncludeChildren):
        (WebCore::HTMLCollection::clearCache):
        (WebCore):
        (WebCore::HTMLCollection::isAcceptableElement):
        * html/HTMLCollection.h:
        (HTMLCollection):
        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::setSelectedState):
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::selectedOptions):
        (WebCore):
        (WebCore::HTMLSelectElement::invalidateSelectedItems):
        (WebCore::HTMLSelectElement::setRecalcListItems):
        * html/HTMLSelectElement.h:
        (WebCore):
        (HTMLSelectElement):
        * html/HTMLSelectElement.idl:

2012-06-27  Daniel Cheng  <dcheng@chromium.org>

        Fix crash in Frame::nodeImage.
        https://bugs.webkit.org/show_bug.cgi?id=89911

        Reviewed by Abhishek Arya.

        We were caching a pointer to a RenderObject and then calling updateLayout(). Instead, we
        need to get a pointer to the RenderObject again after updateLayout().

        Test: fast/events/drag-display-none-element.html

        * page/Frame.cpp:
        (WebCore::Frame::nodeImage):
        * page/mac/FrameMac.mm:
        (WebCore::Frame::snapshotDragImage):
        (WebCore::Frame::nodeImage):

2012-06-27  Tony Chang  <tony@chromium.org>

        Unreviewed, rolling out r121380.
        http://trac.webkit.org/changeset/121380
        https://bugs.webkit.org/show_bug.cgi?id=86525

        Hits an ASSERT in debug.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore):
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseFlex):
        * css/CSSParser.h:
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/StyleBuilder.cpp:
        (ApplyPropertyFlex):
        (WebCore::ApplyPropertyFlex::applyInheritValue):
        (WebCore::ApplyPropertyFlex::applyInitialValue):
        (WebCore::ApplyPropertyFlex::applyValue):
        (WebCore::ApplyPropertyFlex::createHandler):
        (WebCore::ApplyPropertyFlex::getFlexValue):
        (WebCore):
        (WebCore::StyleBuilder::StyleBuilder):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::getPropertyValue):
        (WebCore::StylePropertySet::asText):
        * css/StylePropertyShorthand.cpp:
        (WebCore::webkitFlexFlowShorthand):
        (WebCore::shorthandForProperty):
        * css/StylePropertyShorthand.h:
        (WebCore):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-06-27  Rakesh KN  <rakesh.kn@motorola.com>

        HTMLFieldSetElement::m_documentVersion is not initialized
        https://bugs.webkit.org/show_bug.cgi?id=90038

        Reviewed by Kent Tamura.

        Initialised m_documentVersion member as HTMLFieldSetElement::elements can return an wrong collection.

        Covered by existing tests.

        * html/HTMLFieldSetElement.cpp:
        (WebCore::HTMLFieldSetElement::HTMLFieldSetElement):
        Initialised m_documentVersion.

2012-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>

        JSLock should be per-JSGlobalData
        https://bugs.webkit.org/show_bug.cgi?id=89123

        Reviewed by Geoffrey Garen.

        No new tests. Current regression tests are sufficient.

        Changed all sites that used JSLock to instead use the new JSLockHolder
        and pass in the correct JS context that the code is about to interact with that 
        needs protection. Also added a couple JSLocks to places that didn't already 
        have it that needed it.

        * bindings/js/GCController.cpp:
        (WebCore::collect):
        (WebCore::GCController::garbageCollectSoon):
        (WebCore::GCController::garbageCollectNow):
        (WebCore::GCController::discardAllCompiledCode):
        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
        (WebCore::JSSQLStatementErrorCallback::handleEvent):
        * bindings/js/JSCustomVoidCallback.cpp:
        (WebCore::JSCustomVoidCallback::handleEvent):
        * bindings/js/JSCustomXPathNSResolver.cpp:
        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
        * bindings/js/JSErrorHandler.cpp:
        (WebCore::JSErrorHandler::handleEvent):
        * bindings/js/JSEventCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSEventListener.cpp:
        (WebCore::JSEventListener::handleEvent):
        * bindings/js/JSInjectedScriptHostCustom.cpp:
        (WebCore::InjectedScriptHost::nodeAsScriptValue):
        (WebCore::JSInjectedScriptHost::inspectedObject):
        * bindings/js/JSInjectedScriptManager.cpp:
        (WebCore::InjectedScriptManager::createInjectedScript):
        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
        * bindings/js/JSLazyEventListener.cpp:
        (WebCore::JSLazyEventListener::initializeJSFunction):
        * bindings/js/JSMainThreadExecState.h:
        (WebCore::JSMainThreadExecState::evaluate):
        * bindings/js/JSMutationCallbackCustom.cpp:
        (WebCore::JSMutationCallback::handleEvent):
        * bindings/js/JSNodeFilterCondition.cpp:
        (WebCore::JSNodeFilterCondition::acceptNode):
        * bindings/js/JSRequestAnimationFrameCallbackCustom.cpp:
        (WebCore::JSRequestAnimationFrameCallback::handleEvent):
        * bindings/js/JavaScriptCallFrame.cpp:
        (WebCore::JavaScriptCallFrame::evaluate):
        * bindings/js/PageScriptDebugServer.cpp:
        (WebCore::PageScriptDebugServer::recompileAllJSFunctions):
        * bindings/js/ScheduledAction.cpp:
        (WebCore::ScheduledAction::executeFunctionInContext):
        * bindings/js/ScriptCachedFrameData.cpp:
        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
        (WebCore::ScriptCachedFrameData::restore):
        (WebCore::ScriptCachedFrameData::clear):
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::evaluateInWorld):
        (WebCore::ScriptController::clearWindowShell):
        (WebCore::ScriptController::initScript):
        (WebCore::ScriptController::updateDocument):
        (WebCore::ScriptController::cacheableBindingRootObject):
        (WebCore::ScriptController::bindingRootObject):
        (WebCore::ScriptController::windowScriptNPObject):
        (WebCore::ScriptController::jsObjectForPluginElement):
        (WebCore::ScriptController::clearScriptObjects):
        * bindings/js/ScriptControllerMac.mm:
        (WebCore::ScriptController::windowScriptObject):
        * bindings/js/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::dispatchDidPause):
        * bindings/js/ScriptEventListener.cpp:
        (WebCore::eventListenerHandlerBody):
        (WebCore::eventListenerHandlerLocation):
        * bindings/js/ScriptFunctionCall.cpp:
        (WebCore::ScriptCallArgumentHandler::appendArgument):
        (WebCore::ScriptFunctionCall::call):
        (WebCore::ScriptFunctionCall::construct):
        (WebCore::ScriptCallback::call):
        * bindings/js/ScriptObject.cpp:
        (WebCore::ScriptGlobalObject::set):
        (WebCore::ScriptGlobalObject::get):
        (WebCore::ScriptGlobalObject::remove):
        * bindings/js/ScriptValue.cpp:
        (WebCore::ScriptValue::getString):
        (WebCore::ScriptValue::toInspectorValue):
        * bindings/js/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::~WorkerScriptController):
        (WebCore::WorkerScriptController::initScript):
        (WebCore::WorkerScriptController::evaluate):
        (WebCore::WorkerScriptController::disableEval):
        * bindings/objc/WebScriptObject.mm:
        (_didExecute):
        (-[WebScriptObject callWebScriptMethod:withArguments:]):
        (-[WebScriptObject evaluateWebScript:]):
        (-[WebScriptObject setValue:forKey:]):
        (-[WebScriptObject valueForKey:]):
        (-[WebScriptObject removeWebScriptKey:]):
        (-[WebScriptObject hasWebScriptKey:]):
        (-[WebScriptObject stringRepresentation]):
        (-[WebScriptObject webScriptValueAtIndex:]):
        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateCallbackImplementation):
        * bindings/scripts/test/JS/JSTestCallback.cpp:
        (WebCore::JSTestCallback::callbackWithNoParam):
        (WebCore::JSTestCallback::callbackWithClass1Param):
        (WebCore::JSTestCallback::callbackWithClass2Param):
        (WebCore::JSTestCallback::callbackWithStringList):
        (WebCore::JSTestCallback::callbackWithBoolean):
        (WebCore::JSTestCallback::callbackRequiresThisToPass):
        * bridge/NP_jsobject.cpp:
        (_NPN_InvokeDefault):
        (_NPN_Invoke):
        (_NPN_Evaluate):
        (_NPN_GetProperty):
        (_NPN_SetProperty):
        (_NPN_RemoveProperty):
        (_NPN_HasProperty):
        (_NPN_HasMethod):
        (_NPN_Enumerate):
        (_NPN_Construct):
        * bridge/c/c_class.cpp:
        (JSC::Bindings::CClass::~CClass):
        (JSC::Bindings::CClass::methodsNamed):
        (JSC::Bindings::CClass::fieldNamed):
        * bridge/c/c_instance.cpp:
        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
        (JSC::Bindings::CInstance::invokeMethod):
        (JSC::Bindings::CInstance::invokeDefaultMethod):
        (JSC::Bindings::CInstance::invokeConstruct):
        (JSC::Bindings::CInstance::getPropertyNames):
        * bridge/c/c_runtime.cpp:
        (JSC::Bindings::CField::valueFromInstance):
        (JSC::Bindings::CField::setValueToInstance):
        * bridge/c/c_utility.cpp:
        (JSC::Bindings::convertValueToNPVariant):
        (JSC::Bindings::convertNPVariantToValue):
        * bridge/jni/jni_jsobject.mm:
        (JavaJSObject::call):
        (JavaJSObject::eval):
        (JavaJSObject::getMember):
        (JavaJSObject::setMember):
        (JavaJSObject::removeMember):
        (JavaJSObject::getSlot):
        (JavaJSObject::setSlot):
        (JavaJSObject::toString):
        (JavaJSObject::convertValueToJObject):
        (JavaJSObject::convertJObjectToValue):
        * bridge/jni/jni_objc.mm:
        (JSC::Bindings::dispatchJNICall):
        * bridge/jni/jsc/JNIUtilityPrivate.cpp:
        (JSC::Bindings::convertValueToJValue):
        * bridge/jni/jsc/JavaClassJSC.cpp:
        (JavaClass::JavaClass):
        (JavaClass::~JavaClass):
        * bridge/jni/jsc/JavaInstanceJSC.cpp:
        (JavaInstance::stringValue):
        * bridge/jni/jsc/JavaMethodJSC.cpp:
        (appendClassName):
        (JavaMethod::signature):
        * bridge/jni/jsc/JavaStringJSC.h:
        (JSC::Bindings::JavaString::JavaString):
        (JSC::Bindings::JavaString::~JavaString):
        (JSC::Bindings::JavaString::utf8):
        (JSC::Bindings::JavaString::init):
        * bridge/jsc/BridgeJSC.cpp:
        (JSC::Bindings::Instance::createRuntimeObject):
        (JSC::Bindings::Instance::newRuntimeObject):
        * bridge/objc/objc_instance.mm:
        (ObjcInstance::moveGlobalExceptionToExecState):
        (ObjcInstance::invokeObjcMethod):
        (ObjcInstance::invokeDefaultMethod):
        (ObjcInstance::setValueOfUndefinedField):
        (ObjcInstance::getValueOfUndefinedField):
        * bridge/objc/objc_runtime.mm:
        (JSC::Bindings::ObjcField::valueFromInstance):
        (JSC::Bindings::ObjcField::setValueToInstance):
        * bridge/objc/objc_utility.mm:
        (JSC::Bindings::convertValueToObjcValue):
        (JSC::Bindings::convertNSStringToString):
        (JSC::Bindings::convertObjcValueToValue):
        * bridge/qt/qt_instance.cpp:
        (JSC::Bindings::QtInstance::~QtInstance):
        (JSC::Bindings::QtInstance::getQtInstance):
        (JSC::Bindings::QtInstance::newRuntimeObject):
        * bridge/qt/qt_pixmapruntime.cpp:
        (JSC::Bindings::QtPixmapInstance::createPixmapRuntimeObject):
        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::convertValueToQVariant):
        (JSC::Bindings::convertQVariantToValue):
        (JSC::Bindings::QtRuntimeMetaMethod::call):
        (JSC::Bindings::QtRuntimeConnectionMethod::call):
        * bridge/qt/qt_runtime_qt4.cpp:
        (JSC::Bindings::convertValueToQVariant):
        (JSC::Bindings::convertQVariantToValue):
        (JSC::Bindings::QtRuntimeMetaMethod::call):
        (JSC::Bindings::QtRuntimeConnectionMethod::call):
        * bridge/runtime_root.cpp:
        (JSC::Bindings::RootObject::gcProtect):
        (JSC::Bindings::RootObject::gcUnprotect):
        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::createImageBuffer):
        * html/HTMLImageLoader.cpp:
        (WebCore::HTMLImageLoader::notifyFinished):
        * plugins/PluginView.cpp:
        (WebCore::PluginView::start):
        (WebCore::PluginView::stop):
        (WebCore::PluginView::performRequest):
        (WebCore::PluginView::npObject):
        (WebCore::PluginView::privateBrowsingStateChanged):
        * plugins/blackberry/PluginViewBlackBerry.cpp:
        (WebCore::PluginView::dispatchNPEvent):
        (WebCore::PluginView::setNPWindowIfNeeded):
        (WebCore::PluginView::platformStart):
        (WebCore::PluginView::getWindowInfo):
        * plugins/efl/PluginViewEfl.cpp:
        (WebCore::PluginView::dispatchNPEvent):
        * plugins/gtk/PluginViewGtk.cpp:
        (WebCore::PluginView::dispatchNPEvent):
        (WebCore::PluginView::handleKeyboardEvent):
        (WebCore::PluginView::handleMouseEvent):
        (WebCore::PluginView::setNPWindowIfNeeded):
        (WebCore::PluginView::platformStart):
        * plugins/mac/PluginViewMac.mm:
        (WebCore::PluginView::setNPWindowIfNeeded):
        (WebCore::PluginView::dispatchNPEvent):
        * plugins/qt/PluginViewQt.cpp:
        (WebCore::PluginView::dispatchNPEvent):
        (WebCore::PluginView::setNPWindowIfNeeded):
        (WebCore::PluginView::platformStart):
        * plugins/win/PluginViewWin.cpp:
        (WebCore::PluginView::dispatchNPEvent):
        (WebCore::PluginView::handleKeyboardEvent):
        (WebCore::PluginView::handleMouseEvent):
        (WebCore::PluginView::setNPWindowRect):
        * testing/js/WebCoreTestSupport.cpp:
        (WebCoreTestSupport::injectInternalsObject):
        (WebCoreTestSupport::resetInternalsObject):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::dropProtection):

2012-06-27  Tony Chang  <tony@chromium.org>

        Split flex into flex-grow/flex-shrink/flex-basis
        https://bugs.webkit.org/show_bug.cgi?id=86525

        Reviewed by Ojan Vafai.

        Split flex into 3 separate properties per the spec:
        http://dev.w3.org/csswg/css3-flexbox/#flex-components

        Tests: css3/flexbox/flex-longhand-parsing.html
               css3/flexbox/flex-property-parsing.html: Updated test results.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore): -webkit-flex is no longer enumerable.
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Add new css property names and use
        getCSSPropertyValuesForShorthandProperties for WebkitFlex. Also sort flex propery names.
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue): Fix indent.
        (WebCore::CSSParser::parseValue): Add parsing for new properties and handle -webkit-flex: none.
        (WebCore::CSSParser::parseFlex): Switch to new names (positive -> grow, negative -> shrink,
        preferred size -> basis) and assign to longhand properties.
        * css/CSSParser.h:
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty): Add new properties.
        * css/CSSPropertyNames.in: Add new properties.
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder): Delete special handling of applying flex and just use shorthand handlers.
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::getPropertyValue): Add new shorthand.
        (WebCore::StylePropertySet::asText):
        * css/StylePropertyShorthand.cpp:
        (WebCore::webkitFlexShorthand): Add new shorthand.
        (WebCore::shorthandForProperty):
        * css/StylePropertyShorthand.h:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList): Add to list of properties applied by StyleBuilder.

2012-06-27  Kentaro Hara  <haraken@chromium.org>

        Make Element::elementRareData() and Element::ensureElementRareData() private
        https://bugs.webkit.org/show_bug.cgi?id=90060

        Reviewed by Andreas Kling.

        This is a simple refactoring. Element::elementRareData() and
        Element::ensureElementRareData() can be private methods.

        No tests. No change in behavior.

        * dom/Element.h:
        (Element):

2012-06-27  James Robinson  <jamesr@chromium.org>

        [chromium] Delete unused includes and forward declarations from compositor code
        https://bugs.webkit.org/show_bug.cgi?id=90102

        Reviewed by Adrienne Walker.

        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/ContentLayerChromium.h:
        * platform/graphics/chromium/ImageLayerChromium.cpp:
        * platform/graphics/chromium/LayerChromium.cpp:
        * platform/graphics/chromium/LayerChromium.h:
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        * platform/graphics/chromium/ShaderChromium.h:
        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::updateTiles):
        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:

2012-06-27  Alec Flett  <alecflett@chromium.org>

        IndexedDB: make IDBKey immutable
        https://bugs.webkit.org/show_bug.cgi?id=90016

        Reviewed by Tony Chang.

        Make all members of IDBKey const, so that this can be considered
        an immutable, and thus safe to copy and/or stop ref-counting.

        No new tests, existing tests show this works.

        * Modules/indexeddb/IDBKey.cpp:
        (WebCore::IDBKey::compare):
        * Modules/indexeddb/IDBKey.h:
        (WebCore::IDBKey::createInvalid):
        (WebCore::IDBKey::createNumber):
        (WebCore::IDBKey::createString):
        (WebCore::IDBKey::createDate):
        (WebCore::IDBKey::createMultiEntryArray):
        (WebCore::IDBKey::createArray):
        (WebCore::IDBKey::date):
        (WebCore::IDBKey::IDBKey):
        (IDBKey):

2012-06-27  Erik Arvidsson  <arv@chromium.org>

        [V8] Improve variable resolution order on window
        https://bugs.webkit.org/show_bug.cgi?id=84247

        Reviewed by Ojan Vafai.

        This changes the V8 flag to turn on es52_globals and updates the layout tests to reflect the fixed behavior.

        This is the second (third?) try. Last time there was a bug in the V8 code related to the split window.
        I added a test that tests the failure that caused this to be rolled back last time.

        Tests: fast/dom/Window/es52-globals.html
               fast/dom/Window/window-property-shadowing-onclick.html

        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::V8DOMWindowShell::initContextIfNeeded):
        * bindings/v8/WorkerContextExecutionProxy.cpp:
        (WebCore::WorkerContextExecutionProxy::initIsolate):

2012-06-27  James Robinson  <jamesr@chromium.org>

        [chromium] Use categorized TRACE_EVENTN() macros in compositor code
        https://bugs.webkit.org/show_bug.cgi?id=90100

        Reviewed by Adrienne Walker.

        Specify the category in all traces in the compositor. Patch generated mostly by the sed command
        's/TRACE_EVENT(\(.*\), this, 0)/TRACE_EVENT0("cc", \1)/'.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::beginDrawingFrame):
        (WebCore::LayerRendererChromium::finish):
        (WebCore::LayerRendererChromium::swapBuffers):
        (WebCore::LayerRendererChromium::initializeSharedObjects):
        (WebCore::LayerRendererChromium::tileCheckerboardProgram):
        (WebCore::LayerRendererChromium::solidColorProgram):
        (WebCore::LayerRendererChromium::headsUpDisplayProgram):
        (WebCore::LayerRendererChromium::renderPassProgram):
        (WebCore::LayerRendererChromium::renderPassProgramAA):
        (WebCore::LayerRendererChromium::renderPassMaskProgram):
        (WebCore::LayerRendererChromium::renderPassMaskProgramAA):
        (WebCore::LayerRendererChromium::tileProgram):
        (WebCore::LayerRendererChromium::tileProgramOpaque):
        (WebCore::LayerRendererChromium::tileProgramAA):
        (WebCore::LayerRendererChromium::tileProgramSwizzle):
        (WebCore::LayerRendererChromium::tileProgramSwizzleOpaque):
        (WebCore::LayerRendererChromium::tileProgramSwizzleAA):
        (WebCore::LayerRendererChromium::textureProgram):
        (WebCore::LayerRendererChromium::textureProgramFlip):
        (WebCore::LayerRendererChromium::textureIOSurfaceProgram):
        (WebCore::LayerRendererChromium::videoYUVProgram):
        (WebCore::LayerRendererChromium::videoStreamTextureProgram):
        * platform/graphics/chromium/LayerTextureSubImage.cpp:
        (WebCore::LayerTextureSubImage::uploadWithTexSubImage):
        (WebCore::LayerTextureSubImage::uploadWithMapTexSubImage):
        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::SkPictureCanvasLayerTextureUpdater::drawPicture):
        * platform/graphics/chromium/TextureCopier.cpp:
        (WebCore::AcceleratedTextureCopier::copyTexture):
        * platform/graphics/chromium/TextureManager.cpp:
        (WebCore::TextureManager::evictTexture):
        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
        (WebCore::CCFrameRateController::setActive):
        (WebCore::CCFrameRateController::onTimerTick):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::initialize):
        (WebCore::CCLayerTreeHost::~CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
        (WebCore::CCLayerTreeHost::beginCommitOnImplThread):
        (WebCore::CCLayerTreeHost::didLoseContext):
        (WebCore::CCLayerTreeHost::updateLayers):
        (WebCore::CCLayerTreeHost::animateLayers):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::CCSingleThreadProxy):
        (WebCore::CCSingleThreadProxy::~CCSingleThreadProxy):
        (WebCore::CCSingleThreadProxy::compositeAndReadback):
        (WebCore::CCSingleThreadProxy::stop):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::CCThreadProxy):
        (WebCore::CCThreadProxy::~CCThreadProxy):
        (WebCore::CCThreadProxy::compositeAndReadback):
        (WebCore::CCThreadProxy::initializeContext):
        (WebCore::CCThreadProxy::initializeLayerRenderer):
        (WebCore::CCThreadProxy::setNeedsAnimate):
        (WebCore::CCThreadProxy::setNeedsCommit):
        (WebCore::CCThreadProxy::onSwapBuffersCompleteOnImplThread):
        (WebCore::CCThreadProxy::setNeedsCommitOnImplThread):
        (WebCore::CCThreadProxy::setNeedsForcedCommitOnImplThread):
        (WebCore::CCThreadProxy::postAnimationEventsToMainThreadOnImplThread):
        (WebCore::CCThreadProxy::setNeedsRedraw):
        (WebCore::CCThreadProxy::setNeedsRedrawOnImplThread):
        (WebCore::CCThreadProxy::stop):
        (WebCore::CCThreadProxy::finishAllRenderingOnImplThread):
        (WebCore::CCThreadProxy::beginFrame):
        (WebCore::CCThreadProxy::beginFrameCompleteOnImplThread):
        (WebCore::CCThreadProxy::scheduledActionUpdateMoreResources):
        (WebCore::CCThreadProxy::scheduledActionCommit):
        (WebCore::CCThreadProxy::scheduledActionDrawAndSwapInternal):
        (WebCore::CCThreadProxy::acquireLayerTextures):
        (WebCore::CCThreadProxy::initializeImplOnImplThread):
        (WebCore::CCThreadProxy::initializeContextOnImplThread):
        (WebCore::CCThreadProxy::initializeLayerRendererOnImplThread):
        (WebCore::CCThreadProxy::layerTreeHostClosedOnImplThread):

2012-06-27  W. James MacLean  <wjmaclean@chromium.org>

        [chromium] ScrollbarLayerChromium should support painting forward-track and back-track in different styles.
        https://bugs.webkit.org/show_bug.cgi?id=89908

        Reviewed by Adrienne Walker.

        Test: platform/chromium/compositing/scrollbars/custom-composited-different-track-parts.html

        Adds support for accelerated drawing (impl thread) of scrollbars with different styles for the
        forward-track and back-track parts.

        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        (WebCore::ScrollbarLayerChromium::pushPropertiesTo):
        (WebCore::ScrollbarBackgroundPainter::create):
        (WebCore::ScrollbarBackgroundPainter::ScrollbarBackgroundPainter):
        (ScrollbarBackgroundPainter):
        (WebCore::ScrollbarLayerChromium::setLayerTreeHost):
        (WebCore::ScrollbarLayerChromium::createTextureUpdaterIfNeeded):
        (WebCore::ScrollbarLayerChromium::update):
        * platform/graphics/chromium/ScrollbarLayerChromium.h:
        (ScrollbarLayerChromium):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
        (WebCore::CCScrollbarLayerImpl::CCScrollbarLayerImpl):
        (WebCore):
        (WebCore::CCScrollbarLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
        (WebCore::CCScrollbarLayerImpl::setBackTrackTextureId):
        (WebCore::CCScrollbarLayerImpl::setForeTrackTextureId):
        (CCScrollbarLayerImpl):

2012-06-27  Ian Vollick  <vollick@chromium.org>

        [chromium] Allow screen space rects and occluding rects to be visualized for debugging.
        https://bugs.webkit.org/show_bug.cgi?id=90012

        Reviewed by Adrienne Walker.

        No new tests. No new functionality.

        * platform/graphics/chromium/cc/CCDebugRectHistory.cpp:
        (WebCore::CCDebugRectHistory::enabled):
        (WebCore::CCDebugRectHistory::saveDebugRectsForCurrentFrame):
        (WebCore::CCDebugRectHistory::saveScreenSpaceRects):
        (WebCore):
        (WebCore::CCDebugRectHistory::saveOccludingRects):
        * platform/graphics/chromium/cc/CCDebugRectHistory.h:
        (WebCore):
        (CCDebugRectHistory):
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
        (WebCore::CCHeadsUpDisplay::showDebugRects):
        (WebCore::CCHeadsUpDisplay::draw):
        (WebCore::CCHeadsUpDisplay::drawDebugRects):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::CCLayerTreeSettings::CCLayerTreeSettings):
        (CCLayerTreeSettings):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::CCLayerTreeHostImpl::drawLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (FrameData):
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::::CCOcclusionTrackerBase):
        (WebCore::addOcclusionBehindLayer):
        (WebCore::::markOccludedBehindLayer):
        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
        (CCOcclusionTrackerBase):
        (WebCore::CCOcclusionTrackerBase::setOccludingScreenSpaceRectsContainer):

2012-06-27  Anthony Scian  <ascian@rim.com>

        Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
        https://bugs.webkit.org/show_bug.cgi?id=40118

        Reviewed by Yong Li.

        Implemented stub for createScriptCallStack to call into
        Interpreter and extract the current stack frames, iterate
        through the frames and create the return result required.

        No new tests, manually tested thrown exception and inspector
        tracebacks.

        * bindings/js/ScriptCallStackFactory.cpp:
        (WebCore::createScriptCallStack):

2012-06-27  Ryosuke Niwa  <rniwa@webkit.org>

        Let Xcode have its own way.

        * WebCore.xcodeproj/project.pbxproj:

2012-06-27  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION (Safari 5?): Pasting a line into textarea inserts two newlines
        https://bugs.webkit.org/show_bug.cgi?id=49288

        Reviewed by Tony Chang.

        The bug was caused by positionAvoidingPrecedingNodes getting out of a block when the insertion point is at a line break.
        It caused the subsequent code to be misinformed of the insertion position and ended up not pruning the extra line break.

        Fixed the bug by checking this special case and bailing out so that we don't crawl out of the enclosing block.
        It's similar to checks several lines below it.

        Test: editing/pasteboard/copy-paste-pre-line-content.html

        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::positionAvoidingPrecedingNodes):

2012-06-27  Andrei Onea  <onea@adobe.com>

        [CSSRegions]Change display values that allow regions
        https://bugs.webkit.org/show_bug.cgi?id=89759

        Reviewed by Tony Chang.

        Allow only elements with display values of block, inline-block,
        table-cell, table-caption and list-item to become regions, as per
        CSSRegions spec: http://dev.w3.org/csswg/css3-regions .
        Also added test for checking whether regions are destroyed and/or created
        when changing display value.

        Test: fast/regions/region-element-display-change.html

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::createObject):
        * rendering/style/RenderStyle.h:

2012-06-27  Mike Lawther  <mikelawther@chromium.org>

        CSS3 calc: blending involving expressions
        https://bugs.webkit.org/show_bug.cgi?id=86160

        Reviewed by Tony Chang.

        If either endpoint of a blend involves a calc expression, we create a new
        expression to perform the blend calculation.

        Test: css3/calc/transitions.html
              css3/calc/transitions-dependent.html

        * platform/Length.cpp:
        (WebCore):
        (WebCore::Length::blendCalculation):
        * platform/Length.h:
        (WebCore::Length::blend):
        (Length):

2012-06-27  Hans Muller  <hmuller@adobe.com>

        Move CSSWrapShape style resolution from StyleResolver to StyleBuilder
        https://bugs.webkit.org/show_bug.cgi?id=89668

        Reviewed by Andreas Kling.

        Moved the resolution of the shapeInside and shapeOutside CSS properties
        from the StyleResolver class to StyleBuilder. This is just refactoring
        in preparation for fixing https://bugs.webkit.org/show_bug.cgi?id=89670.

        No new tests were required.

        * css/StyleBuilder.cpp:
        (WebCore):
        (ApplyPropertyWrapShape):
        (WebCore::ApplyPropertyWrapShape::setValue):
        (WebCore::ApplyPropertyWrapShape::applyValue):
        (WebCore::ApplyPropertyWrapShape::createHandler):
        (WebCore::StyleBuilder::StyleBuilder):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-06-27  Alexandru Chiculita  <achicu@adobe.com>

        Blur filter causes issues when scrolling
        https://bugs.webkit.org/show_bug.cgi?id=89475

        Reviewed by Simon Fraser.

        This patch disables the fast scrolling when there is a fixed postioned element that
        has a filter applied on its parent layer. Otherwise the scroll blitting will just
        copy the outsets of the blur effect.

        Test: css3/filters/blur-filter-page-scroll.html

        * page/FrameView.cpp:
        (WebCore::FrameView::scrollContentsFastPath):

2012-06-27  Andreas Kling  <kling@webkit.org>

        REGRESSION(r121296): New zero-size background tests asserting on Mac.
        <http://webkit.org/b/90071>

        Reviewed by Dan Bernstein.

        Remove ASSERT(patternTransform.isInvertible()) as this is now a valid scenario.

        * platform/graphics/cg/ImageCG.cpp:
        (WebCore::Image::drawPattern):

2012-06-27  Shinya Kawanaka  <shinyak@chromium.org>

        HTMLStyleElement::removedFrom seems incorrect.
        https://bugs.webkit.org/show_bug.cgi?id=89986

        Reviewed by Hajime Morita.

        This is a follow-up patch for Bug 88495. The Same bug as Bug 88495 seems to exist on
        HTMLStyleElement::removedFrom().

        No new tests, hard to write a test case.

        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::removedFrom):

2012-06-27  Mike Reed  <reed@google.com>

        Cleanup scaling code in text-decorations for SVG InlineText. Use scale() instead of getCTM/normalizeTransform/setCTM
        to use more standard pattern for scaling, and to allow for these operations to be recorded and played back later
        (potentially with a different starting matrix). This effectively reverts change# 78704.
        https://bugs.webkit.org/show_bug.cgi?id=89888

        Reviewed by Nikolas Zimmermann.

        No new tests. Current layouttests exercise this code path.

        * rendering/svg/SVGInlineTextBox.cpp:
        (WebCore::SVGInlineTextBox::paintDecorationWithStyle):
        (WebCore::SVGInlineTextBox::paintTextWithShadows):

2012-06-27  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>

        [Qt] Remove redundant NDEBUG definition

        Already handled in default_post.prf.

        Reviewed by Tor Arne Vestbø.

        * WebCore.pri:

2012-06-27  Alexander Pavlov  <apavlov@chromium.org>

        Unexpected end of style sheet in @font-face rule discards it rather than closes all open constructs
        https://bugs.webkit.org/show_bug.cgi?id=89980

        Reviewed by Antti Koivisto.

        Use the "closing_brace" at the end of font_face rather than the explicit "'}' maybe_space".

        Test: fast/css/font-face-unexpected-end.html

        * css/CSSGrammar.y:

2012-06-26  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>

        [Qt] Add missing heades to HEADERS

        For JavaScriptCore there aren't any Qt specific files, so we include all
        headers for easy editing in Qt Creator.

        Reviewed by Simon Hausmann.

        * Target.pri:

2012-06-27  Kentaro Hara  <haraken@chromium.org>

        Rename Element::rareData() to Element::elementRareData(), and Element::ensureRareData() to Element::ensureElementRareData()
        https://bugs.webkit.org/show_bug.cgi?id=90050

        Reviewed by Ryosuke Niwa.

        Element::rareData()/Element::ensureRareData() and
        Node::rareData()/Node::ensureRareData() are confusing. They are not virtual
        methods. For clarification, we can rename Element::rareData() to
        Element::elementRareData(), and Element::ensureRareData() to
        Element::ensureElementRareData().

        c.f. SVGRareData uses SVGElement::rareSVGData() and SVGElement::ensureRareSVGData().
        (We might want to rename them to SVGElement::svgRareData() and
        SVGElement::ensureSVGRareData() in a follow-up patch.)

        No tests. No change in behavior.

        * dom/Element.cpp:
        (WebCore::Element::~Element):
        (WebCore::Element::elementRareData):
        (WebCore::Element::ensureElementRareData):
        (WebCore::Element::attributes):
        (WebCore::Element::attach):
        (WebCore::Element::detach):
        (WebCore::Element::recalcStyle):
        (WebCore::Element::shadow):
        (WebCore::Element::ensureShadow):
        (WebCore::Element::shadowPseudoId):
        (WebCore::Element::setShadowPseudoId):
        (WebCore::Element::focus):
        (WebCore::Element::minimumSizeForResizing):
        (WebCore::Element::setMinimumSizeForResizing):
        (WebCore::Element::computedStyle):
        (WebCore::Element::setStyleAffectedByEmpty):
        (WebCore::Element::styleAffectedByEmpty):
        (WebCore::Element::cancelFocusAppearanceUpdate):
        (WebCore::Element::classList):
        (WebCore::Element::optionalClassList):
        (WebCore::Element::dataset):
        (WebCore::Element::containsFullScreenElement):
        (WebCore::Element::setContainsFullScreenElement):
        (WebCore::Element::hasNamedNodeMap):
        (WebCore::Element::ensureCachedHTMLCollection):
        (WebCore::Element::savedLayerScrollOffset):
        (WebCore::Element::setSavedLayerScrollOffset):
        * dom/Element.h:
        (Element):
        * html/LabelableElement.cpp:
        (WebCore::LabelableElement::labels):

2012-06-26  Dominic Cooney  <dominicc@chromium.org>

        [Chromium] Remove unused build scripts and empty folders for JavaScriptCore w/ gyp
        https://bugs.webkit.org/show_bug.cgi?id=90029

        * gyp: Removed empty dir.

2012-06-27  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r121271.
        http://trac.webkit.org/changeset/121271
        https://bugs.webkit.org/show_bug.cgi?id=90056

        Broke a whole bunch of tests and also caused crashes in some
        tests (Requested by rniwa on #webkit).

        * editing/Editor.cpp:
        (WebCore::Editor::markAndReplaceFor):

2012-06-27  Zan Dobersek  <zandobersek@gmail.com>

        [Gtk] Add support for the Gamepad API
        https://bugs.webkit.org/show_bug.cgi?id=87503

        Reviewed by Carlos Garcia Campos.

        Add support for the Gamepad feature on the GTK port.

        The support is available only on Linux, with each gamepad device being presented
        through a GamepadDeviceLinux object. The implementation of this class relies on
        the Linux kernel joystick API.

        Gamepad devices are recognized through the GamepadsGtk class, of which implementation
        is based on GUdev. This way devices are properly registered on connection as objects of
        the GamepadDeviceGtk class which inherits GamepadDeviceLinux. GamepadDeviceGtk reads the
        joystick data through GIO pollable streams and updates the device state accordingly. The
        GamepadsGtk object is then polled for gamepads data through the sampleGamepads method.

        No new tests - tests already exist but require additional testing infrastructure.

        * GNUmakefile.am:
        * GNUmakefile.list.am:
        * bindings/gobject/GNUmakefile.am:
        * bindings/js/JSDOMBinding.h: Add the jsArray method that operates on a Vector of floats.
        (WebCore):
        (WebCore::jsArray):
        * platform/gtk/GamepadsGtk.cpp: Added.
        (WebCore):
        (GamepadDeviceGtk):
        (WebCore::GamepadDeviceGtk::create):
        (WebCore::GamepadDeviceGtk::GamepadDeviceGtk):
        (WebCore::GamepadDeviceGtk::~GamepadDeviceGtk):
        (WebCore::GamepadDeviceGtk::readCallback):
        (GamepadsGtk):
        (WebCore::GamepadsGtk::GamepadsGtk):
        (WebCore::GamepadsGtk::~GamepadsGtk):
        (WebCore::GamepadsGtk::registerDevice):
        (WebCore::GamepadsGtk::unregisterDevice):
        (WebCore::GamepadsGtk::updateGamepadList):
        (WebCore::GamepadsGtk::onUEventCallback):
        (WebCore::GamepadsGtk::isGamepadDevice):
        (WebCore::sampleGamepads):
        * platform/linux/GamepadDeviceLinux.cpp: Added.
        (WebCore):
        (WebCore::GamepadDeviceLinux::GamepadDeviceLinux):
        (WebCore::GamepadDeviceLinux::~GamepadDeviceLinux):
        (WebCore::GamepadDeviceLinux::updateForEvent):
        (WebCore::GamepadDeviceLinux::normalizeAxisValue):
        (WebCore::GamepadDeviceLinux::normalizeButtonValue):
        * platform/linux/GamepadDeviceLinux.h: Added.
        (WebCore):
        (GamepadDeviceLinux):
        (WebCore::GamepadDeviceLinux::connected):
        (WebCore::GamepadDeviceLinux::id):
        (WebCore::GamepadDeviceLinux::timestamp):
        (WebCore::GamepadDeviceLinux::axesCount):
        (WebCore::GamepadDeviceLinux::axesData):
        (WebCore::GamepadDeviceLinux::buttonsCount):
        (WebCore::GamepadDeviceLinux::buttonsData):

2012-06-27  Kentaro Hara  <haraken@chromium.org>

        Rename rareSVGData() to svgRareData()
        https://bugs.webkit.org/show_bug.cgi?id=90051

        Reviewed by Nikolas Zimmermann.

        Since rareSVGData() returns SVGRareData, it would make sense to
        rename rareSVGData() to svgRareData(). Similarly, we can rename
        ensureRareSVGData() to ensureSVGRareData(), and hasRareSVGData()
        to hasSVGRareData().

        c.f. bug 90050 is trying to introduce elementRareData() and
        ensureElementRareData().

        No tests. No change in behavior.

        * WebCore.order:
        * dom/Node.h:
        (WebCore::Node::hasSVGRareData):
        (WebCore::Node::setHasSVGRareData):
        (WebCore::Node::clearHasSVGRareData):
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::~SVGElement):
        (WebCore::SVGElement::willRecalcStyle):
        (WebCore::SVGElement::svgRareData):
        (WebCore::SVGElement::ensureSVGRareData):
        (WebCore::SVGElement::mapInstanceToElement):
        (WebCore::SVGElement::removeInstanceMapping):
        (WebCore::SVGElement::instancesForElement):
        (WebCore::SVGElement::setCursorElement):
        (WebCore::SVGElement::cursorElementRemoved):
        (WebCore::SVGElement::setCursorImageValue):
        (WebCore::SVGElement::cursorImageValueRemoved):
        (WebCore::SVGElement::correspondingElement):
        (WebCore::SVGElement::setCorrespondingElement):
        (WebCore::SVGElement::animatedSMILStyleProperties):
        (WebCore::SVGElement::ensureAnimatedSMILStyleProperties):
        (WebCore::SVGElement::setUseOverrideComputedStyle):
        (WebCore::SVGElement::computedStyle):
        * svg/SVGElement.h:
        (SVGElement):
        * svg/SVGStyledElement.cpp:
        (WebCore::SVGStyledElement::instanceUpdatesBlocked):
        (WebCore::SVGStyledElement::setInstanceUpdatesBlocked):
        (WebCore::SVGStyledElement::hasPendingResources):
        (WebCore::SVGStyledElement::setHasPendingResources):
        (WebCore::SVGStyledElement::clearHasPendingResourcesIfPossible):

2012-06-27  Kentaro Hara  <haraken@chromium.org>

        LabelableElement.cpp should include not ElementRareData.h but NodeRareData.h
        https://bugs.webkit.org/show_bug.cgi?id=90047

        Reviewed by Kent Tamura.

        This is a simple refactoring. What LabelableElement uses is
        not ElementRareData but NodeRareData.

        No tests. No change in behavior.

        * html/LabelableElement.cpp:

2012-06-27  Kentaro Hara  <haraken@chromium.org>

        [V8] Refactor V8BindingPerIsolateData::current() and V8BindingPerIsolateData::get()
        https://bugs.webkit.org/show_bug.cgi?id=90044

        Reviewed by Adam Barth.

        'static_cast<V8BindingPerIsolateData*>(isolate->GetData())' is duplicated
        in V8BindingPerIsolateData::current() and V8BindingPerIsolateData::get().
        This patch removes the duplication.

        No tests. No change in behavior.

        * bindings/v8/V8Binding.h:
        (WebCore::V8BindingPerIsolateData::current):

2012-06-26  Yoshifumi Inoue  <yosin@chromium.org>

        [Platform] Change implementation of LocaleICU class to support more UDateFormat.
        https://bugs.webkit.org/show_bug.cgi?id=89967

        Reviewed by Kent Tamura.

        This patch changes internal functions of LocaleICU class to process
        multiple ICU date time format handles in addition to short date time
        format handle.

        This patch is a part of implementing input type time. I'll add time
        format related ICU date time format handles.

        No new tests. This patch doesn't change behavior.

        * platform/text/LocaleICU.cpp:
        (WebCore::LocaleICU::initializeShortDateFormat): Changed to use openDateFormat().
        (WebCore::LocaleICU::openDateFormat): Added for common usage of udt_open().
        (WebCore::getDateFormatPattern): Added for common usage of udt_toPattern().
        (WebCore::localizeFormat): Changed to take String parameter.
        (WebCore::LocaleICU::initializeLocalizedDateFormatText): Changed to use getDateFormatPattern.
        (WebCore::LocaleICU::createLabelVector): Changed to take UDateFormat parameter.
        (WebCore::LocaleICU::initializeCalendar): Changed for helper functions.
        * platform/text/LocaleICU.h:
        (LocaleICU):

2012-06-26  Luke Macpherson  <macpherson@chromium.org>

        Return correct value for css variables enabled runtime flag.
        https://bugs.webkit.org/show_bug.cgi?id=90040

        Reviewed by Dimitri Glazkov.

        Was always returning true for the runtime flag when the compile time flag was on. That was good for testing,
        but not so much for production.

        * page/Settings.h:
        (WebCore::Settings::cssVariablesEnabled):

2012-06-26  Xueqing Huang  <huangxueqing@baidu.com>

        DragData::asFilenames should not push same file names to result in Windows.
        https://bugs.webkit.org/show_bug.cgi?id=79861

        Reviewed by Alexey Proskuryakov.

        Test: platform/win/fast/forms/file/drag-and-drop-files.html 

        * platform/win/DragDataWin.cpp:
        (WebCore::DragData::asFilenames):

2012-06-26  Geoffrey Garen  <ggaren@apple.com>

        Reduced (but did not eliminate) use of "berzerker GC"
        https://bugs.webkit.org/show_bug.cgi?id=89237

        Reviewed by Gavin Barraclough.

        (PART 2)

        Don't ASSERT that RootObject's destructor runs and invalidates all
        RuntimeObjects before their destructors run.

        We don't guarantee this behavior because some RuntimeObjects may already
        be garbage by the time RootObject's destructor runs, in which case
        RootObject's weak pointers will be NULL, and RootObject will not call
        invalidate() on them.

        It's been theoretically possible for this ASSERT to fire for a while now.
        This patch makes it fire all the time.

        Luckily, we only needed the behavior guarded by this ASSERT for WebKit1
        in Safari on Windows (cf. https://bugs.webkit.org/show_bug.cgi?id=61317),
        to handle the way WebKit1 would unload plugin DLLs. If this ever becomes
        an issue again, we can fix it by (a) not unloading plugin DLLs,
        (b) migrating WebKit1 to the WebKit2 JS-plugin binding model, (c) making
        the Instance pointer in a RuntimeObject an indirect pointer through
        RootObject, or (c) giving RuntimeObject some sort of special way to
        access a zombie weak pointer.

        * bridge/runtime_object.cpp:
        (JSC::Bindings::RuntimeObject::destroy): ASSERT removed. Anders said so.

2012-06-26  Douglas Stockwell  <dstockwell@chromium.org>

        REGRESSION(r107836): box shadow not drawn for opaque images with an opaque background
        https://bugs.webkit.org/show_bug.cgi?id=89958

        Reviewed by Simon Fraser.

        Don't attempt to draw the box shadow as part of the background if the background is
        obscured.

        Test: fast/box-shadow/image-box-shadow.html

        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::boxShadowShouldBeAppliedToBackground):
        (WebCore):
        * rendering/RenderImage.h:
        (RenderImage):

2012-06-26  Nico Weber  <thakis@chromium.org>

        Fix new Wunused-private-field violations that crept in
        https://bugs.webkit.org/show_bug.cgi?id=90032

        Reviewed by Adam Barth.

        * page/Performance.h:
        (Performance):

2012-06-26  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Change return type in bandwidth attribute of network information API
        https://bugs.webkit.org/show_bug.cgi?id=89959

        Reviewed by Adam Barth.

        According to network information API spec, bandwidth attribute should return double type.
        But, existing implementation has used *long* and *unsigned int* types.

        No new tests. Covered by existing tests.

        * Modules/networkinfo/NetworkInfo.cpp:
        (WebCore::NetworkInfo::NetworkInfo):
        * Modules/networkinfo/NetworkInfo.h:
        (WebCore::NetworkInfo::create):
        (WebCore::NetworkInfo::bandwidth):
        (NetworkInfo):
        * Modules/networkinfo/NetworkInfoClient.h:
        (NetworkInfoClient):
        * Modules/networkinfo/NetworkInfoConnection.cpp:
        (WebCore::NetworkInfoConnection::bandwidth):
        * Modules/networkinfo/NetworkInfoConnection.h:
        (NetworkInfoConnection):
        * testing/Internals.cpp:
        (WebCore::Internals::setNetworkInformation):
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-06-26  Luke Macpherson  <macpherson@chromium.org>

        Be careful not to read past the end of input in CSSParser::lex() when looking for variable definitions.
        https://bugs.webkit.org/show_bug.cgi?id=89949

        Reviewed by Abhishek Arya.

        Added repro case as fast/css/short-inline-style.html.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::lex):

2012-06-26  James Robinson  <jamesr@chromium.org>

        [chromium] Remove WebView::graphicsContext3D getter
        https://bugs.webkit.org/show_bug.cgi?id=89916

        Reviewed by Adrienne Walker.

        Deletes code supporting compositor context getter.

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCProxy.h:
        (CCProxy):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        (CCSingleThreadProxy):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (CCThreadProxy):

2012-06-26  Kulanthaivel Palanichamy  <kulanthaivel@codeaurora.org>

        Unexpected element sizes when mixing inline-table with box-sizing
        https://bugs.webkit.org/show_bug.cgi?id=89819

        Reviewed by Julien Chaffraix.

        This change handles box-sizing: border-box property for CSS tables properly.

        Test: fast/box-sizing/css-table-with-box-sizing.html

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::convertStyleLogicalWidthToComputedWidth):
        (WebCore::RenderTable::layout):

2012-06-26  Simon Fraser  <simon.fraser@apple.com>

        Optimize mappings of simple transforms in RenderGeometryMap
        https://bugs.webkit.org/show_bug.cgi?id=90034

        Reviewed by Dean Jackson.
        
        For transforms that are identity or simple translations, don't
        fall off the fast path in RenderGeometryMap; we can just
        treat them as offsets.
        
        Improves performance on pages with lots of translateZ(0) elements.
        
        Remove RenderGeometryMapStep::mapPoint() and mapQuad(), which
        were unused.

        No new tests; optimization only, and tested by assertions.

        * rendering/RenderGeometryMap.cpp:
        (WebCore::RenderGeometryMap::push):

2012-06-26  Kevin Ellis  <kevers@chromium.org>

        Touch adjustment does not target shadow DOM elements
        https://bugs.webkit.org/show_bug.cgi?id=89556

        The position of internal shadow-DOM nodes were not being considered
        when determining the snap position when TOUCH_ADJUSTMENT is enabled 
        for fine tuning the position of synthetic mouse events.  This 
        restriction results in not being able to select the calendar picker
        when input type=date, or to clear the search field for input 
        type=search.

        Reviewed by Antonio Gomes.

        Test: touchadjustment/nested-shadow-node.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::bestClickableNodeForTouchPoint):

2012-06-26  Ryosuke Niwa  <rniwa@webkit.org>

        Stop calling node() and deprecatedEditingOffset() in comparePositions
        https://bugs.webkit.org/show_bug.cgi?id=54535

        Reviewed by Enrica Casucci.

        Replaced deprecatedNode() and deprecatedEditingOffset() by containerNode() and computeOffsetInContainerNode()
        in comparePositions().
        
        In addition, fixed a bunch of bugs in DeleteSelectionCommand::handleSpecialCaseBRDelete revealed by this change:
        - Use node after position instead of deprecated node in determinig whether start and end positions at a br.
        - Don't set m_startsAtEmptyLine true when BR is wrapped in a block element. The only reason this code had worked
        was positions like (div, offset, 0) and (br, before) in <div><br> were treated differently, which we no longer do.

        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::handleSpecialCaseBRDelete):
        * editing/htmlediting.cpp:
        (WebCore::comparePositions):

2012-06-26  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] Use eina_file_ls() in EFL implementation of FileSystem listDirectory()
        https://bugs.webkit.org/show_bug.cgi?id=89976

        Reviewed by Antonio Gomes.

        Rewrite EFL implementation of Filesystem listDirectory() in order to
        use eina_file_ls() instead of POSIX C functions. This results in
        shorter code.

        No new tests, behavior has not changed.

        * platform/efl/FileSystemEfl.cpp:
        (WebCore::listDirectory):

2012-06-26  Alice Cheng  <alice_cheng@apple.com>

        Crash at WebCore::TextIterator::handleTextBox
        https://bugs.webkit.org/show_bug.cgi?id=89526
        <rdar://problem/10305315>

        Reviewed by Darin Adler.

        The range used for marking becomes invalid after SpellingCorrectionCommand, due to changes in the DOM made by ReplaceSelectionCommand. 
        This invalid range caused marking to be incorrect, and Mail.app to crash when iterating through the invalid range.  To fix this,
        recalculate the range for marking after SpellingCorrectionCommand.

        Test: platform/mac/editing/spelling/autocorrection-blockquote-crash.html

        * editing/AlternativeTextController.cpp:
        (WebCore::AlternativeTextController::applyAlternativeTextToRange):
        * editing/Editor.cpp:  (WebCore::Editor::markAndReplaceFor):
        * testing/Internals.cpp:
        (WebCore):
        (WebCore::Internals::hasAutocorrectedMarker):
        * testing/Internals.h: (Internals):
        * testing/Internals.idl:

2012-06-26  Tom Sepez  <tsepez@chromium.org>

        [chromium] HTML5 audio/video tags - loading http content from https page doesn't trigger warning.
        https://bugs.webkit.org/show_bug.cgi?id=89906

        Reviewed by Nate Chapin.

        This patch treats mixed CachedRawResources as affecting the display of insecure content.

        Tests: http/tests/security/mixedContent/insecure-audio-video-in-main-frame.html
               http/tests/security/mixedContent/insecure-xhr-in-main-frame.html

        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::checkInsecureContent):

2012-06-26  Joe Thomas  <joethomas@motorola.com>

        background-size:0 shows as 1px instead of invisible
        https://bugs.webkit.org/show_bug.cgi?id=86942

        Reviewed by Eric Seidel.

        As per the specification http://www.w3.org/TR/css3-background/#background-size, if the background image's width or height resolves to zero,
        this causes the image not to be displayed. The effect should be the same as if it had been a transparent image.
        This is also mentioned in http://www.w3.org/TR/2002/WD-css3-background-20020802/#background-size.

        Test: fast/backgrounds/zero-background-size.html

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::calculateFillTileSize):

2012-06-26  Adam Klein  <adamk@chromium.org>

        [v8] Clean up generated Dictionary-handling code
        https://bugs.webkit.org/show_bug.cgi?id=89994

        Reviewed by Adam Barth.

        No change in behavior, so no new tests.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateParametersCheck):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::optionsObjectCallback):

2012-06-26  Raymond Toy  <rtoy@google.com>

        Include stdio.h when DEBUG_AUDIONODE_REFERENCES is set
        https://bugs.webkit.org/show_bug.cgi?id=89997

        Reviewed by Eric Seidel.

        No new tests needed for a compile issue

        * Modules/webaudio/AudioNode.cpp:  Include stdio.h

2012-06-26  No'am Rosenthal  <noam.rosenthal@nokia.com>

        [Qt] Use premultiplied alpha when extracting image data in WebGL
        https://bugs.webkit.org/show_bug.cgi?id=89937

        Reviewed by Jocelyn Turcotte.

        Perform conversion in QImage only if the image format is not ARGB32 or
        ARGB32_Premultiplied. Otherwise, allow packPixels to perform the conversion if the formats
        don't match, as packPixels already performs pixel-specific operations.

        Covered by tests in LayoutTests/fast/canvas/webgl, e.g. webgl-composite-modes.html.

        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        (WebCore::GraphicsContext3D::getImageData):

2012-06-26  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Move method precondition checks to front end objects
        https://bugs.webkit.org/show_bug.cgi?id=89377

        Reviewed by Tony Chang.

        Now that metadata exists on the front end, most of the pre-condition validation checks
        done on IDB method calls from script can be moved to the front end which simplifies the
        code significantly in the case of complex methods like IDBObjectStore::put().

        Adds an internal "active" flag for transactions, although the behavior is not accurate
        to the spec (it should only be true during event callbacks - http://webkit.org/b/89379).
        The back-end methods can then be simplifed to just adding async tasks to the transaction,
        and the front end methods can take care of all exception cases except for asynchronous
        transaction abort which still requires plumbing back to the front end.

        No functional changes - no new tests.

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::update): Migrate from IDBObjectStoreBackendImpl::put.
        (WebCore::IDBCursor::advance): Add more explicit transaction-is-active check.
        (WebCore::IDBCursor::continueFunction): Ditto.
        (WebCore::IDBCursor::deleteFunction): Ditto.
        (WebCore::IDBCursor::effectiveObjectStore): Convenience function (source may be store or index).
        (WebCore):
        * Modules/indexeddb/IDBCursor.h:
        (WebCore::IDBCursor::isKeyCursor): Distinguish from IDBCursorWithValue.
        (IDBCursor):
        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
        (WebCore::IDBCursorBackendImpl::update): Remove migrated check.
        * Modules/indexeddb/IDBCursorWithValue.h:
        (IDBCursorWithValue):
        * Modules/indexeddb/IDBDatabase.cpp: Migrate checks.
        (WebCore::IDBDatabase::createObjectStore):
        (WebCore::IDBDatabase::deleteObjectStore):
        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp: Replace checks with assertions.
        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
        (WebCore::IDBDatabaseBackendImpl::deleteObjectStore):
        * Modules/indexeddb/IDBIndex.cpp: Add transaction-is-active checks.
        (WebCore::IDBIndex::openCursor):
        (WebCore::IDBIndex::count):
        (WebCore::IDBIndex::openKeyCursor):
        (WebCore::IDBIndex::get):
        (WebCore::IDBIndex::getKey):
        * Modules/indexeddb/IDBObjectStore.cpp: Migrate cehcks.
        (WebCore::IDBObjectStore::get):
        (WebCore::IDBObjectStore::add): Delegates to put(PutMode)
        (WebCore::IDBObjectStore::put): Delegates to put(PutMode)
        (WebCore): Adds put(PutMode) which has the unified checks migrated from
        IDBObjectStoreBackendImpl::put.
        (WebCore::IDBObjectStore::deleteFunction):
        (WebCore::IDBObjectStore::clear):
        (WebCore::IDBObjectStore::createIndex):
        (WebCore::IDBObjectStore::deleteIndex):
        (WebCore::IDBObjectStore::openCursor):
        (WebCore::IDBObjectStore::count):
        * Modules/indexeddb/IDBObjectStore.h: Adds put(PutMode).
        (IDBObjectStore):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::getInternal): Fix trace symbol.
        (WebCore::IDBObjectStoreBackendImpl::put): Remove migrated checks.
        (WebCore::IDBObjectStoreBackendImpl::createIndex): Remove migrated checks.
        (WebCore::IDBObjectStoreBackendImpl::deleteIndex): Remove migrated checks.
        * Modules/indexeddb/IDBTransaction.cpp: Add active flag tracking.
        (WebCore::IDBTransaction::IDBTransaction):
        (WebCore::IDBTransaction::abort):
        (WebCore::IDBTransaction::onAbort):
        (WebCore::IDBTransaction::onComplete):
        * Modules/indexeddb/IDBTransaction.h:
        (WebCore::IDBTransaction::isActive):
        (WebCore::IDBTransaction::isReadOnly): Group IDL/non-IDL methods.
        (IDBTransaction):

2012-06-26  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r121285.
        http://trac.webkit.org/changeset/121285
        https://bugs.webkit.org/show_bug.cgi?id=90014

        "We misinterpreted 'size of the initial containing block'"
        (Requested by tomz on #webkit).

        * css/CSSCalculationValue.cpp:
        (WebCore::CSSCalcValue::computeLengthPx):
        (WebCore::CSSCalcPrimitiveValue::toCalcValue):
        (WebCore::CSSCalcPrimitiveValue::computeLengthPx):
        (WebCore::CSSCalcBinaryOperation::toCalcValue):
        (WebCore::CSSCalcBinaryOperation::computeLengthPx):
        * css/CSSCalculationValue.h:
        (CSSCalcExpressionNode):
        (WebCore::CSSCalcValue::toCalcValue):
        (CSSCalcValue):
        * css/CSSGradientValue.cpp:
        (WebCore::CSSGradientValue::addStops):
        (WebCore::positionFromValue):
        (WebCore::CSSGradientValue::computeEndPoint):
        (WebCore::CSSLinearGradientValue::createGradient):
        (WebCore::CSSRadialGradientValue::resolveRadius):
        (WebCore::CSSRadialGradientValue::createGradient):
        * css/CSSGradientValue.h:
        (CSSGradientValue):
        (CSSRadialGradientValue):
        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::computeLength):
        (WebCore::CSSPrimitiveValue::computeLengthDouble):
        * css/CSSPrimitiveValue.h:
        (CSSPrimitiveValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::convertToLength):
        * css/CSSToStyleMap.cpp:
        (WebCore::CSSToStyleMap::mapFillSize):
        (WebCore::CSSToStyleMap::mapFillXPosition):
        (WebCore::CSSToStyleMap::mapFillYPosition):
        (WebCore::CSSToStyleMap::mapNinePieceImageQuad):
        * css/CSSToStyleMap.h:
        (CSSToStyleMap):
        * css/MediaQueryEvaluator.cpp:
        (WebCore::computeLength):
        (WebCore::device_heightMediaFeatureEval):
        (WebCore::device_widthMediaFeatureEval):
        (WebCore::heightMediaFeatureEval):
        (WebCore::widthMediaFeatureEval):
        * css/SVGCSSStyleSelector.cpp:
        (WebCore::StyleResolver::applySVGProperty):
        * css/StyleBuilder.cpp:
        (WebCore::ApplyPropertyAuto::applyValue):
        (WebCore::ApplyPropertyClip::convertToLength):
        (WebCore::ApplyPropertyLength::applyValue):
        (WebCore::ApplyPropertyBorderRadius::applyValue):
        (WebCore::ApplyPropertyComputeLength::applyValue):
        (WebCore::ApplyPropertyFontSize::applyValue):
        (WebCore::ApplyPropertyLineHeight::applyValue):
        (WebCore::ApplyPropertyPageSize::mmLength):
        (WebCore::ApplyPropertyPageSize::inchLength):
        (WebCore::ApplyPropertyPageSize::applyValue):
        (WebCore::ApplyPropertyVerticalAlign::applyValue):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleResolver.h:
        (StyleResolver):
        * css/WebKitCSSMatrix.cpp:
        (WebCore::WebKitCSSMatrix::setMatrixValue):

2012-06-26  Dave Tu  <dtu@chromium.org>

        [chromium] Expose rendering statistics to WebWidget.
        https://bugs.webkit.org/show_bug.cgi?id=88268

        Reviewed by James Robinson.

        The WebKit side of a basic framework for exposing rendering statistics
        to Chromium's --enable-benchmarking extension.

        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::CCLayerTreeHost::implFrameNumber):
        * platform/graphics/chromium/cc/CCProxy.h:
        (CCProxy):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::implFrameNumber):
        (WebCore):
        (WebCore::CCThreadProxy::implFrameNumberOnImplThread):
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (CCThreadProxy):

2012-06-26  Dave Tharp  <dtharp@codeaurora.org>

        ietestcenter/css3/valuesandunits/units-000.htm asserts
        https://bugs.webkit.org/show_bug.cgi?id=86176

        Reviewed by Beth Dakin.

        Modified computeLengthDouble() to handle vh, vw, and vmin units. Per the spec
        (http://dev.w3.org/csswg/css3-values/#viewport-relative-lengths) viewport -percentage
        lengths are "relative to the size of the initial containing block", which I read to be
        the size of the parent element. Since parentStyle was not available in computeLengthDouble,
        most of the changes for this patch involved "pushing down" the parentStyle pointer through
        the network of computeLength methods and dependencies.

        Tests: css3/viewport-percentage-lengths/css3-viewport-percentage-lengths-vh-border.html
               css3/viewport-percentage-lengths/css3-viewport-percentage-lengths-vmin-border.html
               css3/viewport-percentage-lengths/css3-viewport-percentage-lengths-vw-border.html

        * css/CSSCalculationValue.cpp:
        (WebCore::CSSCalcValue::computeLengthPx):
        (WebCore::CSSCalcPrimitiveValue::toCalcValue):
        (WebCore::CSSCalcPrimitiveValue::computeLengthPx):
        (WebCore::CSSCalcBinaryOperation::toCalcValue):
        (WebCore::CSSCalcBinaryOperation::computeLengthPx):
        * css/CSSCalculationValue.h:
        (CSSCalcExpressionNode):
        (WebCore::CSSCalcValue::toCalcValue):
        (CSSCalcValue):
        * css/CSSGradientValue.cpp:
        (WebCore::CSSGradientValue::addStops):
        (WebCore::positionFromValue):
        (WebCore::CSSGradientValue::computeEndPoint):
        (WebCore::CSSLinearGradientValue::createGradient):
        (WebCore::CSSRadialGradientValue::resolveRadius):
        (WebCore::CSSRadialGradientValue::createGradient):
        * css/CSSGradientValue.h:
        (CSSGradientValue):
        (CSSRadialGradientValue):
        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::computeLength):
        (WebCore::CSSPrimitiveValue::computeLengthDouble):
        * css/CSSPrimitiveValue.h:
        (CSSPrimitiveValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::convertToLength):
        * css/CSSToStyleMap.cpp:
        (WebCore::CSSToStyleMap::parentStyle):
        (WebCore):
        (WebCore::CSSToStyleMap::mapFillSize):
        (WebCore::CSSToStyleMap::mapFillXPosition):
        (WebCore::CSSToStyleMap::mapFillYPosition):
        (WebCore::CSSToStyleMap::mapNinePieceImageQuad):
        * css/CSSToStyleMap.h:
        (CSSToStyleMap):
        * css/MediaQueryEvaluator.cpp:
        (WebCore::computeLength):
        (WebCore::device_heightMediaFeatureEval):
        (WebCore::device_widthMediaFeatureEval):
        (WebCore::heightMediaFeatureEval):
        (WebCore::widthMediaFeatureEval):
        * css/SVGCSSStyleSelector.cpp:
        (WebCore::StyleResolver::applySVGProperty):
        * css/StyleBuilder.cpp:
        (WebCore::ApplyPropertyAuto::applyValue):
        (WebCore::ApplyPropertyClip::convertToLength):
        (WebCore::ApplyPropertyLength::applyValue):
        (WebCore::ApplyPropertyBorderRadius::applyValue):
        (WebCore::ApplyPropertyComputeLength::applyValue):
        (WebCore::ApplyPropertyFontSize::applyValue):
        (WebCore::ApplyPropertyLineHeight::applyValue):
        (WebCore::ApplyPropertyPageSize::mmLength):
        (WebCore::ApplyPropertyPageSize::inchLength):
        (WebCore::ApplyPropertyPageSize::applyValue):
        (WebCore::ApplyPropertyVerticalAlign::applyValue):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleResolver.h:
        (WebCore::StyleResolver::parentNode):
        (StyleResolver):
        * css/WebKitCSSMatrix.cpp:
        (WebCore::WebKitCSSMatrix::setMatrixValue):

2012-06-25  James Robinson  <jamesr@chromium.org>

        [chromium] Add WebLayer API for scrolling
        https://bugs.webkit.org/show_bug.cgi?id=89913

        Reviewed by Adrienne Walker.

        Use new WebScrollableLayer type in ScrollingCoordinatorChromium. This file peeks "under the hood" a fair amount
        since we don't have WebLayer API for scrollbar layers yet.

        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        (WebCore::ScrollingCoordinatorPrivate::setScrollLayer):
        (WebCore::ScrollingCoordinatorPrivate::setHorizontalScrollbarLayer):
        (WebCore::ScrollingCoordinatorPrivate::setVerticalScrollbarLayer):
        (WebCore::ScrollingCoordinatorPrivate::hasScrollLayer):
        (WebCore::ScrollingCoordinatorPrivate::scrollLayer):
        (ScrollingCoordinatorPrivate):
        (WebCore::createScrollbarLayer):
        (WebCore::ScrollingCoordinator::setScrollLayer):
        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
        (WebCore::ScrollingCoordinator::setWheelEventHandlerCount):
        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):

2012-06-26  James Robinson  <jamesr@chromium.org>

        Unreviewed, rolling out r120501.
        http://trac.webkit.org/changeset/120501
        https://bugs.webkit.org/show_bug.cgi?id=89126

        [skia] Fix is too heavy-handed

        * platform/graphics/skia/ImageBufferSkia.cpp:
        (WebCore::drawNeedsCopy):
        * platform/graphics/skia/PlatformContextSkia.cpp:
        (WebCore::PlatformContextSkia::PlatformContextSkia):
        * platform/graphics/skia/PlatformContextSkia.h:
        (PlatformContextSkia):
        (WebCore::PlatformContextSkia::isDeferred):
        (WebCore::PlatformContextSkia::setDeferred):

2012-06-26  Julien Chaffraix  <jchaffraix@webkit.org>

        Crash in FixedTableLayout::layout
        https://bugs.webkit.org/show_bug.cgi?id=88676

        Unreviewed typo fix, pointed out by Darin Adler.

        * rendering/AutoTableLayout.cpp:
        (WebCore::AutoTableLayout::layout):
        * rendering/FixedTableLayout.cpp:
        (WebCore::FixedTableLayout::layout):

2012-06-26  Adam Klein  <adamk@chromium.org>

        MutationObserver.observe should treat a null or undefined options argument as empty
        https://bugs.webkit.org/show_bug.cgi?id=89992

        Reviewed by Ojan Vafai.

        The WebIDL spec was recently updated to treat null or undefined
        Dictionary arguments the same as the empty dictionary. This patch
        updates MutationObserver.observe to follow that spec.

        Note that we still throw a SYNTAX_ERR in this case, since it's an
        error not to pass one of "attributes", "childList", or "characterData"
        as a key in the dictionary.

        * dom/WebKitMutationObserver.cpp:
        (WebCore::WebKitMutationObserver::observe):

2012-06-26  Ian Vollick  <vollick@chromium.org>

        [chromium] The single thread proxy should not automatically tick new animations.
        https://bugs.webkit.org/show_bug.cgi?id=89996

        Reviewed by James Robinson.

        No new tests. No change to existing functionality.

        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::CCSingleThreadProxy):
        (WebCore::CCSingleThreadProxy::initializeLayerRenderer):
        (WebCore::CCSingleThreadProxy::didAddAnimation):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        (WebCore):

2012-06-26  Julien Chaffraix  <jchaffraix@webkit.org>

        Crash in FixedTableLayout::layout
        https://bugs.webkit.org/show_bug.cgi?id=88676

        Reviewed by Abhishek Arya.

        Tests: fast/table/auto-table-layout-colgroup-removal-crash.html
               fast/table/fixed-table-layout/colgroup-removal-crash.html
               fast/table/fixed-table-layout/prepend-in-fixed-table.html

        The issue comes from RenderTable not properly dirtying its preferred logical
        widths. As the table layout codes (both fixed and auto), recomputes their internal
        structures at computePreferredLogicalWidth, the internal structure doesn't match
        the table sizing and we crash.

        This fix adds a work-around in FixedTableLayout::layout (which matches AutoTableLayout).
        The long-term fix would be to properly fix the logic but this is a lot safer, especially
        since our logic is really not bullet-proof at the moment.

        * rendering/FixedTableLayout.cpp:
        (WebCore::FixedTableLayout::layout):
        Added an internal structure recomputation, if we have drifted from our table's structure.
        Also we need to update nEffCols if we call calcWidthArray.

        * rendering/AutoTableLayout.cpp:
        (WebCore::AutoTableLayout::layout):
        Added a comment matching FixedTableLayout. The nEffCols is unneeded but kept for consistency
        with FixedTableLayout.

2012-06-26  Ian Vollick  <vollick@chromium.org>

        [chromium] Layer chromium should need a redraw after getting its first non-empty bounds.
        https://bugs.webkit.org/show_bug.cgi?id=89784

        Reviewed by James Robinson.

        Previously, we'd only set needs redraw if the old bounds were zero,
        and the new bounds were non-zero, but we should actually have 
        checked that the old bounds were non-empty.

        Unit test: LayerChromiumTestWithoutFixture.setBoundsTriggersSetNeedsRedrawAfterGettingNonEmptyBounds

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::setBounds):

2012-06-26  Jia Pu  <jpu@apple.com>

        On Mac, autocorrection sometimes fails to take place in Safari.
        https://bugs.webkit.org/show_bug.cgi?id=89982

        Reviewed by Darin Adler.

        Existing test was turned off due to intermittent failure, which is caused by autocorrection result depending on user data
        that may be altered by previous test runs. Hopefully we can turn the test back on once we have a way to make autocorrection
        behave consistently.

        Basically we should check the value of shouldCheckForCorrection, not shouldShowCorrectionPanel, to determine if we should
        early return in markAndReplaceFor(). 

        * editing/Editor.cpp:
        (WebCore::Editor::markAndReplaceFor):

2012-06-26  Joe Thomas  <joethomas@motorola.com>

        Do early-return when author and user styles are disabled.
        https://bugs.webkit.org/show_bug.cgi?id=89947

        Reviewed by Andreas Kling.

        * dom/Document.cpp:
        (WebCore::Document::collectActiveStylesheets):

2012-06-26  James Robinson  <jamesr@chromium.org>

        [chromium] Remove dead compositor-related API from GraphicsContext3DPrivate / Extensions3DChromium
        https://bugs.webkit.org/show_bug.cgi?id=89933

        Reviewed by Kenneth Russell.

        GraphicsContext3DPrivate and Extensions3DChromium had a fair amount of plumbing and boilerplate to support the
        compositor's use of GraphicsContext3D. A number of extensions, etc, only make sense for a compositor context.
        Since the compositor doesn't use GC3D any more, these are no longer needed.

        * platform/chromium/support/Extensions3DChromium.cpp:
        * platform/chromium/support/GraphicsContext3DChromium.cpp:
        (WebCore::GraphicsContext3D::~GraphicsContext3D):
        (WebCore::GraphicsContext3D::create):
        * platform/chromium/support/GraphicsContext3DPrivate.cpp:
        (WebCore::GraphicsContext3DPrivate::~GraphicsContext3DPrivate):
        (WebCore::GraphicsContext3DPrivate::createGraphicsContextFromWebContext):
        (WebCore::GrMemoryAllocationChangedCallbackAdapter::GrMemoryAllocationChangedCallbackAdapter):
        (WebCore::GraphicsContext3DPrivate::grContext):
        * platform/chromium/support/GraphicsContext3DPrivate.h:
        (WebCore):
        (GraphicsContext3DPrivate):
        * platform/graphics/chromium/Extensions3DChromium.h:

2012-06-26  Yasuhiro Matsuda  <mazda@chromium.org>

        [chromium] Add the workaround of IOSurface-related corruption during readback on Mac OS X.
        https://bugs.webkit.org/show_bug.cgi?id=89797

        Reviewed by James Robinson.

        No new tests. This patch doesn't change behavior.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::getFramebufferPixels):

2012-06-26  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Native memory snapshots crash in debug mode.
        https://bugs.webkit.org/show_bug.cgi?id=89977

        Reviewed by Yury Semikhatsky.

        * bindings/v8/V8DOMWrapper.cpp:
        (WebCore::V8DOMWrapper::maybeDOMWrapper):

2012-06-26  Huang Dongsung  <luxtella@company100.net>

        [Texmap] Bug fix typo about computing bytesPerLine in BitmapTextureGL.
        https://bugs.webkit.org/show_bug.cgi?id=89924

        "bytesPerLine == targetRect.width() / 4" is invalid.
        This patch amended it into "bytesPerLine == targetRect.width() * 4".
        Moreover, changed magic number 4 to bytesPerPixel.

        Reviewed by Noam Rosenthal.

        No new tests. Covered by existing tests.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::BitmapTextureGL::updateContents):

2012-06-26  Roland Takacs  <takacs.roland@stud.u-szeged.hu>

        Shader compiler unprepared to make ESSL output when GLES is used
        https://bugs.webkit.org/show_bug.cgi?id=87718

        Reviewed by Noam Rosenthal.

        Defined a new member that says what type of output code must be generated
        (SH_GLSL_OUTPUT, SH_ESSL_OUTPUT). It is set within the constructor.

        * platform/graphics/ANGLEWebKitBridge.cpp:
        (WebCore::ANGLEWebKitBridge::ANGLEWebKitBridge):
        (WebCore::ANGLEWebKitBridge::validateShaderSource):
        * platform/graphics/ANGLEWebKitBridge.h:
        (ANGLEWebKitBridge):
        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        (WebCore::GraphicsContext3D::GraphicsContext3D):

2012-06-26  Philip Rogers  <pdr@google.com>

        Fix bug where animations failed to start
        https://bugs.webkit.org/show_bug.cgi?id=89943

        Reviewed by Nikolas Zimmermann.

        The unpause code previously checked that the animations had not started
        before un-setting the pause state. This meant that if an animation was
        paused and unpaused before the animations started, it would remain in the
        paused state. This patch simply reorders the unpause logic to fix this bug.

        Test: svg/custom/animate-initial-pause-unpause.html

        * svg/animation/SMILTimeContainer.cpp:
        (WebCore::SMILTimeContainer::resume):

2012-06-26  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: popover is not shown for detached DOM nodes, not referenced directly from JS
        https://bugs.webkit.org/show_bug.cgi?id=89955

        Reviewed by Vsevolod Vlasov.

        Show object popover for all heap snapshot nodes event for those whose
        canBeQueried flag is false. We didn't show popover for such objects before
        as it could lead to the backend crash. In the meantime the backend shouldn't
        fail on such DOM wrappers and report an error if it cannot resolve
        inspected object.

        * inspector/front-end/HeapSnapshotGridNodes.js:
        (WebInspector.HeapSnapshotGenericObjectNode):
        (WebInspector.HeapSnapshotGenericObjectNode.prototype.get data):
        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapSnapshotView.prototype._getHoverAnchor):

2012-06-26  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] Simplify SharedBuffer::createWithContentsOfFile() implementation
        https://bugs.webkit.org/show_bug.cgi?id=89655

        Reviewed by Csaba Osztrogonác.

        Simplify the implementation of SharedBuffer::createWithContentsOfFile()
        in EFL port.

        No new test, no behavior change.

        * platform/efl/SharedBufferEfl.cpp:
        (WebCore::SharedBuffer::createWithContentsOfFile):

2012-06-26  Thiago Marcos P. Santos  <thiago.santos@intel.com>

        [EFL] REGRESSION (r121163): fast/frames/iframe-access-screen-of-deleted.html crashes
        https://bugs.webkit.org/show_bug.cgi?id=89964

        Reviewed by Andreas Kling.

        Added missing null pointer check.

        * platform/efl/PlatformScreenEfl.cpp:
        (WebCore::screenDepth):
        (WebCore::screenDepthPerComponent):

2012-06-26  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Add requestMetadata command and metadataReceived event to FileSystem
        https://bugs.webkit.org/show_bug.cgi?id=87856

        Reviewed by Yury Semikhatsky.

        Test: http/tests/inspector/filesystem/get-metadata.html

        * inspector/Inspector.json:
        * inspector/InspectorFileSystemAgent.cpp:
        (WebCore):
        (WebCore::InspectorFileSystemAgent::requestFileSystemRoot):
        (WebCore::InspectorFileSystemAgent::requestDirectoryContent):
        (WebCore::InspectorFileSystemAgent::requestMetadata):
        * inspector/InspectorFileSystemAgent.h:
        (InspectorFileSystemAgent):
        * inspector/front-end/FileSystemModel.js:
        (WebInspector.FileSystemModel.prototype._directoryContentReceived):
        (WebInspector.FileSystemModel.prototype.requestMetadata):
        (WebInspector.FileSystemModel.Entry.prototype.get isDirectory):
        (WebInspector.FileSystemModel.Entry.prototype.requestMetadata):
        (WebInspector.FileSystemRequestManager):
        (WebInspector.FileSystemRequestManager.prototype._directoryContentReceived):
        (WebInspector.FileSystemRequestManager.prototype.requestMetadata.requestAccepted):
        (WebInspector.FileSystemRequestManager.prototype.requestMetadata):
        (WebInspector.FileSystemRequestManager.prototype._metadataReceived):
        (WebInspector.FileSystemDispatcher.prototype.directoryContentReceived):
        (WebInspector.FileSystemDispatcher.prototype.metadataReceived):

2012-06-25  Jocelyn Turcotte  <turcotte.j@gmail.com>

        [Qt] GraphicsSurface: Fix tile update artifacts on Mac
        https://bugs.webkit.org/show_bug.cgi?id=89887

        Reviewed by Noam Rosenthal.

        * platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp:
        (WebCore::GraphicsSurface::platformCopyToGLTexture):

2012-06-25  Jocelyn Turcotte  <turcotte.j@gmail.com>

        GraphicsSurface: Fix IOSurfaceLock failures on Intel video cards.
        https://bugs.webkit.org/show_bug.cgi?id=89883

        Reviewed by Noam Rosenthal.

        Follow the documentation which says: "If locking the buffer requires a readback,
        the lock will fail with an error return of kIOReturnCannotLock."
        Also make sure that we use the same set of flags when locking and unlocking
        for simplicity and to follow this requirement on the kIOSurfaceLockReadOnly flag.

        * platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp:
        (WebCore::GraphicsSurface::platformLock):
        (WebCore::GraphicsSurface::platformUnlock):

2012-06-26  Philip Rogers  <pdr@google.com>

        Fix setCurrentTime for paused animations
        https://bugs.webkit.org/show_bug.cgi?id=81350

        Reviewed by Nikolas Zimmermann.

        SMILTimeContainer::setElapsed was not resetting the pause time, breaking
        setCurrentTime if the animation was paused.

        Test: svg/custom/animate-pause-resume.html

        * svg/animation/SMILTimeContainer.cpp:
        (WebCore::SMILTimeContainer::setElapsed):

2012-06-26  Csaba Osztrogonác  <ossy@webkit.org>

        [Qt] Unreviewed typo fix after r121144.

        * Target.pri:

2012-06-26  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: columns in heap snapshot summary view are not resizable
        https://bugs.webkit.org/show_bug.cgi?id=89952

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/HeapSnapshotDataGrids.js:
        (WebInspector.HeapSnapshotViewportDataGrid.prototype.onResize): overriden method
        should call overriden one to make sure column resizers are added to the DataGrid.

2012-06-26  Kent Tamura  <tkent@chromium.org>

        Refactoring: Simplify FormController interface
        https://bugs.webkit.org/show_bug.cgi?id=89951

        Reviewed by Kentaro Hara.

        - Remove FormController::hasStateForNewFormElements()
          takeStateForFormElement() can check the emptiness, and return an empty
          FormControlState.

        - Change the argument of takeStateForFormElement()
          Passing just one HTMLFormControlElementWithState object instead of two
          AtomicStringImpl. This is a preparation to use
          HTMLFormControlElementWithState::form() in FormController.

        No new tests. Just a refactoring.

        * html/FormController.cpp:
        (WebCore::FormController::takeStateForFormElement):
        * html/FormController.h:
        (FormController):
        * html/HTMLFormControlElementWithState.cpp:
        (WebCore::HTMLFormControlElementWithState::finishParsingChildren):

2012-06-26  Dominic Cooney  <dominicc@chromium.org>

        WheelEvent should inherit from MouseEvent
        https://bugs.webkit.org/show_bug.cgi?id=76104

        Reviewed by Kentaro Hara.

        The spec for WheelEvent is
        <http://www.w3.org/TR/DOM-Level-3-Events/#webidl-events-WheelEvent>

        Tests: fast/events/event-creation.html
               http://samples.msdn.microsoft.com/ietestcenter/dominheritance/showdominheritancetest.htm?Prototype_WheelEvent

        * bindings/objc/PublicDOMInterfaces.h: Remove redundant MouseEvent API from WheelEvent
        * bindings/scripts/CodeGeneratorObjC.pm: MouseEvents are Events
        * dom/MouseEvent.h: Expose no-arg constructor to WheelEvent
        * dom/WheelEvent.cpp:
        (WebCore::WheelEvent::WheelEvent): Call MouseEvent superconstructor
        (WebCore::WheelEvent::isMouseEvent): Existing callers use this just for
        moves and clicks, ie the type is exactly MouseEvent.
        * dom/WheelEvent.h: Extend MouseEvent
        * dom/WheelEvent.idl: "

2012-06-25  Ryosuke Niwa  <rniwa@webkit.org>

        Get rid of firstItem and nextItem from HTMLCollection
        https://bugs.webkit.org/show_bug.cgi?id=89923

        Reviewed by Andreas Kling.

        Removed HTMLCollection::firstItem and HTMLCollection::nextItem.
        Also added hasAnyItem() and hasExactlyOneItem() to HTMLCollection so that named getter on Document
        doesn't need to compute the full length before returning a HTMLCollection.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::getDocumentLinks):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::namedItemGetter):
        * bindings/js/JSHTMLDocumentCustom.cpp:
        (WebCore::JSHTMLDocument::nameGetter):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::V8DOMWindow::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::V8HTMLDocument::GetNamedProperty):
        * dom/Document.cpp:
        (WebCore::Document::openSearchDescriptionURL):
        * html/HTMLCollection.cpp:
        (WebCore::shouldIncludeChildren):
        (WebCore::HTMLCollection::HTMLCollection):
        (WebCore):
        (WebCore::HTMLCollection::item):
        * html/HTMLCollection.h:
        (HTMLCollection):
        (WebCore::HTMLCollection::hasAnyItem):
        (WebCore::HTMLCollection::hasExactlyOneItem):
        * html/HTMLMapElement.cpp:
        (WebCore::HTMLMapElement::imageElement):

2012-06-25  Pratik Solanki  <psolanki@apple.com>

        JavaScript resources have low priority when SVG is enabled
        https://bugs.webkit.org/show_bug.cgi?id=89932
        <rdar://problem/11741325>

        Reviewed by Adele Peterson.

        r108785 inadvertently lowered the priority of JavaScript resources. Fix the code so we set
        the correct priority for scripts. Also, move the code so that all ifdefs are together at the
        bottom to make it a bit easier to read..

        * loader/cache/CachedResource.cpp:
        (WebCore::defaultPriorityForResourceType):

2012-06-25  Luke Macpherson  <macpherson@chromium.org>

        Add runtime flag to enable/disable CSS variables (in addition to existing compile-time flag).
        https://bugs.webkit.org/show_bug.cgi?id=89542

        Reviewed by Dimitri Glazkov.

        Added fast/css/variables/build-supports-variables.html to test runtime flag in test environment.
        Updated all other css variables tests to enable the runtime flag from JS.

        * css/CSSParser.cpp:
        (WebCore::CSSParserContext::CSSParserContext):
        (WebCore::operator==):
        (WebCore::CSSParser::cssVariablesEnabled):
        (WebCore):
        (WebCore::CSSParser::detectDashToken):
        (WebCore::CSSParser::lex):
        * css/CSSParser.h:
        (CSSParser):
        * css/CSSParserMode.h:
        (CSSParserContext):
        * page/Settings.h:
        (Settings):
        (WebCore::Settings::setCSSVariablesEnabled):
        (WebCore::Settings::cssVariablesEnabled):

2012-06-25  Simon Hausmann  <simon.hausmann@nokia.com>

        Unreviewed build fix after r121223.

        Fix the --minimal Qt build, TextureMapperGL now requires WebGL to be enabled.

        * Target.pri:
        * WebCore.pri:

2012-06-25  Dana Jansens  <danakj@chromium.org>

        [chromium] CCOverdrawMetrics should use the deviceViewportSize to count actual pixels
        https://bugs.webkit.org/show_bug.cgi?id=89922

        Reviewed by Adrienne Walker.

        * platform/graphics/chromium/cc/CCOverdrawMetrics.cpp:
        (WebCore::CCOverdrawMetrics::recordMetricsInternal):

2012-06-25  Huang Dongsung  <luxtella@company100.net>

        [Texmap] Remove platform specific code in BitmapImageGL::updateContents by using
        GraphicsContext3D::extractImageData.
        https://bugs.webkit.org/show_bug.cgi?id=89867

        Reviewed by Noam Rosenthal.

        No new tests. Covered by existing tests.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore):
        (WebCore::BitmapTextureGL::didReset):
        (WebCore::BitmapTextureGL::updateContents):

2012-06-25  James Robinson  <jamesr@chromium.org>

        [chromium] Remove uncalled ManagedTexture::framebufferTexture2D
        https://bugs.webkit.org/show_bug.cgi?id=89930

        Reviewed by Adrienne Walker.

        Removing dead code.

        * platform/graphics/chromium/ManagedTexture.cpp:
        * platform/graphics/chromium/ManagedTexture.h:
        (ManagedTexture):

2012-06-25  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r121206.
        http://trac.webkit.org/changeset/121206
        https://bugs.webkit.org/show_bug.cgi?id=89935

        [chromium] webkit_unit_tests
        WebViewTest.MHTMLWithMissingResourceFinishesLoading crash
        (Requested by ukai on #webkit).

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::scheduleArchiveLoad):

2012-06-25  Anantanarayanan G Iyengar  <ananta@chromium.org>

        [chromium] Ensure that the compositor code which is aware of flipped status of video-textures
        per platform executes on Windows.
        https://bugs.webkit.org/show_bug.cgi?id=89914
        
        Reviewed by James Robinson.

        No new tests. (HW video decode is still only being tested manually for orientation)

        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::appendQuads):

2012-06-25  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r121176.
        http://trac.webkit.org/changeset/121176
        https://bugs.webkit.org/show_bug.cgi?id=89934

        [chromium] browser_tests assert failed:
        FATAL:native_theme_win.cc(1541)] Check failed: false. Invalid
        part: 16 (Requested by ukai on #webkit).

        * platform/chromium/PlatformSupport.h:
        (PlatformSupport):
        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
        (WebCore::ScrollbarThemeChromiumWin::buttonSize):

2012-06-25  Shinya Kawanaka  <shinyak@chromium.org>

        [Shadow] Deleting list distributed to Shadow DOM does not work correctly.
        https://bugs.webkit.org/show_bug.cgi?id=89170

        Reviewed by Ryosuke Niwa.

        When deleting several elements distributed to Shadow DOM, some renderers might be gone in
        processing deletion. To fix them, we should call isContentEditable() instead of rendererIsEditable().

        Test: editing/shadow/delete-list-in-shadow.html

        * editing/DeleteFromTextNodeCommand.cpp:
        (WebCore::DeleteFromTextNodeCommand::doApply):

2012-06-25  Min Qin  <qinmin@chromium.org>

        [Chromium] Fix the css stylesheet for android media controls after recent changes
        https://bugs.webkit.org/show_bug.cgi?id=89910

        Reviewed by Adam Barth.

        After the recent changes on upstream chrome video controls, we need to change the css style sheet for chrome on android.
        No tests needed, just css changes.

        * css/mediaControlsChromiumAndroid.css:
        (audio):
        (audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel):
        (::-webkit-media-controls):
        (audio::-webkit-media-controls-enclosure, video::-webkit-media-controls-enclosure):
        (video::-webkit-media-controls-enclosure):
        (audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button):
        (audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button):
        (audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display):
        (audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline):
        (video::-webkit-media-controls-fullscreen-button):
        (input[type="range"]::-webkit-media-slider-container):
        (input[type="range"]::-webkit-media-slider-thumb):
        (audio::-webkit-media-controls-fullscreen-button):

2012-06-25  Huang Dongsung  <luxtella@company100.net>

        [Qt] Avoid a deep copy of QImage in GraphicsContext3D::getImageData.
        https://bugs.webkit.org/show_bug.cgi?id=89865

        Reviewed by Noam Rosenthal.

        No new tests. Covered by existing tests.

        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        (WebCore::GraphicsContext3D::getImageData):

2012-06-25  Nick Carter  <nick@chromium.org>

        Reduce memory footprint of BitmapImage Vectors.
        https://bugs.webkit.org/show_bug.cgi?id=86563

        Reviewed by Simon Fraser.

        No new tests, affects template params only.

        * platform/graphics/BitmapImage.h:
        (BitmapImage): use an inline capacity of 1 for the image frame Vector 
        * platform/image-decoders/ImageDecoder.h:
        (ImageDecoder): use an inline capacity of 1 for the image frame Vector

2012-06-25  Kent Tamura  <tkent@chromium.org>

        Unreviewed, rolling out r121145.
        http://trac.webkit.org/changeset/121145
        https://bugs.webkit.org/show_bug.cgi?id=89847

        Had an objection for the change.

        * html/FormController.cpp:
        (WebCore):
        (WebCore::FormControlState::serializeTo):
        (WebCore::FormControlState::deserialize):
        (WebCore::formStateSignature):
        (WebCore::FormController::formElementsState):
        (WebCore::FormController::setStateForNewFormElements):
        * html/FormController.h:
        (FormControlState):
        * html/shadow/CalendarPickerElement.cpp:
        (WebCore::addJavaScriptString):

2012-06-25  Jay Civelli  <jcivelli@chromium.org>

        Fix progress load reporting for MHTML documents.

        MHTML documents containing references to resources they don't include
        never finish loading.
        https://bugs.webkit.org/show_bug.cgi?id=71859

        Reviewed by Nate Chapin.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::scheduleArchiveLoad):

2012-06-25  James Robinson  <jamesr@chromium.org>

        [chromium] Use WebGraphicsContext3D in compositor implementation
        https://bugs.webkit.org/show_bug.cgi?id=89700

        Reviewed by Adrienne Walker.

        This converts the compositor implementation from using WebCore::GraphicsContext3D to using the Platform-provided
        WebGraphicsContext3D. This removes several unnecessary layers of indirection/wrapping and cuts down the
        compositor's implementation dependencies. GraphicsContext3D.h is still widely used to provide GL enum values.
        Most of the changes are purely mechanical - changing type names and the like.

        Ownership is changed a bit. Instead of multiple components holding references to the compositor's context, the
        context is now owned by the CCGraphicsContext, which is now owned directly by CCLayerTreeHostImpl.
        CCLayerTreeHostImpl also has ownership of its CCRenderer (LayerRendererChromium in 3D mode) and passes a
        non-owning pointer down to the CCRenderer.

        Extension checking is a bit different. The compositor does not (and never has) used extensions provided by
        WebGL's request/ensure mechanism. It simply checks for the existence of extensions it needs in the GL_EXTENSIONS
        string.

        FrameBufferSkPictureCanvasLayerTextureUpdater had to be patched as well, since it was grabbing a GrContext off
        of the compositor's GraphicsContext3D. This caused many problems. It was inefficient, since it required a full
        state flush when switching between ganesh and compositor calls. The gpu memory management was completely broken
        since the compositor clobbered ganesh's onMemoryAllocationChanged callback. This moves FBSkPCLTU over to using
        the appropriate SharedGraphicsContext3D, like filters.

        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::Texture::updateRect):
        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h:
        (FrameBufferSkPictureCanvasLayerTextureUpdater):
        * platform/graphics/chromium/GeometryBinding.cpp:
        (WebCore::GeometryBinding::GeometryBinding):
        * platform/graphics/chromium/GeometryBinding.h:
        (WebKit):
        (GeometryBinding):
        (WebCore::GeometryBinding::context):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::create):
        (WebCore::LayerRendererChromium::LayerRendererChromium):
        (WebCore::LayerRendererChromium::initialize):
        (WebCore::LayerRendererChromium::~LayerRendererChromium):
        (WebCore::LayerRendererChromium::context):
        (WebCore::LayerRendererChromium::debugGLCall):
        (WebCore::LayerRendererChromium::setVisible):
        (WebCore::LayerRendererChromium::drawStreamVideoQuad):
        (WebCore::LayerRendererChromium::drawHeadsUpDisplay):
        (WebCore::LayerRendererChromium::swapBuffers):
        (WebCore::LayerRendererChromium::onMemoryAllocationChanged):
        (WebCore):
        (WebCore::LayerRendererChromium::onMemoryAllocationChangedOnImplThread):
        (WebCore::LayerRendererChromium::discardFramebuffer):
        (WebCore::LayerRendererChromium::ensureFramebuffer):
        (WebCore::LayerRendererChromium::onContextLost):
        (WebCore::LayerRendererChromium::getFramebufferPixels):
        (WebCore::LayerRendererChromium::getFramebufferTexture):
        (WebCore::LayerRendererChromium::bindFramebufferToTexture):
        (WebCore::LayerRendererChromium::initializeSharedObjects):
        (WebCore::LayerRendererChromium::tileCheckerboardProgram):
        (WebCore::LayerRendererChromium::solidColorProgram):
        (WebCore::LayerRendererChromium::headsUpDisplayProgram):
        (WebCore::LayerRendererChromium::renderPassProgram):
        (WebCore::LayerRendererChromium::renderPassProgramAA):
        (WebCore::LayerRendererChromium::renderPassMaskProgram):
        (WebCore::LayerRendererChromium::renderPassMaskProgramAA):
        (WebCore::LayerRendererChromium::tileProgram):
        (WebCore::LayerRendererChromium::tileProgramOpaque):
        (WebCore::LayerRendererChromium::tileProgramAA):
        (WebCore::LayerRendererChromium::tileProgramSwizzle):
        (WebCore::LayerRendererChromium::tileProgramSwizzleOpaque):
        (WebCore::LayerRendererChromium::tileProgramSwizzleAA):
        (WebCore::LayerRendererChromium::textureProgram):
        (WebCore::LayerRendererChromium::textureProgramFlip):
        (WebCore::LayerRendererChromium::textureIOSurfaceProgram):
        (WebCore::LayerRendererChromium::videoYUVProgram):
        (WebCore::LayerRendererChromium::videoStreamTextureProgram):
        (WebCore::LayerRendererChromium::cleanupSharedObjects):
        (WebCore::LayerRendererChromium::isContextLost):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (WebKit):
        (WebCore):
        (LayerRendererChromium):
        (WebCore::LayerRendererChromium::isFramebufferDiscarded):
        * platform/graphics/chromium/LayerTextureSubImage.cpp:
        (WebCore::LayerTextureSubImage::uploadWithTexSubImage):
        (WebCore::LayerTextureSubImage::uploadWithMapTexSubImage):
        * platform/graphics/chromium/ManagedTexture.cpp:
        (WebCore::ManagedTexture::bindTexture):
        (WebCore::ManagedTexture::framebufferTexture2D):
        * platform/graphics/chromium/PlatformColor.h:
        (WebCore::PlatformColor::bestTextureFormat):
        * platform/graphics/chromium/ProgramBinding.cpp:
        (WebCore::contextLost):
        (WebCore::ProgramBindingBase::init):
        (WebCore::ProgramBindingBase::cleanup):
        (WebCore::ProgramBindingBase::loadShader):
        (WebCore::ProgramBindingBase::createShaderProgram):
        * platform/graphics/chromium/ProgramBinding.h:
        (WebKit):
        (ProgramBindingBase):
        (WebCore::ProgramBinding::ProgramBinding):
        (WebCore::ProgramBinding::initialize):
        * platform/graphics/chromium/ShaderChromium.cpp:
        (WebCore::VertexShaderPosTex::init):
        (WebCore::VertexShaderPosTexYUVStretch::init):
        (WebCore::VertexShaderPos::init):
        (WebCore::VertexShaderPosTexTransform::init):
        (WebCore::VertexShaderQuad::init):
        (WebCore::VertexShaderTile::init):
        (WebCore::VertexShaderVideoTransform::init):
        (WebCore::FragmentTexAlphaBinding::init):
        (WebCore::FragmentTexOpaqueBinding::init):
        (WebCore::FragmentShaderOESImageExternal::init):
        (WebCore::FragmentShaderRGBATexAlphaAA::init):
        (WebCore::FragmentTexClampAlphaAABinding::init):
        (WebCore::FragmentShaderRGBATexAlphaMask::init):
        (WebCore::FragmentShaderRGBATexAlphaMaskAA::init):
        (WebCore::FragmentShaderYUVVideo::init):
        (WebCore::FragmentShaderColor::init):
        (WebCore::FragmentShaderCheckerboard::init):
        * platform/graphics/chromium/ShaderChromium.h:
        (WebKit):
        (VertexShaderPosTex):
        (VertexShaderPosTexYUVStretch):
        (VertexShaderPos):
        (WebCore::VertexShaderPosTexIdentity::init):
        (VertexShaderPosTexTransform):
        (VertexShaderQuad):
        (VertexShaderTile):
        (VertexShaderVideoTransform):
        (FragmentTexAlphaBinding):
        (FragmentTexOpaqueBinding):
        (FragmentShaderOESImageExternal):
        (FragmentShaderRGBATexAlphaAA):
        (FragmentTexClampAlphaAABinding):
        (FragmentShaderRGBATexAlphaMask):
        (FragmentShaderRGBATexAlphaMaskAA):
        (FragmentShaderYUVVideo):
        (FragmentShaderColor):
        (FragmentShaderCheckerboard):
        * platform/graphics/chromium/TextureCopier.cpp:
        (WebCore::AcceleratedTextureCopier::AcceleratedTextureCopier):
        (WebCore::AcceleratedTextureCopier::~AcceleratedTextureCopier):
        (WebCore::AcceleratedTextureCopier::copyTexture):
        * platform/graphics/chromium/TextureCopier.h:
        (WebKit):
        (WebCore):
        (WebCore::AcceleratedTextureCopier::create):
        (AcceleratedTextureCopier):
        * platform/graphics/chromium/TextureManager.h:
        * platform/graphics/chromium/ThrottledTextureUploader.cpp:
        (WebCore::ThrottledTextureUploader::Query::Query):
        (WebCore::ThrottledTextureUploader::Query::~Query):
        (WebCore::ThrottledTextureUploader::Query::begin):
        (WebCore::ThrottledTextureUploader::Query::end):
        (WebCore::ThrottledTextureUploader::Query::isPending):
        (WebCore::ThrottledTextureUploader::Query::wait):
        (WebCore::ThrottledTextureUploader::ThrottledTextureUploader):
        * platform/graphics/chromium/ThrottledTextureUploader.h:
        (WebKit):
        (WebCore::ThrottledTextureUploader::create):
        (WebCore::ThrottledTextureUploader::Query::create):
        (Query):
        (ThrottledTextureUploader):
        * platform/graphics/chromium/TrackingTextureAllocator.cpp:
        (WebCore::TrackingTextureAllocator::TrackingTextureAllocator):
        (WebCore::TrackingTextureAllocator::createTexture):
        (WebCore::TrackingTextureAllocator::deleteTexture):
        (WebCore::TrackingTextureAllocator::deleteAllTextures):
        * platform/graphics/chromium/TrackingTextureAllocator.h:
        (WebKit):
        (WebCore::TrackingTextureAllocator::create):
        (TrackingTextureAllocator):
        * platform/graphics/chromium/cc/CCGraphicsContext.h:
        (CCGraphicsContext):
        (WebCore::CCGraphicsContext::create2D):
        (WebCore::CCGraphicsContext::create3D):
        (WebCore::CCGraphicsContext::context3D):
        (WebCore::CCGraphicsContext::CCGraphicsContext):
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
        (WebCore::CCHeadsUpDisplay::draw):
        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
        (WebCore::CCIOSurfaceLayerImpl::~CCIOSurfaceLayerImpl):
        (WebCore::CCIOSurfaceLayerImpl::willDraw):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::createContext):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHostClient):
        (WebCore::LayerRendererCapabilities::LayerRendererCapabilities):
        (LayerRendererCapabilities):
        (WebCore::CCLayerTreeHost::needsSharedContext):
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::initializeContext):
        (WebCore::CCSingleThreadProxy::recreateContext):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:
        (WebCore::CCTextureUpdater::update):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::initializeContext):
        (WebCore::CCThreadProxy::recreateContext):
        (WebCore::CCThreadProxy::beginFrame):
        (WebCore::CCThreadProxy::initializeContextOnImplThread):
        (WebCore::CCThreadProxy::recreateContextOnImplThread):
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (CCThreadProxy):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::FramePlane::allocateData):
        (WebCore::CCVideoLayerImpl::FramePlane::freeData):
        (WebCore::CCVideoLayerImpl::copyPlaneData):

2012-06-25  Adrienne Walker  <enne@google.com>

        [chromium] Make CCThreadProxy not draw a frame mid-commit
        https://bugs.webkit.org/show_bug.cgi?id=89905

        Reviewed by James Robinson.

        If commitComplete is not called before the next frame goes up, then
        then the max scroll position on the root scroll layer is not updated.
        This causes the compositor-side scrollbar to have an incorrect
        visibleSize, causing the thumbRect to become stretched, relative to
        when it was originally painted.

        CCScheduler::setVisible has the side effect of kicking off a frame, so
        move it last.

        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::scheduledActionCommit):

2012-06-25  Pablo Flouret  <pablof@motorola.com>

        EventSource: Events should not be dispatched after close()
        https://bugs.webkit.org/show_bug.cgi?id=85346

        Reviewed by Adam Barth.

        Spec changed to make sure that no events are dispatched after close() is
        called, even if more data was received before the call to close().

        See,
        https://www.w3.org/Bugs/Public/show_bug.cgi?id=14331#c5
        http://html5.org/tools/web-apps-tracker?from=6771&to=6772

        Firefox behaves like this already.

        Test: http/tests/eventsource/eventsource-events-after-close.html

        * page/EventSource.cpp:
        (WebCore::EventSource::parseEventStream):

2012-06-25  Mike West  <mkwst@chromium.com>

        Fixing compilation failure in StyleResolver.cpp/CSSParser.cpp
        https://bugs.webkit.org/show_bug.cgi?id=89892

        Reviewed by Alexis Menard.

        Adding CSSPropertyVariable to switch statements in CSSParser and
        StyleResolver to fix compilation errors under ninja/clang. I've
        added both as new cases to the switches, with FIXME comments for
        implementation.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-06-25  Jay Civelli  <jcivelli@chromium.org>

        Fix for a memory leak with MHTMLArchives.

        MHTML files present a flat list of frames and resources but the WebKit Archive
        has a tree strcture. So the MHTMLArchive class make sures that every frame
        knows about any other frames and resources.
        Because these objects are ref counted, that would introduce circular references
        preventing the entire Archive from being deleted.
        This fixes this by:
        - making sure the top-frame (which appears as the first entry in the MHTML) is
          not referenced by the other frames.
        - when the main frame is deleted it traverse the entire subarchive (sub-frames)
          graph and makes sure they clear all their references to other subarchives.

        https://bugs.webkit.org/show_bug.cgi?id=88470

        Reviewed by Adam Barth.

        * loader/archive/Archive.cpp:
        (WebCore::Archive::clearAllSubframeArchives):
        (WebCore):
        (WebCore::Archive::clearAllSubframeArchivesImpl):
        * loader/archive/Archive.h:
        (Archive):
        * loader/archive/mhtml/MHTMLArchive.cpp:
        (WebCore::MHTMLArchive::~MHTMLArchive):
        (WebCore):
        (WebCore::MHTMLArchive::create):
        * loader/archive/mhtml/MHTMLArchive.h:
        (MHTMLArchive):

2012-06-25  Alpha Lam  <hclam@chromium.org>

        Unreviewed, rolling out r121178.
        http://trac.webkit.org/changeset/121178
        https://bugs.webkit.org/show_bug.cgi?id=89784

        New unit test added is failing on WebKit Linux (dbg)

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::setBounds):

2012-06-25  Alpha Lam  <hclam@chromium.org>

        Unreviewed, rolling out r121137.
        http://trac.webkit.org/changeset/121137

        Chromium build fix, (un)touch files to build on Chromium Win
        Release

        * css/CSSParserMode.h:
        * css/CSSValue.h:
        (WebCore):
        * css/CSSVariableValue.h:
        * page/Settings.h:
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleRareInheritedData.h:
        * rendering/style/StyleVariableData.h:

2012-06-25  Alpha Lam  <hclam@chromium.org>

        Unreviewed, rolling out r121129.
        http://trac.webkit.org/changeset/121129
        https://bugs.webkit.org/show_bug.cgi?id=89542

        Chromium ASan failure: crbug.com/134402

        * css/CSSParser.cpp:
        (WebCore::CSSParserContext::CSSParserContext):
        (WebCore::operator==):
        (WebCore):
        (WebCore::CSSParser::detectDashToken):
        (WebCore::CSSParser::lex):
        * css/CSSParser.h:
        (CSSParser):
        * css/CSSParserMode.h:
        (CSSParserContext):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * page/Settings.h:
        (Settings):
        * testing/InternalSettings.cpp:
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-06-25  Adam Barth  <abarth@webkit.org>

        Use InterpolationLow on chromium-android
        https://bugs.webkit.org/show_bug.cgi?id=89849

        Reviewed by Daniel Bates.

        Min Qin writes:

          Using InterpolationHigh is very very expensive when resampling
          images.  For example, it took 1400ms to decode an image on
          http://www.crossfitsunnyvale.com/blog/, but it took 2800 ms to do the
          resampling Switch to InterpolationLow will result in linear
          resampling. It is much faster as the time it tooks is almost
          non-noticable [sic] on the trace.

        * platform/graphics/skia/PlatformContextSkia.cpp:
        (WebCore::PlatformContextSkia::State::State):

2012-06-25  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Remove unused backend property accessors
        https://bugs.webkit.org/show_bug.cgi?id=89893

        Reviewed by Darin Fisher.

        Following the "metadata" API addition in trac.webkit.org/changeset/121059
        the IDBXXXBackendInterface types no longer need per-property accessors.

        No new tests - no functional changes.

        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp: Remove method implementation.
        * Modules/indexeddb/IDBDatabaseBackendImpl.h: Remove methods.
        (IDBDatabaseBackendImpl):
        * Modules/indexeddb/IDBDatabaseBackendInterface.h: Remove methods.
        (IDBDatabaseBackendInterface):
        * Modules/indexeddb/IDBIndexBackendImpl.h: Make methods simple accessors.
        (IDBIndexBackendImpl):
        (WebCore::IDBIndexBackendImpl::name):
        (WebCore::IDBIndexBackendImpl::keyPath):
        (WebCore::IDBIndexBackendImpl::unique):
        (WebCore::IDBIndexBackendImpl::multiEntry):
        * Modules/indexeddb/IDBIndexBackendInterface.h: Remove methods.
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp: Remove method implementation.
        * Modules/indexeddb/IDBObjectStoreBackendImpl.h: Make methods simple accessors.
        (IDBObjectStoreBackendImpl):
        (WebCore::IDBObjectStoreBackendImpl::name):
        (WebCore::IDBObjectStoreBackendImpl::keyPath):
        (WebCore::IDBObjectStoreBackendImpl::autoIncrement):
        * Modules/indexeddb/IDBObjectStoreBackendInterface.h: Remove methods.

2012-06-25  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>

        [EFL] Add support for building with ENABLE_MEDIA_STREAM
        https://bugs.webkit.org/show_bug.cgi?id=88413

        Reviewed by Dirk Pranke.

        Add files which are needed for supporting the Media Stream
        feature.

        No change in functionality so no new tests.

        * PlatformEfl.cmake:

2012-06-25  Huang Dongsung  <luxtella@company100.net>

        [Texmap] TextureMapperPaintOptions should keep current surface.
        https://bugs.webkit.org/show_bug.cgi?id=89266

        Before this patch, if a replica layer has a descendant replica child, the child
        layer does not render the result in the parent layer's surface because
        TextureMapperPaintOptions does not keep current surface.
        This patch amends that TextureMapperPaintOptions keeps current surface before
        calling paintSelfAndChildrenWithReplica recursively, so previous surface could be
        restored after paintSelfAndChildrenWithReplica.

        Reviewed by Noam Rosenthal.

        Test: compositing/reflections/animation-inside-reflection.html

        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::paintRecursive):

2012-06-25  Ian Vollick  <vollick@chromium.org>

        [chromium] Layer chromium should need a redraw after getting its first non-empty bounds.
        https://bugs.webkit.org/show_bug.cgi?id=89784

        Reviewed by James Robinson.

        Previously, we'd only set needs redraw if the old bounds were zero,
        and the new bounds were non-zero, but we should actually have 
        checked that the old bounds were non-empty.

        Unit test: LayerChromiumTestWithoutFixture.setBoundsTriggersSetNeedsRedrawAfterGettingNonEmptyBounds

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::setBounds):

2012-06-25  Scott Graham  <scottmg@chromium.org>

        Plumb Scrollbar button dimensions down to WebThemeEngine
        https://bugs.webkit.org/show_bug.cgi?id=89264

        Reviewed by James Robinson.

        Rather than making the height of the scrollbar buttons the same as the
        width of the scrollbar, delegate to the WebThemeEngine. This allows
        matching the Aura theme rather than the standard Windows theme.

        No new tests, as bounds are overridden for DRT.

        * platform/chromium/PlatformSupport.h:
        (PlatformSupport):
        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
        (WebCore::ScrollbarThemeChromiumWin::buttonSize):

2012-06-25  Antti Koivisto  <antti@apple.com>

        Fast path for simple transform parsing
        https://bugs.webkit.org/show_bug.cgi?id=89898

        Reviewed by Anders Carlsson.

        When manipulating transforms using script, the transform value parsing can show up in profiles pretty heavily 
        (up 4% in some cases). We can optimize it easily by implementing a fast path that does not spin up the full CSS
        parser, like we already do for several other common value types.
        
        The patch implements a fast path for transform(), transformX/Y/Z() and transform3D(). It speeds up parsing by >5x.

        * css/CSSParser.cpp:
        (WebCore):
        (WebCore::parseTransformArguments):
        (WebCore::parseTransformValue):
        (WebCore::CSSParser::parseValue):

2012-06-25  Kwang Yul Seo  <skyul@company100.net>

        Remove unused static function shadowFor
        https://bugs.webkit.org/show_bug.cgi?id=89824

        Reviewed by Daniel Bates.

        shadowFor is not used anymore after r117796. No behaviour changes.

        * dom/TreeScopeAdopter.cpp:

2012-06-25  Kwang Yul Seo  <skyul@company100.net>

        Remove unused constant timeWithoutMouseMovementBeforeHidingControls
        https://bugs.webkit.org/show_bug.cgi?id=89823

        Reviewed by Daniel Bates.

        After r87692, timeWithoutMouseMovementBeforeHidingControls is not used anymore.

        * html/HTMLMediaElement.cpp:
        (WebCore):

2012-06-25  Zeev Lieber  <zlieber@chromium.org>

        [Chromium] RenderPass textures are evicted at the end of every frame
        https://bugs.webkit.org/show_bug.cgi?id=89786

        Reviewed by Adrienne Walker.

        Removed calls to TextureManager::reduceMemoryToLimit inside
        finishDrawingFrame() method.

        Added unit tests to verify new behavior.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::finishDrawingFrame):

2012-06-25  Allan Xavier  <allan.xavier@undefinedltd.co.uk>

        [GTK] Add graphviz debug output for the gstreamer video pipeline.
        https://bugs.webkit.org/show_bug.cgi?id=89660

        Reviewed by Martin Robinson.

        Dump the current video pipeline as a graphviz DOT file when the
        pipeline state changes or when an error occours.

        No new tests as the change is only useful for debugging.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::handleMessage):

2012-06-25  Adam Barth  <abarth@webkit.org>

        ASSERT(m_wheelEventHandlerCount > 0) can fire
        https://bugs.webkit.org/show_bug.cgi?id=89856

        Reviewed by Eric Seidel.

        When a node with a wheel or a touch event is moved from one document to
        another, the didAddMumble/didRemoveMumble calls do not balance because
        they're called on different documents. This patch twiddles the counts
        appropriately in that case.

        Test: fast/events/move-element-with-wheel-and-touch-event-listeners.html

        * dom/EventNames.h:
        (WebCore::EventNames::isTouchEventType):
        (EventNames):
        (WebCore::EventNames::touchEventNames):
        * dom/Node.cpp:
        (WebCore::Node::didMoveToNewDocument):

2012-06-25  Eric Seidel  <eric@webkit.org>

        Split map* functions out of StyleResolver into a helper object
        https://bugs.webkit.org/show_bug.cgi?id=89881

        Reviewed by Daniel Bates.

        These map* functions are completely independent of the rest of StyleResolver
        and only exist to serve StyleBuilder.
        CSSToStyleMap doesn't even want to have a StyleResolver pointer, but
        currently needs one to access the resolve-lifetime caches for the
        current resolve.  Once we split out that per-resolve state into
        some sort of ResolveState/ResolveInfo object (akin to PaintInfo/LayoutState)
        then this object will be even simpler.

        No behavioral change, thus no tests.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSToStyleMap.cpp: Added.
        (WebCore):
        (WebCore::CSSToStyleMap::style):
        (WebCore::CSSToStyleMap::rootElementStyle):
        (WebCore::CSSToStyleMap::useSVGZoomRules):
        (WebCore::CSSToStyleMap::styleImage):
        (WebCore::CSSToStyleMap::mapFillAttachment):
        (WebCore::CSSToStyleMap::mapFillClip):
        (WebCore::CSSToStyleMap::mapFillComposite):
        (WebCore::CSSToStyleMap::mapFillOrigin):
        (WebCore::CSSToStyleMap::mapFillImage):
        (WebCore::CSSToStyleMap::mapFillRepeatX):
        (WebCore::CSSToStyleMap::mapFillRepeatY):
        (WebCore::CSSToStyleMap::mapFillSize):
        (WebCore::CSSToStyleMap::mapFillXPosition):
        (WebCore::CSSToStyleMap::mapFillYPosition):
        (WebCore::CSSToStyleMap::mapAnimationDelay):
        (WebCore::CSSToStyleMap::mapAnimationDirection):
        (WebCore::CSSToStyleMap::mapAnimationDuration):
        (WebCore::CSSToStyleMap::mapAnimationFillMode):
        (WebCore::CSSToStyleMap::mapAnimationIterationCount):
        (WebCore::CSSToStyleMap::mapAnimationName):
        (WebCore::CSSToStyleMap::mapAnimationPlayState):
        (WebCore::CSSToStyleMap::mapAnimationProperty):
        (WebCore::CSSToStyleMap::mapAnimationTimingFunction):
        (WebCore::CSSToStyleMap::mapNinePieceImage):
        (WebCore::CSSToStyleMap::mapNinePieceImageSlice):
        (WebCore::CSSToStyleMap::mapNinePieceImageQuad):
        (WebCore::CSSToStyleMap::mapNinePieceImageRepeat):
        * css/CSSToStyleMap.h: Added.
        (WebCore):
        (CSSToStyleMap):
        (WebCore::CSSToStyleMap::CSSToStyleMap):
        * css/StyleBuilder.cpp:
        (WebCore::ApplyPropertyFillLayer::applyValue):
        (WebCore::ApplyPropertyBorderImage::applyValue):
        (WebCore::ApplyPropertyBorderImageModifier::applyValue):
        (WebCore):
        (WebCore::ApplyPropertyAnimation::map):
        (WebCore::StyleBuilder::StyleBuilder):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::StyleResolver):
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleResolver.h:
        (WebCore::StyleResolver::styleMap):
        (StyleResolver):

2012-06-25  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        [EFL] Support screenDepth() functionality.
        https://bugs.webkit.org/show_bug.cgi?id=89423

        Reviewed by Kenneth Rohde Christiansen.

        Support screenDepth() based on ecore_x_window_depth_get(). This functionality may be used by
        both WebKit1 and WebKit2. So, concrete function is placed into EflScreenUtilities.cpp.

        This patch can't support existing test cases. Because, EFL DumpRenderTree works without X11 window
        by default.

        * platform/efl/EflScreenUtilities.cpp:
        (WebCore::getPixelDepth):
        (WebCore):
        * platform/efl/EflScreenUtilities.h:
        (WebCore):
        * platform/efl/PlatformScreenEfl.cpp:
        (WebCore::screenDepth):
        (WebCore::screenDepthPerComponent):

2012-06-25  Shinya Kawanaka  <shinyak@chromium.org>

        [Shadow] Executing Italic and InsertUnorderedList in Shadow DOM causes a crash
        https://bugs.webkit.org/show_bug.cgi?id=88495

        Reviewed by Ryosuke Niwa.

        InsertionPoint::removedFrom(insertionPoint) tries to find its owner ElementShadow from
        parentNode or insertionPoint. If the parent node exsits but we cannot reach ElementShadow from
        the parent node, InsertionPoint::removedFrom does not try to find ElementShadow anymore.

        It's OK if the ElementShadow is being destructed, but there is a case ElementShadow is not being
        destructed in editing. In this case, we should try to find ElementShadow from insertionPoint.
        Otherwise it will bring inconsistency to Shadow DOM, and causes a crash.

        Actually checking the existence of parentNode() does not make any sense. We should get
        shadowRoot() directly.

        Test: editing/shadow/insertorderedlist-crash.html

        * html/shadow/InsertionPoint.cpp:
        (WebCore::InsertionPoint::removedFrom):

2012-06-25  Kinuko Yasuda  <kinuko@chromium.org>

        Remove responseBlob field from XMLHttpResponse.idl
        https://bugs.webkit.org/show_bug.cgi?id=89859

        Reviewed by Eric Seidel.

        Remove XMLHttpResponse.responseBlob from XMLHttpResponse.idl, which
        has only been exposed for a very limited time (since r120574) but
        probably should not have been done so since XHR2 spec no longer has
        the field.  A quick search also showed that no one seems to be using the field.

        (More context: the field was added long time ago with a runtime guard
        which had never been enabled until the guard was removed in r120574
        to remove XHR_RESPONSE_BLOB on all platforms.)

        No new tests as no tests use this field.

        * xml/XMLHttpRequest.idl: Removed responseBlob field.

2012-06-25  Huang Dongsung  <luxtella@company100.net>

        Add static qualifier to GraphicsContext3D::extractImageData.
        https://bugs.webkit.org/show_bug.cgi?id=89866

        GraphicsContext3D::extractImageData does not use member variables.
        Each platform Accelerated-compositing implementation can use this method in
        order to get pixel data of an Image or ImageBuffer object.

        Reviewed by Noam Rosenthal.

        No new tests since there's no change on code behavior.

        * platform/graphics/GraphicsContext3D.h:
        (GraphicsContext3D):

2012-06-25  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: toggling style should not start property edit first.
        https://bugs.webkit.org/show_bug.cgi?id=89834

        Reviewed by Yury Semikhatsky.

        Otherwise property flickers upon toggling.

        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylePropertyTreeElement.prototype):

2012-06-25  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: "Emulate Touch Events" breaks selecting elements with "touchstart" event listeners for inspection.
        https://bugs.webkit.org/show_bug.cgi?id=89861

        Reviewed by Vsevolod Vlasov.

        Upon a mousepress, Inspector should be queried for the "Inspect element" mode up-front,
        before dispatching a synthetic "touchstart" event.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMousePressEvent):

2012-06-25  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: [Styles] Cannot visually set caret before the first CSS property name character
        https://bugs.webkit.org/show_bug.cgi?id=89869

        Reviewed by Vsevolod Vlasov.

        The issue was due to the "editbox" SPAN having a negative margin, thus the leftmost caret position was getting clipped
        by a synthetic SPAN container added by the TextPrompt.

        * inspector/front-end/elementsPanel.css:
        (.styles-section .properties > li.child-editing .webkit-css-property):
        (.styles-section .properties li.child-editing):

2012-06-25  Arko Saha  <arko@motorola.com>

        Microdata: document.getItems(typeNames) is not returning Microdata items when typeNames argument is not specified.
        https://bugs.webkit.org/show_bug.cgi?id=89757

        Reviewed by Ryosuke Niwa.

        With r120979 change, it creates MicroDataItemList with m_typeNames = "http://webkit.org/microdata/undefinedItemType",
        when typeNames argument is not specified. Modified the check in nodeMatches() accordingly.

        This fixes the following failing tests :
            fast/dom/MicroData/002.html
            fast/dom/MicroData/003.html
            fast/dom/MicroData/007.html
            fast/dom/MicroData/009.html
            fast/dom/MicroData/properties-collection-must-see-the-properties-added-in-itemref.html

        * dom/Document.cpp:
        (WebCore::Document::getItems): Use undefinedItemType to avoid String conversion.
        * dom/MicroDataItemList.cpp:
        (WebCore::MicroDataItemList::undefinedItemType): It defines "http://webkit.org/microdata/undefinedItemType"
        string using DEFINE_STATIC_LOCAL to avoid String conversion.
        (WebCore::MicroDataItemList::MicroDataItemList): Use document() method of DynamicNodeList to obtain
        document of owner element.
        (WebCore::MicroDataItemList::~MicroDataItemList): Removed originalTypeNames null check.
        (WebCore::MicroDataItemList::nodeMatches): Return true if originalTypeNames is equal to undefinedItemType.
        * dom/MicroDataItemList.h:

2012-06-25  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix make distcheck.

        * GNUmakefile.list.am: Add missing header file.

2012-06-25  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] Fix Win32 debug build

        Reviewed by Tor Arne Vestbø.

        Consistently use use_all_in_one_files when requested in the configuration. The previous
        Linux condition has been moved to Tools/qmake/mkspecs/features/unix/default_pre.prf

        * Target.pri:

2012-06-25  Philip Rogers  <pdr@google.com>

        Fix rewinding of SVG animations
        https://bugs.webkit.org/show_bug.cgi?id=89846

        Reviewed by Nikolas Zimmermann.

        r116451 introduced an optimization to only clear non-freeze animations when
        calling setCurrentTime (via reset()). This causes fill=freeze animations to
        not clear which breaks rewinding of an animation.

        In the presence of multiple animations, we reset the first animation to the
        base value and accumulate all results into that; this masked the problem because
        2 animations were required to hit the bug (our tests primarily cover just 1).

        Test: svg/animations/animate-reset-freeze.html

        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::reset):

2012-06-25  Kent Tamura  <tkent@chromium.org>

        Change the serialization format of form control state to make the code simple
        https://bugs.webkit.org/show_bug.cgi?id=89847

        Reviewed by Hajime Morita.

        We used multiple strings to represent state of single form control. It
        made the code complex. We change the serialization format so that one
        CSV string represents state.

        Examples in the old format:
            "0"
            "1", "value"
            "3", "value1", "value2,value2", "value3"

        Examples in the new format:
            ""
            ",value"
            ",value1,value2\,value2,value3"

        Test: fast/forms/state-restore-various-values.html

        * html/FormController.cpp:
        (WebCore::FormControlState::serialize):
        Generate comma-separated string.
        ',' in a value is serialized as "\,".
        We changed the signature because we don't need the out-argument.
        (WebCore::FormControlState::deserialize):
        Parses the input comma-separated string.
        We changed the signature because we don't need multiple input strings.
        (formStateSignature):
        Bump up the version because of the representation change.
        (WebCore::FormController::formElementsState):
        The new serialized format occupies just one string for one control.
        - Expected size is now 3n+1.
        - Use FormControlState::serialize().
        (WebCore::FormController::setStateForNewFormElements):
        The new serialized format occupies just one string for one control.
        So we can check the vector size before the iteration.
        * html/FormController.h:
        (FormControlState): Change the function signatures.

        * html/shadow/CalendarPickerElement.cpp:
        (WebCore::addJavaScriptString): Use StringBuilder::appendEscaped().

2012-06-22  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add external resources size to the native memory diagram
        https://bugs.webkit.org/show_bug.cgi?id=89754

        Reviewed by Vsevolod Vlasov.

        Size of external strings and arrays is now reported through the inspector
        protocol and displayed on the native memory chart.

        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/ScriptProfiler.h:
        (WebCore):
        (WebCore::ScriptProfiler::visitJSDOMWrappers):
        (WebCore::ScriptProfiler::visitExternalJSStrings):
        (WebCore::ScriptProfiler::visitExternalJSArrays):
        * bindings/v8/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::visitJSDOMWrappers):
        (WebCore::ScriptProfiler::visitExternalJSStrings):
        (WebCore::ScriptProfiler::visitExternalJSArrays):
        (WebCore):
        * bindings/v8/ScriptProfiler.h:
        (WebCore):
        (ScriptProfiler):
        * bindings/v8/V8Binding.cpp:
        (WebCore::WebCoreStringResource::visitStrings):
        (WebCore::V8BindingPerIsolateData::visitJSExternalStrings):
        * bindings/v8/V8Binding.h:
        (WebCore):
        (V8BindingPerIsolateData):
        * inspector/BindingVisitors.h: Renamed from Source/WebCore/inspector/DOMWrapperVisitor.h.
        (WTF):
        (WebCore):
        (NodeWrapperVisitor):
        (WebCore::NodeWrapperVisitor::~NodeWrapperVisitor):
        (ExternalStringVisitor):
        (WebCore::ExternalStringVisitor::~ExternalStringVisitor):
        (ExternalArrayVisitor):
        (WebCore::ExternalArrayVisitor::~ExternalArrayVisitor):
        * inspector/InspectorMemoryAgent.cpp:
        (MemoryBlockName):
        (WebCore):
        (WebCore::jsExternalResourcesInfo):
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.MemoryBlockViewProperties._initialize):

2012-06-24  Fumitoshi Ukai  <ukai@chromium.org>

        Unreviewed compile error fix of Chromium Win Release.
        Touch header files for ENABLE(CSS_VARIABLES) so that
        it forces to rebuild files by changing ENABLE(CSS_VARIABLES)
        in Sources/WebKit/chromium/features.gypi at r121129

        * css/CSSParserMode.h:
        * css/CSSValue.h:
        (WebCore):
        * css/CSSVariableValue.h:
        * page/Settings.h:
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleRareInheritedData.h:
        * rendering/style/StyleVariableData.h:

2012-06-24  Simon Hausmann  <simon.hausmann@nokia.com>

        [Texmap] Minor cleanup for TextureMapper::accelerationMode()
        https://bugs.webkit.org/show_bug.cgi?id=89825

        Reviewed by Kenneth Rohde Christiansen.

        Replace the virtual method with a simple member variable.

        * platform/graphics/texmap/TextureMapper.h:
        (WebCore::TextureMapper::accelerationMode):
        (WebCore::TextureMapper::TextureMapper):
        (TextureMapper):
        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::TextureMapperGL):
        * platform/graphics/texmap/TextureMapperGL.h:
        * platform/graphics/texmap/TextureMapperImageBuffer.h:
        (WebCore::TextureMapperImageBuffer::TextureMapperImageBuffer):

2012-06-24  Mike Lawther  <mikelawther@chromium.org>

        CSS3 calc: transitions starting and ending with a calc expression move to end state
        https://bugs.webkit.org/show_bug.cgi?id=89738

        Reviewed by Tony Chang.

        The equality operator for CalculationValue was not working as expected. The 
        equality operator for OwnPtr is private, as OwnPtrs should always be different.
        The OwnPtrs ended up getting cast to bool before being compared, and the 
        comparison was always returning true.

        The comparison between OwnPtrs has been removed. It doesn't add value to compare
        the raw pointers either, since OwnPtrs should always be unique. We cannot
        ASSERT the uniqueness though, as it is legitimate to compare a CalculationValue
        to itself.

        Test: css3/calc/transition-start-end-with-calc.html

        * platform/CalculationValue.h:
        (WebCore::CalculationValue::operator==):

2012-06-24  MORITA Hajime  <morrita@google.com>

        NodeRenderingContext::AttachingPhase is redundant.
        https://bugs.webkit.org/show_bug.cgi?id=79220

        Reviewed by Dimitri Glazkov.

        This change removes NodeRenderingContext::AttachingPhase and
        NodeRenderingContext::m_phase respectively. The state originally
        represented as m_phase is naturally encoded into other member variables.

        NodeRenderingContext::m_visualParentShadow is also replaced, with
        a local variable parentScope.

        Basically, what NodeRenderingContext wants to know is the parent of
        the composed shadow tree and an optional insertion point where the
        node is distributed. Once these becomes clear, m_phase is no longer required.
        It was rather a historical artifact.

        No new tests. No behavioral change.

        * dom/NodeRenderingContext.cpp: Replaced m_phase with implicit states.
        (WebCore::NodeRenderingContext::NodeRenderingContext):
        (WebCore::NodeRenderingContext::nextRenderer):
        (WebCore::NodeRenderingContext::previousRenderer):
        (WebCore::NodeRenderingContext::parentRenderer):
        (WebCore::NodeRenderingContext::shouldCreateRenderer):
        (WebCore::NodeRenderingContext::isOnEncapsulationBoundary):
        (WebCore::NodeRenderingContext::isOnUpperEncapsulationBoundary):
        * dom/NodeRenderingContext.h:
        (NodeRenderingContext):
        (WebCore::NodeRenderingContext::parentNodeForRenderingAndStyle): Removed an assert which checks m_phase.
        (WebCore::NodeRenderingContext::resetStyleInheritance): Removed an assert which checks m_phase.
        * html/shadow/InsertionPoint.h:
        (WebCore::isInsertionPoint): Fix null case check.
        (WebCore::isLowerEncapsulationBoundary): Renamed from isShadowBoundary()

2012-06-24  Antti Koivisto  <antti@apple.com>

        REGRESSION(r121124): LayoutTests/fast/block/inline-children-root-linebox-crash.html asserts
        https://bugs.webkit.org/show_bug.cgi?id=89844
        
        Reviewed by Dan Bernstein.

        We need to check for the flipped writing mode and take the slow path if it is used.

        * rendering/RenderGeometryMap.cpp:
        (WebCore::RenderGeometryMap::pushMappingsToAncestor):

2012-06-24  Luke Macpherson  <macpherson@chromium.org>

        Add runtime flag to enable/disable CSS variables (in addition to existing compile-time flag).
        https://bugs.webkit.org/show_bug.cgi?id=89542

        Reviewed by Dimitri Glazkov.

        Added fast/css/variables/build-supports-variables.html to test runtime flag in test environment.
        Updated all other css variables tests to enable the runtime flag from JS.

        * css/CSSParser.cpp:
        (WebCore::CSSParserContext::CSSParserContext):
        (WebCore::operator==):
        (WebCore::CSSParser::cssVariablesEnabled):
        (WebCore):
        (WebCore::CSSParser::detectDashToken):
        (WebCore::CSSParser::lex):
        * css/CSSParser.h:
        (CSSParser):
        * css/CSSParserMode.h:
        (CSSParserContext):
        * page/Settings.h:
        (Settings):
        (WebCore::Settings::setCSSVariablesEnabled):
        (WebCore::Settings::cssVariablesEnabled):

2012-06-22  Kent Tamura  <tkent@chromium.org>

        Selected option is not restored correctly
        https://bugs.webkit.org/show_bug.cgi?id=89623

        Reviewed by Hajime Morita.

        Details of the bug:
        We saved a state of a <select> element as a string of which length was
        the size of <select>'s children. e.g. If a <select> had five children
        and the second and the fifth items were selected, the state string was:
                ".X..X"

        This didn't work well if the structure of the children was updated after
        parsing. For example,
        1. A page has the following <select> initially:
          <select multiple>
            <option>Banana
            <option>Lemon
            <option>Orange
            <option>Strawberry
          <select>

        2. For some reasons, <option>Apple</option> is prepended to the children.
        3. Some items are selected.
        4. The page is unloaded. Selection state is saved.
        5. A user go back to the page again. A browser parses the page again.
        6. Try to restore the <select> state with the saved data at 4.
          But "Apple" is missing. The <select> has wrong selections.

        Solution:
        We save the state as a set of selected values. If "Banana" and
        "Strawberry" are selected in the above <select>, we save two strings;
        "Banana" and "Strawberry", not ".X..X".

        Test: fast/forms/select/select-state-restore.html

        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::saveFormControlState):
        Store selected value strings to a FormControlState object.
        (WebCore::HTMLSelectElement::searchOptionsForValue):
        A helper function to find an <option> with the specified value.
        (WebCore::HTMLSelectElement::restoreFormControlState):
        Clear all of selections, then select options with saved values.
        In order to avoid O(M x N) loop, we start searching at position we found
        the previous value.
        * html/HTMLSelectElement.h: Declare searchOptionsForValue.
        * html/FormController.cpp:
        (formStateSignature): Bump up the version because this is a incompatible
        change.

2012-06-24  David Barr  <davidbarr@chromium.org>

        Add snap to css3-images image-resolution
        https://bugs.webkit.org/show_bug.cgi?id=89745

        Reviewed by Tony Chang.

        Due to floating point imprecision, it is difficult to be precise in dpcm.
        So use PrimitiveValue::roundForImpreciseConversion rather than just floor.

        No new tests; extended fast/css/image-resolution/image-resolution.html

        * css/CSSParser.cpp: Accept snap identifier in image-resolution property.
        (WebCore::CSSParser::parseImageResolution): Map CSSValueSnap to identifier value from cssValuePool.
        * css/CSSValueKeywords.in: Add snap.
        * css/StyleBuilder.cpp: Extend ApplyPropertyImageResolution to apply RenderStyle::imageResolutionSnap.
        (WebCore::ApplyPropertyImageResolution::applyInheritValue): Apply RenderStyle::imageResolutionSnap.
        (WebCore::ApplyPropertyImageResolution::applyInitialValue): Apply RenderStyle::imageResolutionSnap.
        (WebCore::ApplyPropertyImageResolution::applyValue): Map CSSValueSnap to ImageResolutionSnapPixels.
        * rendering/RenderImage.cpp: Extend conditions for recalculation of intrinsic size.
        (WebCore::RenderImage::styleDidChange): Update intrinsic size if RenderStyle::imageResolutionSnap() has changed.
        (WebCore::RenderImage::imageDimensionsChanged): Floor scale factor to int, round up if less than 0.01 away from ceiling.
        * rendering/style/RenderStyle.cpp: Include StyleRareInheritedData::m_imageResolutionSnap in style diff.
        (WebCore::RenderStyle::diff): Map change in StyleRareInheritedData::m_imageResolutionSnap to StyleDifferenceLayout.
        * rendering/style/RenderStyle.h: Add RenderStyle::imageResolutionSnap, RenderStyle::setImageResolutionSnap, RenderStyle::initialImageResolutionSnap.
        * rendering/style/RenderStyleConstants.h: Add enum ImageResolutionSnap.
        * rendering/style/StyleRareInheritedData.cpp: Add StyleRareInheritedData::m_imageResolutionSnap.
        (WebCore::StyleRareInheritedData::StyleRareInheritedData): Add m_imageResolutionSnap to default and copy constructor.
        (WebCore::StyleRareInheritedData::operator==): Include m_imageResolutionSnap in comparison.
        * rendering/style/StyleRareInheritedData.h: Add StyleRareInheritedData::m_imageResolutionSnap.
        (StyleRareInheritedData): Add 1-bit field StyleRareInheritedData::m_imageResolutionSnap.

2012-06-24  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r121106.
        http://trac.webkit.org/changeset/121106
        https://bugs.webkit.org/show_bug.cgi?id=89841

        Caused 85% performance regressions on Dromaeo/jslib-modify-
        jquery.html (Requested by rniwa on #webkit).

        * dom/Document.cpp:
        (WebCore::Document::clearNodeListCaches):
        * dom/Document.h:
        (Document):
        * dom/DynamicNodeList.cpp:
        (WebCore::DynamicSubtreeNodeList::~DynamicSubtreeNodeList):
        * dom/DynamicNodeList.h:
        (WebCore::DynamicSubtreeNodeList::DynamicSubtreeNodeList):
        * dom/Node.cpp:
        (WebCore::Node::clearRareData):
        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged):
        (WebCore::Node::invalidateNodeListsCacheAfterChildrenChanged):
        (WebCore::Node::getElementsByTagName):
        (WebCore::Node::getElementsByTagNameNS):
        (WebCore::Node::getElementsByName):
        (WebCore::Node::getElementsByClassName):
        (WebCore::Node::radioNodeList):
        (WebCore::NodeListsNodeData::invalidateCaches):
        (WebCore):
        (WebCore::NodeRareData::createNodeLists):
        * dom/NodeRareData.h:
        (NodeListsNodeData):
        (WebCore::NodeListsNodeData::adoptTreeScope):
        (WebCore::NodeRareData::ensureNodeLists):
        (NodeRareData):
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::TreeScope):
        * dom/TreeScope.h:
        (WebCore::TreeScope::addNodeListCache):
        (WebCore::TreeScope::removeNodeListCache):
        (WebCore::TreeScope::hasNodeListCaches):
        (TreeScope):
        * dom/TreeScopeAdopter.cpp:
        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
        * html/LabelableElement.cpp:
        (WebCore::LabelableElement::labels):
        * html/LabelsNodeList.cpp:
        (WebCore::LabelsNodeList::LabelsNodeList):
        (WebCore::LabelsNodeList::~LabelsNodeList):
        * html/RadioNodeList.cpp:
        (WebCore::RadioNodeList::RadioNodeList):
        (WebCore::RadioNodeList::~RadioNodeList):

2012-06-24  Adam Barth  <abarth@webkit.org>

        Change the type of the second argument of FrameSelection::revealSelection to use RevealExtentOption
        https://bugs.webkit.org/show_bug.cgi?id=89833

        Reviewed by Ryosuke Niwa.

        As requested by Ryosuke Niwa.  Rare boolean parameters are hard to read.

        * WebCore.exp.in:
        * editing/Editor.cpp:
        (WebCore::Editor::revealSelectionAfterEditingOperation):
        * editing/Editor.h:
        (Editor):
        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::setSelection):
        (WebCore::FrameSelection::revealSelection):
        * editing/FrameSelection.h:

2012-06-24  Antti Koivisto  <antti@apple.com>

        Optimize RenderGeometryMap mappings gathering
        https://bugs.webkit.org/show_bug.cgi?id=89828

        Reviewed by Simon Fraser.

        RenderGeometryMap currently gathers mappings by climbing the rendering tree. This is slow and can produce 
        large number of mapping steps. In the common case we already have the child layer coordinates available in
        the layer tree and we can just use that.
        
        The combination of faster mappings gathering and fewer number of applying steps reduces time spent under 
        RenderLayerCompositor::computeCompositingRequirements to less than half when scrolling the mobile version
        of twitter.com.
        
        * rendering/RenderGeometryMap.cpp:
        (WebCore):
        (WebCore::RenderGeometryMap::pushMappingsToAncestor):
        
            Use pre-computed mapping from the layer tree when possible.

        (WebCore::RenderGeometryMap::popMappingsToAncestor):
        * rendering/RenderGeometryMap.h:
        
            Add some inline capacity.

        (WebCore):
        (RenderGeometryMap):
        * rendering/RenderLayer.h:
        (WebCore::RenderLayer::canUseConvertToLayerCoords):
        (RenderLayer):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::addToOverlapMapRecursive):
        (WebCore::RenderLayerCompositor::computeCompositingRequirements):

2012-06-24  Simon Fraser  <simon.fraser@apple.com>

        Rename isPositioned to isOutOfFlowPositioned for clarity
        https://bugs.webkit.org/show_bug.cgi?id=89836

        Reviewed by Antti Koivisto.
        
        RenderObject and RenderStyle had an isPositioned() method that was
        confusing, because it excluded relative positioning. Rename to 
        isOutOfFlowPositioned(), which makes it clearer that it only applies
        to absolute and fixed positioning.

        Simple rename; no behavior change.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::getPositionOffsetValue):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * dom/Text.cpp:
        (WebCore::Text::rendererIsNeeded):
        * editing/DeleteButtonController.cpp:
        (WebCore::isDeletableElement):
        * editing/TextIterator.cpp:
        (WebCore::shouldEmitNewlinesBeforeAndAfterNode):
        * rendering/AutoTableLayout.cpp:
        (WebCore::shouldScaleColumns):
        * rendering/InlineFlowBox.cpp:
        (WebCore::InlineFlowBox::addToLine):
        (WebCore::InlineFlowBox::placeBoxesInInlineDirection):
        (WebCore::InlineFlowBox::requiresIdeographicBaseline):
        (WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
        (WebCore::InlineFlowBox::flipLinesInBlockDirection):
        (WebCore::InlineFlowBox::computeOverflow):
        (WebCore::InlineFlowBox::computeOverAnnotationAdjustment):
        (WebCore::InlineFlowBox::computeUnderAnnotationAdjustment):
        * rendering/InlineIterator.h:
        (WebCore::isIteratorTarget):
        * rendering/LayoutState.cpp:
        (WebCore::LayoutState::LayoutState):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::MarginInfo::MarginInfo):
        (WebCore::RenderBlock::styleWillChange):
        (WebCore::RenderBlock::styleDidChange):
        (WebCore::RenderBlock::addChildToContinuation):
        (WebCore::RenderBlock::addChildToAnonymousColumnBlocks):
        (WebCore::RenderBlock::containingColumnsBlock):
        (WebCore::RenderBlock::columnsBlockForSpanningElement):
        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):
        (WebCore::getInlineRun):
        (WebCore::RenderBlock::isSelfCollapsingBlock):
        (WebCore::RenderBlock::layoutBlock):
        (WebCore::RenderBlock::addOverflowFromBlockChildren):
        (WebCore::RenderBlock::expandsToEncloseOverhangingFloats):
        (WebCore::RenderBlock::handlePositionedChild):
        (WebCore::RenderBlock::moveRunInUnderSiblingBlockIfNeeded):
        (WebCore::RenderBlock::collapseMargins):
        (WebCore::RenderBlock::clearFloatsIfNeeded):
        (WebCore::RenderBlock::simplifiedNormalFlowLayout):
        (WebCore::RenderBlock::isSelectionRoot):
        (WebCore::RenderBlock::blockSelectionGaps):
        (WebCore::RenderBlock::clearFloats):
        (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):
        (WebCore::RenderBlock::markSiblingsWithFloatsForLayout):
        (WebCore::isChildHitTestCandidate):
        (WebCore::InlineMinMaxIterator::next):
        (WebCore::RenderBlock::computeBlockPreferredLogicalWidths):
        (WebCore::RenderBlock::firstLineBoxBaseline):
        (WebCore::RenderBlock::lastLineBoxBaseline):
        (WebCore::RenderBlock::updateFirstLetter):
        (WebCore::shouldCheckLines):
        (WebCore::getHeightForLineCount):
        (WebCore::RenderBlock::adjustForBorderFit):
        (WebCore::inNormalFlow):
        (WebCore::RenderBlock::adjustLinePositionForPagination):
        (WebCore::RenderBlock::adjustBlockChildForPagination):
        (WebCore::RenderBlock::renderName):
        * rendering/RenderBlock.h:
        (WebCore::RenderBlock::shouldSkipCreatingRunsForObject):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::setMarginsForRubyRun):
        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
        (WebCore::RenderBlock::computeBlockDirectionPositionsForLine):
        (WebCore::RenderBlock::layoutInlineChildren):
        (WebCore::requiresLineBox):
        (WebCore::RenderBlock::LineBreaker::skipTrailingWhitespace):
        (WebCore::RenderBlock::LineBreaker::skipLeadingWhitespace):
        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
        (WebCore::RenderBox::styleWillChange):
        (WebCore::RenderBox::styleDidChange):
        (WebCore::RenderBox::updateBoxModelInfoFromStyle):
        (WebCore::RenderBox::offsetFromContainer):
        (WebCore::RenderBox::positionLineBox):
        (WebCore::RenderBox::computeRectForRepaint):
        (WebCore::RenderBox::computeLogicalWidthInRegion):
        (WebCore::RenderBox::renderBoxRegionInfo):
        (WebCore::RenderBox::computeLogicalHeight):
        (WebCore::RenderBox::computePercentageLogicalHeight):
        (WebCore::RenderBox::computeReplacedLogicalWidthUsing):
        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
        (WebCore::RenderBox::availableLogicalHeightUsing):
        (WebCore::percentageLogicalHeightIsResolvable):
        * rendering/RenderBox.h:
        (WebCore::RenderBox::stretchesToViewport):
        (WebCore::RenderBox::isDeprecatedFlexItem):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::adjustedPositionRelativeToOffsetParent):
        (WebCore::RenderBoxModelObject::mapAbsoluteToLocalPoint):
        * rendering/RenderBoxModelObject.h:
        (WebCore::RenderBoxModelObject::requiresLayer):
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::childDoesNotAffectWidthOrFlexing):
        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
        (WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox):
        (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox):
        (WebCore::RenderDeprecatedFlexibleBox::renderName):
        * rendering/RenderFieldset.cpp:
        (WebCore::RenderFieldset::findLegend):
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::computePreferredLogicalWidths):
        (WebCore::RenderFlexibleBox::autoMarginOffsetInMainAxis):
        (WebCore::RenderFlexibleBox::availableAlignmentSpaceForChild):
        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes):
        (WebCore::RenderFlexibleBox::computeNextFlexLine):
        (WebCore::RenderFlexibleBox::resolveFlexibleLengths):
        (WebCore::RenderFlexibleBox::prepareChildForPositionedLayout):
        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
        (WebCore::RenderFlexibleBox::layoutColumnReverse):
        (WebCore::RenderFlexibleBox::adjustAlignmentForChild):
        (WebCore::RenderFlexibleBox::flipForRightToLeftColumn):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::renderName):
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::computeIntrinsicRatioInformation):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::addChildIgnoringContinuation):
        (WebCore::RenderInline::addChildToContinuation):
        (WebCore::RenderInline::generateCulledLineBoxRects):
        (WebCore):
        (WebCore::RenderInline::culledInlineFirstLineBox):
        (WebCore::RenderInline::culledInlineLastLineBox):
        (WebCore::RenderInline::culledInlineVisualOverflowBoundingBox):
        (WebCore::RenderInline::computeRectForRepaint):
        (WebCore::RenderInline::dirtyLineBoxes):
        * rendering/RenderLayer.cpp:
        (WebCore::checkContainingBlockChainForPagination):
        (WebCore::RenderLayer::updateLayerPosition):
        (WebCore::isPositionedContainer):
        (WebCore::RenderLayer::calculateClipRects):
        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::requiresCompositingForPosition):
        * rendering/RenderLineBoxList.cpp:
        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
        * rendering/RenderListItem.cpp:
        (WebCore::getParentOfFirstLineBox):
        * rendering/RenderMultiColumnBlock.cpp:
        (WebCore::RenderMultiColumnBlock::renderName):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::markContainingBlocksForLayout):
        (WebCore::RenderObject::setPreferredLogicalWidthsDirty):
        (WebCore::RenderObject::invalidateContainerPreferredLogicalWidths):
        (WebCore::RenderObject::styleWillChange):
        (WebCore::RenderObject::offsetParent):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::isOutOfFlowPositioned):
        (WebCore::RenderObject::isInFlowPositioned):
        (WebCore::RenderObject::hasClip):
        (WebCore::RenderObject::isFloatingOrOutOfFlowPositioned):
        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::removeChildNode):
        * rendering/RenderReplaced.cpp:
        (WebCore::hasAutoHeightOrContainingBlockWithAutoHeight):
        * rendering/RenderRubyRun.cpp:
        (WebCore::RenderRubyRun::rubyText):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::addChild):
        (WebCore::RenderTable::computeLogicalWidth):
        (WebCore::RenderTable::layout):
        * rendering/style/RenderStyle.h:

2012-06-24  Oli Lan  <olilan@chromium.org>

        After Editor::setComposition is called, input should scroll to the end of the composition.
        https://bugs.webkit.org/show_bug.cgi?id=88999

        Reviewed by Ryosuke Niwa.

        This fixes an issue where after a call to setComposition, the start of the composition is revealed
        (scrolled to) instead of the end (where the caret/editing point should be).

        The change is to allow revealSelectionAfterEditingOperation to take a revealExtent parameter,
        and to pass that parameter as true when calling from setIgnoreCompositionSelectionChange, which is
        called at the end of setComposition.

        Test: fast/forms/input-set-composition-scroll.html

        * editing/Editor.cpp:
        (WebCore::Editor::revealSelectionAfterEditingOperation):
        (WebCore::Editor::setIgnoreCompositionSelectionChange):
        * editing/Editor.h:
        (Editor):

2012-06-24  Joshua Bell  <jsbell@chromium.org>

        Web Inspector: Simplify InspectorIndexedDBAgent to use IDB metadata API
        https://bugs.webkit.org/show_bug.cgi?id=89495

        Reviewed by Vsevolod Vlasov.

        No new tests - no functional changes.

        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore):

2012-06-24  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: speed up Timeline and Elements panel rendering
        https://bugs.webkit.org/show_bug.cgi?id=89771

        Reviewed by Yury Semikhatsky.

        I used timeline panel to find unnecessary style operations.

        * inspector/front-end/ElementsTreeOutline.js:
        (WebInspector.ElementsTreeElement.prototype.updateTitle):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype._updateEventDividers):
        (WebInspector.TimelinePanel.prototype._updateFrames):
        (WebInspector.TimelinePanel.prototype.sidebarResized):
        (WebInspector.TimelinePanel.prototype.onResize):
        (WebInspector.TimelinePanel.prototype._onScroll):
        (WebInspector.TimelinePanel.prototype._refresh):
        (WebInspector.TimelinePanel.prototype._refreshRecords):
        (WebInspector.TimelinePanel.prototype._adjustScrollPosition):

2012-06-23  Ryosuke Niwa  <rniwa@webkit.org>

        Inserting nodes is slow due to Node::notifyNodeListsAttributeChanged (20%+)
        https://bugs.webkit.org/show_bug.cgi?id=73853

        Reviewed by Anders Carlsson and Ojan Vafai.

        Invalidate all node lists at document level to avoid having to walk up the DOM tree in the invalidation.
        In particular, this makes appending node O(1) with respect to the depth of the tree in common cases when
        we have node lists somewhere in the tree scope.

        We now invalidate more node lists than we used to but it shouldn't matter much in practice because
        most websites don't add or remove nodes or modify relevant attributes while iterating through node lists.
        The change would also register each node list to document thereby consuming one extra pointer, however,
        this should not have a significant memory impact given we used to do it unintentionally until I fixed it in
        r110797 three months ago.

        Also, RadioNodeList and LabelsNodeList had always been invalidated at document level so this refactoring
        also allows us to move calls to registerDynamicSubtreeNodeList and unregisterDynamicSubtreeNodeList in
        those node lists to DynamicSubtreeNodeList, and even delete NodeListsNodeData::invalidateCaches().

        In addition, removed m_numNodeListCaches from TreeScope since it was only used to avoid walking up
        the ancestors in invalidateNodeListsCacheAfterAttributeChanged and invalidateNodeListsCacheAfterChildrenChanged
        but we don't walk up the ancestors any more. Also note that m_listsInvalidatedAtDocument tells us exactly
        how many node lists are present for each document.

        * dom/Document.cpp:
        (WebCore::Document::clearNodeListCaches): Optionally takes a qualified attribute name so that we don't
        have to invalidate tag node lists when only attributes are modified.
        * dom/Document.h:
        (Document):
        * dom/DynamicNodeList.cpp:
        (WebCore::DynamicSubtreeNodeList::~DynamicSubtreeNodeList): Calls unregisterDynamicSubtreeNodeList.
        * dom/DynamicNodeList.h:
        (WebCore::DynamicSubtreeNodeList::DynamicSubtreeNodeList): Calls registerDynamicSubtreeNodeList.
        * dom/Node.cpp:
        (WebCore::Node::clearRareData):
        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged): No longer walks up the tree to invalidate
        node list caches. All invalidations are done in Document::clearNodeListCaches.
        (WebCore::Node::invalidateNodeListsCacheAfterChildrenChanged): Ditto.
        (WebCore::Node::getElementsByTagName):
        (WebCore::Node::getElementsByTagNameNS):
        (WebCore::Node::getElementsByName):
        (WebCore::Node::getElementsByClassName):
        (WebCore::Node::radioNodeList):
        (WebCore):
        (WebCore::NodeRareData::createNodeLists):
        * dom/NodeRareData.h:
        (NodeListsNodeData):
        (WebCore::NodeListsNodeData::adoptTreeScope): Invalidate node list caches while registering and
        unregistering node lists from old and new documents respectively now that invalidateCaches() has been
        (WebCore::NodeRareData::ensureNodeLists):
        (NodeRareData):
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::TreeScope):
        * dom/TreeScope.h:
        (TreeScope):
        * dom/TreeScopeAdopter.cpp:
        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
        * html/LabelableElement.cpp:
        (WebCore::LabelableElement::labels):
        * html/LabelsNodeList.cpp:
        (WebCore::LabelsNodeList::LabelsNodeList):
        (WebCore::LabelsNodeList::~LabelsNodeList):
        * html/RadioNodeList.cpp:
        (WebCore::RadioNodeList::RadioNodeList):
        (WebCore::RadioNodeList::~RadioNodeList):

2012-06-23  Ryosuke Niwa  <rniwa@webkit.org>

        Clang and cl.exe build fix after r121103. Don't inherit from WTF::PairHash<unsigned char, StringType>.

        * dom/NodeRareData.h:

2012-06-23  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r120979): getElementsByTagName is 12% slower
        https://bugs.webkit.org/show_bug.cgi?id=89783

        Reviewed by Darin Adler.

        The problem is that hashing std::pair<unsigned short, AtomicString> is very slow compared to just hashing AtomicString,
        which internally holds a hash already. Fixed the regression by replacing the default hash function by the one that
        computes AtomicString's hash + list type. This is okay because we only have 7 node list types at the moment.

        * dom/NodeRareData.h:
        (NodeListsNodeData):
        (WebCore::NodeListsNodeData::NodeListCacheMapEntryHash::hash):
        (NodeListCacheMapEntryHash):
        (WebCore::NodeListsNodeData::NodeListCacheMapEntryHash::equal):
        (WebCore::NodeListsNodeData::namedNodeListKey):

2012-06-23  Dan Bernstein  <mitz@apple.com>

        RenderText’s minimum preferred width is incorrect automatic hyphenation is used
        https://bugs.webkit.org/show_bug.cgi?id=89814

        Reviewed by Sam Weinig.

        Test: fast/text/hyphen-min-preferred-width.html

        * rendering/RenderText.cpp:
        (WebCore::maxWordFragmentWidth): Added this helper function. It returns the width of the
        widest hyphenated fragment of the word (except for the suffix after the last hyphen) and
        the offset of the last hyphenation opportunity.
        (WebCore::RenderText::computePreferredLogicalWidths): Changed this function to consider the
        widths of hyphenated word fragments rather than entire words when computing the minimum
        width. Because hyphenating and measuring all fragments is expensive, hyphenation is only
        attempted if the unhyphenated word is wider than the current minimum width.

2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r121058.
        http://trac.webkit.org/changeset/121058
        https://bugs.webkit.org/show_bug.cgi?id=89809

        Patch causes plugins tests to crash in GTK debug builds
        (Requested by zdobersek on #webkit).

        * bindings/js/GCController.cpp:
        (WebCore::collect):
        (WebCore::GCController::garbageCollectSoon):
        (WebCore::GCController::garbageCollectNow):
        (WebCore::GCController::discardAllCompiledCode):
        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
        (WebCore::JSSQLStatementErrorCallback::handleEvent):
        * bindings/js/JSCustomVoidCallback.cpp:
        (WebCore::JSCustomVoidCallback::handleEvent):
        * bindings/js/JSCustomXPathNSResolver.cpp:
        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
        * bindings/js/JSErrorHandler.cpp:
        (WebCore::JSErrorHandler::handleEvent):
        * bindings/js/JSEventCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSEventListener.cpp:
        (WebCore::JSEventListener::handleEvent):
        * bindings/js/JSInjectedScriptHostCustom.cpp:
        (WebCore::InjectedScriptHost::nodeAsScriptValue):
        (WebCore::JSInjectedScriptHost::inspectedObject):
        * bindings/js/JSInjectedScriptManager.cpp:
        (WebCore::InjectedScriptManager::createInjectedScript):
        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
        * bindings/js/JSLazyEventListener.cpp:
        (WebCore::JSLazyEventListener::initializeJSFunction):
        * bindings/js/JSMainThreadExecState.h:
        (WebCore::JSMainThreadExecState::evaluate):
        * bindings/js/JSMutationCallbackCustom.cpp:
        (WebCore::JSMutationCallback::handleEvent):
        * bindings/js/JSNodeFilterCondition.cpp:
        (WebCore::JSNodeFilterCondition::acceptNode):
        * bindings/js/JSRequestAnimationFrameCallbackCustom.cpp:
        (WebCore::JSRequestAnimationFrameCallback::handleEvent):
        * bindings/js/JavaScriptCallFrame.cpp:
        (WebCore::JavaScriptCallFrame::evaluate):
        * bindings/js/PageScriptDebugServer.cpp:
        (WebCore::PageScriptDebugServer::recompileAllJSFunctions):
        * bindings/js/ScheduledAction.cpp:
        (WebCore::ScheduledAction::executeFunctionInContext):
        * bindings/js/ScriptCachedFrameData.cpp:
        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
        (WebCore::ScriptCachedFrameData::restore):
        (WebCore::ScriptCachedFrameData::clear):
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::evaluateInWorld):
        (WebCore::ScriptController::clearWindowShell):
        (WebCore::ScriptController::initScript):
        (WebCore::ScriptController::updateDocument):
        (WebCore::ScriptController::cacheableBindingRootObject):
        (WebCore::ScriptController::bindingRootObject):
        (WebCore::ScriptController::windowScriptNPObject):
        (WebCore::ScriptController::jsObjectForPluginElement):
        (WebCore::ScriptController::clearScriptObjects):
        * bindings/js/ScriptControllerMac.mm:
        (WebCore::ScriptController::windowScriptObject):
        * bindings/js/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::dispatchDidPause):
        * bindings/js/ScriptEventListener.cpp:
        (WebCore::eventListenerHandlerBody):
        (WebCore::eventListenerHandlerLocation):
        * bindings/js/ScriptFunctionCall.cpp:
        (WebCore::ScriptCallArgumentHandler::appendArgument):
        (WebCore::ScriptFunctionCall::call):
        (WebCore::ScriptFunctionCall::construct):
        (WebCore::ScriptCallback::call):
        * bindings/js/ScriptObject.cpp:
        (WebCore::ScriptGlobalObject::set):
        (WebCore::ScriptGlobalObject::get):
        (WebCore::ScriptGlobalObject::remove):
        * bindings/js/ScriptValue.cpp:
        (WebCore::ScriptValue::getString):
        (WebCore::ScriptValue::toInspectorValue):
        * bindings/js/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::~WorkerScriptController):
        (WebCore::WorkerScriptController::initScript):
        (WebCore::WorkerScriptController::evaluate):
        (WebCore::WorkerScriptController::disableEval):
        * bindings/objc/WebScriptObject.mm:
        (_didExecute):
        (-[WebScriptObject _setImp:originRootObject:rootObject:]):
        (-[WebScriptObject _setOriginRootObject:andRootObject:]):
        (-[WebScriptObject dealloc]):
        (-[WebScriptObject finalize]):
        (-[WebScriptObject callWebScriptMethod:withArguments:]):
        (-[WebScriptObject evaluateWebScript:]):
        (-[WebScriptObject setValue:forKey:]):
        (-[WebScriptObject valueForKey:]):
        (-[WebScriptObject removeWebScriptKey:]):
        (-[WebScriptObject hasWebScriptKey:]):
        (-[WebScriptObject stringRepresentation]):
        (-[WebScriptObject webScriptValueAtIndex:]):
        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateCallbackImplementation):
        * bindings/scripts/test/JS/JSTestCallback.cpp:
        (WebCore::JSTestCallback::callbackWithNoParam):
        (WebCore::JSTestCallback::callbackWithClass1Param):
        (WebCore::JSTestCallback::callbackWithClass2Param):
        (WebCore::JSTestCallback::callbackWithStringList):
        (WebCore::JSTestCallback::callbackWithBoolean):
        (WebCore::JSTestCallback::callbackRequiresThisToPass):
        * bridge/NP_jsobject.cpp:
        (_NPN_InvokeDefault):
        (_NPN_Invoke):
        (_NPN_Evaluate):
        (_NPN_GetProperty):
        (_NPN_SetProperty):
        (_NPN_RemoveProperty):
        (_NPN_HasProperty):
        (_NPN_HasMethod):
        (_NPN_Enumerate):
        (_NPN_Construct):
        * bridge/c/c_class.cpp:
        (JSC::Bindings::CClass::~CClass):
        (JSC::Bindings::CClass::methodsNamed):
        (JSC::Bindings::CClass::fieldNamed):
        * bridge/c/c_instance.cpp:
        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
        (JSC::Bindings::CInstance::invokeMethod):
        (JSC::Bindings::CInstance::invokeDefaultMethod):
        (JSC::Bindings::CInstance::invokeConstruct):
        (JSC::Bindings::CInstance::getPropertyNames):
        * bridge/c/c_runtime.cpp:
        (JSC::Bindings::CField::valueFromInstance):
        (JSC::Bindings::CField::setValueToInstance):
        * bridge/c/c_utility.cpp:
        (JSC::Bindings::convertValueToNPVariant):
        (JSC::Bindings::convertNPVariantToValue):
        * bridge/jni/jni_jsobject.mm:
        (JavaJSObject::call):
        (JavaJSObject::eval):
        (JavaJSObject::getMember):
        (JavaJSObject::setMember):
        (JavaJSObject::removeMember):
        (JavaJSObject::getSlot):
        (JavaJSObject::setSlot):
        (JavaJSObject::toString):
        (JavaJSObject::convertValueToJObject):
        (JavaJSObject::convertJObjectToValue):
        * bridge/jni/jni_objc.mm:
        (JSC::Bindings::dispatchJNICall):
        * bridge/jni/jsc/JNIUtilityPrivate.cpp:
        (JSC::Bindings::convertValueToJValue):
        * bridge/jni/jsc/JavaClassJSC.cpp:
        (JavaClass::JavaClass):
        (JavaClass::~JavaClass):
        * bridge/jni/jsc/JavaInstanceJSC.cpp:
        (JavaInstance::stringValue):
        * bridge/jni/jsc/JavaMethodJSC.cpp:
        (appendClassName):
        (JavaMethod::signature):
        * bridge/jni/jsc/JavaStringJSC.h:
        (JSC::Bindings::JavaString::JavaString):
        (JSC::Bindings::JavaString::~JavaString):
        (JSC::Bindings::JavaString::utf8):
        (JSC::Bindings::JavaString::init):
        * bridge/jsc/BridgeJSC.cpp:
        (JSC::Bindings::Instance::createRuntimeObject):
        (JSC::Bindings::Instance::newRuntimeObject):
        * bridge/objc/objc_instance.mm:
        (ObjcInstance::moveGlobalExceptionToExecState):
        (ObjcInstance::invokeObjcMethod):
        (ObjcInstance::invokeDefaultMethod):
        (ObjcInstance::setValueOfUndefinedField):
        (ObjcInstance::getValueOfUndefinedField):
        * bridge/objc/objc_runtime.mm:
        (JSC::Bindings::ObjcField::valueFromInstance):
        (JSC::Bindings::ObjcField::setValueToInstance):
        * bridge/objc/objc_utility.mm:
        (JSC::Bindings::convertValueToObjcValue):
        (JSC::Bindings::convertNSStringToString):
        (JSC::Bindings::convertObjcValueToValue):
        * bridge/qt/qt_instance.cpp:
        (JSC::Bindings::QtInstance::~QtInstance):
        (JSC::Bindings::QtInstance::getQtInstance):
        (JSC::Bindings::QtInstance::newRuntimeObject):
        * bridge/qt/qt_pixmapruntime.cpp:
        (JSC::Bindings::QtPixmapInstance::createPixmapRuntimeObject):
        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::convertValueToQVariant):
        (JSC::Bindings::convertQVariantToValue):
        (JSC::Bindings::QtRuntimeMetaMethod::call):
        (JSC::Bindings::QtRuntimeConnectionMethod::call):
        * bridge/qt/qt_runtime_qt4.cpp:
        (JSC::Bindings::convertValueToQVariant):
        (JSC::Bindings::convertQVariantToValue):
        (JSC::Bindings::QtRuntimeMetaMethod::call):
        (JSC::Bindings::QtRuntimeConnectionMethod::call):
        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::createImageBuffer):
        * html/HTMLImageLoader.cpp:
        (WebCore::HTMLImageLoader::notifyFinished):
        * plugins/PluginView.cpp:
        (WebCore::PluginView::start):
        (WebCore::PluginView::stop):
        (WebCore::PluginView::performRequest):
        (WebCore::PluginView::npObject):
        (WebCore::PluginView::privateBrowsingStateChanged):
        * plugins/blackberry/PluginViewBlackBerry.cpp:
        (WebCore::PluginView::dispatchNPEvent):
        (WebCore::PluginView::setNPWindowIfNeeded):
        (WebCore::PluginView::platformStart):
        (WebCore::PluginView::getWindowInfo):
        * plugins/efl/PluginViewEfl.cpp:
        (WebCore::PluginView::dispatchNPEvent):
        * plugins/gtk/PluginViewGtk.cpp:
        (WebCore::PluginView::dispatchNPEvent):
        (WebCore::PluginView::handleKeyboardEvent):
        (WebCore::PluginView::handleMouseEvent):
        (WebCore::PluginView::setNPWindowIfNeeded):
        (WebCore::PluginView::platformStart):
        * plugins/mac/PluginViewMac.mm:
        (WebCore::PluginView::setNPWindowIfNeeded):
        (WebCore::PluginView::dispatchNPEvent):
        * plugins/qt/PluginViewQt.cpp:
        (WebCore::PluginView::dispatchNPEvent):
        (WebCore::PluginView::setNPWindowIfNeeded):
        (WebCore::PluginView::platformStart):
        * plugins/win/PluginViewWin.cpp:
        (WebCore::PluginView::dispatchNPEvent):
        (WebCore::PluginView::handleKeyboardEvent):
        (WebCore::PluginView::handleMouseEvent):
        (WebCore::PluginView::setNPWindowRect):
        * testing/js/WebCoreTestSupport.cpp:
        (WebCoreTestSupport::injectInternalsObject):
        (WebCoreTestSupport::resetInternalsObject):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::dropProtection):

2012-06-23  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Store hit-test rect in HitTestPoint as Rect.
        https://bugs.webkit.org/show_bug.cgi?id=89454

        Reviewed by Darin Adler.

        Calculate the rectangle early and store that instead of padding
        to avoid recalculating the rectangle for every single element
        hit tested.

        No change in functionality. No new tests.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::bestClickableNodeForTouchPoint):
        (WebCore::EventHandler::bestZoomableAreaForTouchPoint):
        * rendering/HitTestResult.cpp:
        (WebCore::HitTestPoint::HitTestPoint):
        (WebCore::HitTestPoint::operator=):
        (WebCore::HitTestPoint::setPoint):
        (WebCore::hitTestPointIntersects):
        (WebCore::HitTestPoint::intersects):
        (WebCore::HitTestResult::addNodeToRectBasedTestResult):
        * rendering/HitTestResult.h:
        (HitTestPoint):
        (WebCore::HitTestPoint::boundingBox):
        (WebCore::HitTestPoint::topPadding):
        (WebCore::HitTestPoint::rightPadding):
        (WebCore::HitTestPoint::bottomPadding):
        (WebCore::HitTestPoint::leftPadding):
        (HitTestResult):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::hitTestColumns):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::nodeAtPoint):

2012-06-22  Benjamin Poulain  <bpoulain@apple.com>

        Text with text-overflow:ellipsis and text-align:right is left aligned
        https://bugs.webkit.org/show_bug.cgi?id=88705

        Reviewed by Dan Bernstein.

        When building the line of a text with overflow, we do not know if we can place
        an ellipsis and where it should be. Because of that, text is laid out as if it does
        not have text-overflow: ellipsis.

        This causes problems with text-alignement right in LTR and left in RTL. The shortened text
        did not follow the allignment.

        This patch changes the position of lines with ellipsis after layout to follow the allignment.
        In RenderBlock::checkLinesForTextOverflow(), the call to RootInlineBox::placeEllipsis() now
        also gives the width of the truncated text. We use this width to re-compute the alignement and
        shift the box if necessary.

        In RenderBlock::deleteEllipsisLineBoxes() we revert the text to the position computed with the
        total width. This way all layout computation is done as usual.

        Tests: fast/css/text-overflow-ellipsis-text-align-left.html
               fast/css/text-overflow-ellipsis-text-align-right.html

        * rendering/InlineBox.cpp:
        (WebCore::InlineBox::canAccommodateEllipsis): Make the method const for readability, truncating is
        done later in placeEllipsisBox().
        (WebCore::InlineBox::placeEllipsisBox): Add an output argument, truncatedWidth, giving the width
        of the text + ellipsis after truncation (if any truncation can be done).
        * rendering/InlineBox.h:
        (InlineBox):
        * rendering/InlineFlowBox.cpp:
        (WebCore::InlineBox::adjustLogicalPosition): adjustPosition() logical coordinates.
        (WebCore::InlineFlowBox::canAccommodateEllipsis):
        (WebCore::InlineFlowBox::placeEllipsisBox):
        * rendering/InlineFlowBox.h:
        (InlineFlowBox):
        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::placeEllipsisBox):
        * rendering/InlineTextBox.h:
        (InlineTextBox):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::deleteEllipsisLineBoxes): In addition to removing the truncation, we
        need to revert the shift introduced by checkLinesForTextOverflow(). This restore the lines
        to its original, untruncated position in order to layout the block correctly in RenderBlock::layoutInlineChildren().
        (WebCore::RenderBlock::checkLinesForTextOverflow): After we truncate the text, we now recompute the shift we need
        for alignment, and move the line accordingly.
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::applyLineClamp):
        * rendering/RootInlineBox.cpp:
        (WebCore::RootInlineBox::placeEllipsis): Return the width of the truncated text + the width of the ellipsis.
        (WebCore::RootInlineBox::placeEllipsisBox):
        (WebCore::RootInlineBox::adjustPosition):
        * rendering/RootInlineBox.h:
        (RootInlineBox):

2012-06-22  Eugene Klyuchnikov  <eustas.big@gmail.com>

        Web Inspector: Fix negative time interval on zoom-in
        https://bugs.webkit.org/show_bug.cgi?id=89798

        Reviewed by Pavel Feldman.

        Steps to reproduce:
        1) Record timeline
        2) Select small range with left tick close to zero
        3) Move pointer to the right end of the ruler
        4) Zoom-in with mouse-wheel

        Result: right tick goes below the zero.

        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineOverviewWindow.prototype._zoom):

2012-06-22  Alexandru Chiculita  <achicu@adobe.com>

        [CSS Shaders] Re-enable the CSS Shaders compile time flag on Safari Mac
        https://bugs.webkit.org/show_bug.cgi?id=89781

        Reviewed by Dean Jackson.

        Added ENABLE_CSS_SHADERS flag as enabled by default on Safari for Mac.

        No new tests, just re-enabled existing tests.

        * css/CSSValueKeywords.in: Added empty line to force a rebuild of the file on the EWS.
        * Configurations/FeatureDefines.xcconfig:

2012-06-22  David Grogan  <dgrogan@chromium.org>

        IndexedDB: Avoid infinite loop if we try to encode -1 for leveldb
        https://bugs.webkit.org/show_bug.cgi?id=89625

        It gets worse, memory is allocated inside the loop so the process is
        eventually killed by the OS.

        Reviewed by Tony Chang.

        Added tests to Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp

        * Modules/indexeddb/IDBLevelDBCoding.cpp:
        (WebCore::IDBLevelDBCoding::encodeInt):
        (WebCore::IDBLevelDBCoding::encodeVarInt):

2012-06-22  Hayato Ito  <hayato@chromium.org>

        [Shadow] ShadowRoot.activeElement should use the result of re-targeting algorithm.
        https://bugs.webkit.org/show_bug.cgi?id=89763

        Reviewed by Dimitri Glazkov.

        Use the result of the re-targeting algorithm in calculating
        shadow root's activeElement so that ShadowRoot.activeElement returns
        a focused distributed node correctly as the algorithm says.

        The spec is:
        https://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#active-element

        Tests: fast/dom/shadow/shadow-root-activeElement.html

        * dom/EventDispatcher.cpp:
        (WebCore):
        (WebCore::EventRelatedTargetAdjuster::adjust):
        (WebCore::EventDispatcher::ensureEventAncestors):
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::focusedNode):
        * html/shadow/InsertionPoint.h:
        (WebCore::InsertionPoint::contains):

2012-06-22  James Robinson  <jamesr@chromium.org>

        [chromium] LayerRendererChromium is not getting visibility messages in single threaded compositing mode.
        https://bugs.webkit.org/show_bug.cgi?id=89045

        Reviewed by Adrienne Walker.

        Based on patch by Michal Mocny <mmocny@google.com>.

        Invariants:

        1.) We never commit (paint, animate, any of it) when not visible on the main thread -except- for
        compositeAndReadback, regardless of threaded vs non-threaded mode
        2.) CCLayerTreeHost::m_contentsTextureManager's memory budget is only set by updateLayers() when we are going to
        make a frame and is always set to a non-zero value
        3.) Zero-sized allocations from the GPU process are always serviced immediately on the impl thread.  Non-zero
        allocations are met in the next frame, whenever we would produce that frame according to our usual frame
        scheduling logic.
        4.) The impl thread always knows the set of currently-allocated managed texture IDs and can delete them all
        whenever it likes without needing the main thread to be responsive.

        Details:

        There are two main changes - tweaking how the contents texture manager's budget is handled and tweaking frame
        scheduling for the !visible case.

        The scheduling change is a bit more subtle but it unifies the single and multi threaded paths and is really
        important.  Except for compositeAndReadback (which I'll talk about below), we simply won't produce frames when
        not visible.  This already happens in the single threaded path thanks to render_widget so the only change is to
        the threaded path.  The difficulty here is we might post a beginFrame task from the impl thread and then get a
        setVisible(false) call on the main thread before the beginFrame task runs.  Since I'm making the setVisible()
        call a blocking call from main thread -> impl thread, when the beginFrame task eventually does run on the main
        thread we can know that the impl thread's notion of visibility is in sync with the main threads.  Thus I'm
        planning to simply abort the frame before doing any processing on the main thread.  The scheduler will know if
        it gets a beginFrameAborted and COMMIT_STATE_IDLE.

        compositeAndReadback is special - this call currently does come in when we aren't visible (in single and
        threaded mode) and we need to service it.  In particular, we need to send a beginFrame over and have it
        not be ignored on the main thread.  For this I'm thinking of having the proxy keep track of whether it's
        servicing a compositeAndReadback() and use that bit on the main thread to know to process the beginFrame
        normally.  On the impl side, we need a few changes.  First, we have to allocate a default framebuffer
        (ensureFramebufferCHROMIUM) even if we've dropped it previously and remember to discard it after the
        readPixels().  Second, we have to provide a non-zero contents texture allocation on the beginFrame message, and
        again remember to delete the textures after the readPixels().  Third, we have to know that the beginFrame is a
        forced frame so when we get the beginFrameComplete we go ahead with the rest of the frame.  For this, I think
        I'll have to add ACTION_BEGIN_FORCED_FRAME and a corresponding COMMIT_STATE_FORCED_FRAME_IN_PROGRESS so the
        scheduler can keep track of the magicness of this frame, and then add some logic after the readpixels call to
        drop resources after the readback.  It's probably a good time to stop swapping on readbacks too....

        The contents texture manager's budget is only relevant when we want to make a frame, so it's now passed in on
        the updateLayers().  Since we only make frames when we are visible and we never have a zero allocation when
        visible (thanks to the frame scheduling changes above), this value is always non-zero.  The other thing the
        texture manager needs to know about is if we've killed all of the underlying textures from the impl thread -
        this bit is passed in by the proxy before the updateLayers() call.  This means if we're running while visible
        and the manager wants to decrease our budget to something other than zero, we'll get a new (non-zero) allocation
        on the impl thread, schedule a frame, then when it's time to make the frame pass the new lower limit in to
        updateLayers(), then have the contents texture manager evict down to our new limit and make a frame with the new
        budget.  When the commit completes we'll get notified on the impl thread of which textures the contents texture
        manager decided to evict and issue the deleteTexture() calls on them.

        The texture budget we pass in will be based on the most recent non-zero memory allocation we received from the
        GPU memory manager, or some default value I'll pull out my ass if we haven't heard anything yet.  On compositor
        initialization, we can't afford to wait for a round-trip through the GPU process to get a budget for the first
        frame.  I don't think handling a decrease to a non-zero budget on a visible tab needs to be terribly urgent - we
        can get to it when we get to making the next frame.  If we wanted to satisfy reduced texture budgets directly
        from the impl thread, we could keep a priority-list ordered set of textures once we have priorities and delete
        based on that.  Let's worry about that later.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererGpuMemoryAllocationChangedCallbackAdapter::onGpuMemoryAllocationChangedOnImpl):
        (WebCore::LayerRendererChromium::LayerRendererChromium):
        (WebCore::LayerRendererChromium::initialize):
        (WebCore::LayerRendererChromium::setVisible):
        (WebCore::LayerRendererChromium::setGpuMemoryAllocation):
        (WebCore):
        (WebCore::LayerRendererChromium::swapBuffers):
        (WebCore::LayerRendererChromium::getFramebufferPixels):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (WebCore):
        (LayerRendererChromium):
        * platform/graphics/chromium/TextureManager.cpp:
        (WebCore::TextureManager::evictAndRemoveAllDeletedTextures):
        (WebCore):
        * platform/graphics/chromium/TextureManager.h:
        (TextureAllocator):
        (TextureManager):
        * platform/graphics/chromium/TrackingTextureAllocator.cpp:
        (WebCore::TrackingTextureAllocator::createTexture):
        (WebCore::TrackingTextureAllocator::deleteTexture):
        (WebCore):
        (WebCore::TrackingTextureAllocator::deleteAllTextures):
        * platform/graphics/chromium/TrackingTextureAllocator.h:
        (TrackingTextureAllocator):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
        (WebCore::CCLayerTreeHost::setVisible):
        (WebCore::CCLayerTreeHost::evictAllContentTextures):
        (WebCore::CCLayerTreeHost::updateLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::commitComplete):
        (WebCore::CCLayerTreeHostImpl::canDraw):
        (WebCore::CCLayerTreeHostImpl::context):
        (WebCore::CCLayerTreeHostImpl::releaseContentsTextures):
        (WebCore):
        (WebCore::CCLayerTreeHostImpl::setMemoryAllocationLimitBytes):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImplClient):
        (WebCore::CCLayerTreeHostImpl::contentsTexturesWerePurgedSinceLastCommit):
        (WebCore::CCLayerTreeHostImpl::memoryAllocationLimitBytes):
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCProxy.h:
        (CCProxy):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (CCRendererClient):
        * platform/graphics/chromium/cc/CCScheduler.cpp:
        (WebCore::CCScheduler::beginFrameComplete):
        (WebCore::CCScheduler::beginFrameAborted):
        (WebCore):
        (WebCore::CCScheduler::didSwapBuffersComplete):
        (WebCore::CCScheduler::didLoseContext):
        (WebCore::CCScheduler::didRecreateContext):
        (WebCore::CCScheduler::vsyncTick):
        * platform/graphics/chromium/cc/CCScheduler.h:
        (CCScheduler):
        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
        (WebCore::CCSchedulerStateMachine::beginFrameAborted):
        (WebCore):
        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h:
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::setVisible):
        (WebCore):
        (WebCore::CCSingleThreadProxy::stop):
        (WebCore::CCSingleThreadProxy::commitAndComposite):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        (CCSingleThreadProxy):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::CCThreadProxy):
        (WebCore::CCThreadProxy::compositeAndReadback):
        (WebCore::CCThreadProxy::setVisible):
        (WebCore):
        (WebCore::CCThreadProxy::setVisibleOnImplThread):
        (WebCore::CCThreadProxy::scheduledActionBeginFrame):
        (WebCore::CCThreadProxy::beginFrame):
        (WebCore::CCThreadProxy::beginFrameAbortedOnImplThread):
        (WebCore::CCThreadProxy::scheduledActionDrawAndSwapInternal):
        (WebCore::CCThreadProxy::layerTreeHostClosedOnImplThread):
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (CCThreadProxy):
        (BeginFrameAndCommitState):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
        (WebCore::CCVideoLayerImpl::willDraw):
        (WebCore::CCVideoLayerImpl::willDrawInternal):
        (WebCore::CCVideoLayerImpl::FramePlane::allocateData):
        (WebCore::CCVideoLayerImpl::FramePlane::freeData):
        (WebCore::CCVideoLayerImpl::allocatePlaneData):
        (WebCore::CCVideoLayerImpl::freePlaneData):
        (WebCore::CCVideoLayerImpl::freeUnusedPlaneData):
        (WebCore::CCVideoLayerImpl::didLoseContext):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
        (FramePlane):

2012-06-22  Julien Chaffraix  <jchaffraix@webkit.org>

        REGRESSION(r116446): Crash in RenderBoxModelObject::adjustedPositionRelativeToOffsetParent
        https://bugs.webkit.org/show_bug.cgi?id=89785

        Reviewed by Abhishek Arya.

        Test: fullscreen/full-screen-crash-offsetLeft.html

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::adjustedPositionRelativeToOffsetParent):
        Added a NULL-check for parent() as it can be NULL in fullscreen mode. Also updated a stale
        comment while touching the code.

2012-06-22  Kenneth Russell  <kbr@google.com>

        Unreviewed, rolling out r121064.
        http://trac.webkit.org/changeset/121064
        https://bugs.webkit.org/show_bug.cgi?id=88268

        Broke Chromium Mac build.

        * WebCore.gypi:
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::updateAnimations):
        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore):
        (WebCore::CCLayerTreeHost::frameNumber):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::drawLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (WebCore::CCLayerTreeHostImpl::frameNumber):
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCProxy.h:
        (WebCore):
        (CCProxy):
        * platform/graphics/chromium/cc/CCRenderingStats.h: Removed.
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (CCThreadProxy):

2012-06-22  Ryuan Choi  <ryuan.choi@samsung.com>

        [EFL][WK2] Support keyboard event
        https://bugs.webkit.org/show_bug.cgi?id=89268

        Reviewed by Chang Shu.

        Extract keyDownCommandsMap and keyPressCommandsMap to share WebKit1/Efl and WebKit2/Efl.

        * platform/efl/EflKeyboardUtilities.cpp:
        (WebCore):
        (WebCore::keyDownCommandsMap):
        (WebCore::keyPressCommandsMap):
        (KeyDownEntry):
        (KeyPressEntry):
        (WebCore::createKeyDownCommandMap):
        (WebCore::createKeyPressCommandMap):
        (WebCore::getKeyDownCommandName):
        (WebCore::getKeyPressCommandName):
        * platform/efl/EflKeyboardUtilities.h:
        (WebCore):

2012-06-22  Alec Flett  <alecflett@chromium.org>

        IndexedDB: refactor index-writing to be more self-contained
        https://bugs.webkit.org/show_bug.cgi?id=89607

        Reviewed by Tony Chang.

        Refactor index-writing into the IndexWriter class. Does not change
        existing behavior but begins migrating index-writing logic into a
        self-contained class that can eventually be used in the
        frontend (renderer) side of IndexedDB.

        No new tests, behavior is unchanged.

        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore):
        (WebCore::IDBObjectStoreBackendImpl::putInternal):
        (WebCore::IDBObjectStoreBackendImpl::populateIndex):

2012-06-22  Dave Tu  <dtu@chromium.org>

        [chromium] Expose rendering statistics to WebWidget.
        https://bugs.webkit.org/show_bug.cgi?id=88268

        Reviewed by James Robinson.

        The WebKit side of a basic framework for exposing rendering statistics
        to Chromium's --enable-benchmarking extension.

        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::CCLayerTreeHost::implFrameNumber):
        * platform/graphics/chromium/cc/CCProxy.h:
        (CCProxy):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::implFrameNumber):
        (WebCore):
        (WebCore::CCThreadProxy::implFrameNumberOnImplThread):
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (CCThreadProxy):

2012-06-22  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Do not accumulate occlusion from 3d layers on the main thread
        https://bugs.webkit.org/show_bug.cgi?id=89704

        Reviewed by James Robinson.

        Layer iterators on the main thread may not iterate over 3d layers
        in correct front-to-back or back-to-front order, because layer
        sorting is not performed on the main thread. As a result,
        occlusion tracking can accidentally think something is occluded if
        a 3d layer is processed out of order. This patch choses to solve
        this by avoiding accumulating occlusion for 3d layers. It may be
        appropriate later to consider adding layer sorting on the main
        thread, but for now that seemed like an unnecessary heavy-handed
        approach.

        In addition to a new unit test that covers this, other unit tests
        were changed to work on the impl thread, so that the 3d layers
        still accumulate occlusion as required.

        Unit test added to CCOcclusionTrackerTest:
          CCOcclusionTrackerTestUnsorted3dLayers

        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::layerIsInUnsorted3dRenderingContext):
        (WebCore):
        (WebCore::::markOccludedBehindLayer):

2012-06-22  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Snapshot metadata in front end to avoid IPC round-trips
        https://bugs.webkit.org/show_bug.cgi?id=88467

        Reviewed by Tony Chang.

        Define a new type (IDBDatabaseMetadata) that captures the "schema" of an
        IDB database (name, version, properties of stores, properties of indexes).
        Add a method for the front end to request this from the back end once up
        front to avoid later calls (which may be slow IPC calls in ports). Implement
        IDB spec logic that the metadata should be frozen for a particular IDBDatabase
        connection, and only change within a version change transaction, and the spec's
        funky requirement for aborted version change transactions.

        Test: storage/indexeddb/metadata.html

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::IDBDatabase): Fetch metadata from back end when connection is created.
        (WebCore::IDBDatabase::transactionCreated):
        (WebCore::IDBDatabase::transactionFinished): Update metadata at the end of a transaction in 
        case it was rolled back.
        (WebCore::IDBDatabase::objectStoreNames): Move implementation to front-end.
        (WebCore):
        (WebCore::IDBDatabase::createObjectStore): Update local copy of metadata.
        (WebCore::IDBDatabase::deleteObjectStore): Update local copy of metadata.
        * Modules/indexeddb/IDBDatabase.h:
        (WebCore::IDBDatabase::name): Move implementation to front-end.
        (WebCore::IDBDatabase::version): Move implementation to front-end.
        (IDBDatabase):
        (WebCore::IDBDatabase::metadata):
        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::metadata): Construct a metadata snapshot.
        (WebCore):
        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
        (IDBDatabaseBackendImpl):
        * Modules/indexeddb/IDBDatabaseBackendInterface.h:
        (WebCore):
        (IDBDatabaseBackendInterface):
        * Modules/indexeddb/IDBIndex.cpp: Store a copy of the metadata, which will never
        change during the lifetime of the index.
        (WebCore::IDBIndex::IDBIndex):
        * Modules/indexeddb/IDBIndex.h:
        (WebCore::IDBIndex::create):
        (WebCore::IDBIndex::name): Move implementation to front-end.
        (WebCore::IDBIndex::objectStore): Return RefPtr (unrelated tidying).
        (WebCore::IDBIndex::keyPath): Move implementation to front-end.
        (WebCore::IDBIndex::unique): Move implementation to front-end.
        (WebCore::IDBIndex::multiEntry): Move implementation to front-end.
        (IDBIndex):
        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
        (WebCore::IDBIndexBackendImpl::metadata): Construct a metadata snapshot.
        (WebCore):
        * Modules/indexeddb/IDBIndexBackendImpl.h:
        (IDBIndexBackendImpl):
        * Modules/indexeddb/IDBMetadata.h: Added new structs.
        (WebCore):
        (WebCore::IDBDatabaseMetadata::IDBDatabaseMetadata):
        (IDBDatabaseMetadata):
        (WebCore::IDBObjectStoreMetadata::IDBObjectStoreMetadata):
        (IDBObjectStoreMetadata):
        (WebCore::IDBIndexMetadata::IDBIndexMetadata):
        (IDBIndexMetadata):
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::IDBObjectStore): Store a "live" copy of the metadata, and
        and copy in case of an aborted version change transaction.
        (WebCore::IDBObjectStore::indexNames): Move implementation to front-end.
        (WebCore::IDBObjectStore::createIndex): Update metadata to include new index.
        (WebCore::IDBObjectStore::index): Pass along metadata to instance constructor.
        (WebCore::IDBObjectStore::deleteIndex): Delete index from metadata.
        * Modules/indexeddb/IDBObjectStore.h:
        (WebCore::IDBObjectStore::create):
        (WebCore::IDBObjectStore::name): Move implementation to front-end.
        (WebCore::IDBObjectStore::keyPath): Move implementation to front-end.
        (WebCore::IDBObjectStore::transaction): Return RefPtr (unrelated tidying).
        (WebCore::IDBObjectStore::autoIncrement): Move implementation to front-end.
        (WebCore::IDBObjectStore::metadata): Allow copying the metadata, in case of abort.
        (WebCore::IDBObjectStore::resetMetadata): Allow setting the metadata, in case of abort.
        (IDBObjectStore):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::metadata): Construct a metadata snapshot.
        (WebCore):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
        (WebCore):
        (IDBObjectStoreBackendImpl):
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::objectStore): Pass along metadata to instance constructor.
        (WebCore::IDBTransaction::objectStoreCreated): Track stores changed during transaction.
        (WebCore::IDBTransaction::objectStoreDeleted):Track stores changed during transaction.
        (WebCore::IDBTransaction::onAbort): Revert stores metadata potentially changed during transaction.
        * Modules/indexeddb/IDBTransaction.h:
        (IDBTransaction):
        * WebCore.gypi:

2012-06-20  Mark Hahnenberg  <mhahnenberg@apple.com>

        JSLock should be per-JSGlobalData
        https://bugs.webkit.org/show_bug.cgi?id=89123

        Reviewed by Gavin Barraclough.

        No new tests. Current regression tests are sufficient.

        Changed all sites that used JSLock to instead use the new JSLockHolder
        and pass in the correct JS context that the code is about to interact with that 
        needs protection. Also added a couple JSLocks to places that didn't already 
        have it that needed it.

        * bindings/js/GCController.cpp:
        (WebCore::collect):
        (WebCore::GCController::garbageCollectSoon):
        (WebCore::GCController::garbageCollectNow):
        (WebCore::GCController::discardAllCompiledCode):
        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
        (WebCore::JSSQLStatementErrorCallback::handleEvent):
        * bindings/js/JSCustomVoidCallback.cpp:
        (WebCore::JSCustomVoidCallback::handleEvent):
        * bindings/js/JSCustomXPathNSResolver.cpp:
        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
        * bindings/js/JSErrorHandler.cpp:
        (WebCore::JSErrorHandler::handleEvent):
        * bindings/js/JSEventCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSEventListener.cpp:
        (WebCore::JSEventListener::handleEvent):
        * bindings/js/JSInjectedScriptHostCustom.cpp:
        (WebCore::InjectedScriptHost::nodeAsScriptValue):
        (WebCore::JSInjectedScriptHost::inspectedObject):
        * bindings/js/JSInjectedScriptManager.cpp:
        (WebCore::InjectedScriptManager::createInjectedScript):
        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
        * bindings/js/JSLazyEventListener.cpp:
        (WebCore::JSLazyEventListener::initializeJSFunction):
        * bindings/js/JSMainThreadExecState.h:
        (WebCore::JSMainThreadExecState::evaluate):
        * bindings/js/JSMutationCallbackCustom.cpp:
        (WebCore::JSMutationCallback::handleEvent):
        * bindings/js/JSNodeFilterCondition.cpp:
        (WebCore::JSNodeFilterCondition::acceptNode):
        * bindings/js/JSRequestAnimationFrameCallbackCustom.cpp:
        (WebCore::JSRequestAnimationFrameCallback::handleEvent):
        * bindings/js/JavaScriptCallFrame.cpp:
        (WebCore::JavaScriptCallFrame::evaluate):
        * bindings/js/PageScriptDebugServer.cpp:
        (WebCore::PageScriptDebugServer::recompileAllJSFunctions):
        * bindings/js/ScheduledAction.cpp:
        (WebCore::ScheduledAction::executeFunctionInContext):
        * bindings/js/ScriptCachedFrameData.cpp:
        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
        (WebCore::ScriptCachedFrameData::restore):
        (WebCore::ScriptCachedFrameData::clear):
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::evaluateInWorld):
        (WebCore::ScriptController::clearWindowShell):
        (WebCore::ScriptController::initScript):
        (WebCore::ScriptController::updateDocument):
        (WebCore::ScriptController::cacheableBindingRootObject):
        (WebCore::ScriptController::bindingRootObject):
        (WebCore::ScriptController::windowScriptNPObject):
        (WebCore::ScriptController::jsObjectForPluginElement):
        (WebCore::ScriptController::clearScriptObjects):
        * bindings/js/ScriptControllerMac.mm:
        (WebCore::ScriptController::windowScriptObject):
        * bindings/js/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::dispatchDidPause):
        * bindings/js/ScriptEventListener.cpp:
        (WebCore::eventListenerHandlerBody):
        (WebCore::eventListenerHandlerLocation):
        * bindings/js/ScriptFunctionCall.cpp:
        (WebCore::ScriptCallArgumentHandler::appendArgument):
        (WebCore::ScriptFunctionCall::call):
        (WebCore::ScriptFunctionCall::construct):
        (WebCore::ScriptCallback::call):
        * bindings/js/ScriptObject.cpp:
        (WebCore::ScriptGlobalObject::set):
        (WebCore::ScriptGlobalObject::get):
        (WebCore::ScriptGlobalObject::remove):
        * bindings/js/ScriptValue.cpp:
        (WebCore::ScriptValue::getString):
        (WebCore::ScriptValue::toInspectorValue):
        * bindings/js/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::~WorkerScriptController):
        (WebCore::WorkerScriptController::initScript):
        (WebCore::WorkerScriptController::evaluate):
        (WebCore::WorkerScriptController::disableEval):
        * bindings/objc/WebScriptObject.mm:
        (_didExecute):
        (-[WebScriptObject _setImp:originRootObject:rootObject:]):
        (-[WebScriptObject _setOriginRootObject:andRootObject:]):
        (-[WebScriptObject dealloc]):
        (-[WebScriptObject finalize]):
        (-[WebScriptObject callWebScriptMethod:withArguments:]):
        (-[WebScriptObject evaluateWebScript:]):
        (-[WebScriptObject setValue:forKey:]):
        (-[WebScriptObject valueForKey:]):
        (-[WebScriptObject removeWebScriptKey:]):
        (-[WebScriptObject hasWebScriptKey:]):
        (-[WebScriptObject stringRepresentation]):
        (-[WebScriptObject webScriptValueAtIndex:]):
        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateCallbackImplementation):
        * bindings/scripts/test/JS/JSTestCallback.cpp:
        (WebCore::JSTestCallback::callbackWithNoParam):
        (WebCore::JSTestCallback::callbackWithClass1Param):
        (WebCore::JSTestCallback::callbackWithClass2Param):
        (WebCore::JSTestCallback::callbackWithStringList):
        (WebCore::JSTestCallback::callbackWithBoolean):
        (WebCore::JSTestCallback::callbackRequiresThisToPass):
        * bridge/NP_jsobject.cpp:
        (_NPN_InvokeDefault):
        (_NPN_Invoke):
        (_NPN_Evaluate):
        (_NPN_GetProperty):
        (_NPN_SetProperty):
        (_NPN_RemoveProperty):
        (_NPN_HasProperty):
        (_NPN_HasMethod):
        (_NPN_Enumerate):
        (_NPN_Construct):
        * bridge/c/c_class.cpp:
        (JSC::Bindings::CClass::~CClass):
        (JSC::Bindings::CClass::methodsNamed):
        (JSC::Bindings::CClass::fieldNamed):
        * bridge/c/c_instance.cpp:
        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
        (JSC::Bindings::CInstance::invokeMethod):
        (JSC::Bindings::CInstance::invokeDefaultMethod):
        (JSC::Bindings::CInstance::invokeConstruct):
        (JSC::Bindings::CInstance::getPropertyNames):
        * bridge/c/c_runtime.cpp:
        (JSC::Bindings::CField::valueFromInstance):
        (JSC::Bindings::CField::setValueToInstance):
        * bridge/c/c_utility.cpp:
        (JSC::Bindings::convertValueToNPVariant):
        (JSC::Bindings::convertNPVariantToValue):
        * bridge/jni/jni_jsobject.mm:
        (JavaJSObject::call):
        (JavaJSObject::eval):
        (JavaJSObject::getMember):
        (JavaJSObject::setMember):
        (JavaJSObject::removeMember):
        (JavaJSObject::getSlot):
        (JavaJSObject::setSlot):
        (JavaJSObject::toString):
        (JavaJSObject::convertValueToJObject):
        (JavaJSObject::convertJObjectToValue):
        * bridge/jni/jni_objc.mm:
        (JSC::Bindings::dispatchJNICall):
        * bridge/jni/jsc/JNIUtilityPrivate.cpp:
        (JSC::Bindings::convertValueToJValue):
        * bridge/jni/jsc/JavaClassJSC.cpp:
        (JavaClass::JavaClass):
        (JavaClass::~JavaClass):
        * bridge/jni/jsc/JavaInstanceJSC.cpp:
        (JavaInstance::stringValue):
        * bridge/jni/jsc/JavaMethodJSC.cpp:
        (appendClassName):
        (JavaMethod::signature):
        * bridge/jni/jsc/JavaStringJSC.h:
        (JSC::Bindings::JavaString::JavaString):
        (JSC::Bindings::JavaString::~JavaString):
        (JSC::Bindings::JavaString::utf8):
        (JSC::Bindings::JavaString::init):
        * bridge/jsc/BridgeJSC.cpp:
        (JSC::Bindings::Instance::createRuntimeObject):
        (JSC::Bindings::Instance::newRuntimeObject):
        * bridge/objc/objc_instance.mm:
        (ObjcInstance::moveGlobalExceptionToExecState):
        (ObjcInstance::invokeObjcMethod):
        (ObjcInstance::invokeDefaultMethod):
        (ObjcInstance::setValueOfUndefinedField):
        (ObjcInstance::getValueOfUndefinedField):
        * bridge/objc/objc_runtime.mm:
        (JSC::Bindings::ObjcField::valueFromInstance):
        (JSC::Bindings::ObjcField::setValueToInstance):
        * bridge/objc/objc_utility.mm:
        (JSC::Bindings::convertValueToObjcValue):
        (JSC::Bindings::convertNSStringToString):
        (JSC::Bindings::convertObjcValueToValue):
        * bridge/qt/qt_instance.cpp:
        (JSC::Bindings::QtInstance::~QtInstance):
        (JSC::Bindings::QtInstance::getQtInstance):
        (JSC::Bindings::QtInstance::newRuntimeObject):
        * bridge/qt/qt_pixmapruntime.cpp:
        (JSC::Bindings::QtPixmapInstance::createPixmapRuntimeObject):
        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::convertValueToQVariant):
        (JSC::Bindings::convertQVariantToValue):
        (JSC::Bindings::QtRuntimeMetaMethod::call):
        (JSC::Bindings::QtRuntimeConnectionMethod::call):
        * bridge/qt/qt_runtime_qt4.cpp:
        (JSC::Bindings::convertValueToQVariant):
        (JSC::Bindings::convertQVariantToValue):
        (JSC::Bindings::QtRuntimeMetaMethod::call):
        (JSC::Bindings::QtRuntimeConnectionMethod::call):
        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::createImageBuffer):
        * html/HTMLImageLoader.cpp:
        (WebCore::HTMLImageLoader::notifyFinished):
        * plugins/PluginView.cpp:
        (WebCore::PluginView::start):
        (WebCore::PluginView::stop):
        (WebCore::PluginView::performRequest):
        (WebCore::PluginView::npObject):
        (WebCore::PluginView::privateBrowsingStateChanged):
        * plugins/blackberry/PluginViewBlackBerry.cpp:
        (WebCore::PluginView::dispatchNPEvent):
        (WebCore::PluginView::setNPWindowIfNeeded):
        (WebCore::PluginView::platformStart):
        (WebCore::PluginView::getWindowInfo):
        * plugins/efl/PluginViewEfl.cpp:
        (WebCore::PluginView::dispatchNPEvent):
        * plugins/gtk/PluginViewGtk.cpp:
        (WebCore::PluginView::dispatchNPEvent):
        (WebCore::PluginView::handleKeyboardEvent):
        (WebCore::PluginView::handleMouseEvent):
        (WebCore::PluginView::setNPWindowIfNeeded):
        (WebCore::PluginView::platformStart):
        * plugins/mac/PluginViewMac.mm:
        (WebCore::PluginView::setNPWindowIfNeeded):
        (WebCore::PluginView::dispatchNPEvent):
        * plugins/qt/PluginViewQt.cpp:
        (WebCore::PluginView::dispatchNPEvent):
        (WebCore::PluginView::setNPWindowIfNeeded):
        (WebCore::PluginView::platformStart):
        * plugins/win/PluginViewWin.cpp:
        (WebCore::PluginView::dispatchNPEvent):
        (WebCore::PluginView::handleKeyboardEvent):
        (WebCore::PluginView::handleMouseEvent):
        (WebCore::PluginView::setNPWindowRect):
        * testing/js/WebCoreTestSupport.cpp:
        (WebCoreTestSupport::injectInternalsObject):
        (WebCoreTestSupport::resetInternalsObject):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::dropProtection):

2012-06-22  Jeff Timanus  <twiz@chromium.org>

        [Chromium] Change implementing a fast-path for copying GPU-accelerated Canvas2D instances to WebGL textures.
        https://bugs.webkit.org/show_bug.cgi?id=86275

        This change adds the necessary plumbing to the various rendering contexts to copy the backing store texture of
        a Canvas2D instance to be copied to a WebGL texture.  The GL_CHROMIUM_copy_texture extension is necessary
        because the backing-store for a GPU-accelerated skia Canvas2D is normally in BGRA format, which is not supported
        by glCopyTexImage.

        Reviewed by Kenneth Russell.

        Test: fast/canvas/webgl/*

        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore):
        (WebCore::WebGLRenderingContext::texImage2D):
        * platform/chromium/support/Extensions3DChromium.cpp:
        (WebCore::Extensions3DChromium::copyTextureCHROMIUM):
        (WebCore):
        * platform/graphics/Extensions3D.h:
        (Extensions3D):
        * platform/graphics/ImageBuffer.cpp:
        (WebCore):
        (WebCore::ImageBuffer::copyToPlatformTexture):
        * platform/graphics/ImageBuffer.h:
        (WebCore):
        (ImageBuffer):
        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
        (WebCore::Canvas2DLayerBridge::backBufferTexture):
        (WebCore):
        * platform/graphics/chromium/Canvas2DLayerBridge.h:
        (Canvas2DLayerBridge):
        * platform/graphics/chromium/Extensions3DChromium.h:
        (Extensions3DChromium):
        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
        (WebCore::Extensions3DOpenGL::copyTextureCHROMIUM):
        (WebCore):
        * platform/graphics/opengl/Extensions3DOpenGL.h:
        (Extensions3DOpenGL):
        * platform/graphics/qt/Extensions3DQt.cpp:
        (WebCore::Extensions3DQt::copyTextureCHROMIUM):
        (WebCore):
        * platform/graphics/qt/Extensions3DQt.h:
        (Extensions3DQt):
        * platform/graphics/skia/ImageBufferSkia.cpp:
        (WebCore::ImageBuffer::copyToPlatformTexture):
        (WebCore):

2012-06-22  Danilo Cesar Lemes de Paula  <danilo.cesar@collabora.co.uk>

        Add url to supportsType
        https://bugs.webkit.org/show_bug.cgi?id=89514

        Reviewed by Eric Carlson.

        No new tests since there's no change on code behavior.

        When a blob is created as the address for a Media Stream, the MediaEngine
        will ask it's players if they support that media. However, a player built
        for MediaStream needs to know to URL to decide if it's supported or not.

        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::createDocument):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::canPlayType):
        (WebCore::HTMLMediaElement::selectNextSourceChild):
        * html/HTMLMediaElement.h:
        * platform/graphics/MediaPlayer.cpp:
        (MediaPlayerFactory):
        (WebCore::MediaPlayerFactory::MediaPlayerFactory):
        (WebCore):
        (WebCore::textPlain):
        (WebCore::bestMediaEngineForTypeAndCodecs):
        (WebCore::MediaPlayer::load):
        (WebCore::MediaPlayer::loadWithNextMediaEngine):
        (WebCore::MediaPlayer::paint):
        (WebCore::MediaPlayer::supportsType):
        * platform/graphics/MediaPlayer.h:
        (WebCore):
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
        (WebCore::MediaPlayerPrivateAVFoundationCF::supportsType):
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:
        (MediaPlayerPrivateAVFoundationCF):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        (MediaPlayerPrivateAVFoundationObjC):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::supportsType):
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
        (WebCore::MediaPlayerPrivate::supportsType):
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
        (MediaPlayerPrivate):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
        (MediaPlayerPrivateGStreamer):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        (MediaPlayerPrivateQTKit):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::supportsType):
        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
        (WebCore::MediaPlayerPrivateQt::supportsType):
        * platform/graphics/qt/MediaPlayerPrivateQt.h:
        (MediaPlayerPrivateQt):
        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::supportsType):
        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h:
        (MediaPlayerPrivateQuickTimeVisualContext):
        * platform/graphics/wince/MediaPlayerPrivateWinCE.h:
        (MediaPlayerPrivate):

2012-06-22  Joshua Netterfield  <jnetterfield@rim.com>

        [BlackBerry] Sanitize GLSL code using ANGLE.

        BlackBerry port does not sanitize GLSL code with ANGLE
        https://bugs.webkit.org/show_bug.cgi?id=89583

        Reviewed by Rob Buis.

        No new tests are required.

        * CMakeLists.txt: Added ANGLE requirment for CMake builds with WEBGL
        * platform/graphics/ANGLEWebKitBridge.h: Added include for ANGLE/ShaderLang.h in BlackBerry platform.
        * platform/graphics/GraphicsContext3D.h: Added include for ANGLEWebKitBridge.h in BlackBerry platform.

2012-06-22  Dan Bernstein  <mitz@apple.com>

        RenderText’s minimum preferred width is incorrect when soft hyphens are used
        https://bugs.webkit.org/show_bug.cgi?id=89775

        Reviewed by Simon Fraser.

        Test: fast/text/soft-hyphen-min-preferred-width.html

        * rendering/RenderText.cpp:
        (WebCore::hyphenWidth): Added this helper function.
        (WebCore::RenderText::computePreferredLogicalWidths): In places where this function tests
        for the soft hyphen character, added a check that the 'hyphens' style property is not set
        to 'none', because in that case soft hyphens are not break opportunities. Also added an
        explicit check to suppress break opportunities from isBreakable() if the occur after a
        soft hyphen and 'hyphens' is set to 'none'. Finally, when measuring text up to a potential
        line break, added the width of the hyphen string when needed.

2012-06-22  Dean Jackson  <dino@apple.com>

        BitmapImage duplicates code to calculate size
        https://bugs.webkit.org/show_bug.cgi?id=89728
        <rdar://problem/11724321>

        Reviewed by Darin Adler.

        Add a new updateSize method to BitmapImage that
        avoids duplication in the size and
        sizeRespectingOrientation methods.

        No new tests needed.

        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::updateSize): new method that will set
        m_size and m_sizeRespectingOrientation if necessary.
        (WebCore):
        (WebCore::BitmapImage::size):
        (WebCore::BitmapImage::sizeRespectingOrientation): these each
        now call updateSize rather than duplicate the update code.
        * platform/graphics/BitmapImage.h:
        (BitmapImage):

2012-06-22  Erik Arvidsson  <arv@chromium.org>

        [V8] Clean up visitDOMWrapper code
        https://bugs.webkit.org/show_bug.cgi?id=89774

        Reviewed by Tony Chang.

        This moves the check if domWrapperVisitorFunction is null into a function of the WrapperTypeInfo struct.
        This is so that users of WrapperTypeInfo does not need to know about the inner details of the struct.
        It also makes things more consistent since the other fields in the struct have these kind of functions.

        This is a follow up change to http://trac.webkit.org/changeset/120854.

        No new tests. Covered by existing tests.

        * bindings/v8/V8GCController.cpp:
        (WebCore::GrouperVisitor::visitDOMWrapper): Call WrapperTypeInfo::visitDOMWrapper instead.
        * bindings/v8/WrapperTypeInfo.h:
        (WrapperTypeInfo):
        (WebCore::WrapperTypeInfo::visitDOMWrapper): If domWrapperVisitorFunction is non null call it.

2012-06-22  Jan Keromnes  <janx@linux.com>

        Web Inspector: ExtensionPanel.onSearch listener doesn't work
        https://bugs.webkit.org/show_bug.cgi?id=89517

        Reviewed by Yury Semikhatsky.

        Added a test to see if listener fires on search:
        LayoutTests/inspector/extensions/extensions-panel.html

        * inspector/front-end/ExtensionPanel.js:
        (WebInspector.ExtensionPanel.prototype.searchCanceled):
        (WebInspector.ExtensionPanel.prototype.performSearch):
        (WebInspector.ExtensionPanel.prototype.jumpToNextSearchResult):
        (WebInspector.ExtensionPanel.prototype.jumpToPreviousSearchResult):

2012-06-22  Brian Salomon  <bsalomon@google.com>

        Increase the GrContext texture cache count cap to 2K
        https://bugs.webkit.org/show_bug.cgi?id=89761

        Reviewed by Stephen White.

        Tests: The change is for performance. The code is exercised by all the canvas 2d layout tests.

        * platform/chromium/support/GraphicsContext3DPrivate.cpp:

2012-06-22  Silvia Pfeiffer  <silviapf@chromium.org>

        [Chromium] Adjust the displayed elements of the new Chrome media controls.
        https://bugs.webkit.org/show_bug.cgi?id=89416

        Reviewed by Eric Carlson.

        No new tests - existing media tests cover these cases.

        Remove the volume slider for videos without audio or media resource.
        Display the transport bar for videos without a media resource.
        Don't show the fullscreen button for

        * html/shadow/MediaControlRootElementChromium.cpp:
        (WebCore::MediaControlRootElementChromium::reset):
        Don't display volume slider if media controller has no audio.
        Don't display fullscreen button if media controller supportsFullscreen().
        (WebCore::MediaControlRootElementChromium::reportedError):
        Don't hide the timeline for failed videos, e.g. where the resource doesn't load.

2012-06-22  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: [Elements] Right-clicking on whitespace should show the same context menu as right-clicking on the tag text
        https://bugs.webkit.org/show_bug.cgi?id=89766

        Reviewed by Vsevolod Vlasov.

        Explicitly check for the TreeElement.representedObject's nodeType()
        rather than for the event target's enclosing element class.
        Drive-by: do not consider the "collapsed node has children" ellipsis as a text node.

        * inspector/front-end/ElementsTreeOutline.js:
        (WebInspector.ElementsTreeOutline.prototype.populateContextMenu):

2012-06-22  Florin Malita  <fmalita@chromium.org>

        REGRESSION (Safari 5.1.5 - ToT): Crash in RenderSVGRoot::computeReplacedLogicalWidth
        https://bugs.webkit.org/show_bug.cgi?id=85797

        Reviewed by Darin Adler.

        Test: svg/custom/svg-width-intrinsic-crash.html

        RenderSVGRoot::computeReplacedLogicalWidth assumes that if
        SVGSVGElement::widthAttributeEstablishesViewport returns false, the
        SVG must be embedded via <object>. This is not always the case, though:
        widthAttributeEstablishesViewport can also return false for inline
        SVG if it doesn't have a replaced logical width.

        Updated computeReplacedLogical{Width,Height} to handle the
        !widthAttributeEstablishesViewport && !isEmbeddedThroughFrameContainingSVGDocument
        case gracefully.

        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth):
        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight):

2012-06-22  Hayato Ito  <hayato@chromium.org>

        Modify event re-targeting algorithm so that we can tell which distributed node is clicked.
        https://bugs.webkit.org/show_bug.cgi?id=89073

        Reviewed by Dimitri Glazkov.

        Re-landing r120945 since bug 89172 was resolved.

        Adopt a new event re-targeting algorithm in the latest Shadow DOM spec.
        The corresponding bug in the shadow DOM spec is:
        https://www.w3.org/Bugs/Public/show_bug.cgi?id=17090

        This change is introduced to handle the following use case:
        1. There is an insertion point, with zero or more nodes distributed into it.
        2. User clicks on one of the items.
        3. The event handler in shadow DOM subtree wants to know which item was clicked on.

        The new re-targeting algorithm sets an event's target to a
        distributed node where an event was originally fired, instead of
        an insertion point to where the node is distributed.

        The similar re-targeting algorithm also applies to an event's
        relatedTarget.

        Test: fast/dom/shadow/shadow-dom-event-dispatching.html

        * dom/EventDispatcher.cpp:
        (WebCore::EventRelatedTargetAdjuster::adjust):
        (WebCore::EventDispatcher::ensureEventAncestors):

2012-06-22  Andrey Kosyakov  <caseq@chromium.org>

        Unreviewed follow-up to r121030, fix display of "Duration" in timeline event details popup.

        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):

2012-06-22  Kenneth Russell  <kbr@google.com>

        Unreviewed, rolling out r121025.
        http://trac.webkit.org/changeset/121025
        https://bugs.webkit.org/show_bug.cgi?id=89580

        Caused crash in
        EventHandler.shouldTurnVerticalTicksIntoHorizontal webkit unit
        test on 10.7

        * page/EventHandler.cpp:
        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
        (WebCore::EventHandler::handleWheelEvent):
        * page/EventHandler.h:
        (EventHandler):
        * page/chromium/EventHandlerChromium.cpp:
        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
        * page/gtk/EventHandlerGtk.cpp:
        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):

2012-06-21  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: only increase length for timeline bars below minimal width
        https://bugs.webkit.org/show_bug.cgi?id=89727

        Reviewed by Pavel Feldman.

        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelineCalculator.prototype.computeBarGraphWindowPosition):
        (WebInspector.TimelineCalculator.prototype.setDisplayWindow):
        (WebInspector.TimelineRecordGraphRow.prototype.update):

2012-06-22  David Kilzer  <ddkilzer@apple.com>

        BUILD FIX: FormController.cpp fails to build on 32-bit architectures

        This fixes the following build failure introduced in r121004 for
        Bug 89628:

            FormController.cpp:62:36: error: implicit conversion loses integer precision: 'uint64_t' (aka 'unsigned long long') to 'size_t' (aka 'unsigned long') [-Werror,-Wshorten-64-to-32]
                state.m_values.reserveCapacity(valueSize);
                ~~~~~                          ^~~~~~~~~

        * html/FormController.cpp:
        (WebCore::FormControlState::deserialize): Change type of
        valueSize from uint64_t to size_t.

2012-06-22  Abhishek Arya  <inferno@chromium.org>

        Crash in DragController::concludeEditDrag.
        https://bugs.webkit.org/show_bug.cgi?id=89762

        Reviewed by Ryosuke Niwa.

        RefPtr the innerFrame since it can get destroyed due to mutation
        event fired in DragController::dispatchTextInputEventFor().

        Test: editing/pasteboard/drop-text-events-sideeffect-crash.html

        * page/DragController.cpp:
        (WebCore::DragController::concludeEditDrag):

2012-06-22  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: timeline event details popup misses CPU time
        https://bugs.webkit.org/show_bug.cgi?id=89765

        Reviewed by Pavel Feldman.

        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):

2012-06-22  Peter Beverloo  <peter@chromium.org>

        [Chromium] Disable c++0x compatibility warnings in JavaScriptCore.gyp when building for Android
        https://bugs.webkit.org/show_bug.cgi?id=88853

        Reviewed by Steve Block.

        The Android exclusions were necessary to fix a gyp generation error, as
        the gcc_version variable wasn't being defined for Android. Remove these
        exceptions when Chromium is able to define the gcc_version variable.

        * WebCore.gyp/WebCore.gyp:

2012-06-22  Takashi Sakamoto  <tasak@google.com>

        [Shadow] parentTreeScope() of nested shadow DOM subtree returns document().
        https://bugs.webkit.org/show_bug.cgi?id=89172

        Reviewed by Hajime Morita.

        Added setParentTreeScope to set parent treescope of shadow root to be
        host's treescope in ElementShadow::addShadowRoot.

        Test: fast/dom/shadow/parent-tree-scope-in-shadow.html

        * dom/ElementShadow.cpp:
        (WebCore::ElementShadow::addShadowRoot):
        Added setParentTreeScope.
        * testing/Internals.cpp:
        (WebCore::Internals::parentTreeScope):
        Newly added. This method returns a parent tree scope's root node of
        a given node, because a tree scope's root node is either document node
        or shadow root node and both nodes derive from TreeScope. So root nodes
        are treated as TreeScope.
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:
        Added parentTreeScope.

2012-06-22  Tony Chang  <tony@chromium.org>

        -webkit-flex-flow shouldn't be an enumerable property of the computed style
        https://bugs.webkit.org/show_bug.cgi?id=89698

        Reviewed by Ojan Vafai.

        flex-flow is a shorthand for flex-direction and flex-wrap:
        http://dev.w3.org/csswg/css3-flexbox/#flex-flow-property
        Shorthand properties should not be enumerable in the computed style, although you can still
        get the value from the computed style.

        Tests: css3/flexbox/css-properties.html: New test case added.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore):

2012-06-22  Robert Kroeger  <rjkroege@chromium.org>

        Suppress horizontal conversion of PlatformWheelEvents when hasPreciseScrollingDeltas is true
        https://bugs.webkit.org/show_bug.cgi?id=89580

        WebKit GTK and Chromium Linux force vertical wheel events to
        scroll horizontally when over horizontal scroll bars.  This is
        undesirable for touchpad scrolling with
        hasPreciseScrollingDeltas() == true. Modified shouldTurnVerticalTicksIntoHorizontal
        to not perform this conversion for PlatformWheelEvents with preciseScrollingDeltas.

        Reviewed by Adam Barth.

        Unit tests in EventHandlerTest.cpp

        * page/EventHandler.cpp:
        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal): 
        (WebCore::EventHandler::handleWheelEvent):
        * page/EventHandler.h:
        (EventHandler):
        * page/chromium/EventHandlerChromium.cpp:
        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
        * page/gtk/EventHandlerGtk.cpp:
        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):

2012-06-22  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: partially instrument DOM Tree native memory.
        https://bugs.webkit.org/show_bug.cgi?id=89568

        This patch adds MemoryInstrumentation class that counts all visited
        objects and calls reportMemoryUsage for the instrumented classes.

        Reviewed by Yury Semikhatsky.

        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/ScriptWrappable.h:
        (WebCore::ScriptWrappable::reportMemoryUsage):
        (ScriptWrappable):
        * bindings/v8/ScriptWrappable.h:
        (WebCore::ScriptWrappable::reportMemoryUsage):
        (ScriptWrappable):
        * css/StylePropertySet.h:
        (WebCore::StylePropertySet::reportMemoryUsage):
        (StylePropertySet):
        * dom/ContainerNode.h:
        (WebCore::ContainerNode::reportMemoryUsage):
        (ContainerNode):
        * dom/Element.h:
        (WebCore::Element::reportMemoryUsage):
        (Element):
        * dom/ElementAttributeData.h:
        (WebCore::ElementAttributeData::reportMemoryUsage):
        (ElementAttributeData):
        * dom/MemoryInstrumentation.h: Added.
        (WebCore):
        (MemoryInstrumentation):
        (WebCore::MemoryInstrumentation::~MemoryInstrumentation):
        (WebCore::MemoryInstrumentation::reportObject):
        (WebCore::MemoryInstrumentation::reportPointer):
        (MemoryObjectInfo):
        (WebCore::MemoryObjectInfo::MemoryObjectInfo):
        (WebCore::MemoryObjectInfo::reportInstrumentedPointer):
        (WebCore::MemoryObjectInfo::reportPointer):
        (WebCore::MemoryObjectInfo::reportInstrumentedObject):
        (WebCore::MemoryObjectInfo::reportObject):
        (WebCore::MemoryObjectInfo::reportObjectInfo):
        (WebCore::MemoryObjectInfo::objectType):
        (WebCore::MemoryObjectInfo::objectSize):
        (WebCore::MemoryInstrumentation::reportInstrumentedPointer):
        (WebCore::MemoryInstrumentation::reportInstrumentedObject):
        * dom/Node.cpp:
        (WebCore::Node::reportMemoryUsage):
        (WebCore):
        * dom/Node.h:
        (Node):
        * dom/QualifiedName.h:
        (WebCore::QualifiedName::QualifiedNameImpl::reportMemoryUsage):
        (WebCore::QualifiedName::reportMemoryUsage):
        * inspector/InspectorMemoryAgent.cpp:
        (MemoryBlockName):
        (WebCore):
        (WebCore::addMemoryBlockFor):
        (WebCore::domTreeInfo):
        (WebCore::memoryCacheInfo):
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
        * platform/TreeShared.h:
        (WebCore::TreeShared::reportMemoryUsage):
        (TreeShared):

2012-06-22  Peter Rybin  <peter.rybin@gmail.com>

        Web Inspector: Support 'Restart frame' in inspector frontend
        https://bugs.webkit.org/show_bug.cgi?id=89678

        Reviewed by Pavel Feldman.

        Action is added to call frame placard's context menu. Context menu is now built
        on a call frame level rather than on callback sidebar level.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/CallStackSidebarPane.js:
        (WebInspector.CallStackSidebarPane):
        (WebInspector.CallStackSidebarPane.prototype.update):
        (WebInspector.CallStackSidebarPane.Placard):
        (WebInspector.CallStackSidebarPane.Placard.prototype._update):
        (WebInspector.CallStackSidebarPane.Placard.prototype._placardContextMenu):
        (_restartFrame):
        * inspector/front-end/DebuggerModel.js:
        (WebInspector.DebuggerModel.prototype.rawLocationToUILocation):
        (WebInspector.DebuggerModel.prototype.callStackModified):
        (WebInspector.DebuggerModel.CallFrame.prototype.restart):
        * inspector/front-end/Script.js:
        (WebInspector.Script.prototype.editSource):

2012-06-22  Jocelyn Turcotte  <turcotte.j@gmail.com>

        [Qt] Fix the remote inspector loading problems on Mac
        https://bugs.webkit.org/show_bug.cgi?id=89747

        Reviewed by Simon Hausmann.

        Make sure that the state of a SocketStreamHandle is set properly
        when created from an existing QTcpSocket.

        This fixes the inspectorserver Qt api auto test on Mac.

        * platform/network/qt/SocketStreamHandleQt.cpp:
        (WebCore::SocketStreamHandle::SocketStreamHandle):

2012-06-22  Yoshifumi Inoue  <yosin@chromium.org>

        REGRESSION(r117738):[Forms] validationMessage IDL attribute should not have range overflow message if value isn't range overflow
        https://bugs.webkit.org/show_bug.cgi?id=89736

        Reviewed by Kent Tamura.

        Tests: fast/forms/date/input-date-validation-message.html
               fast/forms/number/input-number-validation-message.html
               fast/forms/range/input-range-validation-message.html

        This patch changes comparison operator for range overflow message in
        InputType::validationMessage().

        * html/InputType.cpp:
        (WebCore::InputType::validationMessage):

2012-06-22  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Add frontend-side Entry object to FileSystemModel
        https://bugs.webkit.org/show_bug.cgi?id=89739

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/FileSystemModel.js:
        (WebInspector.FileSystemModel.prototype._fileSystemRootReceived):
        (WebInspector.FileSystemModel.prototype.requestDirectoryContent):
        (WebInspector.FileSystemModel.prototype._directoryContentReceived):
        (WebInspector.FileSystemModel.FileSystem):
        (WebInspector.FileSystemModel.Entry):
        (WebInspector.FileSystemModel.Entry.prototype.get fileSystemModel):
        (WebInspector.FileSystemModel.Entry.prototype.get fileSystem):
        (WebInspector.FileSystemModel.Entry.prototype.get url):
        (WebInspector.FileSystemModel.Entry.prototype.get name):
        (WebInspector.FileSystemModel.Entry.prototype.get isDirectory):
        (WebInspector.FileSystemModel.Directory):
        (WebInspector.FileSystemModel.Directory.prototype.requestDirectoryContent):
        (WebInspector.FileSystemModel.File):
        (WebInspector.FileSystemModel.File.prototype.get mimeType):
        (WebInspector.FileSystemModel.File.prototype.get resourceType):

2012-06-22  Amy Ousterhout  <aousterh@chromium.org>

        Renamed DeviceOrientation to DeviceOrientationData
        https://bugs.webkit.org/show_bug.cgi?id=88663

        Reviewed by Steve Block.

        No new tests because this is simply a name change.

        Renamed DeviceOrientation to DeviceOrientationData in order to be consistent with DeviceMotionData.
        Updated all files that use DeviceOrientation.
  
        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.exp.in:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSDeviceOrientationEventCustom.cpp:
        (WebCore::JSDeviceOrientationEvent::initDeviceOrientationEvent):
        * bindings/v8/custom/V8DeviceOrientationEventCustom.cpp:
        (WebCore::V8DeviceOrientationEvent::initDeviceOrientationEventCallback):
        * dom/DOMAllInOne.cpp:
        * dom/DeviceOrientationClient.h:
        (WebCore):
        (DeviceOrientationClient):
        * dom/DeviceOrientationController.cpp:
        (WebCore::DeviceOrientationController::timerFired):
        (WebCore::DeviceOrientationController::didChangeDeviceOrientation):
        * dom/DeviceOrientationController.h:
        (WebCore):
        (DeviceOrientationController):
        * dom/DeviceOrientationData.cpp: Renamed from Source/WebCore/dom/DeviceOrientation.cpp.
        (WebCore):
        (WebCore::DeviceOrientationData::create):
        (WebCore::DeviceOrientationData::DeviceOrientationData):
        (WebCore::DeviceOrientationData::alpha):
        (WebCore::DeviceOrientationData::beta):
        (WebCore::DeviceOrientationData::gamma):
        (WebCore::DeviceOrientationData::absolute):
        (WebCore::DeviceOrientationData::canProvideAlpha):
        (WebCore::DeviceOrientationData::canProvideBeta):
        (WebCore::DeviceOrientationData::canProvideGamma):
        (WebCore::DeviceOrientationData::canProvideAbsolute):
        * dom/DeviceOrientationData.h: Renamed from Source/WebCore/dom/DeviceOrientation.h.
        (WebCore):
        (DeviceOrientationData):
        * dom/DeviceOrientationEvent.cpp:
        (WebCore::DeviceOrientationEvent::DeviceOrientationEvent):
        (WebCore::DeviceOrientationEvent::initDeviceOrientationEvent):
        * dom/DeviceOrientationEvent.h:
        (WebCore):
        (WebCore::DeviceOrientationEvent::create):
        (DeviceOrientationEvent):
        (WebCore::DeviceOrientationEvent::orientation):
        * loader/EmptyClients.h:
        (WebCore::EmptyDeviceOrientationClient::lastOrientation):
        * platform/mock/DeviceOrientationClientMock.cpp:
        (WebCore::DeviceOrientationClientMock::setOrientation):
        * platform/mock/DeviceOrientationClientMock.h:
        (WebCore::DeviceOrientationClientMock::lastOrientation):
        (DeviceOrientationClientMock):
        * platform/qt/DeviceOrientationClientQt.cpp:
        (DeviceOrientationClientQt):
        * platform/qt/DeviceOrientationClientQt.h:
        (DeviceOrientationClientQt):
        * platform/qt/DeviceOrientationProviderQt.h:
        (DeviceOrientationProviderQt):
 
2012-06-21  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Support separate script compilation and execution.
        https://bugs.webkit.org/show_bug.cgi?id=89646

        Reviewed by Pavel Feldman.

        Separate script compilation and run commands added to protocol and DebuggerAgent.
        Separate script compilation and run implemented in v8 ScriptDebugServer, stubs added for js implementation.

        Test: inspector/debugger/debugger-compile-and-run.html

        * bindings/js/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::compileScript):
        (WebCore):
        (WebCore::ScriptDebugServer::clearCompiledScripts):
        (WebCore::ScriptDebugServer::runScript):
        * bindings/js/ScriptDebugServer.h:
        (WebCore::ScriptDebugServer::supportsSeparateScriptCompilationAndExecution):
        (ScriptDebugServer):
        * bindings/v8/PageScriptDebugServer.cpp:
        (WebCore::PageScriptDebugServer::compileScript):
        (WebCore):
        (WebCore::PageScriptDebugServer::clearCompiledScripts):
        (WebCore::PageScriptDebugServer::runScript):
        * bindings/v8/PageScriptDebugServer.h:
        (PageScriptDebugServer):
        * bindings/v8/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::compileScript):
        (WebCore):
        (WebCore::ScriptDebugServer::clearCompiledScripts):
        (WebCore::ScriptDebugServer::runScript):
        * bindings/v8/ScriptDebugServer.h:
        (WebCore):
        (WebCore::ScriptDebugServer::supportsSeparateScriptCompilationAndExecution):
        (ScriptDebugServer):
        * inspector/Inspector.json:
        * inspector/InspectorDebuggerAgent.cpp:
        (WebCore::InspectorDebuggerAgent::disable):
        (WebCore::InspectorDebuggerAgent::supportsSeparateScriptCompilationAndExecution):
        (WebCore):
        (WebCore::InspectorDebuggerAgent::compileScript):
        (WebCore::InspectorDebuggerAgent::runScript):
        * inspector/InspectorDebuggerAgent.h:
        (InspectorDebuggerAgent):
        (WebCore::InspectorDebuggerAgent::injectedScriptManager):
        * inspector/PageDebuggerAgent.cpp:
        (WebCore::PageDebuggerAgent::injectedScriptForEval):
        (WebCore):
        * inspector/PageDebuggerAgent.h:
        (PageDebuggerAgent):
        * inspector/WorkerDebuggerAgent.cpp:
        (WebCore::WorkerDebuggerAgent::injectedScriptForEval):
        (WebCore):
        * inspector/WorkerDebuggerAgent.h:
        (WorkerDebuggerAgent):
        * inspector/front-end/Settings.js:
        * inspector/front-end/inspector.js:
        (WebInspector.doLoadedDone):

2012-06-22  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: InspectorState::updateCookie should not do JSON serialization if unsupported
        https://bugs.webkit.org/show_bug.cgi?id=89743

        Since all InspectorClient's are InspectorStateClient's provide a
        virtual accessor that determines whether or not InspectorClient updates
        are supported or not.

        Reviewed by Yury Semikhatsky.

        * inspector/InspectorState.cpp:
        (WebCore::InspectorState::updateCookie):
        Don't serialize and message the client if the client doesn't do anything with it.

        * inspector/InspectorStateClient.h:
        * inspector/WorkerInspectorController.cpp:
        (WebCore::InspectorStateClient::supportsInspectorStateUpdates):
        Let the client say whether or not supports updates or not.

2012-06-21  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120982.
        http://trac.webkit.org/changeset/120982
        https://bugs.webkit.org/show_bug.cgi?id=89740

        [chromium] ASSERTION FAILED:
        m_allocatedTextureIds.contains(textureId) (Requested by ukai
        on #webkit).

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererGpuMemoryAllocationChangedCallbackAdapter::onGpuMemoryAllocationChangedOnImpl):
        (WebCore::LayerRendererChromium::LayerRendererChromium):
        (WebCore::LayerRendererChromium::initialize):
        (WebCore::LayerRendererChromium::setVisible):
        (WebCore::LayerRendererChromium::swapBuffers):
        (WebCore::LayerRendererChromium::getFramebufferPixels):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (WebCore):
        (LayerRendererChromium):
        * platform/graphics/chromium/TextureManager.cpp:
        * platform/graphics/chromium/TextureManager.h:
        (TextureAllocator):
        (TextureManager):
        * platform/graphics/chromium/TrackingTextureAllocator.cpp:
        (WebCore::TrackingTextureAllocator::createTexture):
        (WebCore::TrackingTextureAllocator::deleteTexture):
        * platform/graphics/chromium/TrackingTextureAllocator.h:
        (TrackingTextureAllocator):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
        (WebCore::CCLayerTreeHost::setNeedsForcedCommit):
        (WebCore):
        (WebCore::CCLayerTreeHost::setVisible):
        (WebCore::CCLayerTreeHost::setContentsMemoryAllocationLimitBytes):
        (WebCore::CCLayerTreeHost::updateLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::commitComplete):
        (WebCore::CCLayerTreeHostImpl::canDraw):
        (WebCore::CCLayerTreeHostImpl::context):
        (WebCore::CCLayerTreeHostImpl::setContentsMemoryAllocationLimitBytes):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImplClient):
        (WebCore::CCLayerTreeHostImpl::sourceFrameCanBeDrawn):
        (WebCore::CCLayerTreeHostImpl::setSourceFrameCanBeDrawn):
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCProxy.h:
        (CCProxy):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (CCRendererClient):
        * platform/graphics/chromium/cc/CCScheduler.cpp:
        (WebCore::CCScheduler::beginFrameComplete):
        (WebCore::CCScheduler::didSwapBuffersComplete):
        (WebCore::CCScheduler::didLoseContext):
        (WebCore::CCScheduler::didRecreateContext):
        (WebCore::CCScheduler::vsyncTick):
        * platform/graphics/chromium/cc/CCScheduler.h:
        (CCScheduler):
        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h:
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::setNeedsForcedCommit):
        (WebCore):
        (WebCore::CCSingleThreadProxy::stop):
        (WebCore::CCSingleThreadProxy::postSetContentsMemoryAllocationLimitBytesToMainThreadOnImplThread):
        (WebCore::CCSingleThreadProxy::commitAndComposite):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        (CCSingleThreadProxy):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::CCThreadProxy):
        (WebCore::CCThreadProxy::compositeAndReadback):
        (WebCore::CCThreadProxy::setNeedsForcedCommit):
        (WebCore):
        (WebCore::CCThreadProxy::postSetContentsMemoryAllocationLimitBytesToMainThreadOnImplThread):
        (WebCore::CCThreadProxy::scheduledActionBeginFrame):
        (WebCore::CCThreadProxy::beginFrame):
        (WebCore::CCThreadProxy::scheduledActionDrawAndSwapInternal):
        (WebCore::CCThreadProxy::setContentsMemoryAllocationLimitBytes):
        (WebCore::CCThreadProxy::layerTreeHostClosedOnImplThread):
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (CCThreadProxy):
        (BeginFrameAndCommitState):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
        (WebCore::CCVideoLayerImpl::willDraw):
        (WebCore::CCVideoLayerImpl::willDrawInternal):
        (WebCore::CCVideoLayerImpl::FramePlane::allocateData):
        (WebCore::CCVideoLayerImpl::FramePlane::freeData):
        (WebCore::CCVideoLayerImpl::allocatePlaneData):
        (WebCore::CCVideoLayerImpl::freePlaneData):
        (WebCore::CCVideoLayerImpl::freeUnusedPlaneData):
        (WebCore::CCVideoLayerImpl::didLoseContext):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
        (FramePlane):

2012-06-21  Kent Tamura  <tkent@chromium.org>

        Make FormControlState capable to store multiple values
        https://bugs.webkit.org/show_bug.cgi?id=89628

        Reviewed by Hajime Morita.

        Make FormControlState capable to store multiple values in order to
        clean FileInputType.cpp up and prepare to fix Bug 89623.

        No new tests. This doesn't change web-exposed behavior, and
        fast/forms/file/recover-file-input-in-unposted-form.html covers
        major part of this change.

        * html/FormController.cpp:
        (WebCore::FormControlState::serializeTo): Support for two or more values.
        (WebCore::FormControlState::deserialize): ditto.
        (WebCore::formStateSignature):
        Bump up the version because the state format for <input type=file> is changed.
        * html/FormController.h:
         - String m_value -> Vector<String> m_values
         - Add some functions.
         - Remove hasValue() and value().
        (WebCore::FormControlState::FormControlState): m_value -> m_values.
        (WebCore::FormControlState::valueSize): Added.
        (WebCore::FormControlState::operator[]): Added.
        (FormControlState): Add append() declaration, etc.
        (WebCore::FormControlState::operator=): m_value -> m_values
        (WebCore::FormControlState::append): Added.

        * html/HTMLFormControlElementWithState.cpp:
        (WebCore::HTMLFormControlElementWithState::finishParsingChildren):
        Use valueSize() instead of hasValue().
        * html/HTMLFormControlElementWithState.h:
        (HTMLFormControlElementWithState): Update the comment.

        * html/FileInputType.cpp:
        (WebCore::FileInputType::saveFormControlState):
        Use multiple value capability of FormControlState
        (WebCore::FileInputType::restoreFormControlState): ditto.

        * html/BaseCheckableInputType.cpp:
        (WebCore::BaseCheckableInputType::restoreFormControlState): Use [0] instead of value().
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::restoreFormControlState): ditto.
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::restoreFormControlState): ditto.
        * html/HiddenInputType.cpp:
        (WebCore::HiddenInputType::restoreFormControlState): ditto.
        * html/InputType.cpp:
        (WebCore::InputType::restoreFormControlState): ditto.

2012-06-21  Ryosuke Niwa  <rniwa@webkit.org>

        LabelsNodeList isn't updated properly after its owner node is adopted into a new document
        https://bugs.webkit.org/show_bug.cgi?id=89730

        Reviewed by Darin Adler.

        When a node is adopted, node lists that are invalidated at document level need to be unregistered
        from old document and registered to new document so that DOM mutations in new document will invalidate
        caches in the node lists. Done that in NodeListsNodeData::adoptTreeScope, which was extracted from
        TreeScopeAdopter::moveTreeToNewScope.

        Also renamed DynamicNodeList::node() and m_node to rootNode() and m_ownerNode to better express
        their semantics and added ownerNode() to make m_ownerNode private to DynamicNodeList.

        Test: fast/forms/label/labels-owner-node-adopted.html

        * bindings/js/JSNodeListCustom.cpp:
        (WebCore::JSNodeListOwner::isReachableFromOpaqueRoots):
        * dom/ChildNodeList.cpp:
        (WebCore::ChildNodeList::~ChildNodeList):
        (WebCore::ChildNodeList::length):
        (WebCore::ChildNodeList::item):
        (WebCore::ChildNodeList::nodeMatches):
        * dom/ClassNodeList.cpp:
        (WebCore::ClassNodeList::ClassNodeList):
        (WebCore::ClassNodeList::~ClassNodeList):
        * dom/DynamicNodeList.cpp:
        (WebCore::DynamicSubtreeNodeList::length):
        (WebCore::DynamicSubtreeNodeList::itemForwardsFromCurrent):
        (WebCore::DynamicSubtreeNodeList::itemBackwardsFromCurrent):
        (WebCore::DynamicSubtreeNodeList::item):
        (WebCore::DynamicNodeList::itemWithName):
        * dom/DynamicNodeList.h:
        (WebCore::DynamicNodeList::DynamicNodeList):
        (WebCore::DynamicNodeList::ownerNode):
        (WebCore::DynamicNodeList::rootedAtDocument):
        (WebCore::DynamicNodeList::shouldInvalidateOnAttributeChange):
        (WebCore::DynamicNodeList::rootNode):
        (WebCore::DynamicNodeList::document):
        (DynamicNodeList):
        * dom/NameNodeList.cpp:
        (WebCore::NameNodeList::~NameNodeList):
        * dom/NodeRareData.h:
        (WebCore::NodeListsNodeData::adoptTreeScope):
        (NodeListsNodeData):
        * dom/TagNodeList.cpp:
        (WebCore::TagNodeList::~TagNodeList):
        * dom/TreeScopeAdopter.cpp:
        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
        * html/LabelsNodeList.cpp:
        (WebCore::LabelsNodeList::~LabelsNodeList):
        (WebCore::LabelsNodeList::nodeMatches):
        * html/RadioNodeList.cpp:
        (WebCore::RadioNodeList::~RadioNodeList):
        (WebCore::RadioNodeList::checkElementMatchesRadioNodeListFilter):

2012-06-21  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Properly display native memory sizes bigger than 2GB
        https://bugs.webkit.org/show_bug.cgi?id=89661

        Reviewed by Pavel Feldman.

        * inspector/Inspector.json:
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore::jsHeapInfo):
        (WebCore::inspectorData):
        (WebCore::renderTreeInfo):
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):

2012-06-21  Abhishek Arya  <inferno@chromium.org>

        Crash in RenderBlock::layoutPositionedObjects.
        https://bugs.webkit.org/show_bug.cgi?id=89599

        Reviewed by Julien Chaffraix.

        Test: fast/table/table-split-positioned-object-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::splitBlocks): no longer need to explicitly call
        removePositionedObjects, since it is part of moveChildrenTo.
        * rendering/RenderBlock.h:
        (WebCore::RenderBlock::hasPositionedObjects): helper to tell if we have
        positioned objects in our list.
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::splitAnonymousBoxesAroundChild): Like r102263, this
        condition was wrong and while moving children across completely different 
        trees, we need fullRemoveInsert as true.
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::moveChildTo): see code comment.
        (WebCore::RenderBoxModelObject::moveChildrenTo): see code comment. 

2012-06-21  Kwang Yul Seo  <skyul@company100.net>

        Make HTMLDocumentParser::create(DocumentFragment*,Element*, FragmentScriptingPermission) private.
        https://bugs.webkit.org/show_bug.cgi?id=89724

        Reviewed by Darin Adler.

        It is used only by HTMLDocumentParser::parseDocumentFragment. No behavioral changes.

        * html/parser/HTMLDocumentParser.h:
        (WebCore::HTMLDocumentParser::create):
        (HTMLDocumentParser):

2012-06-21  Kalev Lember  <kalevlember@gmail.com>

        [GTK] Use the empty plugin support on non-X11 and non-Windows platforms
        https://bugs.webkit.org/show_bug.cgi?id=89501

        Reviewed by Martin Robinson.

        The GTK+ port doesn't currently support NPAPI plugins on platforms other
        than X11 or Windows. Using PluginPackageNone and PluginViewNone makes it
        easier to build it on other platforms and also allows us to drop some
        ifdefs from PluginPackageGtk and PluginViewGtk.

        * GNUmakefile.list.am:

2012-06-21  Shinya Kawanaka  <shinyak@chromium.org>

        [Shadow][Editing] Assertion in VisibleSelection::adjuseSelectionToAvoidCrossingBoundaries() is triggered.
        https://bugs.webkit.org/show_bug.cgi?id=89081

        Reviewed by Ryosuke Niwa.

        firstEditablePositionAfterPositionInRoot and lastEditablePositionBeforePositionInRoot did not
        consider a case that an argument hiehestRoot can be in Shadow DOM. So when adjusting selection to
        avoid crossing editing boundaries, VisiblePosition can break shadow boundaries, and it causes
        an assertion trigger.

        By this patch, firstEditablePositionAfterPositionInRoot and lastEditablePositionBeforePositionInRoot will
        adjust position to the tree scope of highestRoot instead of its parent tree scope.

        Test: editing/shadow/adjusting-editing-boundary-with-table-in-shadow.html

        * editing/htmlediting.cpp:
        (WebCore::firstEditablePositionAfterPositionInRoot):
        (WebCore::lastEditablePositionBeforePositionInRoot):

2012-06-21  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: exception in TimelinePresentationModel when recording timeline
        https://bugs.webkit.org/show_bug.cgi?id=89716

        Reviewed by Pavel Feldman.

        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline.processRecord):
        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.prototype.filteredRecords):
        (WebInspector.TimelinePresentationModel.prototype.isVisible):

2012-06-21  Oli Lan  <olilan@chromium.org>

        Add methods to select between offsets in an editable field.
        https://bugs.webkit.org/show_bug.cgi?id=89098

        Reviewed by Ryosuke Niwa.

        Reviewed by Ryosuke Niwa.

        Adds a new method setSelectionOffsets to Editor. This selects between
        the two integer offsets provided in the node currently being edited,
        assuming the offsets are given relative to the rootEditableElement.
        If no node or field is currently being edited, the method returns false.
        
        Test: a new test has been added to the chromium port's WebViewTest that
        calls this via WebViewImpl::setSelectionEditableOffsets.
        
        * editing/Editor.cpp:
        (WebCore::Editor::setSelectionOffsets):
        (WebCore):
        * editing/Editor.h:
        (Editor):

2012-06-21  Julien Chaffraix  <jchaffraix@webkit.org>

        Add support for the grid and inline-grid display types.
        https://bugs.webkit.org/show_bug.cgi?id=60732

        Reviewed by Tony Chang.

        Tests: fast/css-grid-layout/containing-block-grids-expected.html
               fast/css-grid-layout/containing-block-grids.html
               fast/css-grid-layout/floating-empty-grids-expected.html
               fast/css-grid-layout/floating-empty-grids.html

        Based on an earlier patch by David Hyatt <hyatt@apple.com>.

        Added the first renderer for grid elements.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        Added RenderGrid files to the build systems.

        * rendering/RenderGrid.cpp: Added.
        (WebCore::RenderGrid::RenderGrid):
        (WebCore::RenderGrid::~RenderGrid):
        (WebCore::RenderGrid::layoutBlock):
        (WebCore::RenderGrid::renderName):
        * rendering/RenderGrid.h: Added.
        (RenderGrid):
        Skeleton renderer for now.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::createObject):
        Return our new RenderGrid for our 2 new |display| values.

        * rendering/style/RenderStyle.h:
        Added INLINE_GRID to the inline and replaced types.

2012-06-21  Ryosuke Niwa  <rniwa@webkit.org>

        Clang build fix.

        * dom/NodeRareData.h:

2012-06-19  James Robinson  <jamesr@chromium.org>

        [chromium] LayerRendererChromium is not getting visibility messages in single threaded compositing mode.
        https://bugs.webkit.org/show_bug.cgi?id=89045

        Reviewed by Adrienne Walker.

        Based on patch by Michal Mocny <mmocny@google.com>.

        Invariants:

        1.) We never commit (paint, animate, any of it) when not visible on the main thread -except- for
        compositeAndReadback, regardless of threaded vs non-threaded mode
        2.) CCLayerTreeHost::m_contentsTextureManager's memory budget is only set by updateLayers() when we are going to
        make a frame and is always set to a non-zero value
        3.) Zero-sized allocations from the GPU process are always serviced immediately on the impl thread.  Non-zero
        allocations are met in the next frame, whenever we would produce that frame according to our usual frame
        scheduling logic.
        4.) The impl thread always knows the set of currently-allocated managed texture IDs and can delete them all
        whenever it likes without needing the main thread to be responsive.

        Details:

        There are two main changes - tweaking how the contents texture manager's budget is handled and tweaking frame
        scheduling for the !visible case.

        The scheduling change is a bit more subtle but it unifies the single and multi threaded paths and is really
        important.  Except for compositeAndReadback (which I'll talk about below), we simply won't produce frames when
        not visible.  This already happens in the single threaded path thanks to render_widget so the only change is to
        the threaded path.  The difficulty here is we might post a beginFrame task from the impl thread and then get a
        setVisible(false) call on the main thread before the beginFrame task runs.  Since I'm making the setVisible()
        call a blocking call from main thread -> impl thread, when the beginFrame task eventually does run on the main
        thread we can know that the impl thread's notion of visibility is in sync with the main threads.  Thus I'm
        planning to simply abort the frame before doing any processing on the main thread.  The scheduler will know if
        it gets a beginFrameAborted and COMMIT_STATE_IDLE.

        compositeAndReadback is special - this call currently does come in when we aren't visible (in single and
        threaded mode) and we need to service it.  In particular, we need to send a beginFrame over and have it
        not be ignored on the main thread.  For this I'm thinking of having the proxy keep track of whether it's
        servicing a compositeAndReadback() and use that bit on the main thread to know to process the beginFrame
        normally.  On the impl side, we need a few changes.  First, we have to allocate a default framebuffer
        (ensureFramebufferCHROMIUM) even if we've dropped it previously and remember to discard it after the
        readPixels().  Second, we have to provide a non-zero contents texture allocation on the beginFrame message, and
        again remember to delete the textures after the readPixels().  Third, we have to know that the beginFrame is a
        forced frame so when we get the beginFrameComplete we go ahead with the rest of the frame.  For this, I think
        I'll have to add ACTION_BEGIN_FORCED_FRAME and a corresponding COMMIT_STATE_FORCED_FRAME_IN_PROGRESS so the
        scheduler can keep track of the magicness of this frame, and then add some logic after the readpixels call to
        drop resources after the readback.  It's probably a good time to stop swapping on readbacks too....

        The contents texture manager's budget is only relevant when we want to make a frame, so it's now passed in on
        the updateLayers().  Since we only make frames when we are visible and we never have a zero allocation when
        visible (thanks to the frame scheduling changes above), this value is always non-zero.  The other thing the
        texture manager needs to know about is if we've killed all of the underlying textures from the impl thread -
        this bit is passed in by the proxy before the updateLayers() call.  This means if we're running while visible
        and the manager wants to decrease our budget to something other than zero, we'll get a new (non-zero) allocation
        on the impl thread, schedule a frame, then when it's time to make the frame pass the new lower limit in to
        updateLayers(), then have the contents texture manager evict down to our new limit and make a frame with the new
        budget.  When the commit completes we'll get notified on the impl thread of which textures the contents texture
        manager decided to evict and issue the deleteTexture() calls on them.

        The texture budget we pass in will be based on the most recent non-zero memory allocation we received from the
        GPU memory manager, or some default value I'll pull out my ass if we haven't heard anything yet.  On compositor
        initialization, we can't afford to wait for a round-trip through the GPU process to get a budget for the first
        frame.  I don't think handling a decrease to a non-zero budget on a visible tab needs to be terribly urgent - we
        can get to it when we get to making the next frame.  If we wanted to satisfy reduced texture budgets directly
        from the impl thread, we could keep a priority-list ordered set of textures once we have priorities and delete
        based on that.  Let's worry about that later.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererGpuMemoryAllocationChangedCallbackAdapter::onGpuMemoryAllocationChangedOnImpl):
        (WebCore::LayerRendererChromium::LayerRendererChromium):
        (WebCore::LayerRendererChromium::initialize):
        (WebCore::LayerRendererChromium::setVisible):
        (WebCore::LayerRendererChromium::setGpuMemoryAllocation):
        (WebCore):
        (WebCore::LayerRendererChromium::swapBuffers):
        (WebCore::LayerRendererChromium::getFramebufferPixels):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (WebCore):
        (LayerRendererChromium):
        * platform/graphics/chromium/TextureManager.cpp:
        (WebCore::TextureManager::evictAndRemoveAllDeletedTextures):
        (WebCore):
        * platform/graphics/chromium/TextureManager.h:
        (TextureAllocator):
        (TextureManager):
        * platform/graphics/chromium/TrackingTextureAllocator.cpp:
        (WebCore::TrackingTextureAllocator::createTexture):
        (WebCore::TrackingTextureAllocator::deleteTexture):
        (WebCore):
        (WebCore::TrackingTextureAllocator::deleteAllTextures):
        * platform/graphics/chromium/TrackingTextureAllocator.h:
        (TrackingTextureAllocator):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
        (WebCore::CCLayerTreeHost::setVisible):
        (WebCore::CCLayerTreeHost::evictAllContentTextures):
        (WebCore::CCLayerTreeHost::updateLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::commitComplete):
        (WebCore::CCLayerTreeHostImpl::canDraw):
        (WebCore::CCLayerTreeHostImpl::context):
        (WebCore::CCLayerTreeHostImpl::releaseContentsTextures):
        (WebCore):
        (WebCore::CCLayerTreeHostImpl::setMemoryAllocationLimitBytes):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImplClient):
        (WebCore::CCLayerTreeHostImpl::contentsTexturesWerePurgedSinceLastCommit):
        (WebCore::CCLayerTreeHostImpl::memoryAllocationLimitBytes):
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCProxy.h:
        (CCProxy):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (CCRendererClient):
        * platform/graphics/chromium/cc/CCScheduler.cpp:
        (WebCore::CCScheduler::beginFrameComplete):
        (WebCore::CCScheduler::beginFrameAborted):
        (WebCore):
        (WebCore::CCScheduler::didSwapBuffersComplete):
        (WebCore::CCScheduler::didLoseContext):
        (WebCore::CCScheduler::didRecreateContext):
        (WebCore::CCScheduler::vsyncTick):
        * platform/graphics/chromium/cc/CCScheduler.h:
        (CCScheduler):
        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
        (WebCore::CCSchedulerStateMachine::beginFrameAborted):
        (WebCore):
        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h:
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::setVisible):
        (WebCore):
        (WebCore::CCSingleThreadProxy::stop):
        (WebCore::CCSingleThreadProxy::commitAndComposite):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        (CCSingleThreadProxy):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::CCThreadProxy):
        (WebCore::CCThreadProxy::compositeAndReadback):
        (WebCore::CCThreadProxy::setVisible):
        (WebCore):
        (WebCore::CCThreadProxy::setVisibleOnImplThread):
        (WebCore::CCThreadProxy::scheduledActionBeginFrame):
        (WebCore::CCThreadProxy::beginFrame):
        (WebCore::CCThreadProxy::beginFrameAbortedOnImplThread):
        (WebCore::CCThreadProxy::scheduledActionDrawAndSwapInternal):
        (WebCore::CCThreadProxy::layerTreeHostClosedOnImplThread):
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (CCThreadProxy):
        (BeginFrameAndCommitState):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
        (WebCore::CCVideoLayerImpl::willDraw):
        (WebCore::CCVideoLayerImpl::willDrawInternal):
        (WebCore::CCVideoLayerImpl::FramePlane::allocateData):
        (WebCore::CCVideoLayerImpl::FramePlane::freeData):
        (WebCore::CCVideoLayerImpl::allocatePlaneData):
        (WebCore::CCVideoLayerImpl::freePlaneData):
        (WebCore::CCVideoLayerImpl::freeUnusedPlaneData):
        (WebCore::CCVideoLayerImpl::didLoseContext):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
        (FramePlane):

2012-06-20  Ryosuke Niwa  <rniwa@webkit.org>

        Shrink NodeListsNodeData
        https://bugs.webkit.org/show_bug.cgi?id=89036

        Reviewed by Andreas Kling.

        Replaced 6 hash maps of AtomicString, String, and RefPtr<QualifiedName::QualifiedNameImpl> and a raw pointer
        by 3 hash maps of std::pair<unsigned short, AtomicString>, std::pair<unsigned short, String>, and QualifiedName,
        to halve the NodeListsNodeData's size (Reduced from 7 pointers to 3 pointers). Made those hash maps private and
        added addCacheWith* and removeCacheWith* member functions to reduce the code duplication.

        Also got rid of removeCached*NodeList member functions from Node and Document now that DynamicSubtreeNodeList can
        simply call nodeLists()->removeCacheWith* on m_node.

        * dom/ChildNodeList.cpp:
        (WebCore::ChildNodeList::ChildNodeList):
        * dom/ClassNodeList.cpp:
        (WebCore::ClassNodeList::~ClassNodeList):
        * dom/Document.cpp:
        (WebCore::Document::getItems): Use addCacheWithName.
        * dom/Document.h: Got rid of removeCachedMicroDataItemList.
        (Document):
        * dom/DynamicNodeList.cpp:
        (WebCore): Moved the constructor to the header file.
        * dom/DynamicNodeList.h: Added NodeListType and InvalidationType to be used in NodeListsNodeData.
        (WebCore::DynamicNodeList::DynamicNodeList): Takes the invalidation type.
        (WebCore::DynamicNodeList::document): Added.
        (WebCore::DynamicNodeList::shouldInvalidateOnAttributeChange): Added.
        (WebCore::DynamicNodeList::Caches::Caches): Added shouldInvalidateOnAttributeChange to retain the invalidation type.
        (Caches):
        (WebCore::DynamicSubtreeNodeList::DynamicSubtreeNodeList):
        * dom/MicroDataItemList.cpp:
        (WebCore::MicroDataItemList::~MicroDataItemList):
        * dom/NameNodeList.cpp:
        (WebCore::NameNodeList::NameNodeList):
        (WebCore::NameNodeList::~NameNodeList):
        (WebCore::NameNodeList::nodeMatches):
        * dom/NameNodeList.h:
        (WebCore):
        (NameNodeList):
        (WebCore::NameNodeList::create):
        * dom/Node.cpp:
        (WebCore::Node::nodeLists): Added so that node lists can directly call removeCacheWith*.
        (WebCore::Node::getElementsByTagName):
        (WebCore::Node::getElementsByTagNameNS):
        (WebCore::Node::getElementsByName):
        (WebCore::Node::getElementsByClassName):
        (WebCore::Node::radioNodeList):
        (WebCore::NodeListsNodeData::invalidateCaches): Merged invalidateCachesThatDependOnAttributes. The function takes
        the attribute name to avoid invalidating tag node lists when only attributes are modified. Also, now we have exactly
        three hash maps to invalidate: m_atomicNameCaches, m_nameCaches, and m_tagNodeListCacheNS.
        (WebCore): NodeListsNodeData::isEmpty is moved to NodeRareData.h.
        * dom/Node.h:
        (WebCore):
        (Node):
        * dom/NodeRareData.h:
        (NodeListsNodeData):
        (WebCore::NodeListsNodeData::addCacheWithAtomicName):
        (WebCore::NodeListsNodeData::addCacheWithName):
        (WebCore::NodeListsNodeData::addCacheWithQualifiedName):
        (WebCore::NodeListsNodeData::removeCacheWithAtomicName):
        (WebCore::NodeListsNodeData::removeCacheWithName):
        (WebCore::NodeListsNodeData::removeCacheWithQualifiedName):
        (WebCore::NodeListsNodeData::isEmpty): Moved from Node.cpp now that this function is much shorter.
        (WebCore::NodeListsNodeData::NodeListsNodeData):
        (WebCore::NodeListsNodeData::namedNodeListKey): Helper member functions to obtain the key for AtomicString and
        String hash maps.
        * dom/TagNodeList.cpp:
        (WebCore::TagNodeList::TagNodeList):
        (WebCore::TagNodeList::~TagNodeList):
        (WebCore::HTMLTagNodeList::HTMLTagNodeList): Hard code namespaceURI = starAtom since other values are never used.
        (WebCore::HTMLTagNodeList::nodeMatches): Given that, assert m_namespace == starAtom.
        * dom/TagNodeList.h:
        (WebCore::TagNodeList::create): Add a new version of create that doesn't take namespace (assume starAtom) so that
        addCacheWithAtomicName works with this class.
        (WebCore::HTMLTagNodeList::create): Removed namespaceURI from the argument list since it's always starAtom.
        (HTMLTagNodeList):
        * html/LabelableElement.cpp:
        (WebCore::LabelableElement::labels):
        * html/LabelsNodeList.cpp:
        (WebCore::LabelsNodeList::LabelsNodeList): Removed redundant m_forNode (identical to m_node in DynamicNodeList).
        (WebCore::LabelsNodeList::~LabelsNodeList):
        (WebCore::LabelsNodeList::nodeMatches):
        * html/LabelsNodeList.h:
        (WebCore::LabelsNodeList::create):
        (LabelsNodeList):
        * html/RadioNodeList.cpp:
        (WebCore::RadioNodeList::RadioNodeList): Removed redundant m_baseElement (identical to m_node in DynamicNodeList).
        Also changed the first argument's type from Element* to Node* so that it works better with new template member
        functions of NodeListsNodeData.
        (WebCore::RadioNodeList::~RadioNodeList):
        (WebCore::RadioNodeList::checkElementMatchesRadioNodeListFilter):
        * html/RadioNodeList.h:
        (WebCore::RadioNodeList::create):
        (RadioNodeList):

2012-06-21  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120945.
        http://trac.webkit.org/changeset/120945
        https://bugs.webkit.org/show_bug.cgi?id=89703

        editing/shadow/breaking-editing-boundaries.html started to
        crash (Requested by hayato on #webkit).

        * dom/EventDispatcher.cpp:
        (WebCore::EventRelatedTargetAdjuster::adjust):
        (WebCore::EventDispatcher::ensureEventAncestors):

2012-06-21  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] Use setGstElementClassMetadata.

        Rubber/stamped by Martin Robinson.

        This function was introduced in r120790 but I forgot to actually
        use it in that patch.

        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
        (webkit_video_sink_class_init):
        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:

2012-06-21  Erik Arvidsson  <arv@chromium.org>

        [V8] Use v8::V8::AddImplicitReferences instead of SetHiddenValue
        https://bugs.webkit.org/show_bug.cgi?id=80880

        Reviewed by Adam Barth.

        We used to add a hidden property in the getter to the returned wrapper.
        With this patch we instead handle the liveness of the wrapper in the GC phase by
        calling v8::V8::AddHiddenReference.

        To reduce the amount of custom code we need, the V8 code generator now supports
        GenerateIsReachable (as well as CustomIsReachable) which, even though different
        from the JSC attribute, is used in the same cases and takes the same values (even though
        at the moment not all JSC values are supported by V8). Interfaces that have *IsReachable
        also have a dependent life time (just like if V8DependentLifetime was present).

        No new tests. Covered by existing tests.

        * Target.pri:
        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GetGenerateIsReachable): Abstracted GenerateIsReachable and JSGenerateIsReachable.
        (GetCustomIsReachable): Ditto.
        (GenerateHeader):
        (GenerateImplementation):
        * bindings/scripts/CodeGeneratorV8.pm:
        (NeedsToVisitDOMWrapper):
        (GetGenerateIsReachable):
        (GetCustomIsReachable):
        (GenerateVisitDOMWrapper):
        (GenerateHeader):
        (GenerateNamedConstructorCallback):
        (GenerateImplementation):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/test/V8/V8Float64Array.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8Float64Array.h:
        (V8Float64Array):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
        (V8TestActiveDOMObject):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
        (V8TestCustomNamedGetter):
        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestEventConstructor.h:
        (V8TestEventConstructor):
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestEventTarget.h:
        (V8TestEventTarget):
        * bindings/scripts/test/V8/V8TestException.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestException.h:
        (V8TestException):
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestInterface.h:
        (V8TestInterface):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
        (V8TestMediaQueryListListener):
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
        (V8TestNamedConstructor):
        * bindings/scripts/test/V8/V8TestNode.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestNode.h:
        (V8TestNode):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestObj.h:
        (V8TestObj):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
        (V8TestSerializedScriptValueInterface):
        * bindings/v8/NPV8Object.cpp:
        (WebCore::npObjectTypeInfo):
        * bindings/v8/V8GCController.cpp:
        (WebCore::GrouperVisitor::visitDOMWrapper):
        * bindings/v8/WrapperTypeInfo.h:
        (WebCore):
        (WrapperTypeInfo):
        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp: Removed.
        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        * bindings/v8/custom/V8DOMTokenListCustom.cpp: Removed.
        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
        (WebCore):
        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
        * bindings/v8/custom/V8StyleSheetCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8TextTrackListCustom.cpp: Removed.
        * css/CSSStyleSheet.idl:
        * css/StyleSheet.idl:
        * dom/DOMStringMap.idl:
        * dom/NamedNodeMap.idl:
        * html/DOMTokenList.idl:
        * html/track/TextTrackList.idl:

2012-06-21  Alec Flett  <alecflett@chromium.org>

        IndexedDB: Implement spec behavior for multiEntry indexes with invalid/duplicate subkeys
        https://bugs.webkit.org/show_bug.cgi?id=86123

        Reviewed by Darin Fisher.

        Distinguish between an actual invalid IDBKey, and an array of
        possibly-invalid subkeys by making IDBKey::isValid() check subkeys
        if the type is an array.

        Introduce a new way to transform an IDBKey into a
        multiEntry-specific IDBKey, (IDBKey::createMultiEntryArray)
        throwing out duplicates and invalid keys. Use it when storing
        index entries for multiEntry indexes.

        No new tests: existing tests have been altered to include new behavior.

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::continueFunction):
        * Modules/indexeddb/IDBFactory.cpp:
        (WebCore::IDBFactory::cmp):
        * Modules/indexeddb/IDBIndex.cpp:
        (WebCore::IDBIndex::get):
        (WebCore::IDBIndex::getKey):
        * Modules/indexeddb/IDBKey.cpp:
        (WebCore::IDBKey::isValid):
        (WebCore):
        * Modules/indexeddb/IDBKey.h:
        (WebCore::IDBKey::createMultiEntryArray):
        (IDBKey):
        * Modules/indexeddb/IDBKeyRange.cpp:
        (WebCore::IDBKeyRange::only):
        (WebCore::IDBKeyRange::lowerBound):
        (WebCore::IDBKeyRange::upperBound):
        (WebCore::IDBKeyRange::bound):
        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
        (WebCore::IDBLevelDBBackingStore::putObjectStoreRecord):
        (WebCore::IDBLevelDBBackingStore::putIndexDataForRecord):
        * Modules/indexeddb/IDBLevelDBCoding.cpp:
        (WebCore::IDBLevelDBCoding::encodeIDBKey):
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::get):
        (WebCore::IDBObjectStore::add):
        (WebCore::IDBObjectStore::put):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::putInternal):
        (WebCore):
        * bindings/v8/IDBBindingUtilities.cpp:
        (WebCore::createIDBKeyFromValue):

2012-06-21  Ian Vollick  <vollick@chromium.org>

        [chromium] Overlays when using the web inspector are blurry with device scale factor > 1
        https://bugs.webkit.org/show_bug.cgi?id=89676

        Reviewed by James Robinson.

        Whenever we construct a GraphicsLayerChromium, make initialize the
        device and page scale factors, if possible.

        Unit test: GraphicsLayerChromiumTest.shouldStartWithCorrectContentsScale

        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):

2012-06-21  Philippe Normand  <pnormand@igalia.com>

        [Qt] REGRESSION(r120790): broke video rendering
        https://bugs.webkit.org/show_bug.cgi?id=89619

        Reviewed by Alexis Menard.

        Invert the pixel components of the Image on little endian architectures.

        * platform/graphics/gstreamer/ImageGStreamerQt.cpp:
        (ImageGStreamer::ImageGStreamer):

2012-06-21  James Simonsen  <simonjam@chromium.org>

        [Resource Timing] Implement Resource Timing interface
        https://bugs.webkit.org/show_bug.cgi?id=61152

        This patch implements the Resource Timing interface. It doesn't do anything
        useful, because nothing populates the timeline yet. There are also some gaps
        in the implementation, which have been filed as bugs.

        http://dvcs.w3.org/hg/webperf/raw-file/tip/specs/ResourceTiming/Overview.html

        Reviewed by Tony Gentilcore.

        No new tests. Feature is disabled on all platforms.

        * CMakeLists.txt:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * Target.pri:
        * UseV8.cmake:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/v8/custom/V8PerformanceEntryCustom.cpp:
        (WebCore):
        (WebCore::toV8): Support PerformanceEntry polymorphism.
        * dom/EventNames.h:
        (WebCore):
        * dom/EventTargetFactory.in:
        * page/Performance.cpp:
        (WebCore::Performance::~Performance):
        (WebCore):
        (WebCore::Performance::interfaceName): Reqired for EventTarget.
        (WebCore::Performance::scriptExecutionContext): Ditto.
        (WebCore::Performance::webkitGetEntries): Return "resource" entries.
        (WebCore::Performance::webkitGetEntriesByType): Ditto.
        (WebCore::Performance::webkitGetEntriesByName): Ditto.
        (WebCore::Performance::webkitClearResourceTimings): New.
        (WebCore::Performance::webkitSetResourceTimingBufferSize): New. Unimplemented.
        (WebCore::Performance::addResourceTiming): This is how resources in WebCore will report to the timeline.
        (WebCore::Performance::eventTargetData): Required for EventTarget.
        (WebCore::Performance::ensureEventTargetData): Ditto.
        * page/Performance.h:
        (Performance):
        (WebCore::Performance::refEventTarget):
        (WebCore::Performance::derefEventTarget):
        * page/Performance.idl:
        * page/PerformanceEntry.cpp:
        (WebCore::PerformanceEntry::~PerformanceEntry):
        (WebCore):
        * page/PerformanceEntry.h:
        (PerformanceEntry):
        (WebCore::PerformanceEntry::isResource):
        * page/PerformanceEntry.idl:
        * page/PerformanceResourceTiming.cpp: Added.
        (WebCore):
        (WebCore::PerformanceResourceTiming::PerformanceResourceTiming):
        (WebCore::PerformanceResourceTiming::initiatorType):
        (WebCore::PerformanceResourceTiming::redirectStart):
        (WebCore::PerformanceResourceTiming::redirectEnd):
        (WebCore::PerformanceResourceTiming::fetchStart):
        (WebCore::PerformanceResourceTiming::domainLookupStart):
        (WebCore::PerformanceResourceTiming::domainLookupEnd):
        (WebCore::PerformanceResourceTiming::connectStart):
        (WebCore::PerformanceResourceTiming::connectEnd):
        (WebCore::PerformanceResourceTiming::secureConnectionStart):
        (WebCore::PerformanceResourceTiming::requestStart):
        (WebCore::PerformanceResourceTiming::responseStart):
        (WebCore::PerformanceResourceTiming::responseEnd):
        (WebCore::PerformanceResourceTiming::monotonicTimeToDocumentMilliseconds):
        (WebCore::PerformanceResourceTiming::resourceTimeToMilliseconds):
        * page/PerformanceResourceTiming.h: Added.
        (WebCore):
        (PerformanceResourceTiming):
        (WebCore::PerformanceResourceTiming::create):
        (WebCore::PerformanceResourceTiming::isResource):
        * page/PerformanceResourceTiming.idl: Added.

2012-06-21  Hans Wennborg  <hans@chromium.org>

        Speech JavaScript API: Remove FIXMEs about whether events bubble and are cancelable
        https://bugs.webkit.org/show_bug.cgi?id=89657

        Reviewed by Adam Barth.

        The spec has been updated to clarify that the events do not bubble and
        are not cancelable.

        No new tests, just removing comments.

        * Modules/speech/SpeechRecognition.cpp:
        (WebCore::SpeechRecognition::didStartAudio):
        * Modules/speech/SpeechRecognitionError.cpp:
        (WebCore::SpeechRecognitionError::SpeechRecognitionError):

2012-06-21  Andrey Adaikin  <aandrey@chromium.org>

        Web Inspector: [WebGL] Rename InjectedWebGLScriptSource.js -> InjectedScriptWebGLModuleSource.js
        https://bugs.webkit.org/show_bug.cgi?id=89675

        Reviewed by Pavel Feldman.

        * CMakeLists.txt:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.am:
        * GNUmakefile.list.am:
        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * inspector/InjectedScriptWebGLModule.cpp:
        (WebCore::InjectedScriptWebGLModule::source):
        * inspector/InjectedScriptWebGLModuleSource.js: Renamed from Source/WebCore/inspector/InjectedWebGLScriptSource.js.
        (.):

2012-06-21  Kalev Lember  <kalevlember@gmail.com>

        [GTK] Fix NPAPI plugins on Windows
        https://bugs.webkit.org/show_bug.cgi?id=54531

        Reviewed by Martin Robinson.

        Switch to using PluginPackageWin.cpp and PluginViewWin.cpp on Windows
        platform, and leave plugins/gtk/ only for XP_UNIX platforms. With this
        we can share a lot of code with other ports and don't have to
        reimplement all the Windows-specific code in plugins/gtk/.

        * GNUmakefile.am:
        * GNUmakefile.list.am:
        * platform/FileSystem.h:
        (WebCore):
        * platform/graphics/GraphicsContext.h:
        (GraphicsContext):
        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
        (GraphicsContextPlatformPrivate):
        * platform/graphics/transforms/TransformationMatrix.h:
        (TransformationMatrix):
        * platform/graphics/win/GraphicsContextCairoWin.cpp:
        (WebCore):
        * platform/graphics/win/GraphicsContextWin.cpp:
        (WebCore):
        * platform/gtk/FileSystemGtk.cpp:
        (WebCore::unloadModule):
        * plugins/PluginView.h:
        (PluginView):
        * plugins/win/PluginViewWin.cpp:
        (windowHandleForPageClient):
        (WebCore::registerPluginView):
        (WebCore::PluginView::paint):
        (WebCore::PluginView::handleMouseEvent):
        (WebCore::PluginView::platformStart):
        (WebCore::PluginView::snapshot):

2012-06-21  Brady Eidson  <beidson@apple.com>

        <rdar://problem/11718988> and https://bugs.webkit.org/show_bug.cgi?id=89673
        showModalDialog fix creates risk of never returning from RunLoop::performWork, potentially blocking other event sources

        In case handling a function on the queue places additional functions on the queue, we should
        limit the number of functions each invocation of performWork() performs so it can return and
        other event sources have a chance to spin.

        The showModalDialog fix in question is http://trac.webkit.org/changeset/120879

        Reviewed by Darin Adler and Anders Carlson.

        * platform/RunLoop.cpp:
        (WebCore::RunLoop::performWork): If there are only N functions in the queue when performWork is called,
          only handle up to N functions before returning. Any additional functions will be handled the next time
          the runloop spins.

2012-06-21  Tim Horton  <timothy_horton@apple.com>

        SVGImageCache isn't invalidated for <img> on dynamic page scale changes
        https://bugs.webkit.org/show_bug.cgi?id=89621
        <rdar://problem/11714677>

        Reviewed by Simon Fraser.

        Previously, device and page scale factors were being cached as a part of the SVGImageCache's
        size request. However, an <img> never has a reason to update its size request when the page
        scale is changed via gesture zooming, as no layout occurs.

        Instead, look up the relevant scales when the image is requested (which will occur during every
        repaint), allowing page scale changes to take effect without requiring an updated size request.

        Test: svg/as-image/image-respects-pageScaleFactor-change.html

        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::lookupOrCreateImageForRenderer):
        (WebCore::CachedImage::setContainerSizeForRenderer):
        * svg/graphics/SVGImageCache.cpp:
        (WebCore::SVGImageCache::lookupOrCreateBitmapImageForRenderer):
        * svg/graphics/SVGImageCache.h:
        (WebCore::SVGImageCache::SizeAndScales::SizeAndScales):
        (SizeAndScales):

2012-06-21  Philip Rogers  <pdr@google.com>

        Add pending resource even if others are pending
        https://bugs.webkit.org/show_bug.cgi?id=89633

        Reviewed by Dirk Schulze.

        An element can have multiple simultaneous pending resources but some of
        this code was legacy, before the hasPendingResource()->hasPendingResources()
        change (r105573). This patch continues adding a pending resource even if
        there are other pending resources. In some cases, this can lead to marking
        a resource as pending twice but the performance impact of that is negligible.

        Other than SVGUseElement, SVGTrefElement and SVGFEImageElement are also
        changed. These elements are unaffected because they can only have
        a single resource at the moment (href), with other Style url() references
        being handled by their parent containers.

        Tests: svg/custom/use-multiple-pending-resources-expected.svg
               svg/custom/use-multiple-pending-resources.svg

        * svg/SVGFEImageElement.cpp:
        (WebCore::SVGFEImageElement::buildPendingResource):
        * svg/SVGTRefElement.cpp:
        (WebCore::SVGTRefElement::detachTarget):
        (WebCore::SVGTRefElement::buildPendingResource):
        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::buildPendingResource):

2012-06-21  Kalev Lember  <kalevlember@gmail.com>

        [GTK] Replace the use of "struct stat" with GStatBuf
        https://bugs.webkit.org/show_bug.cgi?id=89488

        Reviewed by Martin Robinson.

        Make sure we pass GStatBuf to g_stat(); depending on the platform, it
        isn't always the same as "struct stat", e.g. on Windows.

        * platform/gtk/FileSystemGtk.cpp:
        (WebCore::getFileSize):
        (WebCore::getFileModificationTime):

2012-06-21  Min Qin  <qinmin@chromium.org>

        remove ENABLE_FULLSCREEN_MEDIA_CONTROL flag
        https://bugs.webkit.org/show_bug.cgi?id=89614

        Reviewed by Eric Carlson.

        Desktop chromium also starts to use fullscreen button after https://bugs.webkit.org/show_bug.cgi?id=88818
        we don't need this flag any more
        No test needed as this change just removes a flag.

        * html/shadow/MediaControlRootElementChromium.cpp:
        (WebCore::MediaControlRootElementChromium::MediaControlRootElementChromium):
        (WebCore::MediaControlRootElementChromium::create):
        (WebCore::MediaControlRootElementChromium::setMediaController):
        (WebCore::MediaControlRootElementChromium::reset):
        (WebCore::MediaControlRootElementChromium::reportedError):
        * html/shadow/MediaControlRootElementChromium.h:
        (MediaControlRootElementChromium):

2012-06-21  Hayato Ito  <hayato@chromium.org>

        Modify event re-targeting algorithm so that we can tell which distributed node is clicked.
        https://bugs.webkit.org/show_bug.cgi?id=89073

        Reviewed by Dimitri Glazkov.

        Adopt a new event re-targeting algorithm in the latest Shadow DOM spec.
        The corresponding bug in the shadow DOM spec is:
        https://www.w3.org/Bugs/Public/show_bug.cgi?id=17090

        This change is introduced to handle the following use case:
        1. There is an insertion point, with zero or more nodes distributed into it.
        2. User clicks on one of the items.
        3. The event handler in shadow DOM subtree wants to know which item was clicked on.

        The new re-targeting algorithm sets an event's target to a
        distributed node where an event was originally fired, instead of
        an insertion point to where the node is distributed.

        The similar re-targeting algorithm also applies to an event's
        relatedTarget.

        Test: fast/dom/shadow/shadow-dom-event-dispatching.html

        * dom/EventDispatcher.cpp:
        (WebCore::EventRelatedTargetAdjuster::adjust):
        (WebCore::EventDispatcher::ensureEventAncestors):

2012-06-21  Andrei Onea  <onea@adobe.com>

        [CSSRegions]Change WEBKIT_REGION_RULE value to 16
        https://bugs.webkit.org/show_bug.cgi?id=89421

        Reviewed by Tony Chang.

        Modified WEBKIT_REGION_RULE where applicable to match CSS Regions spec.
        The new value for WEBKIT_REGION_RULE is 16 (was 10).

        * css/CSSRule.cpp:
        (WebCore):
        Added COMPILE_ASSERT to ensure StyleRule::Region and CSSRule::WEBKIT_REGION_RULE will
        * css/CSSRule.h:
        (CSSRule):
        Modified m_type bitfield length to 5
        * css/CSSRule.idl:
        * css/StyleRule.cpp:
        (SameSizeAsStyleRuleBase):
        (WebCore):
        Added COMPILE_ASSERT to ensure that StyleRuleBase will always have exactly 32bits.
        * css/StyleRule.h:
        (StyleRuleBase):
        Modified m_type bitfield to 5 to accommodate the new value, and modified
        m_sourceLine bitfield to 27 bits in order to keep StyleRule 32
        bits long. Consequently, any css rule longer than 67,108,863 lines will
        cause overflow - however, the value is large enough not to cause
        problems.

2012-06-21  Silvia Pfeiffer  <silviapf@chromium.org>

        Paint played and buffered ranges differently in Chrome video controls.
        https://bugs.webkit.org/show_bug.cgi?id=89284

        Reviewed by Eric Carlson.

        No new tests; existing video control tests cover this case.

        The Chrome video controls are receiving a visual update. This patch changes
        the format in which the playback position slider displays the buffered range.
        It is painted in a lighter color left of the position thumb and darker right
        of the position thumb

        * css/mediaControlsChromium.css:
        (input[type="range"]::-webkit-media-slider-container):
        Adjust the border color of the playback position slider.
        * rendering/RenderMediaControlsChromium.cpp:
        (WebCore::paintRoundedSliderBackground):
        Adjust the background color of the position slider.
        (WebCore::paintSliderRangeHighlight):
        Make the color of the range region a function parameter,
        provide start and end position as pixel width instead of percentage,
        and make sure the rounded corners at beginning and end don't turn into rectangles.
        (WebCore):
        Move the mediaSliderThumbWidth variable up to be used in paintMediaSlider().
        (WebCore::paintMediaSlider):
        Calculate start, current and end position instead of fractions,
        adjust the current position by half the thumb's width for improved rendering,
        and draw two highlight areas: one bright one before current position and
        one grey one after current position.
        (WebCore::paintMediaVolumeSlider):
        Adjust the paintSliderRangeHighlight function call and add the colors.

2012-06-21  Kwang Yul Seo  <skyul@company100.net>

        Remove unused static variable uninitializedLineNumberValue.
        https://bugs.webkit.org/show_bug.cgi?id=89643

        Reviewed by Alexey Proskuryakov.

        No behavioral changes.

        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore):

2012-06-21  Kwang Yul Seo  <skyul@company100.net>

        Remove unused static function skipComment.
        https://bugs.webkit.org/show_bug.cgi?id=89641

        Reviewed by Alexey Proskuryakov.

        No behavioral changes.

        * loader/TextResourceDecoder.cpp:

2012-06-21  Nico Weber  <thakis@chromium.org>

        Remove two more member variables found by clang's Wunused-private-field
        https://bugs.webkit.org/show_bug.cgi?id=89672

        Reviewed by Anders Carlsson.

        * html/shadow/MediaControlRootElementChromium.h:
        (MediaControlRootElementChromium):
        * platform/graphics/filters/FECustomFilter.cpp:
        (WebCore::FECustomFilter::FECustomFilter):
        * platform/graphics/filters/FECustomFilter.h:
        (FECustomFilter):

2012-06-21  Julien Chaffraix  <jchaffraix@webkit.org>

        Non-fixed length margins don't work with align=center
        https://bugs.webkit.org/show_bug.cgi?id=89626

        Reviewed by Levi Weintraub.

        Tests: fast/block/negative-start-margin-align-center-percent.html
               fast/block/positive-margin-block-child-align-center-calc.html

        Calling Length::value() is a bad idea as it returns the *raw* value of
        the length. For percent and calculated length this is a bad idea as they
        bear not relation to the actual computed length.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeInlineDirectionMargins):
        Fixed the code to use minimumValueForLength as this nicely takes care of the 'auto' case.

2012-06-21  Robert Kroeger  <rjkroege@chromium.org>

        [chromium] style improvement for setDeviceScaleFactor code
        https://bugs.webkit.org/show_bug.cgi?id=89665

        Correct a coding style error committed in https://bugs.webkit.org/show_bug.cgi?id=88916

        Reviewed by Adrienne Walker.

        Purely code hygiene: existing tests suffice.

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::setDeviceScaleFactor):

2012-06-21  Shinya Kawanaka  <shinyak@chromium.org>

        [Crash][Editing] Pressing enter on LI element triggers assertion in Shadow DOM.
        https://bugs.webkit.org/show_bug.cgi?id=89171

        Reviewed by Ryosuke Niwa.

        Since modidying Shadow DOM removes renderer of elements in Shadow DOM and shadow host,
        assertion to check the existence of renderer was triggered.

        We should update layout here to create renderer again.

        Test: editing/shadow/pressing-enter-on-list.html

        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::appendBlockPlaceholder):

2012-06-21  Andrey Adaikin  <aandrey@chromium.org>

        Web Inspector: [WebGL] Add injected WebGL module class
        https://bugs.webkit.org/show_bug.cgi?id=89592

        Reviewed by Pavel Feldman.

        Adding a new InjectedScriptWebGLModule class and moving WebGL-related
        stuff out of InjectedScriptManager class.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * inspector/InjectedScriptManager.cpp:
        * inspector/InjectedScriptManager.h:
        (InjectedScriptManager):
        * inspector/InjectedScriptModule.cpp:
        (WebCore::InjectedScriptModule::ensureInjected):
        * inspector/InjectedScriptModule.h:
        (InjectedScriptModule):
        * inspector/InjectedScriptWebGLModule.cpp: Copied from Source/WebCore/inspector/InjectedScriptModule.cpp.
        (WebCore):
        (WebCore::InjectedScriptWebGLModule::InjectedScriptWebGLModule):
        (WebCore::InjectedScriptWebGLModule::moduleForState):
        (WebCore::InjectedScriptWebGLModule::source):
        (WebCore::InjectedScriptWebGLModule::wrapWebGLContext):
        (WebCore::InjectedScriptWebGLModule::captureFrame):
        * inspector/InjectedScriptWebGLModule.h: Copied from Source/WebCore/inspector/InjectedScriptModule.h.
        (WebCore):
        (InjectedScriptWebGLModule):
        * inspector/InspectorWebGLAgent.cpp:
        (WebCore::InspectorWebGLAgent::wrapWebGLRenderingContextForInstrumentation):

2012-06-21  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: do not add separator to the end of the context menu.
        https://bugs.webkit.org/show_bug.cgi?id=89634

        Reviewed by Vsevolod Vlasov.

        Attaching separators only before menu items now.

        * inspector/front-end/ContextMenu.js:
        (WebInspector.ContextSubMenuItem.prototype.appendItem):
        (WebInspector.ContextSubMenuItem.prototype.appendSubMenuItem):
        (WebInspector.ContextSubMenuItem.prototype.appendCheckboxItem):
        (WebInspector.ContextSubMenuItem.prototype.appendSeparator):
        (WebInspector.ContextSubMenuItem.prototype._pushItem):

2012-06-21  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Unify FileSystem callbacks
        https://bugs.webkit.org/show_bug.cgi?id=89420

        Reviewed by Vsevolod Vlasov.

        * inspector/InspectorFileSystemAgent.cpp:
        (WebCore):

2012-06-20  Hans Wennborg  <hans@chromium.org>

        Speech JavaScript API: SpeechRecognition should hook up with ActiveDOMObject more
        https://bugs.webkit.org/show_bug.cgi?id=89217

        Reviewed by Adam Barth.

        Previously, the SpeechRecognition was kept alive while waiting for
        pending events by making the embedder hold a reference to the object.
        We should do this by using ActiveDOMObject's setPendingActivity() instead.

        Also, override ActiveDOMObject::stop() to get notified when the user
        leaves the page.

        Test: fast/speech/scripted/navigate-away.html

        * Modules/speech/SpeechRecognition.cpp:
        (WebCore::SpeechRecognition::start):
        (WebCore::SpeechRecognition::didEnd):
        (WebCore::SpeechRecognition::stop):
        (WebCore):
        * Modules/speech/SpeechRecognition.h:
        (SpeechRecognition):

2012-06-21  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Move requestId allocation from FileSystem frontend to backend
        https://bugs.webkit.org/show_bug.cgi?id=89555

        Reviewed by Vsevolod Vlasov.

        Test: http/tests/inspector/filesystem/get-filesystem-root.html:
              http/tests/inspector/filesystem/read-directory.html:

        * inspector/Inspector.json:
        * inspector/InspectorFileSystemAgent.cpp:
        (WebCore):
        (WebCore::InspectorFileSystemAgent::requestFileSystemRoot):
        (WebCore::InspectorFileSystemAgent::requestDirectoryContent):
        (WebCore::InspectorFileSystemAgent::InspectorFileSystemAgent):
        * inspector/InspectorFileSystemAgent.h:
        (InspectorFileSystemAgent):
        * inspector/front-end/FileSystemModel.js:
        (WebInspector.FileSystemModel.prototype._originAdded):
        (WebInspector.FileSystemModel.prototype._fileSystemRootReceived):
        (WebInspector.FileSystemRequestManager):
        (WebInspector.FileSystemRequestManager.prototype.requestFileSystemRoot.requestAccepted):
        (WebInspector.FileSystemRequestManager.prototype.requestFileSystemRoot):
        (WebInspector.FileSystemRequestManager.prototype._fileSystemRootReceived):
        (WebInspector.FileSystemRequestManager.prototype.requestDirectoryContent.requestAccepted):
        (WebInspector.FileSystemRequestManager.prototype.requestDirectoryContent):
        (WebInspector.FileSystemRequestManager.prototype._directoryContentReceived):
        (WebInspector.FileSystemDispatcher.prototype.fileSystemRootReceived):
        (WebInspector.FileSystemDispatcher.prototype.directoryContentReceived):

2012-06-20  Arnaud Renevier  <arno@renevier.net>

        [cairo] improve putByteArray speed by avoiding max/min checks at Color construction.
        https://bugs.webkit.org/show_bug.cgi?id=89138

        Reviewed by Adam Barth.

        Color constructor accepts integer arguments and checks if they are
        between 0 and 255. In some cases, we already known those numbers to be
        within those boundaries. For example when using unsigned chars. So
        this patch introduces Color::createUnChecked which return a Color
        object without checking for boundaries.

        No new tests: no behaviour change

        * platform/graphics/Color.cpp:
        (WebCore::colorFromPremultipliedARGB):
        * platform/graphics/Color.h:
        (WebCore::Color::createUnCheked):
        (Color):
        * platform/graphics/cairo/ImageBufferCairo.cpp:
        (WebCore::ImageBuffer::putByteArray):

2012-06-20  Zeev Lieber  <zlieber@chromium.org>

        [Chromium] Damage tracker is not used without partial swap, causing valid render passes to be removed
        https://bugs.webkit.org/show_bug.cgi?id=89589

        Reviewed by Adrienne Walker.

        When not using partial swap, the CCDamageTracker was not used, and
        its m_currentDamageRect was always empty. As a result,
        CCLayerTreeHostImpl was thinking no content was changed and was
        removing more textures than needed. Fixed this by turning on
        CCDamageTracker usage even if not using partial swap, but
        overwriting the rootScissorRect with viewport rect if required.

        Added unit tests to exercise this scenario.

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):

2012-06-20  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Make step action of SpinButtonElement replaceable
        https://bugs.webkit.org/show_bug.cgi?id=89439

        Reviewed by Kent Tamura.

        This patch introduces SpinButtonElement::Callback to specify step
        action by control clients for using SpinButtonElement by
        TextFieldInputType and future version of TimeInputField.

        In addition to this improving flexibility of SpinButtonElement, we
        free HTMLInputElement from SpinButtonElement dependency on
        stepUpFromRenderer.

        No new tests. This patch doesn't change behavior.

        * html/HTMLInputElement.cpp: Removed stepUpFromRenderer().
        * html/HTMLInputElement.h: Removed stepUpFromRenderer().
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::~TextFieldInputType): Added to call SpinButtonElement::removeStepActionHandler.
        (WebCore::TextFieldInputType::handleKeydownEventForSpinButton): Changed to call spinButtonStep{Down,Up}
        (WebCore::TextFieldInputType::handleWheelEventForSpinButton): Changed to call spinButtonStep{Down,Up}
        (WebCore::TextFieldInputType::createShadowSubtree): Added SpinButtonElement::StepActionHandler parameter.
        (WebCore::TextFieldInputType::destroyShadowSubtree): Added to call SpinButtonElement::removeStepActionHandler.
        (WebCore::TextFieldInputType::spinButtonStepDown): Added for implementation of SpinButtonElement::StepActionHandler.
        (WebCore::TextFieldInputType::spinButtonStepUp): Added for implementation of SpinButtonElement::StepActionHandler.
        * html/TextFieldInputType.h:
        (TextFieldInputType):
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::SpinButtonElement::SpinButtonElement): Added StepActionHandler parameter.
        (WebCore::SpinButtonElement::defaultEventHandler): Changed to call doStepAction.
        (WebCore::SpinButtonElement::doStepAction): Added to call StepActionHandler if possible.
        (WebCore::SpinButtonElement::step): Changed to call doStepAction.
        * html/shadow/TextControlInnerElements.h:
        (StepActionHandler): Added.

2012-06-20  Adrienne Walker  <enne@google.com>

        [chromium] Modify CCDamageTracker hash to allow for layer id 0
        https://bugs.webkit.org/show_bug.cgi?id=89631

        Reviewed by James Robinson.

        HashMap has the bizarre property that 0 is the empty value for integer
        keys. Modify the damage tracking HashMap to use negative values for
        both the empty and the deleted key traits. Additionally, make sure we
        never generate negative layer IDs in practice.

        Test: passes webkit_unit_tests with the patch in bug 89589 applied.

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::LayerChromium):
        * platform/graphics/chromium/cc/CCDamageTracker.h:
        (RectMapKeyTraits):
        (WebCore::CCDamageTracker::RectMapKeyTraits::emptyValue):
        (WebCore::CCDamageTracker::RectMapKeyTraits::constructDeletedValue):
        (WebCore::CCDamageTracker::RectMapKeyTraits::isDeletedValue):
        (CCDamageTracker):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::CCLayerImpl):

2012-06-20  Adam Klein  <adamk@chromium.org>

        Use Dictionary in MutationObserver.observe to kill custom code
        https://bugs.webkit.org/show_bug.cgi?id=89629

        Reviewed by Ryosuke Niwa.

        Move code for dictionary parsing in MutationObserver.observe
        that used to be duplicated (with different implementations)
        in JSC and V8 bindings into WebKitMutationObserver.cpp, using
        the new Dictionary interface.

        No new tests, no change in behavior.

        * bindings/js/JSWebKitMutationObserverCustom.cpp:
        * bindings/v8/custom/V8WebKitMutationObserverCustom.cpp:
        * dom/WebKitMutationObserver.cpp:
        (WebCore::WebKitMutationObserver::observe):
        * dom/WebKitMutationObserver.h:
        (WebCore):
        * dom/WebKitMutationObserver.idl:

2012-06-20  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120889.
        http://trac.webkit.org/changeset/120889
        https://bugs.webkit.org/show_bug.cgi?id=89630

        [Chromium] webkit_unit_tests didDrawNotCalledOnHiddenLayer
        start failing (Requested by ukai on #webkit).

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):

2012-06-20  Hayato Ito  <hayato@chromium.org>

        [Shadow][Editing] Deleting character in distributed element caused a crash.
        https://bugs.webkit.org/show_bug.cgi?id=88484

        Reviewed by Ryosuke Niwa.

        If we mutate nodes which are children of a shadow host, it causes
        ElementShadow::invalidateDistribution().  As a result, shadow host
        is detached (and lazyAttached()) and its renderer is gone.  That
        causes assertion error since isEditablePosition() assumes
        anchorNode's style was correctly calculated.

        This patch makes isEditablePosition() call
        document->updateLayoutIgnorePendingStylesheets() so that it does
        not return a bogus result.

        There is an exceptional caller of isEditablePosition,
        RenderBlock::paintCaret(), from where we can not call
        updateLayout() in isEditablePosition because it hits assertion,
        ASSERT(!isPainting). So I've added the third parameter to
        isEditablePosition to control updating the style.

        Test: edition/shadow/delete-characters-in-distributed-node.html

        * editing/FrameSelection.h:
        (WebCore::FrameSelection::rendererIsEditable):
        * editing/VisibleSelection.cpp:
        (WebCore::VisibleSelection::rendererIsEditable):
        (WebCore):
        * editing/VisibleSelection.h:
        (VisibleSelection):
        * editing/htmlediting.cpp:
        (WebCore::isEditablePosition):
        * editing/htmlediting.h:
        (WebCore):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::paintCaret):

2012-06-20  Kent Tamura  <tkent@chromium.org>

        Unmodified form control value are overwritten by another form
        control value with the same name after navigating and going back
        https://bugs.webkit.org/show_bug.cgi?id=89409

        Reviewed by Hajime Morita.

        Detail of the bug:
        If a page had multiple form controls of which names and types were
        identical like the following:
          <input type=text name=name1 id=input1>
          <input type=text name=name1 id=input2>
        and a user updated the value of the second control, then went to
        another page and went back to the page again, we restored the updated
        value to the first element, and didn't update the second element.

        We didn't save unmodified control state, and the form state data
        had no ways to represent "this control should be skipped".

        How to resovle the bug:
        We need to represent "this control should be skipped" in the
        seriazlied form state vector.

        - A serialized control state had three items:
                name, type, value.
          Now we change it to:
                name, type, flag, optional value

        - It is definitely incompatible with serizlized state produced by
        older WebCore. So, we need to add the signature string to
        represent the version of serialized state format.

        - Because the state for a form control is variable-length and we
        can't deserialize it in reverse-order, we change the on-memory
        representation from Vector<> to Deque<>.

        Test: fast/forms/state-restore-to-non-edited-controls.html

        * html/FormController.cpp:
        (WebCore::FormControlState::serializeTo):
        Added. Serialize a state for a form control to a string vector.
        (WebCore::FormControlState::deserialize):
        Added. Produce a FormControlState object from the specified string vector.
        It can produce a FromControlState of the failure type.
        (WebCore::formStateSignature): The signature string of the serialized state.
        (WebCore::FormController::formElementsState):
         - Capacity:
          The size of seirlized data for one form control is typically 4.
          +1 for the signature.
         - We need to store a FormControlState with no values.
        (WebCore::FormController::setStateForNewFormElements):
         - We can't iterate over the stateVector in reverse order any more
           because serialized control state is variable-length.
         - We put FormControlState objects to HashMap instead of String objects.
        (WebCore::FormController::takeStateForFormElement):
         Updated for Deque<>.
        * html/FormController.h:
        (FormControlState): Declare deserialize() and serializeTo().
        (WebCore::FormControlState::isFailure): Added.
        (WebCore::FormControlState::FormControlState):
        Added to create a FormControlState with failure type.
        (FormController):
        Change the value type of m_stateForNewFormElements from Vector<String>
        to Deque<FormControlState>.

2012-06-20  Alexandru Chiculita  <achicu@adobe.com>

        [CSS Shaders] Rename CustomFilterShader class name to CustomFilterCompiledProgram
        https://bugs.webkit.org/show_bug.cgi?id=89578

        Reviewed by Dean Jackson.

        I've renamed CustomFilterShader to CustomFilterCompiledProgram to make it obvious that it is the result of 
        calling CustomFilterProgram::compileProgramWithContext.

        No new tests, just renamed an existing class.
        
        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/filters/CustomFilterCompiledProgram.cpp: Renamed from Source/WebCore/platform/graphics/filters/CustomFilterShader.cpp.
        (WebCore):
        (WebCore::CustomFilterCompiledProgram::defaultVertexShaderString):
        (WebCore::CustomFilterCompiledProgram::defaultFragmentShaderString):
        (WebCore::CustomFilterCompiledProgram::CustomFilterCompiledProgram):
        (WebCore::CustomFilterCompiledProgram::compileShader):
        (WebCore::CustomFilterCompiledProgram::linkProgram):
        (WebCore::CustomFilterCompiledProgram::initializeParameterLocations):
        (WebCore::CustomFilterCompiledProgram::uniformLocationByName):
        (WebCore::CustomFilterCompiledProgram::~CustomFilterCompiledProgram):
        * platform/graphics/filters/CustomFilterCompiledProgram.h: Renamed from Source/WebCore/platform/graphics/filters/CustomFilterShader.h.
        (WebCore):
        * platform/graphics/filters/CustomFilterProgram.cpp:
        (WebCore::CustomFilterProgram::compileProgramWithContext): Renamed method from createShaderWithContext to compileProgramWithContext.
        * platform/graphics/filters/CustomFilterProgram.h:
        (WebCore):
        * platform/graphics/filters/FECustomFilter.cpp: Renamed m_shader to m_compiledProgram.
        (WebCore::FECustomFilter::platformApplySoftware):
        (WebCore::FECustomFilter::initializeContext):
        (WebCore::FECustomFilter::bindProgramParameters):
        (WebCore::FECustomFilter::bindProgramAndBuffers):
        * platform/graphics/filters/FECustomFilter.h:
        (WebCore):
        (FECustomFilter):

2012-06-19  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: reduce timeline refresh rate
        https://bugs.webkit.org/show_bug.cgi?id=89548

        Reviewed by Pavel Feldman.

        Minimize resource contention with the inspected page during refresh:

        - reduce refresh for both overview and main panes to 300ms
        - automatically limit window size to approximately one pageful of events in the lower pane
        - do not refresh lower pane for events that are outside of the window

        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineOverviewPane.prototype._update):
        (WebInspector.TimelineOverviewPane.prototype._onWindowChanged):
        (WebInspector.TimelineOverviewPane.prototype.setWindowTimes): Set overview window by times.
        (WebInspector.TimelineOverviewPane.prototype._updateWindow):
        (WebInspector.TimelineOverviewPane.prototype._scheduleRefresh): Refresh once in 300ms (insted of once in 100ms).
        (WebInspector.TimelineOverviewWindow.prototype._setWindow):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype._onTimelineEventRecorded): Do not refresh if the new record is outside of window.
        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
        (WebInspector.TimelinePanel.prototype._resetPanel):
        (WebInspector.TimelinePanel.prototype._scheduleRefresh): Refresh rate: 100ms -> 300ms.
        (WebInspector.TimelinePanel.prototype._refreshRecords): Automatically set overview window.
        * inspector/front-end/TimelinePresentationModel.js: Expose filterRecords
        (WebInspector.TimelinePresentationModel.prototype.filteredRecords):
        (WebInspector.TimelinePresentationModel.prototype.filterRecords):
        (WebInspector.TimelinePresentationModel.prototype._innerFilterRecords):

2012-06-20  Zeev Lieber  <zlieber@chromium.org>

        [Chromium] Damage tracker is not used without partial swap, causing valid render passes to be removed
        https://bugs.webkit.org/show_bug.cgi?id=89589

        Reviewed by Adrienne Walker.

        When not using partial swap, the CCDamageTracker was not used, and
        its m_currentDamageRect was always empty. As a result,
        CCLayerTreeHostImpl was thinking no content was changed and was
        removing more textures than needed. Fixed this by turning on
        CCDamageTracker usage even if not using partial swap, but
        overwriting the rootScissorRect with viewport rect if required.

        Added unit tests to exercise this scenario.

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):

2012-06-20  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Remove redundant IDBObjectStore.delete() overloads
        https://bugs.webkit.org/show_bug.cgi?id=89587

        Reviewed by Darin Fisher.

        The IDBObjectStore.delete(IDBKey) overload can delegate to the delete(IDBKeyRange)
        overload. Also cleaned up redundant checks in related overloads.

        Test: storage/indexeddb/deleted-objects.html

        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
        (WebCore::IDBCursorBackendImpl::deleteFunction): Call keyRange variant instead.
        * Modules/indexeddb/IDBIndex.cpp:
        (WebCore::IDBIndex::get): Remove redundant deleted/invalid IDBKey checks.
        (WebCore::IDBIndex::getKey): Remove redundant deleted/invalid IDBKey checks.
        * Modules/indexeddb/IDBKeyRange.cpp: Null IDBKeys are not acceptable; currently
        not passed in by any callers.
        (WebCore::IDBKeyRange::only):
        (WebCore::IDBKeyRange::lowerBound):
        (WebCore::IDBKeyRange::upperBound):
        (WebCore::IDBKeyRange::bound):
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::get): Was missing deleted check in IDBKeyRange overload.
        Removed redundant checks in IDBKey overload.
        (WebCore::IDBObjectStore::deleteFunction): Delegate to IDBKeyRange overload.
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp: Remove IDBKey overload.
        * Modules/indexeddb/IDBObjectStoreBackendImpl.h: Remove IDBKey overload.
        (IDBObjectStoreBackendImpl):
        * Modules/indexeddb/IDBObjectStoreBackendInterface.h: Remove IDBKey overload.

2012-06-20  Shinya Kawanaka  <shinyak@chromium.org>

        [Shadow][Editing] Selection will break editing boundaries in Shadow DOM.
        https://bugs.webkit.org/show_bug.cgi?id=89075

        Reviewed by Antti Koivisto.

        At the shadow boundary, some styles (e.g. user-modify, text-decoration) cannot be inherited
        from the shadow host. However, when style property cache is used, such styles are wrongly
        inherited from the cache.

        So this patch makes not to use cache for inehrited styles at the shadow boundary.

        Tests: editing/shadow/breaking-editing-boundary-with-table.html
               editing/shadow/contenteditable-propagation-at-shadow-boundary.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-06-20  Garret Kelly  <gdk@chromium.org>

        Moving cookieEnabled/setCookieEnabled from Page to Settings.
        https://bugs.webkit.org/show_bug.cgi?id=89545

        Reviewed by Adam Barth.

        * dom/Document.cpp:
        (WebCore::Document::cookie):
        (WebCore::Document::setCookie):
        * page/Navigator.cpp:
        (WebCore::Navigator::cookieEnabled):
        * page/Page.h:
        (Page):
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (WebCore::Settings::setCookieEnabled):
        (WebCore::Settings::cookieEnabled):
        (Settings):
        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::setUpCookiesForQuickTime):

2012-06-20  Adam Barth  <abarth@webkit.org>

        internals.settings.setDeviceScaleFactor doesn't work for WebKit2 and must be removed
        https://bugs.webkit.org/show_bug.cgi?id=89274

        Reviewed by James Robinson.

        Using this window.internals API causes the apple-mac port to ASSERT in
        WebKit2 because WebKit2 keeps a copy of this state in the UI process.
        When a test uses this internals API, the WebCore state gets out of sync
        with the state in the UI process.

        Tests should use setBackingScaleFactor instead.

        * testing/InternalSettings.cpp:
        (WebCore):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-06-20  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: persist timeline panel overview mode
        https://bugs.webkit.org/show_bug.cgi?id=88711

        Reviewed by Pavel Feldman.

        - replace all internal methods of switching to a new mode of TimelineOverviewPane with setMode();
        - make current mode a persistent setting;

        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineOverviewPane):
        (WebInspector.TimelineOverviewPane.prototype.setMode):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel):

2012-06-20  Brady Eidson  <beidson@apple.com>

        <rdar://problem/11653784> and https://bugs.webkit.org/show_bug.cgi?id=89590
        showModalDialog message handling is flaky in WebKit2

        Because RunLoop::performWork() swaps the function queue to a temporary Vector before calling
        the functions an inner run-loop - such as we see with running a modal dialog - does not have
        a change to handle any of the functions that were queued after the WebPageProxy::RunModal message.

        By servicing the functions in the queue one at a time we can give the RunLoop a chance to pick up
        where it left off if RunLoop::performWork is re-entered.

        To guarantee RunLoop::performWork is re-entered to handle those functions we also need to signal
        its source before entering the modal run loop so our RunLoop is woken up.

        Reviewed by Darin Adler.

        * WebCore.exp.in:
        * platform/RunLoop.cpp:
        (WebCore::RunLoop::performWork): Take the first function off the queue one at a time so subsequent
          functions remain in the queue and can be handled by an inner modal run loop.
        * platform/RunLoop.h:
        (RunLoop): Change the function queue to be a Deque to efficiently support "takeFirst" 

2012-06-20  Varun Jain  <varunjain@chromium.org>

        Account for device scale factor when creating image for dragging.
        https://bugs.webkit.org/show_bug.cgi?id=89489

        Reviewed by Adam Barth.

        Manual Test: ManualTests/chromium/drag-image-accounts-for-device-scale.html

        * page/Frame.cpp:
        (WebCore::Frame::nodeImage):
        (WebCore::Frame::dragImageForSelection):

2012-06-20  Jacky Jiang  <zhajiang@rim.com>

        Add a != operator to ViewportArguments
        https://bugs.webkit.org/show_bug.cgi?id=87505

        Reviewed by Antonio Gomes.
        Patch by Jacky Jiang  <zhajiang@rim.com>

        Add a != operator to ViewportArguments for convenience.

        * dom/ViewportArguments.h:
        (ViewportArguments):
        (WebCore::ViewportArguments::operator!=):

2012-06-20  Ryosuke Niwa  <rniwa@webkit.org>

        Let Xcode have its own way.

        * WebCore.xcodeproj/project.pbxproj:

2012-06-20  Ryosuke Niwa  <rniwa@webkit.org>

        Move m_listsInvalidatedAtDocument from NodeListsNodeData to Document
        https://bugs.webkit.org/show_bug.cgi?id=89603

        Reviewed by Andreas Kling.

        Moved the variable. m_listsInvalidatedAtDocument is never used in non-Document nodes
        so it was just wasting memory space.

        * dom/Document.cpp:
        (WebCore::Document::registerDynamicSubtreeNodeList):
        (WebCore::Document::unregisterDynamicSubtreeNodeList):
        (WebCore):
        (WebCore::Document::clearNodeListCaches):
        * dom/Document.h:
        (Document):
        * dom/DynamicNodeList.h:
        (DynamicSubtreeNodeList):
        * dom/Node.cpp:
        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged):
        (WebCore::Node::invalidateNodeListsCacheAfterChildrenChanged):
        (WebCore):
        (WebCore::NodeListsNodeData::invalidateCachesThatDependOnAttributes): RadioNodeList
        is invalidated at document level. No need to invalidate it again here.
        (WebCore::NodeListsNodeData::isEmpty):
        * dom/NodeRareData.h:
        (NodeListsNodeData):

2012-06-20  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120854.
        http://trac.webkit.org/changeset/120854
        https://bugs.webkit.org/show_bug.cgi?id=89604

        Broke Chromium WebKit Linux (dbg) (Requested by arv on
        #webkit).

        * Target.pri:
        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateImplementation):
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateHeader):
        (GenerateNamedConstructorCallback):
        (GenerateImplementation):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/test/V8/V8Float64Array.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8Float64Array.h:
        (V8Float64Array):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
        (V8TestActiveDOMObject):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
        (V8TestCustomNamedGetter):
        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestEventConstructor.h:
        (V8TestEventConstructor):
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestEventTarget.h:
        (V8TestEventTarget):
        * bindings/scripts/test/V8/V8TestException.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestException.h:
        (V8TestException):
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestInterface.h:
        (V8TestInterface):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
        (V8TestMediaQueryListListener):
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
        (V8TestNamedConstructor):
        * bindings/scripts/test/V8/V8TestNode.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestNode.h:
        (V8TestNode):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestObj.h:
        (V8TestObj):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
        (V8TestSerializedScriptValueInterface):
        * bindings/v8/NPV8Object.cpp:
        (WebCore::npObjectTypeInfo):
        * bindings/v8/V8GCController.cpp:
        (WebCore::GrouperVisitor::visitDOMWrapper):
        * bindings/v8/WrapperTypeInfo.h:
        (WebCore):
        (WrapperTypeInfo):
        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp: Copied from Source/WebCore/bindings/v8/custom/V8StyleSheetCustom.cpp.
        (WebCore):
        (WebCore::toV8):
        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        (WebCore::toV8):
        (WebCore):
        * bindings/v8/custom/V8DOMTokenListCustom.cpp: Copied from Source/WebCore/bindings/v8/custom/V8StyleSheetCustom.cpp.
        (WebCore):
        (WebCore::toV8):
        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
        (WebCore):
        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
        (WebCore::toV8):
        (WebCore):
        * bindings/v8/custom/V8StyleSheetCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8TextTrackListCustom.cpp: Copied from Source/WebCore/bindings/v8/custom/V8StyleSheetCustom.cpp.
        (WebCore):
        (WebCore::toV8):
        * css/CSSStyleSheet.idl:
        * css/StyleSheet.idl:
        * dom/DOMStringMap.idl:
        * dom/NamedNodeMap.idl:
        * html/DOMTokenList.idl:
        * html/track/TextTrackList.idl:

2012-06-20  Abhishek Arya  <inferno@chromium.org>

        Crash on accessing a removed renderer from percent height descendant map.
        https://bugs.webkit.org/show_bug.cgi?id=88017

        Reviewed by Eric Seidel.

        Test: fast/block/percent-height-descendant-not-removed-crash2.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::hasPercentHeightContainerMap): helper to tell
        if we have a height container map.
        (WebCore):
        (WebCore::RenderBlock::hasPercentHeightDescendant): change from a debug
        only function to a regular function for use. no need to null check
        for a percent height container map in this function.
        (WebCore::RenderBlock::clearPercentHeightDescendantsFrom): helper to
        clear all percent height descendants under us.
        (WebCore::RenderBlock::removePercentHeightDescendantIfNeeded): helper to
        clear the box if it exists in the percent height descendant map.
        * rendering/RenderBlock.h:
        (RenderBlock):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::willBeDestroyed): remove the assert and change the
        percent height detection check to use removePercentHeightDescendantIfNeeded.
        We shouldn't rely on logicalHeight().isPercent() as it can change when our
        writing mode changes. Instead, just query the map directly to see if we exist.
        (WebCore::RenderBox::styleDidChange): when our writing mode changes from
        horizontal to vertical or vice versa, we clear all our descendants from
        the percent height descendant map. Cache the value of isHorizontalWritingMode()
        before it changes in styleDidChange and compare it with the new value
        (can't use oldStyle->isHorizontalWritingMode() since it can be inherited
        and already updated).

2012-06-20  Julien Chaffraix  <jchaffraix@webkit.org>

        REGRESSION(r113885): Margin not properly applied to elements with align=center
        https://bugs.webkit.org/show_bug.cgi?id=89515

        Reviewed by Levi Weintraub.

        Reviewed by Levi Weintraub.

        Tests: fast/block/negative-margin-start-positive-margin-end.html
               fast/block/negative-start-margin-align-center.html
               fast/block/positive-margin-block-child-align-center-rtl.html
               fast/block/positive-margin-block-child-align-center.html
               fast/block/positive-margin-start-align-center.html
               fast/block/positive-margin-start-negative-margin-end-align-center.html
               fast/table/table-cell-negative-start-margin-align-center.html

        r113885 changed the code-path for elements with auto width to call computeInlineDirectionMargins.
        However this uncovered an existing bug in the function when dealing with align="center" (text-align: -webkit-center)
        where we would ignore the margin. This goes against what other browsers are doing and our previous behavior.

        Note that align="left" and "right" are likely impacted too and will be investigated / fixed in follow-up changes.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeInlineDirectionMargins):
        To match other browsers' behavior, changed the function to include margin in our computations.

2012-06-19  James Robinson  <jamesr@chromium.org>

        [chromium] Separate LayerRenderer initialization from updateLayers
        https://bugs.webkit.org/show_bug.cgi?id=89525

        Reviewed by Adrienne Walker.

        This adds an explicit call to initialize the layer renderer of a given CCLayerTreeHost instead of having it be
        implicit in updateLayers(). This way the proxies can control the initialization sequence more closely and do
        useful work between the two calls.

        Refactor, no change in behavior. Covered by existing tests.

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::compositeAndReadback):
        (WebCore::CCLayerTreeHost::initializeLayerRendererIfNeeded):
        (WebCore):
        (WebCore::CCLayerTreeHost::updateLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::commitAndComposite):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::compositeAndReadback):
        (WebCore::CCThreadProxy::beginFrame):

2012-06-20  Yong Li  <yoli@rim.com>

        SecurityOrigin::canDisplay() should return true when m_universalAccess is true
        https://bugs.webkit.org/show_bug.cgi?id=84865

        Reviewed by Adam Barth.

        Add an early return (true) in canDisplay() for if (m_universalAccess),
        as we did for canAccess() and canRequest().

        No new tests. We should be good as long as this change doesn't break existing
        tests, which means the contents supposed to be blocked are still blocked when
        m_universalAccess is false.

        * page/SecurityOrigin.cpp:
        (WebCore::SecurityOrigin::canDisplay):

2012-06-20  Erik Arvidsson  <arv@chromium.org>

        [V8] Use v8::V8::AddImplicitReferences instead of SetHiddenValue
        https://bugs.webkit.org/show_bug.cgi?id=80880

        Reviewed by Adam Barth.

        We used to add a hidden property in the getter to the returned wrapper.
        With this patch we instead handle the liveness of the wrapper in the GC phase by
        calling v8::V8::AddHiddenReference.

        To reduce the amount of custom code we need, the V8 code generator now supports
        GenerateIsReachable (as well as CustomIsReachable) which, even though different
        from the JSC attribute, is used in the same cases and takes the same values (even though
        at the moment not all JSC values are supported by V8). Interfaces that have *IsReachable
        also have a dependent life time (just like if V8DependentLifetime was present).

        Retry. Last time we got ASAN issues on some Cromium Linux bots. 

        No new tests. Covered by existing tests.

        * Target.pri:
        * UseV8.cmake:
        * WebCore.gypi:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GetGenerateIsReachable): Abstracted GenerateIsReachable and JSGenerateIsReachable.
        (GetCustomIsReachable): Ditto.
        (GenerateHeader):
        (GenerateImplementation):
        * bindings/scripts/CodeGeneratorV8.pm:
        (NeedsToVisitDOMWrapper):
        (GetGenerateIsReachable):
        (GetCustomIsReachable):
        (GenerateVisitDOMWrapper):
        (GenerateHeader):
        (GenerateNamedConstructorCallback):
        (GenerateImplementation):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/test/V8/V8Float64Array.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8Float64Array.h:
        (V8Float64Array):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
        (V8TestActiveDOMObject):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
        (V8TestCustomNamedGetter):
        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestEventConstructor.h:
        (V8TestEventConstructor):
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestEventTarget.h:
        (V8TestEventTarget):
        * bindings/scripts/test/V8/V8TestException.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestException.h:
        (V8TestException):
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestInterface.h:
        (V8TestInterface):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
        (V8TestMediaQueryListListener):
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
        (V8TestNamedConstructor):
        * bindings/scripts/test/V8/V8TestNode.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestNode.h:
        (V8TestNode):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestObj.h:
        (V8TestObj):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
        (V8TestSerializedScriptValueInterface):
        * bindings/v8/NPV8Object.cpp:
        (WebCore::npObjectTypeInfo):
        * bindings/v8/V8GCController.cpp:
        (WebCore::GrouperVisitor::visitDOMWrapper):
        * bindings/v8/WrapperTypeInfo.h:
        (WebCore):
        (WrapperTypeInfo):
        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp: Removed.
        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        * bindings/v8/custom/V8DOMTokenListCustom.cpp: Removed.
        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
        (WebCore):
        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
        * bindings/v8/custom/V8StyleSheetCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8TextTrackListCustom.cpp: Removed.
        * css/CSSStyleSheet.idl:
        * css/StyleSheet.idl:
        * dom/DOMStringMap.idl:
        * dom/NamedNodeMap.idl:
        * html/DOMTokenList.idl:
        * html/track/TextTrackList.idl:

2012-06-20  Tony Chang  <tony@chromium.org>

        Regression(r116408): Ctrl-A (select all) on large text file hangs the tab with high CPU usage
        https://bugs.webkit.org/show_bug.cgi?id=89562

        Reviewed by Ryosuke Niwa.

        Rather than replace the newlines in-place (in O(n^2)), build a new string using StringBuilder, which takes O(n).

        No new tests, this is a perf improvement.

        * platform/chromium/ClipboardUtilitiesChromium.cpp:
        (WebCore::replaceNewlinesWithWindowsStyleNewlines):
        * platform/win/ClipboardUtilitiesWin.cpp:
        (WebCore::replaceNewlinesWithWindowsStyleNewlines):

2012-06-20  Elliott Sprehn  <esprehn@gmail.com>

        Add support for fit-content etc
        https://bugs.webkit.org/show_bug.cgi?id=38919

        Reviewed by Tony Chang.

        Implement the CSS3 intrinsic dimension keywords for width properties and
        add most of the plumbing for height properties but don't expose them
        yet since this patch doesn't enforce them (matching current Gecko).
        http://dev.w3.org/csswg/css3-writing-modes/#intrinsic-sizing

        This patch implements -webkit-min-content, -webkit-max-content,
        -webkit-fill-available and -webkit-fit-content for all width
        properties.

        Tests: fast/css-intrinsic-dimensions/height-dynamic-property-value.html
               fast/css-intrinsic-dimensions/height-property-value.html
               fast/css-intrinsic-dimensions/max-width-constrained.html
               fast/css-intrinsic-dimensions/max-width-unconstrained.html
               fast/css-intrinsic-dimensions/min-width.html
               fast/css-intrinsic-dimensions/width-avoid-floats.html
               fast/css-intrinsic-dimensions/width-dynamic-property-value.html
               fast/css-intrinsic-dimensions/width-property-value.html
               fast/css-intrinsic-dimensions/width.html

        * css/CSSParser.cpp: Add parser support for the new keywords.
        (WebCore::CSSParser::parseValue):
        * css/CSSPrimitiveValue.cpp:
        (WebCore):
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        * css/CSSValueKeywords.in:
        * css/LengthFunctions.cpp: Implement conversion functions.
        (WebCore::minimumValueForLength):
        (WebCore::valueForLength):
        (WebCore::floatValueForLength):
        * css/StyleBuilder.cpp:
        (WebCore::ApplyPropertyLength::applyValue):
        (WebCore::StyleBuilder::StyleBuilder): Clean up the template for old
           intrinsic values and add new values. Rename old intrinsic to
           LegacyIntrinsic and add support for the new dimension keywords as
           Intrinsic.
        * platform/Length.h:
        (WebCore::Length::isIntrinsicOrAuto):
        (WebCore::Length::isLegacyIntrinsic): New method to check for old
            min-intrinsic and intrinsic keywords.
        (WebCore::Length::isIntrinsic): New method to check for CSS3 intrinsic
            dimension keywords like min-content.
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeLogicalWidthInRegionUsing): Expose the max
           and min logical preferred widths as the new keywords.
        (WebCore::RenderBox::sizesLogicalWidthToFitContent): Renamed method to
           be more consistent with the new MinContent naming in the spec.
        * rendering/RenderBox.h:
        (RenderBox):

2012-06-20  Christopher Cameron  <ccameron@chromium.org>

        [chromium] webkit-backface-visibility doesn't work with video
        https://bugs.webkit.org/show_bug.cgi?id=88908

        When determining a contents layer's backface culling, use the parent
        layer's transform and backface-visibility properties. Track which
        layers need this special treatment with useParentBackfaceVisibility
        and setUseParentBackfaceVisibility functions in WebCore::LayerChromium,
        WebKit::WebLayer, and WebCore::CCLayerImpl.

        Reviewed by Adrienne Walker.

        Tests: compositing/backface-visibility/backface-visibility-image.html
               compositing/backface-visibility/backface-visibility-webgl.html

        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::setupContentsLayer):
            When a contents layer is added, tag it as inheriting its backface
            culling from its parent.
        * platform/graphics/chromium/LayerChromium.cpp:
            (WebCore::LayerChromium::LayerChromium):
                Initialize new m_useParentBackfaceVisibility member variable.
            (WebCore::LayerChromium::pushPropertiesTo):
                Propagate m_useParentBackfaceVisibility to CCLayerImpl.
        * platform/graphics/chromium/LayerChromium.h:
            (WebCore::LayerChromium::setUseParentBackfaceVisibility):
            (WebCore::LayerChromium::useParentBackfaceVisibility):
            (LayerChromium):
                Add m_useParentBackfaceVisibility member variable and modify
                and query accessors.
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
            (WebCore::CCLayerImpl::CCLayerImpl):
                Initialize new m_useParentBackfaceVisibility member variable.
        * platform/graphics/chromium/cc/CCLayerImpl.h:
            (WebCore::CCLayerImpl::setUseParentBackfaceVisibility):
            (WebCore::CCLayerImpl::useParentBackfaceVisibility):
            (CCLayerImpl):
                Add m_useParentBackfaceVisibility member variable and modify
                and query accessors.
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
            (WebCore::layerShouldBeSkipped):
                When examining a layer, if the layer has 
                useParentBackfaceVisibility set then use the layer's parent
                layer to determine backface culling.

2012-06-20  Nate Chapin  <japhet@chromium.org>

        Don't re-enter CachedResource::removeClient() if an XHR
        is canceled and restarted multiple times.
        https://bugs.webkit.org/show_bug.cgi?id=89378

        Reviewed by Eric Seidel.

        Test: http/tests/xmlhttprequest/reentrant-cancel.html

        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::cancel):
        (WebCore::DocumentThreadableLoader::clearResource): Save off a copy of m_resource
           then clear it, so we don't call clearResource() multiple times for the same resource.

2012-06-20  Robert Hogan  <robert@webkit.org>

        Negative margin block doesn't properly clear a float enclosed by a previous sibling
        https://bugs.webkit.org/show_bug.cgi?id=10900

        Reviewed by Eric Seidel.

        Tests: fast/block/float/previous-sibling-abspos-001.html
               fast/block/float/previous-sibling-abspos-002.html
               fast/block/float/previous-sibling-float-001.html
               fast/block/float/previous-sibling-float-002.html
               fast/css/clear-float-sibling.html

        Parent blocks keep a list of child floats that extend out of the parent block and
        by implication overhang into the parent's siblings. But this doesn't work if the
        sibling has collapsing margins - it will not find the float in the previous block's
        list so will ignore the float and fail to clear it.

        RenderBlock:collapseMargins() needs to check if a child's collapsing margin has 
        reduced the height of the parent up past the bottom of its previous sibling's lowest float
        and add the now overhanging float to the parent's float list if appropriate. No need to do
        this if the previous sibling is a float or is positioned - the child will clear/avoid it anyway
        and attempting to avoid floated children of floats causes incorrect layout.
        
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::collapseMargins):

2012-06-20  Andrey Adaikin  <aandrey@chromium.org>

        Web Inspector: Allow module injections into the InjectedScript
        https://bugs.webkit.org/show_bug.cgi?id=89530

        Add a new InjectedScriptModule abstract class that inherits InjectedScriptBase
        to reuse implementation, and which javascript code is injected via
        InjectedScript.

        Reviewed by Pavel Feldman.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/ScriptObject.cpp:
        (WebCore::ScriptObject::ScriptObject):
        (WebCore):
        * bindings/js/ScriptObject.h:
        (ScriptObject):
        (WebCore::ScriptObject::ScriptObject):
        * bindings/v8/ScriptObject.cpp:
        (WebCore::ScriptObject::ScriptObject):
        (WebCore):
        * bindings/v8/ScriptObject.h:
        (ScriptObject):
        (WebCore::ScriptObject::~ScriptObject):
        * inspector/InjectedScript.cpp:
        * inspector/InjectedScript.h:
        (WebCore):
        (WebCore::InjectedScript::name):
        (InjectedScript):
        * inspector/InjectedScriptBase.cpp:
        (WebCore::InjectedScriptBase::callFunctionWithEvalEnabled):
        * inspector/InjectedScriptBase.h:
        (WebCore):
        (InjectedScriptBase):
        * inspector/InjectedScriptManager.h:
        (InjectedScriptManager):
        (WebCore::InjectedScriptManager::inspectedStateAccessCheck):
        * inspector/InjectedScriptModule.cpp: Copied from Source/WebCore/inspector/InjectedScriptBase.h.
        (WebCore):
        (WebCore::InjectedScriptModule::InjectedScriptModule):
        (WebCore::InjectedScriptModule::ensureInjected):
        * inspector/InjectedScriptModule.h: Copied from Source/WebCore/bindings/js/ScriptObject.h.
        (WebCore):
        (InjectedScriptModule):
        * inspector/InjectedScriptSource.js:
        (.):

2012-06-20  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: Timeline label bar jiggles when scrolling
        https://bugs.webkit.org/show_bug.cgi?id=89579

        Reviewed by Vsevolod Vlasov.

        Adding timeline header into the timeline panel and settings its position
        to absolute. Drive-by fix that updates rulers on sidebar resize.

        * inspector/front-end/TimelineGrid.js:
        (WebInspector.TimelineGrid):
        (WebInspector.TimelineGrid.prototype.get gridHeaderElement):
        (WebInspector.TimelineGrid.prototype.addEventDividers):
        (WebInspector.TimelineGrid.prototype.setScrollAndDividerTop):
        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineOverviewPane.prototype.sidebarResized):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel):
        (WebInspector.TimelinePanel.prototype.sidebarResized):
        (WebInspector.TimelinePanel.prototype.onResize):
        * inspector/front-end/timelinePanel.css:
        (#timeline-grid-header):

2012-06-20  Ian Vollick  <vollick@chromium.org>

        [chromium] Make sure that render surfaces are not pixel doubled with a device scale factor of 2
        https://bugs.webkit.org/show_bug.cgi?id=86882

        Reviewed by Adrienne Walker.

        To ensure that render surfaces are not pixel doubled when device scale factor is
        two, the render surface's owning layer's draw transform is scaled by the
        contents scale (in the same way that the parent matrix is scaled by the device
        scale factor). The transformedLayerRect's dimensions also need to be in pixel
        space. The surface origin transform should not scale, but needs to offset the
        correct number of pixels, and the replica transforms need to be modified to
        account for the scaling.

        To accomplish this, CCLayerImpl's needed to be made aware of contentsScale.

        Thanks to Adrienne Walker for the computation of the replica draw transform.

        Unit test: CCLayerTreeHostCommonTest.verifyRenderSurfaceTranformsInHighDPI

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::pushPropertiesTo):
        * platform/graphics/chromium/LayerChromium.h:
        (LayerChromium):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore::CCLayerImpl::setContentsScale):
        (WebCore::CCLayerImpl::contentsScale):
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateDrawTransformsInternal):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
        (WebCore::CCScrollbarLayerImpl::CCScrollbar::totalSize):

2012-06-20  Alexis Menard  <alexis.menard@openbossa.org>

        [CSS3 Backgrounds and Borders] Implement box-decoration-break rendering.
        https://bugs.webkit.org/show_bug.cgi?id=88228

        Reviewed by Eric Seidel.

        Implement the new CSS property box-decoration-break. It modifies
        where we decide whether the borders needs to be sliced or not by
        checking if the box-decoration-break is set to clone. If it's the case
        then we need to explicitely redraw all edges.

        Test: fast/box-decoration-break/box-decoration-break-rendering.html

        * rendering/InlineFlowBox.cpp:
        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
        (WebCore::InlineFlowBox::paintFillLayer):

2012-06-20  Julien Chaffraix  <jchaffraix@webkit.org>

        Use IntSize in RenderLayer to represent scroll offsets
        https://bugs.webkit.org/show_bug.cgi?id=89154

        Reviewed by Eric Seidel.

        Refactoring, covered by existing tests.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::scrollTo):
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::forwardEvent):
        * page/SpatialNavigation.cpp:
        (WebCore::scrollInDirection):
        * rendering/RenderMarquee.cpp:
        (WebCore::RenderMarquee::start):
        Updated those call-sites to use the IntSize variant of the scrolling function.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::panScrollFromPoint):
        Updated the signature to use IntPoint to avoid an extra round-trip to LayoutPoint
        (furthermore touch points should be in device pixels).

        (WebCore::RenderLayer::clampScrollOffset):
        Added this function that clamps a scroll offset to the box's size. This enables more
        code sharing between the different functions. Also removed a NULL-check that shouldn't
        be needed: scrolling is a RenderBox concept so any callers should ensure that we have
        a RenderBox or it makes no sense to try to scroll.

        (WebCore::RenderLayer::updateLayerPosition):
        (WebCore::adjustedScrollDelta):
        (WebCore::RenderLayer::scrollByRecursively):
        (WebCore::RenderLayer::scrollToOffset):
        (WebCore::RenderLayer::scrollRectToVisible):
        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
        Updated to do IntSize arithmetic. Reuse clampScrollOffset when applicable.

        * rendering/RenderLayer.h:
        (WebCore::RenderLayer::scrollToXOffset):
        (WebCore::RenderLayer::scrollToYOffset):
        Updated the functions to take IntSize as much as possible.

2012-06-20  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: mark used/allocated JS heap on the native memory bar chart.
        https://bugs.webkit.org/show_bug.cgi?id=89476

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.NativeMemoryBarChart):
        (WebInspector.NativeMemoryBarChart.prototype._updateView):
        * inspector/front-end/nativeMemoryProfiler.css:
        (.memory-bar-chart-bar):
        (.memory-bar-chart-unused):
        (.memory-bar-chart-percent):

2012-06-20  Joshua Bell  <jsbell@chromium.org>

        [Chromium] IndexedDB: Don't close database if pending connections are in flight
        https://bugs.webkit.org/show_bug.cgi?id=89512

        Add a counter tracking connections between the two phases, which is used along with
        the completed connection count to determine the total number of connections.

        Reviewed by Tony Chang.

        Test: webkit_unit_tests --gtest_filter='IDBDatabaseBackendTest.ConnectionLifecycle'

        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::IDBDatabaseBackendImpl):
        (WebCore::IDBDatabaseBackendImpl::setVersion):
        (WebCore::IDBDatabaseBackendImpl::connectionCount):
        (WebCore):
        (WebCore::IDBDatabaseBackendImpl::processPendingCalls):
        (WebCore::IDBDatabaseBackendImpl::transaction):
        (WebCore::IDBDatabaseBackendImpl::registerFrontendCallbacks):
        (WebCore::IDBDatabaseBackendImpl::openConnection):
        (WebCore::IDBDatabaseBackendImpl::close):
        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
        (IDBDatabaseBackendImpl):
        * Modules/indexeddb/IDBFactoryBackendImpl.cpp:
        (WebCore::IDBFactoryBackendImpl::openInternal):
        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore):

2012-06-20  Sergey Rogulenko  <rogulenko@google.com>

        Web Inspector: duplicating selected text when Enter key is pressed 
        https://bugs.webkit.org/show_bug.cgi?id=89559

        Reviewed by Pavel Feldman.

        * inspector/front-end/TextViewer.js:
        (WebInspector.TextEditorMainPanel.prototype.handleEnterKey):
        The returned result of method normalize() should be used.

2012-06-20  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>

        [Cairo] Fix memory leak in GraphicsContext3DCairo.cpp
        https://bugs.webkit.org/show_bug.cgi?id=89561

        Reviewed by Martin Robinson.

        Fix a memory leak in GraphicsContext3D::getImageData().

        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
        (WebCore::GraphicsContext3D::getImageData): asNewNativeImage() returns a
        caller-owned pointer to the native image data. So, using OwnPtr to manage
        memory automatically.

2012-06-20  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Use HitTestPoint instead of LayoutPoint for nodeAtPoint.
        https://bugs.webkit.org/show_bug.cgi?id=89448

        Reviewed by Eric Seidel.

        This patch updates the API of nodeAtPoint without changing any 
        functionality. This is largest change necessary to support
        transforms in area-based hit-testing, but is only boilerplate.

        No change in functionality. No new tests. 

        * rendering/EllipsisBox.cpp:
        (WebCore::EllipsisBox::nodeAtPoint):
        * rendering/EllipsisBox.h:
        (EllipsisBox):
        * rendering/HitTestResult.cpp:
        (WebCore::HitTestResult::addNodeToRectBasedTestResult):
        * rendering/HitTestResult.h:
        (WebCore::HitTestPoint::intersects):
        (HitTestPoint):
        (HitTestResult):
        * rendering/InlineBox.cpp:
        (WebCore::InlineBox::nodeAtPoint):
        * rendering/InlineBox.h:
        (InlineBox):
        * rendering/InlineFlowBox.cpp:
        (WebCore::InlineFlowBox::nodeAtPoint):
        * rendering/InlineFlowBox.h:
        (InlineFlowBox):
        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::nodeAtPoint):
        * rendering/InlineTextBox.h:
        (InlineTextBox):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::nodeAtPoint):
        (WebCore::RenderBlock::hitTestFloats):
        (WebCore::RenderBlock::hitTestColumns):
        (WebCore::RenderBlock::hitTestContents):
        * rendering/RenderBlock.h:
        (RenderBlock):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::nodeAtPoint):
        * rendering/RenderBox.h:
        (RenderBox):
        * rendering/RenderEmbeddedObject.cpp:
        (WebCore::RenderEmbeddedObject::nodeAtPoint):
        * rendering/RenderEmbeddedObject.h:
        (RenderEmbeddedObject):
        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::hitTestRegion):
        * rendering/RenderFlowThread.h:
        * rendering/RenderFrameSet.cpp:
        (WebCore::RenderFrameSet::nodeAtPoint):
        * rendering/RenderFrameSet.h:
        (RenderFrameSet):
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::nodeAtPoint):
        * rendering/RenderImage.h:
        (RenderImage):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::nodeAtPoint):
        * rendering/RenderInline.h:
        (RenderInline):
        * rendering/RenderLayer.cpp:
        (WebCore::ClipRect::intersects):
        (WebCore::RenderLayer::hitTest):
        (WebCore::RenderLayer::createLocalTransformState):
        (WebCore::RenderLayer::hitTestLayer):
        (WebCore::RenderLayer::hitTestContents):
        (WebCore::RenderLayer::hitTestList):
        (WebCore::RenderLayer::hitTestPaginatedChildLayer):
        (WebCore::RenderLayer::hitTestChildLayerColumns):
        * rendering/RenderLayer.h:
        (ClipRect):
        (RenderLayer):
        * rendering/RenderLineBoxList.cpp:
        (WebCore::RenderLineBoxList::hitTest):
        * rendering/RenderLineBoxList.h:
        (RenderLineBoxList):
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::nodeAtPoint):
        * rendering/RenderListBox.h:
        (RenderListBox):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::hitTest):
        (WebCore::RenderObject::nodeAtPoint):
        * rendering/RenderObject.h:
        (RenderObject):
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::nodeAtPoint):
        * rendering/RenderRegion.h:
        (RenderRegion):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::nodeAtPoint):
        * rendering/RenderTable.h:
        (RenderTable):
        * rendering/RenderTableRow.cpp:
        (WebCore::RenderTableRow::nodeAtPoint):
        * rendering/RenderTableRow.h:
        (RenderTableRow):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::nodeAtPoint):
        * rendering/RenderTableSection.h:
        (RenderTableSection):
        * rendering/RenderText.h:
        * rendering/RenderTextControlMultiLine.cpp:
        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
        * rendering/RenderTextControlMultiLine.h:
        (RenderTextControlMultiLine):
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::nodeAtPoint):
        * rendering/RenderTextControlSingleLine.h:
        (RenderTextControlSingleLine):
        * rendering/RenderWidget.cpp:
        (WebCore::RenderWidget::nodeAtPoint):
        * rendering/RenderWidget.h:
        (RenderWidget):
        * rendering/RootInlineBox.cpp:
        (WebCore::RootInlineBox::nodeAtPoint):
        * rendering/RootInlineBox.h:
        (RootInlineBox):
        * rendering/svg/RenderSVGForeignObject.cpp:
        (WebCore::RenderSVGForeignObject::nodeAtFloatPoint):
        (WebCore::RenderSVGForeignObject::nodeAtPoint):
        * rendering/svg/RenderSVGForeignObject.h:
        (RenderSVGForeignObject):
        * rendering/svg/RenderSVGModelObject.cpp:
        (WebCore::RenderSVGModelObject::nodeAtPoint):
        * rendering/svg/RenderSVGModelObject.h:
        (RenderSVGModelObject):
        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::nodeAtPoint):
        * rendering/svg/RenderSVGRoot.h:
        (RenderSVGRoot):
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::nodeAtFloatPoint):
        (WebCore::RenderSVGText::nodeAtPoint):
        * rendering/svg/RenderSVGText.h:
        (RenderSVGText):
        * rendering/svg/SVGInlineTextBox.cpp:
        (WebCore::SVGInlineTextBox::nodeAtPoint):
        * rendering/svg/SVGInlineTextBox.h:
        (SVGInlineTextBox):

2012-06-20  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: don't report context ids before DidCommitLoad
        https://bugs.webkit.org/show_bug.cgi?id=89567

        Reviewed by Pavel Feldman.

        When inspector state is restored only report existing context ids
        if "did commit load" even has already been dispatched.

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        * inspector/PageRuntimeAgent.cpp:
        (WebCore::PageRuntimeAgent::PageRuntimeAgent):
        (WebCore::PageRuntimeAgent::restore):
        * inspector/PageRuntimeAgent.h:
        (WebCore):
        (WebCore::PageRuntimeAgent::create):
        (PageRuntimeAgent):

2012-06-20  Zeev Lieber  <zlieber@chromium.org>

        [Chromium] Remove redundant #includes in compositor
        https://bugs.webkit.org/show_bug.cgi?id=89503

        Reviewed by Adrienne Walker.

        Removed some redundant #includes to clarify dependency
        picture. Some 90 #includes removed, some 50 less disruptive
        #includes added. This brings the number of class dependencies to
        902 from 1383.

        No new tests are required, as this is only affects compile-time behavior.

        * platform/graphics/chromium/AnimationTranslationUtil.h:
        (WebCore):
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
        * platform/graphics/chromium/Canvas2DLayerBridge.h:
        * platform/graphics/chromium/ContentLayerChromium.cpp:
        * platform/graphics/chromium/ContentLayerChromium.h:
        * platform/graphics/chromium/DrawingBufferChromium.cpp:
        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/GraphicsLayerChromium.h:
        * platform/graphics/chromium/ImageLayerChromium.cpp:
        * platform/graphics/chromium/LayerChromium.h:
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        * platform/graphics/chromium/LayerRendererChromium.h:
        (WebCore):
        * platform/graphics/chromium/LayerTextureUpdater.h:
        * platform/graphics/chromium/ManagedTexture.cpp:
        * platform/graphics/chromium/ProgramBinding.h:
        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
        * platform/graphics/chromium/RenderSurfaceChromium.h:
        * platform/graphics/chromium/TextureCopier.cpp:
        * platform/graphics/chromium/TextureLayerChromium.cpp:
        * platform/graphics/chromium/TextureManager.cpp:
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        * platform/graphics/chromium/TiledLayerChromium.h:
        * platform/graphics/chromium/cc/CCActiveAnimation.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp:
        * platform/graphics/chromium/cc/CCDrawQuad.cpp:
        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
        * platform/graphics/chromium/cc/CCFrameRateController.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCProxy.cpp:
        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
        * platform/graphics/chromium/cc/CCRenderPass.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        * platform/graphics/chromium/cc/CCRenderer.h:
        * platform/graphics/chromium/cc/CCScopedThreadProxy.h:
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCTextureLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCTimer.cpp:
        * platform/graphics/chromium/cc/CCTimer.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:

2012-06-20  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Implement native memory bar diagram
        https://bugs.webkit.org/show_bug.cgi?id=89106

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.NativeMemoryBarChart):
        (WebInspector.NativeMemoryBarChart.prototype._updateStats):
        (WebInspector.NativeMemoryBarChart.prototype.willHide):
        (WebInspector.NativeMemoryBarChart.prototype.wasShown):
        (WebInspector.NativeMemoryBarChart.prototype._updateView):
        * inspector/front-end/ProfileLauncherView.js:
        (WebInspector.ProfileLauncherView):
        * inspector/front-end/Settings.js:
        (WebInspector.ExperimentsSettings):
        * inspector/front-end/nativeMemoryProfiler.css:
        (.memory-bar-chart-name):
        (.memory-bar-chart-bar):
        (.memory-bar-chart-size):
        (.memory-bar-chart-total):

2012-06-20  Hans Wennborg  <hans@chromium.org>

        Speech JavaScript API: add SpeechRecognition.maxAlternatives attribute
        https://bugs.webkit.org/show_bug.cgi?id=89459

        Reviewed by Eric Seidel.

        Add the SpeechRecognition.maxAlternatives attribute.

        Test: fast/speech/scripted/basics.html:

        * Modules/speech/SpeechRecognition.cpp:
        (WebCore::SpeechRecognition::start):
        (WebCore::SpeechRecognition::SpeechRecognition):
        * Modules/speech/SpeechRecognition.h:
        (WebCore::SpeechRecognition::maxAlternatives):
        (WebCore::SpeechRecognition::setMaxAlternatives):
        (SpeechRecognition):
        * Modules/speech/SpeechRecognition.idl:
        * Modules/speech/SpeechRecognitionClient.h:
        (SpeechRecognitionClient):
        * Modules/speech/SpeechRecognitionController.h:
        (WebCore::SpeechRecognitionController::start):
        (SpeechRecognitionController):

2012-06-20  Takashi Sakamoto  <tasak@google.com>

        applyAuthorStyles makes rules declared in all enclosing shadow dom subtrees applicable.
        https://bugs.webkit.org/show_bug.cgi?id=89061

        Reviewed by Dimitri Glazkov.

        Fixing apply-author-styles bug. If there exists some shadow subtree A
        and A has apply-author-styles flag set, whether some rules declared in
        a tree B is applicable in A or not depends on:
        - the tree B encloses the tree A, and
        - all trees which enclose A and are enclosed by B has
          apply-author-styles set.
        c.f.
        http://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#styles
        However the second rule was not implemented.

        Test: fast/css/style-scoped/style-scoped-apply-author-styles.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::setupScopeStack):
        Modified to add a new member variable, authorStyleBoundsIndex to
        ScopeStackFrame used by m_scopeStack. The index means: if shadow dom
        subtree A and B has the same value and A encloses B, all shadow dom
        subtrees which enclose B and are enclosed by B have
        apply-author-styles set. And B also has apply-author-styles set.
        This means, if some element X has authorStyleBoundsIndex N, all
        rulesets whose scopes have authorStyleBoundsIndex N are applicable in
        B's tree scope. If all shadow dom subtrees have apply-author-styles
        unset, the index looks almost the same as treeScope(). In this case,
        Rules in different tree scopes have different author style bounds
        index.
        (WebCore::StyleResolver::pushScope):
        (WebCore::StyleResolver::popScope):
        Added the code for updating m_scopeStackParentBoundsIndex. The member
        variable keeps m_scopeStackParent's author style bounds index.
        (WebCore::StyleResolver::matchScopedAuthorRules):
        Modified to consider author style's bounds index. Firstly applying
        scoped styles declared in document if apply-author-styles is set.
        Next, applying scoped styles declared in shadow dom subtree with
        considering author style bounds index, i.e. considering
        apply-author-styles flag.
        * css/StyleResolver.h:
        (WebCore::StyleResolver::ScopeStackFrame::ScopeStackFrame):
        (ScopeStackFrame):
        Added m_authorStyleBoundsIndex to keep apply-author-styles flag
        information. m_authorStyleBoundsIndex increments by 1 if shadow root is
        given and it has apply-author-styles unset.
        Now rules in the same authorStyleBoundsIndex should be applied.
        (StyleResolver):
        Added m_scopeStackParentBoundsIndex.
        As m_scopeStackParentAuthorStyleBoundsIndex is a little long,
        used m_scopeStackParentBoundsIndex.

2012-06-20  Amy Ousterhout  <aousterh@chromium.org>

        Adds DeviceMotionClientMock
        https://bugs.webkit.org/show_bug.cgi?id=89220

        Reviewed by Steve Block.

        No new tests because DeviceMotionClientMock is designed to enable future testing and cannot be tested in itself.

        Adds DeviceMotionClientMock in WebCore to enable testing of DeviceMotion once it is fully implemented in WebKit.
        This addition was originally included in https://bugs.webkit.org/show_bug.cgi?id=89197 but was split into a separate patch for easier review.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * platform/mock/DeviceMotionClientMock.cpp: Added.
        (WebCore):
        (WebCore::DeviceMotionClientMock::DeviceMotionClientMock):
        (WebCore::DeviceMotionClientMock::setController):
        (WebCore::DeviceMotionClientMock::startUpdating):
        (WebCore::DeviceMotionClientMock::stopUpdating):
        (WebCore::DeviceMotionClientMock::setMotion):
        (WebCore::DeviceMotionClientMock::timerFired):
        * platform/mock/DeviceMotionClientMock.h: Added.
        (WebCore):
        (DeviceMotionClientMock):

2012-06-19  Vivek Galatage  <vivekgalatage@gmail.com>

        Web Inspector: Clicking "Clear all profiles" while ongoing recording should reset the ProfileLauncherView
        https://bugs.webkit.org/show_bug.cgi?id=89464

        Reviewed by Yury Semikhatsky.

        Resetting the ProfileLauncherView in order to reflect the correct states of buttons

        No new tests as UI related minor fix.

        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype._reset):

2012-06-19  Hayato Ito  <hayato@chromium.org>

        Assertion for event's target is wrong.
        https://bugs.webkit.org/show_bug.cgi?id=89479

        Reviewed by Hajime Morita.

        Fix an assertion to ensure that event's target is reachable from a current target.

        No new tests. Fix an assert condition.

        * dom/EventContext.cpp:
        (WebCore::EventContext::EventContext):
        * dom/EventContext.h:
        (EventContext):
        (WebCore::EventContext::setRelatedTarget):
        (WebCore::EventContext::isUnreachableNode):
        (WebCore):
        (WebCore::EventContext::isReachable):

2012-06-19  Benjamin Poulain  <bpoulain@apple.com>

        Refactoring: Geolocation::startRequest() should not create the GeoNotifiers
        https://bugs.webkit.org/show_bug.cgi?id=89533

        Reviewed by David Kilzer.

        It was odd to create the GeoNotifiers in Geolocation::startRequest() and having
        assertions from the call site.

        This patch move GeoNotifiers initialization to the exposed methods and pass them to
        startRequest() as needed.
        This will also help when adding support for dynamic permission reset and suspend/resume.

        * Modules/geolocation/Geolocation.cpp:
        (WebCore::Geolocation::getCurrentPosition):
        (WebCore::Geolocation::watchPosition):
        (WebCore::Geolocation::startRequest):
        * Modules/geolocation/Geolocation.h:
        (Geolocation):

2012-06-19  Cris Neckar  <cdn@chromium.org>

        Fixes condition where inserting a CounterNode subtree which could result in incorrect placement.
        https://bugs.webkit.org/show_bug.cgi?id=88142

        Reviewed by Adam Barth.

        Test: fast/css/counters/counter-reset-subtree-insert-crash.html

        * rendering/CounterNode.cpp:
        (WebCore::CounterNode::insertAfter):

2012-06-19  Csaba Osztrogonác  <ossy@webkit.org>

        [Qt] Unreviewed buildfix after r120790. Typo fix.

        * platform/graphics/gstreamer/ImageGStreamerQt.cpp:
        (ImageGStreamer::ImageGStreamer):

2012-06-19  Takashi Sakamoto  <tasak@google.com>

        [Shadow DOM] ShadowRoot.host should be gone
        https://bugs.webkit.org/show_bug.cgi?id=88387

        According to the w3c spec change,
        i.e. https://www.w3.org/Bugs/Public/show_bug.cgi?id=16764
        Removed host attribute from ShadowRoot.idl.

        Reviewed by Dimitri Glazkov.

        No new tests, because this change modified only idl.

        * dom/ShadowRoot.idl:
        Just removed host attribute.

2012-06-19  Adam Klein  <adamk@chromium.org>

        Pass ScriptValue by const ref where possible
        https://bugs.webkit.org/show_bug.cgi?id=89531

        Reviewed by Kentaro Hara.

        Previously ScriptValue was sometimes passed by value, sometimes by const ref.

        For consistency and optimality, pass by const ref everywhere (except where
        ScriptValue is returned from non-accessor methods).

        No new tests, no change in behavior.

        * bindings/js/ScriptFunctionCall.h:
        (ScriptCallback):
        * bindings/js/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::getHeapObjectId):
        * bindings/js/ScriptProfiler.h:
        (ScriptProfiler):
        * bindings/js/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::setException):
        * bindings/js/WorkerScriptController.h:
        (WorkerScriptController):
        * bindings/v8/ScriptFunctionCall.cpp:
        (WebCore::ScriptCallback::ScriptCallback):
        * bindings/v8/ScriptFunctionCall.h:
        (ScriptCallback):
        * bindings/v8/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::getHeapObjectId):
        (WebCore):
        * bindings/v8/ScriptProfiler.h:
        (ScriptProfiler):
        * bindings/v8/ScriptValue.h:
        (WebCore::ScriptValue::operator==):
        (WebCore::ScriptValue::operator!=):
        * bindings/v8/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::setException):
        * bindings/v8/WorkerScriptController.h:
        (WorkerScriptController):
        * css/MediaQueryListListener.h:
        (WebCore::MediaQueryListListener::create):
        (WebCore::MediaQueryListListener::MediaQueryListListener):
        * dom/CustomEvent.cpp:
        (WebCore::CustomEvent::initCustomEvent):
        * dom/CustomEvent.h:
        (CustomEvent):
        (WebCore::CustomEvent::detail):
        * dom/MessageEvent.h:
        (WebCore::MessageEvent::dataAsScriptValue):
        * dom/PopStateEvent.h:
        (WebCore::PopStateEvent::state):
        * inspector/InjectedScript.cpp:
        (WebCore::InjectedScript::wrapObject):
        * inspector/InjectedScript.h:
        (InjectedScript):

2012-06-18  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] 0.11 video-sink
        https://bugs.webkit.org/show_bug.cgi?id=77087

        Reviewed by Martin Robinson.

        Port the video sink to GStreamer 0.11 APIs. There is no change in
        functionality compared to 0.10, for now.

        * platform/graphics/gstreamer/GStreamerVersioning.cpp:
        (webkitGetVideoSizeAndFormatFromCaps):
        (webkitGstCreateBuffer):
        * platform/graphics/gstreamer/GStreamerVersioning.h:
        (WebCore):
        * platform/graphics/gstreamer/ImageGStreamer.h:
        (WebCore::ImageGStreamer::createImage):
        (WebCore::ImageGStreamer::setCropRect):
        (WebCore::ImageGStreamer::rect):
        (ImageGStreamer):
        * platform/graphics/gstreamer/ImageGStreamerCairo.cpp:
        (ImageGStreamer::ImageGStreamer):
        * platform/graphics/gstreamer/ImageGStreamerQt.cpp:
        (ImageGStreamer::ImageGStreamer):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer):
        (WebCore::MediaPlayerPrivateGStreamer::naturalSize):
        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
        (_WebKitVideoSinkPrivate):
        (webkitVideoSinkRender):
        (webkitVideoSinkProposeAllocation):
        (webkit_video_sink_class_init):
        * platform/graphics/gstreamer/VideoSinkGStreamer.h:
        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:

2012-06-19  Tony Payne  <tpayne@chromium.org>

        Add monitor profile support for Win
        https://bugs.webkit.org/show_bug.cgi?id=88565

        Reviewed by Eric Seidel.

        Tests: fast/images/jpeg-with-color-profile.html
        fast/images/png-with-color-profile.html. Also covered by numerous
        layout tests.

        * WebCore.gyp/WebCore.gyp:
        * platform/PlatformScreen.h:
        (WebCore):
        * platform/blackberry/PlatformScreenBlackBerry.cpp:
        (WebCore::screenColorProfile):
        (WebCore):
        * platform/chromium/PlatformScreenChromium.cpp:
        (WebCore::screenColorProfile):
        (WebCore):
        * platform/efl/PlatformScreenEfl.cpp:
        (WebCore::screenColorProfile):
        (WebCore):
        * platform/gtk/PlatformScreenGtk.cpp:
        (WebCore::screenColorProfile):
        (WebCore):
        * platform/image-decoders/ImageDecoder.h:
        (ImageFrame):
        (ImageDecoder):
        (WebCore::ImageDecoder::qcmsOutputDeviceProfile):
        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
        (turboSwizzled):
        (colorSpaceHasAlpha):

2012-06-19  Erik Arvidsson  <arv@chromium.org>

        [V8] Fix issue where a callback got a null calling context
        https://bugs.webkit.org/show_bug.cgi?id=89532

        Reviewed by Kentaro Hara.

        Test: fast/dom/Window/post-message-crash.html

        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::handlePostMessageCallback): Check the calling context and throw a type error (like JSC) if it is null.

2012-06-19  Tony Chang  <tony@chromium.org>

        Refactor RenderFlexibleBox terminology to use grow/shrink instead of positive/negative
        https://bugs.webkit.org/show_bug.cgi?id=89493

        Reviewed by Eric Seidel.

        The spec stopped referring to positive and negative flex and now
        talks about flex grow and flex shrink. Also, the preferred size is
        now known as the flex basis. Make the code match the terms used in
        the spec. http://dev.w3.org/csswg/css3-flexbox/

        This will also make it easier to split flex into long hand notation
        (flex-grow, flex-shrink and flex-basis).

        No new tests, covered by existing tests.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/StyleBuilder.cpp:
        (WebCore::ApplyPropertyFlex::applyInheritValue):
        (WebCore::ApplyPropertyFlex::applyInitialValue):
        (WebCore::ApplyPropertyFlex::applyValue):
        * page/animation/CSSPropertyAnimation.cpp:
        (WebCore::PropertyWrapperFlex::equals):
        (WebCore::PropertyWrapperFlex::blend):
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::flexBasisForChild):
        (WebCore::RenderFlexibleBox::preferredMainAxisContentExtentForChild):
        (WebCore::RenderFlexibleBox::layoutFlexItems):
        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes):
        (WebCore::RenderFlexibleBox::computeNextFlexLine):
        (WebCore::RenderFlexibleBox::freezeViolations):
        (WebCore::RenderFlexibleBox::resolveFlexibleLengths):
        * rendering/RenderFlexibleBox.h:
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleFlexibleBoxData.cpp:
        (WebCore::StyleFlexibleBoxData::StyleFlexibleBoxData):
        (WebCore::StyleFlexibleBoxData::operator==):
        * rendering/style/StyleFlexibleBoxData.h:
        (StyleFlexibleBoxData):

2012-06-19  Steve VanDeBogart  <vandebo@chromium.org>

        Make DOMFileSystem selectively structure clonable so it can be the body of a web intent.
        https://bugs.webkit.org/show_bug.cgi?id=88267

        Reviewed by David Levin.

        This functionality will allow FileSystem API objects to be dispatched to
        web content in order to enable, for instance, an intent notifying web
        content that a particular filesystem has been mounted by the local
        system. The goal at this point is not to enable across-the-board
        clonability, but just for handling the particular use case.

        * bindings/v8/SerializedScriptValue.cpp:
        (WebCore::V8ObjectMap::Writer::writeDOMFileSystem):
        (WebCore::V8ObjectMap::Serializer::writeDOMFileSystem):
        (WebCore::V8ObjectMap::Serializer::doSerialize):
        (WebCore::V8ObjectMap::Reader::read):
        (WebCore::V8ObjectMap::Reader::readDOMFileSystem):

2012-06-19  Kenneth Russell  <kbr@google.com>

        Unreviewed, rolling out r120772.
        http://trac.webkit.org/changeset/120772
        https://bugs.webkit.org/show_bug.cgi?id=89503

        Broke build on Chromium Mac

        * platform/graphics/chromium/AnimationTranslationUtil.h:
        (WebCore):
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
        * platform/graphics/chromium/Canvas2DLayerBridge.h:
        * platform/graphics/chromium/ContentLayerChromium.cpp:
        * platform/graphics/chromium/ContentLayerChromium.h:
        * platform/graphics/chromium/DrawingBufferChromium.cpp:
        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/GraphicsLayerChromium.h:
        (WebCore):
        * platform/graphics/chromium/ImageLayerChromium.cpp:
        * platform/graphics/chromium/LayerChromium.h:
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        * platform/graphics/chromium/LayerRendererChromium.h:
        (WebCore):
        * platform/graphics/chromium/LayerTextureUpdater.h:
        * platform/graphics/chromium/ManagedTexture.cpp:
        * platform/graphics/chromium/ProgramBinding.h:
        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
        * platform/graphics/chromium/RenderSurfaceChromium.h:
        * platform/graphics/chromium/TextureCopier.cpp:
        * platform/graphics/chromium/TextureLayerChromium.cpp:
        * platform/graphics/chromium/TextureManager.cpp:
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        * platform/graphics/chromium/TiledLayerChromium.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCActiveAnimation.h:
        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp:
        * platform/graphics/chromium/cc/CCDrawQuad.cpp:
        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
        * platform/graphics/chromium/cc/CCFrameRateController.h:
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
        * platform/graphics/chromium/cc/CCProxy.cpp:
        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
        * platform/graphics/chromium/cc/CCRenderPass.h:
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        * platform/graphics/chromium/cc/CCRenderer.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCScopedThreadProxy.h:
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCTextureLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
        * platform/graphics/chromium/cc/CCTimer.cpp:
        * platform/graphics/chromium/cc/CCTimer.h:
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:

2012-06-19  Zeev Lieber  <zlieber@chromium.org>

        [Chromium] Remove redundant #includes in compositor
        https://bugs.webkit.org/show_bug.cgi?id=89503

        Reviewed by Adrienne Walker.

        Removed some redundant #includes to clarify dependency
        picture. Some 90 #includes removed, some 50 less disruptive
        #includes added. This brings the number of class dependencies to
        902 from 1383.

        No new tests are required, as this is only affects compile-time behavior.

        * platform/graphics/chromium/AnimationTranslationUtil.h:
        (WebCore):
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
        * platform/graphics/chromium/Canvas2DLayerBridge.h:
        * platform/graphics/chromium/ContentLayerChromium.cpp:
        * platform/graphics/chromium/ContentLayerChromium.h:
        * platform/graphics/chromium/DrawingBufferChromium.cpp:
        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/GraphicsLayerChromium.h:
        * platform/graphics/chromium/ImageLayerChromium.cpp:
        * platform/graphics/chromium/LayerChromium.h:
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        * platform/graphics/chromium/LayerRendererChromium.h:
        (WebCore):
        * platform/graphics/chromium/LayerTextureUpdater.h:
        * platform/graphics/chromium/ManagedTexture.cpp:
        * platform/graphics/chromium/ProgramBinding.h:
        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
        * platform/graphics/chromium/RenderSurfaceChromium.h:
        * platform/graphics/chromium/TextureCopier.cpp:
        * platform/graphics/chromium/TextureLayerChromium.cpp:
        * platform/graphics/chromium/TextureManager.cpp:
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        * platform/graphics/chromium/TiledLayerChromium.h:
        * platform/graphics/chromium/cc/CCActiveAnimation.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp:
        * platform/graphics/chromium/cc/CCDrawQuad.cpp:
        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
        * platform/graphics/chromium/cc/CCFrameRateController.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCProxy.cpp:
        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
        * platform/graphics/chromium/cc/CCRenderPass.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        * platform/graphics/chromium/cc/CCRenderer.h:
        * platform/graphics/chromium/cc/CCScopedThreadProxy.h:
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCTextureLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCTimer.cpp:
        * platform/graphics/chromium/cc/CCTimer.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:

2012-06-19  Julien Chaffraix  <jchaffraix@webkit.org>

        Align RenderLayer's descendant dependent flags semantics
        https://bugs.webkit.org/show_bug.cgi?id=89241

        Reviewed by Simon Fraser.

        Refactoring only, covered by existing tests.

        This change aligns the naming and implementation of the different descendant
        dependent flags. While aligning, I found some bugs (inefficiencies) with how
        the visible descendant flags was computed.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::setHasVisibleContent):
        Changed this method to not take a boolean as every callers was passing 'true'.
        Reworked the logic under this assumption.

        (WebCore::RenderLayer::dirtyVisibleContentStatus):
        Updated after the following renaming.

        (WebCore::RenderLayer::dirtyAncestorChainVisibleDescendantStatus):
        Renamed this function from dirtyVisibleDescendantStatus to match the hasSelfPaintingLayer
        naming and implementation.

        (WebCore::RenderLayer::setAncestorChainHasVisibleDescendant):
        Added this function to factor the visible descendant setting out of defunct childVisibilityChanged.
        Also improved the efficiency of the function by clearing the dirty flag as it goes up (an unnoticed bug).

        (WebCore::RenderLayer::addChild):
        (WebCore::RenderLayer::removeChild):
        Updated to use the new functions lieu of childVisibilityChanged.
        * rendering/RenderLayer.h:
        (RenderLayer::childVisibilityChanged):
        Removed this function as it wasn't adding much and it's a lot more clear to call
        dirtyAncestorChainVisibleDescendantStatus / setAncestorChainHasVisibleDescendant.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::styleWillChange):
        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::appendChildNode):
        (WebCore::RenderObjectChildList::insertChildNode):
        Updated those callers after removing the boolean parameter from setHasVisibleContent.

2012-06-19  Andrey Adaikin  <aandrey@chromium.org>

        Web Inspector: Extract InjectedScriptBase class from the InjectedScript
        https://bugs.webkit.org/show_bug.cgi?id=89107

        Extract methods from the InjectedScript that do not depend on
        the concrete InjectedScriptSource.js implementation.

        Reviewed by Pavel Feldman.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * inspector/InjectedScript.cpp:
        (WebCore::InjectedScript::InjectedScript):
        (WebCore::InjectedScript::evaluate):
        (WebCore::InjectedScript::callFunctionOn):
        (WebCore::InjectedScript::evaluateOnCallFrame):
        (WebCore::InjectedScript::getFunctionDetails):
        (WebCore::InjectedScript::getProperties):
        (WebCore::InjectedScript::nodeForObjectId):
        (WebCore::InjectedScript::releaseObject):
        (WebCore::InjectedScript::wrapCallFrames):
        (WebCore::InjectedScript::wrapObject):
        (WebCore::InjectedScript::wrapSerializedObject):
        (WebCore::InjectedScript::findObjectById):
        (WebCore::InjectedScript::inspectNode):
        (WebCore::InjectedScript::releaseObjectGroup):
        (WebCore::InjectedScript::nodeAsScriptValue):
        * inspector/InjectedScript.h:
        (WebCore):
        (InjectedScript):
        * inspector/InjectedScriptBase.cpp: Added.
        (WebCore):
        (WebCore::InjectedScriptBase::InjectedScriptBase):
        (WebCore::InjectedScriptBase::canAccessInspectedWindow):
        (WebCore::InjectedScriptBase::injectedScriptObject):
        (WebCore::InjectedScriptBase::callFunctionWithEvalEnabled):
        (WebCore::InjectedScriptBase::makeCall):
        (WebCore::InjectedScriptBase::makeEvalCall):
        * inspector/InjectedScriptBase.h: Copied from Source/WebCore/bindings/js/ScriptObject.h.
        (WebCore):
        (InjectedScriptBase):
        (WebCore::InjectedScriptBase::~InjectedScriptBase):
        (WebCore::InjectedScriptBase::hasNoValue):
        (WebCore::InjectedScriptBase::scriptState):
        * inspector/InspectorAllInOne.cpp:

2012-06-19  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120621.
        http://trac.webkit.org/changeset/120621
        https://bugs.webkit.org/show_bug.cgi?id=89518

        Memory graph should have been behind the experimental flag.
        (Requested by pfeldman on #webkit).

        * inspector/front-end/NativeMemorySnapshotView.js:
        * inspector/front-end/ProfileLauncherView.js:
        (WebInspector.ProfileLauncherView):
        * inspector/front-end/nativeMemoryProfiler.css:
        (.memory-blocks-list .item):

2012-06-19  Hans Muller  <hmuller@adobe.com>

        The CSS_WRAP_SHAPE CSSWrapShape::Type is no longer needed
        https://bugs.webkit.org/show_bug.cgi?id=89403

        Reviewed by Eric Seidel.

        Removed CSS_WRAP_SHAPE_PATH definition from CSSWrapShapes.h.
        It's no longer required. This definition was never used or
        tested, no new tests are required.

        * css/CSSWrapShapes.h:

2012-06-19  Ken Buchanan  <kenrb@chromium.org>

        Absolute positioned objects should not be added to anonymous block lists
        https://bugs.webkit.org/show_bug.cgi?id=87768

        Reviewed by Abhishek Arya.

        containingBlock() was returning an anonymous block for absolute
        positioned objects under a relative positioned inline in the case
        that the inline is split and the object is underneath the block
        continuation. Anonymous blocks should never have anything in their
        positioned object lists because they can be destroyed at any time
        for a different reasons such as anonymous block merging, which is
        a problem for layout if they have m_posChildNeedsLayout set.

        This patch adds a generic check for anonymous blocks in
        containingBlock() to correct this problem.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::containingBlock):

2012-06-19  Jan Keromnes  <janx@linux.com>

        Web Inspector: extensionPanel.onSearch `action` strings should be
        enumerated.
        https://bugs.webkit.org/show_bug.cgi?id=89509

        Reviewed by Pavel Feldman.

        Fixed LayoutTests/inspector/extensions/extensions-api-expected.txt
        accordingly.

        * inspector/front-end/ExtensionAPI.js:
        (defineCommonExtensionSymbols):
        (injectedExtensionAPI.Panels.prototype.setOpenResourceHandler):
        (injectedExtensionAPI.Panels.prototype.get SearchAction):
        * inspector/front-end/ExtensionPanel.js:
        (WebInspector.ExtensionPanel.prototype.searchCanceled):
        (WebInspector.ExtensionPanel.prototype.performSearch):
        (WebInspector.ExtensionPanel.prototype.jumpToNextSearchResult):
        (WebInspector.ExtensionPanel.prototype.jumpToPreviousSearchResult):

2012-06-19  Dana Jansens  <danakj@chromium.org>

        [chromium] Add an allocation step for CCRenderer before drawing a frame
        https://bugs.webkit.org/show_bug.cgi?id=88924

        Reviewed by Adrienne Walker.

        This step will be used to decide which RenderPass textures can be kept
        alive and do not need to be drawn again.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore):
        (WebCore::LayerRendererChromium::decideRenderPassAllocationsForFrame):
        (WebCore::LayerRendererChromium::beginDrawingFrame):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::drawLayers):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (CCRenderer):

2012-06-19  Alexandru Chiculita  <achicu@adobe.com>

        [CSS Shaders] Create a shared object between FECustomFilter objects to store the shared resources
        https://bugs.webkit.org/show_bug.cgi?id=87878

        Reviewed by Dean Jackson.

        An object called CustomFilterGlobalContext is created the first time a new FECustomFilter is needed in a document.
        It is used to store the GraphicsContext3D needed to render the CSS Shaders. The context is shared by all the elements
        in a document (no cross-domain).

        More resources will be shared in following patches, including precompiled shaders and vertices/indices data.
        https://bugs.webkit.org/show_bug.cgi?id=88427
        https://bugs.webkit.org/show_bug.cgi?id=88429

        The plan is to make CustomFilterGlobalContext and FECustomFilter (or a base class extracted out of it) usable from platform
        code in the hardware accelerated compositing layer. The only dependency of the code is on the GraphicsContext3D.

        No new tests. No functionality is changed yet, just added the new objects.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/filters/CustomFilterGlobalContext.cpp: Added.
        (WebCore):
        (WebCore::CustomFilterGlobalContext::CustomFilterGlobalContext):
        (WebCore::CustomFilterGlobalContext::~CustomFilterGlobalContext):
        (WebCore::CustomFilterGlobalContext::prepareContextIfNeeded):
        * platform/graphics/filters/CustomFilterGlobalContext.h: Added.
        (WebCore):
        (CustomFilterGlobalContext):
        (WebCore::CustomFilterGlobalContext::context):
        * platform/graphics/filters/FECustomFilter.cpp:
        (WebCore::FECustomFilter::FECustomFilter): Changed to use the global context instead of the host window.
        (WebCore::FECustomFilter::create):
        (WebCore::FECustomFilter::initializeContext):
        * platform/graphics/filters/FECustomFilter.h:
        (WebCore):
        (FECustomFilter):
        * rendering/FilterEffectRenderer.cpp:
        (WebCore::FilterEffectRenderer::build): Changed to initialize the global context if needed and pass it to the FECustomFilter.
        * rendering/RenderView.cpp:
        (WebCore):
        (WebCore::RenderView::customFilterGlobalContext):
        * rendering/RenderView.h:
        (WebCore):
        (RenderView):

2012-06-19  Dominik Röttsches  <dominik.rottsches@intel.com>

        [cairo] Fix LayoutTests/fast/canvas/patternfill-repeat.html
        https://bugs.webkit.org/show_bug.cgi?id=53085

        Reviewed by Martin Robinson.

        Clipping previously unlimited vertical and horizontal pattern repeats with
        a clip rectangle similar to the Qt Graphics Context.

        No new tests, this patch fixes
        canvas/philip/tests/2d.pattern.paint.repeat* tests.

        * platform/graphics/Pattern.h:
        (WebCore::Pattern::getPatternSpaceTransform): Adding constant getter method to be able to map to pattern space externally, needed by PlatformContextCairo::clipForPatternFilling.
        * platform/graphics/cairo/PlatformContextCairo.cpp:
        (WebCore::PlatformContextCairo::prepareForFilling):
        (WebCore::PlatformContextCairo::clipForPatternFilling): Clip pattern repeats if needed.
        * platform/graphics/cairo/PlatformContextCairo.h:

2012-06-19  Hayato Ito  <hayato@chromium.org>

        [Shadow DOM] An upper boundary breaks if a child node of an insertion point is clicked.
        https://bugs.webkit.org/show_bug.cgi?id=89407

        Reviewed by Dimitri Glazkov.

        Update an event re-targeting algorithm so that it can set event's
        target correctly when a fallback element in an insertion point is
        clicked. To distinguish between distributed nodes and fallback
        elements in an ancestor chain of composite shadow tree, an event
        dispatcher checks explicitly whether a node is actually
        distributed or assigned to the given insertion point.

        Test: fast/dom/shadow/shadow-dom-event-dispatching.html

        * dom/EventDispatcher.cpp:
        (WebCore::isAssignedTo):
        (WebCore):
        (WebCore::EventDispatcher::ensureEventAncestors):
        * html/shadow/InsertionPoint.h:
        (WebCore::InsertionPoint::contains):

2012-06-19  Adrienne Walker  <enne@google.com>

        Fix scrollbar layers being misplaced with a clipped owner layer
        https://bugs.webkit.org/show_bug.cgi?id=89486

        Reviewed by Simon Fraser.

        Scrollbar layers are positioned relative to their parent layer. If
        that parent gets clipped, then that positioning becomes incorrect and
        scrollbars get positioned relative to the clipped bounds instead of
        the full bounds. Fix by not clipping in this case.

        Test: compositing/overflow/scrollbars-with-clipped-owner.html

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::shouldClipCompositedBounds):

2012-06-19  Shinya Kawanaka  <shinyak@chromium.org>

        [Shadow][Editing] applying document.execCommand('bold') twice to elements having shadow insertion points causes a crash.
        https://bugs.webkit.org/show_bug.cgi?id=88502

        Reviewed by Ryosuke Niwa.

        When inserting or removing insertion points (<shadow> or <content>) into or from Shdaow DOM,
        ElementShadow::invalidateDistribution() will be called immediately. It will remove all the renderers
        of elements in the Shadow DOM. Since Node::rendererIsEditable() returns false when an renderer does not
        exist, all the elements in the Shadow DOM will be considered as non-content-editable until recalculating
        layout, though some of them may actually be content-editable.

        Actually the current code does not recalculate layout inside editing command, so a disaster happens.
        For example, performing an editing command quits before completing all the commands, because the command
        thinks it is adding some elements to a non-content-editable element (but actually it's content-editable).

        So we have to recalculate layout if necessary when checking an element is content-editable or not.
        This can be achieved by using Node::isContentEditable() instead of Node::rendererIsEditable().

        Test: editing/shadow/bold-twice-in-shadow.html

        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::removeInlineStyleFromElement):
        * editing/InsertNodeBeforeCommand.cpp:
        (WebCore::InsertNodeBeforeCommand::doApply):
        (WebCore::InsertNodeBeforeCommand::doUnapply):
        * editing/RemoveNodeCommand.cpp:
        (WebCore::RemoveNodeCommand::doApply):

2012-06-19  Kenneth Russell  <kbr@google.com>

        Unreviewed, rolling out r120744.
        http://trac.webkit.org/changeset/120744
        https://bugs.webkit.org/show_bug.cgi?id=89220

        Broke build on Chromium Windows canary bots

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * platform/mock/DeviceMotionClientMock.cpp: Removed.
        * platform/mock/DeviceMotionClientMock.h: Removed.

2012-06-18  Filip Pizlo  <fpizlo@apple.com>

        It should be possible to look at disassembly
        https://bugs.webkit.org/show_bug.cgi?id=89319

        Reviewed by Sam Weinig.
        
        Just fixing EFL's build system now that JSC has a new directory.

        * CMakeLists.txt:

2012-06-19  Amy Ousterhout  <aousterh@chromium.org>

        Adds DeviceMotionClientMock
        https://bugs.webkit.org/show_bug.cgi?id=89220

        Reviewed by Steve Block.

        Adds DeviceMotionClientMock in WebCore to enable testing of DeviceMotion once it is fully implemented in WebKit.
        This addition was originally included in https://bugs.webkit.org/show_bug.cgi?id=89197 but was split into a separate patch for easier review.

        No new tests because DeviceMotionClientMock is designed to enable future testing and cannot be tested in itself.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * platform/mock/DeviceMotionClientMock.cpp: Added.
        (WebCore):
        (WebCore::DeviceMotionClientMock::DeviceMotionClientMock):
        (WebCore::DeviceMotionClientMock::setController):
        (WebCore::DeviceMotionClientMock::startUpdating):
        (WebCore::DeviceMotionClientMock::stopUpdating):
        (WebCore::DeviceMotionClientMock::setMotion):
        (WebCore::DeviceMotionClientMock::timerFired):
        * platform/mock/DeviceMotionClientMock.h: Added.
        (WebCore):
        (DeviceMotionClientMock):
        
2012-06-19  Alexandre Elias  <aelias@google.com>

        Fix link error with fillWithEmptyClients
        https://bugs.webkit.org/show_bug.cgi?id=89484

        Reviewed by Ryosuke Niwa.

        fillWithEmptyClients() was within #if ENABLE() guard in the .cpp file
        but not in the header.  There is now a caller unrelated to these ENABLEs
        in WebHelperPluginImpl, so linking fails if both SVG and PAGE_POPUP
        are disabled.

        This function looks generic, so just remove the ENABLE guards.

        No new tests. (Build fix.)

        * loader/EmptyClients.cpp:
        (WebCore::fillWithEmptyClients):

2012-06-19  Abhishek Arya  <inferno@chromium.org>

        Crash in RenderInline::willBeDestroyed.
        https://bugs.webkit.org/show_bug.cgi?id=89386

        Reviewed by Julien Chaffraix.

        We were unable to find the previous continuation during the process
        of cleaning up empty anonymous block continuation. The reason being
        that we were just looking till our immediate parent and ignoring the
        fact that it can be enclosed in anonymous blocks. The change skips
        over anonymous blocks in the parent chain.

        Test: fullscreen/empty-anonymous-block-continuation-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removeChild):

2012-06-19  Andreas Kling  <kling@webkit.org>

        Remove the -webkit-match-nearest-mail-blockquote-color property.
        <http://webkit.org/b/89480>

        Reviewed by Antti Koivisto.

        This property does nothing except taking up a bit on StyleRareNonInheritedData.
        It's apparently famous for being the longest property name we support.
        This passes the torch to -webkit-border-bottom-right-radius.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue):
        * css/CSSPrimitiveValueMappings.h:
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/CSSValueKeywords.in:
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyleConstants.h:
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:
        (StyleRareNonInheritedData):

2012-06-19  Andrew Lo  <anlo@rim.com>

        [BlackBerry] Animations continue to request frames after they have finished
        https://bugs.webkit.org/show_bug.cgi?id=89483

        Reviewed by Rob Buis.

        Don't report that we have running animations if all the animations
        are finished. This prevents unnecessary requesting of animation frames.
        Internal PR165119
        Internally Reviewed by Arvid Nilsson.

        * platform/graphics/blackberry/LayerAnimation.cpp:
        (WebCore::progress):
        (WebCore::fetchIntervalEndpoints):
        (WebCore::LayerAnimation::apply):
        * platform/graphics/blackberry/LayerAnimation.h:
        (WebCore::LayerAnimation::finished):
        (WebCore::LayerAnimation::LayerAnimation):
        (LayerAnimation):
        * platform/graphics/blackberry/LayerCompositingThread.cpp:
        (WebCore::LayerCompositingThread::updateAnimations):

2012-06-19  Abhishek Arya  <inferno@chromium.org>

        Wrong repaintContainerSkipped in RenderObject::container()
        when positioned objects are enclosed in a <foreignObject>.
        https://bugs.webkit.org/show_bug.cgi?id=89384

        Reviewed by Simon Fraser.

        No new tests. The bug was found in a code audit.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::container):

2012-06-19  Abhishek Arya  <inferno@chromium.org>

        Crash in WebCore::RenderSVGModelObject::checkIntersection
        https://bugs.webkit.org/show_bug.cgi?id=89059

        Reviewed by Rob Buis.

        getElementCTM updates layout causing the renderer to be destroyed. We get
        the new renderer by storing the element pointer and later accessing it using
        the element pointer.

        Test: svg/custom/intersection-list-crash.svg

        * rendering/svg/RenderSVGModelObject.cpp:
        (WebCore::RenderSVGModelObject::checkIntersection):
        (WebCore::RenderSVGModelObject::checkEnclosure):

2012-06-13  Eric Uhrhane  <ericu@chromium.org>

        FileWriter progress events should be throttled to 50ms
        https://bugs.webkit.org/show_bug.cgi?id=89022

        Reviewed by Kent Tamura.

        No new tests; existing tests validate our event sequences, and testing
        timing is likely to be flaky.

        * Modules/filesystem/FileWriter.cpp:
        (WebCore):
        (WebCore::FileWriter::FileWriter):
        (WebCore::FileWriter::didWrite): Throttle sending progress events.
        * Modules/filesystem/FileWriter.h:
        (FileWriter): Add a variable that remembers when the last event was
        sent.

2012-06-19  Dan Bernstein  <mitz@apple.com>

        WebCore part of: Paginated display API doesn’t allow setting the page progression direction
        https://bugs.webkit.org/show_bug.cgi?id=89394

        Reviewed by Darin Adler.

        Updated fast/multicol/pagination-*.html.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::styleForDocument): Changed to handle the new Pagination::Mode enum
        values and set the column progression in addition to the column axis.
        * page/Page.h: Changed the Pagination::Mode enum values to ones that specify an axis and a
        direction along that axis.
        * testing/Internals.cpp:
        (WebCore::Internals::setPagination): Changed to support the new Pagination::Mode enum values.

2012-06-19  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Make RenderTableSection - nodeAtPoint and paintObject reuse spanning logic.
        https://bugs.webkit.org/show_bug.cgi?id=88066

        Reviewed by Julien Chaffraix.

        Makes dirtiedRows and dirtiedColumns reuse spannedRows and spannedColumns
        internally. This also changes their API to accept a damage-rect flipped 
        by logicalRectForWritingModeAndDirection.

        The generic code in spannedRows and spannedColumns solves a few FIXMEs 
        surrounding RTL tables, which should improve performance.

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::dirtiedRows):
        (WebCore::RenderTableSection::dirtiedColumns):
        (WebCore::RenderTableSection::paintObject):
        * rendering/RenderTableSection.h:
        (WebCore::CellSpan::start):
        (WebCore::CellSpan::end):
        (CellSpan):
        (RenderTableSection):

2012-06-19  Christophe Dumez  <christophe.dumez@intel.com>

        [JSC] Implement support for JSDictionary::convertValue(Vector<String>& result)
        https://bugs.webkit.org/show_bug.cgi?id=89447

        Reviewed by Adam Barth.

        Add implementation for JSDictionary::convertValue(Vector<String>& result)
        so that IDBDatabase::createObjectStore() compiles with JSC.

        Tests: storage/indexeddb

        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::convertValue):
        (WebCore):
        * bindings/js/JSDictionary.h:

2012-06-19  Andy Estes  <aestes@apple.com>

        [Mac] AudioFileReader::createBus() leaks an AudioBufferList if ExtAudioFileRead() returns an error
        https://bugs.webkit.org/show_bug.cgi?id=89429

        Reviewed by Darin Adler.

        * platform/audio/mac/AudioFileReaderMac.cpp:
        (WebCore::AudioFileReader::createBus): Call destroyAudioBufferList()
        before returning if ExtAudioFileRead() returns an error.

2012-06-19  Martin Robinson  <mrobinson@igalia.com>

        2012-06-19  Martin Robinson  <mrobinson@igalia.com>

        Fix the GTK+ build by adding some missing source files to the source list.

        * GNUmakefile.list.am: WebGLDepthTexture.cpp/h to the source list.

2012-06-19  Peter Wang  <peter.wang@torchmobile.com.cn>

        Remove the function ScriptDebugServer::supportsNativeBreakpoints()
        https://bugs.webkit.org/show_bug.cgi?id=88759

        Reviewed by Pavel Feldman.

        Since both JSC and V8 support DOM breakpoint now, remove the conditional interface and related code.
        So there is no new tests.

        * bindings/js/ScriptDebugServer.h:
        * bindings/v8/ScriptDebugServer.h:
        * inspector/Inspector.json:
        * inspector/InspectorDebuggerAgent.cpp:
        * inspector/InspectorDebuggerAgent.h:
        (InspectorDebuggerAgent):
        * inspector/front-end/ElementsPanel.js:
        (WebInspector.ElementsPanel):
        (WebInspector.ElementsPanel.prototype.wasShown):
        (WebInspector.ElementsPanel.prototype._populateContextMenu):
        * inspector/front-end/NetworkPanel.js:
        (WebInspector.NetworkLogView.prototype._createTable):
        (WebInspector.NetworkLogView.prototype.switchToDetailedView):
        (WebInspector.NetworkLogView.prototype.switchToBriefView):
        (WebInspector.NetworkDataGridNode.prototype.createCells):
        (WebInspector.NetworkDataGridNode.prototype.refreshRequest):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.wasShown):
        (WebInspector.ScriptsPanel.prototype._clearInterface):
        * inspector/front-end/Settings.js:
        * inspector/front-end/inspector.js:
        (WebInspector.doLoadedDone):

2012-06-19  Nikita Vasilyev  <me@elv1s.ru>

        Web Inspector: Make text in WebSocket Frames tab selectable
        https://bugs.webkit.org/show_bug.cgi?id=89307

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/ResourceWebSocketFrameView.js:
        (WebInspector.ResourceWebSocketFrameView):
        * inspector/front-end/networkPanel.css:
        (.resource-websocket-frame-view):

2012-06-19  Peter Rybin  <peter.rybin@gmail.com>

        Web Inspector: Support 'Restart frame' in protocol and backend
        https://bugs.webkit.org/show_bug.cgi?id=89147

        Reviewed by Yury Semikhatsky.

        Inspector.json got new command in Debugger domain.
        A call path from InspectorDebuggerAgent to V8 Debug.LiveEdit.RestartFrame API
        is built.
        JSC implementation is a stub with fix me (40300). 

        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
        (WebCore::JSJavaScriptCallFrame::restart):
        (WebCore):
        * bindings/js/ScriptDebugServer.cpp:
        (WebCore):
        (WebCore::ScriptDebugServer::updateCallStack):
        * bindings/js/ScriptDebugServer.h:
        (ScriptDebugServer):
        * bindings/v8/DebuggerScript.js:
        (.):
        * bindings/v8/JavaScriptCallFrame.cpp:
        (WebCore::JavaScriptCallFrame::restart):
        (WebCore):
        * bindings/v8/JavaScriptCallFrame.h:
        (JavaScriptCallFrame):
        * bindings/v8/ScriptDebugServer.cpp:
        (WebCore):
        (WebCore::ScriptDebugServer::updateCallStack):
        * bindings/v8/ScriptDebugServer.h:
        * bindings/v8/ScriptFunctionCall.cpp:
        (WebCore::ScriptFunctionCall::call):
        * bindings/v8/custom/V8JavaScriptCallFrameCustom.cpp:
        (WebCore::V8JavaScriptCallFrame::restartCallback):
        (WebCore):
        * inspector/InjectedScript.cpp:
        (WebCore::InjectedScript::restartFrame):
        (WebCore):
        * inspector/InjectedScript.h:
        (InjectedScript):
        * inspector/InjectedScriptExterns.js:
        (JavaScriptCallFrame.prototype.restart):
        * inspector/InjectedScriptSource.js:
        (.):
        * inspector/Inspector.json:
        * inspector/InspectorDebuggerAgent.cpp:
        (WebCore::InspectorDebuggerAgent::restartFrame):
        * inspector/InspectorDebuggerAgent.h:
        (InspectorDebuggerAgent):
        * inspector/JavaScriptCallFrame.idl:

2012-06-19  Andrei Poenaru  <poenaru@adobe.com>

        Replaced printf with fprintf in DEBUG_AUDIONODE_REFERENCES

        Change printf to fprintf in DEBUG_AUDIONODE_REFERENCES
        https://bugs.webkit.org/show_bug.cgi?id=86564

        Reviewed by Csaba Osztrogonác.

        There is no need for new tests: writing data to stderr, instead of stdout.

        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::~AudioContext):
        * Modules/webaudio/AudioNode.cpp:
        (WebCore::AudioNode::~AudioNode):
        (WebCore::AudioNode::ref):
        (WebCore::AudioNode::finishDeref):
        (WebCore::AudioNode::printNodeCounts):

2012-06-19  Dominik Röttsches  <dominik.rottsches@intel.com>

        [GTK] Assert failure in svg/batik/text/textDecoration.svg,textEffect3.svg for 64bit Debug bot
        https://bugs.webkit.org/show_bug.cgi?id=89104

        Reviewed by Nikolas Zimmermann.

        Adding SVGInline to assertion to fix assertion failure. Same assertion was hit on Chromium.

        Covered by existing tests
        svg/batik/text/textDecoration.svg
        svg/batik/text/textEffect3.svg
        where the assertion failure was hit.

        * rendering/svg/RenderSVGResourceContainer.cpp:
        (WebCore::RenderSVGResourceContainer::shouldTransformOnTextPainting):

2012-06-19  Csaba Osztrogonác  <ossy@webkit.org>

        [Qt] Buildfix for newer Qt5, use QPointer instead of the deprecated QWeakPointer.
        https://bugs.webkit.org/show_bug.cgi?id=89449

        Reviewed by Simon Hausmann.

        * bridge/qt/qt_instance.h:
        (QtInstance):
        * bridge/qt/qt_runtime.h:
        (QtField):
        * platform/Widget.h:
        (Widget):

2012-06-19  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: FileSystem tree should hide uninitialized FileSystem
        https://bugs.webkit.org/show_bug.cgi?id=88602

        Reviewed by Vsevolod Vlasov.

        Test: http/tests/inspector/filesystem/get-filesystem-root.html

        * inspector/Inspector.json:
        * inspector/InspectorFileSystemAgent.cpp:
        (WebCore):
        (WebCore::InspectorFileSystemAgent::getFileSystemRoot):
        * inspector/InspectorFileSystemAgent.h:
        (InspectorFileSystemAgent):
        * inspector/front-end/FileSystemModel.js:
        (WebInspector.FileSystemModel.prototype._originAdded):
        (WebInspector.FileSystemModel.prototype.refreshFileSystemList):
        (WebInspector.FileSystemModel.prototype._gotFileSystem):
        (WebInspector.FileSystemModel.FileSystem):
        (WebInspector.FileSystemRequestManager):
        (WebInspector.FileSystemRequestManager.prototype.getFileSystemRoot):
        (WebInspector.FileSystemRequestManager.prototype._gotFileSystemRoot):
        (WebInspector.FileSystemDispatcher.prototype.gotFileSystemRoot):
        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.FileSystemListTreeElement.prototype._fileSystemRemoved):

2012-06-19  Mike West  <mkwst@chromium.org>

        Introduce ENABLE_CSP_NEXT configuration flag.
        https://bugs.webkit.org/show_bug.cgi?id=89300

        Reviewed by Adam Barth.

        The 1.0 draft of the Content Security Policy spec is just about to
        move to Last Call. We'll hide work on the upcoming 1.1 spec behind
        this ENABLE flag, disabled by default.

        Spec: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html

        * Configurations/FeatureDefines.xcconfig:

2012-06-19  Thiago Marcos P. Santos  <thiago.santos@intel.com>

        Make StylePropertySet::merge() always override on conflict
        https://bugs.webkit.org/show_bug.cgi?id=89348

        Reviewed by Ryosuke Niwa.

        merge() was only used with argOverridesOnConflict = true, which
        makes the extra parameter useless. It will also save a boolean check.

        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::mergeAndOverrideOnConflict):
        * css/StylePropertySet.h:
        (StylePropertySet):
        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange):
        * editing/EditingStyle.cpp:
        (WebCore::EditingStyle::overrideWithStyle):
        (WebCore::styleFromMatchedRulesForElement):
        (WebCore::EditingStyle::mergeStyleFromRules):
        (WebCore::EditingStyle::mergeStyleFromRulesForSerialization):

2012-06-19  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Move isKeyboardFocusable and isMouseFocusable to InputType from HTMLInputElement
        https://bugs.webkit.org/show_bug.cgi?id=89425

        Reviewed by Kent Tamura.

        This patch moves implementation of HTMLInpueElement::isKeyboardFocusable
        and isMouseFocusable to InputType class to allow each implementation
        of InputType can decide focus-ability.

        No new tests. This patch doesn't change behavior.

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::isKeyboardFocusable): Changed to call InputType::isKeyboardFocusable.
        (WebCore::HTMLInputElement::isMouseFocusable): Changed to call InputType::isMouseFocusable.
        (WebCore::HTMLInputElement::isTextFormControlFocusable): Added to allow InputType can call a method in HTMLTextFormControlElement.
        (WebCore::HTMLInputElement::isTextFormControlKeyboardFocusable): Added to allow InputType can call a method in HTMLTextFormControlElement.
        (WebCore::HTMLInputElement::isTextFormControlMouseFocusable): Added to allow InputType can call a method in HTMLTextFormControlElement.
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/InputType.cpp:
        (WebCore::InputType::isKeyboardFocusable): Changed to call isTextFormControlKeyboardFocusable.
        (WebCore::InputType::isMouseFocusable): Added for default method of derived InputType classes.
        * html/InputType.h:
        (InputType): Chagned signature of isKeyboardFocusable.
        * html/RadioInputType.cpp:
        (WebCore::RadioInputType::isKeyboardFocusable): Changed to call isTextFormControlKeyboardFocusable which was done in HTMLInputElement.
        * html/RadioInputType.h:
        (RadioInputType):
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::isKeyboardFocusable): Moved implementation from HTMLInputElement.
        (WebCore::TextFieldInputType::isMouseFocusable): Moved implementation from HTMLInputElement.
        * html/TextFieldInputType.h:
        (TextFieldInputType):

2012-06-19  Sergio Villar Senin  <svillar@igalia.com>

        Calling nativeImageForCurrentFrame() causes assertion failure: m_verifier.isSafeToUse()
        https://bugs.webkit.org/show_bug.cgi?id=67582

        Reviewed by David Levin.

        Added a new synchronous method to the IconDatabase that returns a
        native image for the platform instead of a WebCore::Image*.

        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::synchronousNativeIconForPageURL):
        (WebCore):
        * loader/icon/IconDatabase.h:
        (IconDatabase):
        * loader/icon/IconDatabaseBase.h:
        (WebCore::IconDatabaseBase::synchronousNativeIconForPageURL):
        (IconDatabaseBase):

2012-06-19  Andy Estes  <aestes@apple.com>

        [Mac] Use AutodrainedPool instead of NSAutoreleasePool in AudioBus::loadPlatformResource()
        https://bugs.webkit.org/show_bug.cgi?id=89427

        Reviewed by Dan Bernstein.

        loadPlatformResource() called -[NSAutoreleasePool release] at each of
        its exit points, which is not only an error-prone pattern but is
        incorrect in garbage-collected environments. AutodrainedPool solves
        both these problems by automatically calling -[NSAutoreleasePool drain]
        when going out of scope.

        * platform/audio/mac/AudioBusMac.mm:
        (WebCore::AudioBus::loadPlatformResource):

2012-06-19  Mike West  <mkwst@chromium.org>

        Compilation failure in StyleResolver.cpp
        https://bugs.webkit.org/show_bug.cgi?id=89446

        Reviewed by Ryosuke Niwa.

        Adding 'CSSPropertyWebkitColumnProgression' to a switch statement from
        which it was missing.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-06-19  Csaba Osztrogonác  <ossy@webkit.org>

        [Qt] Unreviewed build system fix after r120051.

        * Target.pri:

2012-06-19  Mike West  <mkwst@chromium.org>

        Add a scheme registry for bypassing Content Security Policy.
        https://bugs.webkit.org/show_bug.cgi?id=89373

        Reviewed by Adam Barth.

        The Content Security Policy specification notes that "Enforcing a CSP
        policy should not interfere with the operation of user-supplied scripts
        such as third-party user-agent add-ons and JavaScript bookmarklets."
        (https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#processing-model)
        This use case can be at least partially addressed by adding a scheme
        registry for certain types of URLs whose resources should be loaded
        regardless of a page's defined policy directives.

        See http://crbug.com/133223 for additional context.

        Test: http/tests/security/contentSecurityPolicy/register-bypassing-scheme.html

        * WebCore.exp.in:
            Exporting new symbols for use by Internals.
        * page/ContentSecurityPolicy.cpp:
        (WebCore::isAllowedByAllWithURL):
            Adding a check against the new SchemeRegistry method to determine
            whether or not we should proceed with checking the URL against the
            policy.
        * platform/SchemeRegistry.cpp:
        (WebCore::CSPBypassingSchemes):
        (WebCore):
        (WebCore::SchemeRegistry::registerURLSchemeAsBypassingContentSecurityPolicy):
        (WebCore::SchemeRegistry::removeURLSchemeRegisteredAsBypassingContentSecurityPolicy):
        (WebCore::SchemeRegistry::schemeShouldBypassContentSecurityPolicy):
        * platform/SchemeRegistry.h:
        (SchemeRegistry):
            Adding the scheme registry for CSP-bypassing URL schemes.
        * testing/Internals.cpp:
        (WebCore):
        (WebCore::Internals::registerURLSchemeAsBypassingContentSecurityPolicy):
        (WebCore::Internals::removeURLSchemeRegisteredAsBypassingContentSecurityPolicy):
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:
            Adding a method to Internals so that we can write a layout test.

2012-06-18  Andy Estes  <aestes@apple.com>

        [Mac] Editor::fontAttributesForSelectionStart() leaks a NSShadow
        https://bugs.webkit.org/show_bug.cgi?id=89424

        Reviewed by Dan Bernstein.

        * editing/mac/EditorMac.mm:
        (WebCore::Editor::fontAttributesForSelectionStart): Store the NSShadow
        in a RetainPtr so that it's released before going out of scope.

2012-06-18  Kent Tamura  <tkent@chromium.org>

        Refactoring: Introduce a class to represent restoring state of a form control
        https://bugs.webkit.org/show_bug.cgi?id=89412

        Reviewed by Hajime Morita.

        HTMLFormControlElementWithState::saveFormControlState had two return
        values; One is a boolean to represent whether we should save the state
        or not, and another is form control value. This patch introduces
        FormControlState class representing these values.

        We're going to extend FormControlState class so that it can contain
        multiple strings to fix a FileInputType issue and it have another type
        to fix Bug 89409.

        No new tests. Just a refactoring.

        * html/FormController.cpp:
        (WebCore::FormController::formElementsState):
        Gets a state string from a FormControlState instance.
        (WebCore::FormController::takeStateForFormElement):
        Creates a FormControlState instance with a state string.
        * html/FormController.h:
        (WebCore::FormControlState): Added.

        * html/BaseCheckableInputType.cpp:
        (WebCore::BaseCheckableInputType::saveFormControlState):
        Use FormControlState class.
        (WebCore::BaseCheckableInputType::restoreFormControlState): ditto.
        * html/BaseCheckableInputType.h:
        (BaseCheckableInputType): ditto.
        * html/FileInputType.cpp:
        (WebCore::FileInputType::saveFormControlState): ditto.
        (WebCore::FileInputType::restoreFormControlState): ditto.
        * html/FileInputType.h:
        (FileInputType): ditto.
        * html/HTMLFormControlElementWithState.cpp:
        (WebCore::HTMLFormControlElementWithState::saveFormControlState): ditto.
        (WebCore::HTMLFormControlElementWithState::finishParsingChildren): ditto.
        * html/HTMLFormControlElementWithState.h:
        (HTMLFormControlElementWithState): ditto.
        (WebCore::HTMLFormControlElementWithState::restoreFormControlState): ditto.
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::saveFormControlState): ditto.
        (WebCore::HTMLInputElement::restoreFormControlState): ditto.
        * html/HTMLInputElement.h:
        (HTMLInputElement): ditto.
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::saveFormControlState): ditto.
        (WebCore::HTMLSelectElement::restoreFormControlState): ditto.
        * html/HTMLSelectElement.h:
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::saveFormControlState): ditto.
        (WebCore::HTMLTextAreaElement::restoreFormControlState): ditto.
        * html/HTMLTextAreaElement.h:
        * html/HiddenInputType.cpp:
        (WebCore::HiddenInputType::saveFormControlState): ditto.
        (WebCore::HiddenInputType::restoreFormControlState): ditto.
        * html/HiddenInputType.h:
        (HiddenInputType): ditto.
        * html/InputType.cpp:
        (WebCore::InputType::saveFormControlState): ditto.
        (WebCore::InputType::restoreFormControlState): ditto.
        * html/InputType.h:
        (InputType): ditto.
        * html/PasswordInputType.cpp:
        (WebCore::PasswordInputType::saveFormControlState): ditto.
        (WebCore::PasswordInputType::restoreFormControlState): ditto.
        * html/PasswordInputType.h:
        (PasswordInputType): ditto.

2012-06-18  Joone Hur  <joone.hur@intel.com>

        [EFL] Fontconfig can't be linked properly
        https://bugs.webkit.org/show_bug.cgi?id=89418

        Unreviewed build fix.

        Make Fontconfig be linked correctly.

        No new tests. This is only a build fix.

        * PlatformEfl.cmake: add FONTCONFIG_LIBRARIES to WebCore_LIBRARIES.

2012-06-18  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>

        [Cairo] Fix memory leaks in GLContextGLX.cpp
        https://bugs.webkit.org/show_bug.cgi?id=89346

        Reviewed by Martin Robinson.

        Fix memory leaks found in GLContextGLX.cpp.

        * platform/graphics/glx/GLContextGLX.cpp:
        (WebCore::GLContextGLX::cleanupActiveContextsAtExit): Removing element reduces
        size of the vector, so the loop termination condition was failing in the last
        iteration, when the vector contains more than one element. This patch fixes the
        issue by iterating the vector backwards, so the termination condition doesn't
        fail until the size() reaches 0.
        (WebCore::GLContextGLX::createPbufferContext): Delete GLXPbuffer
        returned by glXCreatePbuffer().
        (WebCore::GLContextGLX::createPixmapContext): Delete XVisualInfo
        returned by glXChooseVisual().

2012-06-18  Gregg Tavares  <gman@google.com>

        Expose WEBGL_depth_texture extension to WebGL
        https://bugs.webkit.org/show_bug.cgi?id=87029
        
        Reviewed by Kenneth Russell.

        Test: fast/canvas/webgl/webgl-depth-texture.html

        * CMakeLists.txt:
        * DerivedSources.make:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * bindings/js/JSWebGLRenderingContextCustom.cpp:
        (WebCore::toJS):
        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
        (WebCore::toV8Object):
        * html/canvas/WebGLDepthTexture.cpp: Copied from Source/WebCore/html/canvas/WebGLExtension.h.
        (WebCore):
        (WebCore::WebGLDepthTexture::WebGLDepthTexture):
        (WebCore::WebGLDepthTexture::~WebGLDepthTexture):
        (WebCore::WebGLDepthTexture::getName):
        (WebCore::WebGLDepthTexture::create):
        (WebCore::WebGLDepthTexture::supported):
        * html/canvas/WebGLDepthTexture.h: Copied from Source/WebCore/html/canvas/WebGLExtension.h.
        (WebCore):
        (WebGLDepthTexture):
        * html/canvas/WebGLDepthTexture.idl: Copied from Source/WebCore/html/canvas/WebGLExtension.h.
        * html/canvas/WebGLExtension.h:
        * html/canvas/WebGLFramebuffer.cpp:
        (WebCore::WebGLFramebuffer::initializeAttachments):
        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore):
        (WebCore::WebGLRenderingContext::validateSettableTexFormat):
        (WebCore::WebGLRenderingContext::copyTexImage2D):
        (WebCore::WebGLRenderingContext::copyTexSubImage2D):
        (WebCore::WebGLRenderingContext::generateMipmap):
        (WebCore::WebGLRenderingContext::getExtension):
        (WebCore::WebGLRenderingContext::getSupportedExtensions):
        (WebCore::WebGLRenderingContext::texImage2DBase):
        (WebCore::WebGLRenderingContext::texImage2D):
        (WebCore::WebGLRenderingContext::texSubImage2DBase):
        (WebCore::WebGLRenderingContext::texSubImage2D):
        (WebCore::WebGLRenderingContext::validateTexFuncFormatAndType):
        (WebCore::WebGLRenderingContext::validateTexFuncParameters):
        (WebCore::WebGLRenderingContext::validateTexFuncData):
        * html/canvas/WebGLRenderingContext.h:
        (WebCore):
        (WebGLRenderingContext):
        * platform/graphics/GraphicsContext3D.cpp:
        (WebCore::GraphicsContext3D::getClearBitsByAttachmentType):
        (WebCore):
        (WebCore::GraphicsContext3D::getClearBitsByFormat):
        * platform/graphics/GraphicsContext3D.h:

2012-06-12  Kinuko Yasuda  <kinuko@chromium.org>

        Support File/DirectoryEntry access for <input type=file> if FileSystem API is enabled
        https://bugs.webkit.org/show_bug.cgi?id=88293

        Reviewed by Tony Chang.

        Proposal email on whatwg: http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2011-November/033814.html
        Proposal draft: http://wiki.whatwg.org/wiki/DragAndDropEntries

        Test: fast/forms/file/input-file-entries.html

        * Modules/filesystem/HTMLInputElementFileSystem.cpp: Added.
        * Modules/filesystem/HTMLInputElementFileSystem.h: Added.
        * Modules/filesystem/HTMLInputElementFileSystem.idl: Added.
        * WebCore.gypi:
        * html/FileInputType.cpp:
        (WebCore::FileInputType::receiveDroppedFiles): Retrieves dropped file
        system Id if the given DragData has it.
        (WebCore::FileInputType::droppedFileSystemId): Added. This returns
        dropped file system Id retrieved in receiveDroppedFiles, or an empty
        string if the platform does not support isolated file system for
        dropped files.
        * html/FileInputType.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::droppedFileSystemId): Added.
        * html/HTMLInputElement.h:
        * html/InputType.cpp:
        (WebCore::InputType::droppedFileSystemId): Added.
        * html/InputType.h:
        * platform/DragData.cpp:
        * platform/DragData.h:
        * platform/chromium/DragDataChromium.cpp:
        (WebCore::DragData::droppedFileSystemId): Added.

2012-06-18  Shinya Kawanaka  <shinyak@chromium.org>

        [Crash][Editing] VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries() crashes in some Shadow DOM case.
        https://bugs.webkit.org/show_bug.cgi?id=88500

        Reviewed by Ryosuke Niwa.

        When selecting from a child of shadow host to an element in Shadow DOM, the start position of
        Selection comes after the end position of Selection in some cases. This caused a crash.

        For example, let's think '<div id="host">A</div>D' and host has a Shadow DOM whose innerHTML
        is 'B<content></content>C'. When selecting from just after A (p1 = (PositionIsOffsetInAnchor,
        #text, 1)) to just before B (p2 = (PositionIsOffsetInAnchor, shadowRoot, 0)), since
        comparePosition always judge as p2 is before p1, m_start and m_end in VisibleSelection
        will be p2 and p1 respectively.

        However, the anchorNodes of p1 and p2 have the different tree scope, we have to adjust p2 to
        the same tree scope as p1. Since p2 is m_start, m_start was adjusted to positionAfterNode(div).
        This breaks the assumption that m_start is always before (or equal to) m_end.

        This patch keeps the assumption. When we cannot move m_start to positionAfterNode(div),
        we move m_start to positionBeforeNode(div). Note that we cannot always move m_start to
        positionBeforeNode(div), because when selecting just after D (p3 = (PositionIsOffsetInAnchor,
        D's parent, 2), we don't want to select A.

        In this case, m_start should be adjusted to positionAfterNode(div).

        Test: editing/shadow/breaking-editing-boundaries.html

        * editing/VisibleSelection.cpp:
        (WebCore::adjustPositionForEnd):
        (WebCore):
        (WebCore::adjustPositionForStart):
        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingShadowBoundaries):
        * editing/VisibleSelection.h:
        (VisibleSelection):

2012-06-18  Mike Lawther  <mikelawther@chromium.org>

        Crash when setting title dynamically
        https://bugs.webkit.org/show_bug.cgi?id=88083

        Reviewed by Dan Bernstein.

        Test: fast/text/title-crash.html

        The crashing code takes a rare branch in StyleResolver::styleForElement() where
        m_parentStyle is set to point to m_style. Consequently, while applying properties
        to m_style we end up mutating m_parentStyle.

        In this situation, we clone style() and point m_parentStyle at the clone. The
        clone is destroyed at the end of StyleResolver::styleForElement().

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-06-18  Adrienne Walker  <enne@google.com>

        RenderLayerBacking sometimes doesn't attach scrollbars to graphics layer tree
        https://bugs.webkit.org/show_bug.cgi?id=89402

        Reviewed by James Robinson.

        RenderLayerBacking only attaches scrollbar layers to the graphics
        layer tree if there's a clip layer. This is wrong, because these
        scrollbars become orphans and other code expects them to handle
        repainting the scrollbars (which now become invisible). Fix by always
        attaching scrollbar layers.

        Test: compositing/overflow/image-load-overflow-scrollbars.html

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateInternalHierarchy):

2012-06-18  Amy Ousterhout  <aousterh@chromium.org>

        [Chromium] DeviceOrientation Cleanup
        https://bugs.webkit.org/show_bug.cgi?id=89354

        Reviewed by Kent Tamura.

        No new tests because there is no intended change in behavior.

        * platform/mock/DeviceOrientationClientMock.h: added OVERRIDE specifier for virtual functions
        (DeviceOrientationClientMock):

2012-06-18  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] media/video-seek-past-end-playing.html is flaky
        https://bugs.webkit.org/show_bug.cgi?id=89301

        Reviewed by Philippe Normand.

        Switch to double for media duration and playback position
        calculations to avoid precision problems.
        This patch also removes the workaround for the precision
        problem in didEnd() which is no longer needed.

        Test: media/video-seek-past-end-playing.html

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::playbackPosition):
        (WebCore::MediaPlayerPrivateGStreamer::duration):

2012-06-18  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120593.
        http://trac.webkit.org/changeset/120593
        https://bugs.webkit.org/show_bug.cgi?id=89404

        Caused failures in fast/forms/file/input-file-entries.html
        (Requested by atwilson on #webkit).

        * Modules/filesystem/DOMFileSystem.cpp:
        (WebCore::DOMFileSystem::createIsolatedFileSystem):
        * Modules/filesystem/HTMLInputElementFileSystem.cpp: Removed.
        * Modules/filesystem/HTMLInputElementFileSystem.h: Removed.
        * Modules/filesystem/HTMLInputElementFileSystem.idl: Removed.
        * WebCore.gypi:
        * html/FileInputType.cpp:
        (WebCore::FileInputType::receiveDroppedFiles):
        * html/FileInputType.h:
        (FileInputType):
        * html/HTMLInputElement.cpp:
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/InputType.cpp:
        * html/InputType.h:
        (InputType):
        * platform/DragData.cpp:
        (WebCore::DragData::modifierKeyState):
        (WebCore):
        * platform/DragData.h:
        (DragData):
        * platform/chromium/DragDataChromium.cpp:

2012-06-14  James Robinson  <jamesr@chromium.org>

        [chromium] Use WebImageLayer in GraphicsLayerChromium for image layers
        https://bugs.webkit.org/show_bug.cgi?id=89150

        Reviewed by Adrienne Walker.

        Uses WebImageLayer instead of ImageLayerChromium for GraphicsLayerChromium::setContentsToImage.

        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::setContentsToImage):

2012-06-14  James Robinson  <jamesr@chromium.org>

        [chromium] GraphicsLayerChromium should use WebContentLayer directly
        https://bugs.webkit.org/show_bug.cgi?id=89145

        Reviewed by Adrienne Walker.

        Ports GraphicsLayerChromium (or more specifically OpaqueRectTrackingContentLayerDelegate) to implement
        WebContentLayerClient instead of ContentLayerDelegate. In addition to the mechanical changes, this requires
        eagerly setting drawsContent on GraphicsLayerChromium::m_layer since WebContentLayerImpl's default value is
        different from LayerChromium's. Covered by all of compositing/

        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp:
        (WebCore::OpaqueRectTrackingContentLayerDelegate::paintContents):
        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h:
        (OpaqueRectTrackingContentLayerDelegate):

2012-06-18  David Barr  <davidbarr@chromium.org>

        Add from-image to css3-images image-resolution
        https://bugs.webkit.org/show_bug.cgi?id=85451

        Reviewed by Tony Chang.

        The css3-images module is at candidate recommendation.
        http://www.w3.org/TR/2012/CR-css3-images-20120417/#the-image-resolution

        No new tests; extended fast/css/image-resolution/image-resolution.html

        * css/CSSParser.cpp: Accept from-image identifier in image-resolution property.
        (WebCore::CSSParser::parseImageResolution): Map CSSValueFromImage to identifier value from cssValuePool.
        * css/CSSValueKeywords.in: Add from-image.
        * css/StyleBuilder.cpp: Extend ApplyPropertyImageResolution to apply RenderStyle::imageResolutionSource.
        (WebCore::ApplyPropertyImageResolution::applyInheritValue): Apply RenderStyle::imageResolutionSource.
        (WebCore::ApplyPropertyImageResolution::applyInitialValue): Apply RenderStyle::imageResolutionSource.
        (WebCore::ApplyPropertyImageResolution::applyValue): Map CSSValueFromImage to ImageResolutionFromImage.
        * rendering/RenderImage.cpp: Extend conditions for recalculation of intrinsic size.
        (WebCore::RenderImage::styleDidChange): Update intrinsic size if RenderStyle::imageResolutionSource() has changed.
        * rendering/style/RenderStyle.cpp: Include StyleRareInheritedData::m_imageResolutionSource in style diff.
        (WebCore::RenderStyle::diff): Map change in StyleRareInheritedData::m_imageResolutionSource to StyleDifferenceLayout.
        * rendering/style/RenderStyle.h: Add RenderStyle::imageResolutionSource, RenderStyle::setImageResolutionSource, RenderStyle::initialImageResolutionSource.
        * rendering/style/RenderStyleConstants.h: Add enum ImageResolutionSource.
        * rendering/style/StyleRareInheritedData.cpp: Add StyleRareInheritedData::m_imageResolutionSource.
        (WebCore::StyleRareInheritedData::StyleRareInheritedData): Add m_imageResolutionSource to default and copy constructor.
        (WebCore::StyleRareInheritedData::operator==): Include m_imageResolutionSource in comparison.
        * rendering/style/StyleRareInheritedData.h: Add StyleRareInheritedData::m_imageResolutionSource.
        (StyleRareInheritedData): Add 1-bit field StyleRareInheritedData::m_imageResolutionSource.

2012-06-18  James Robinson  <jamesr@chromium.org>

        [chromium] REGRESSION(r120346) ContentLayerPainter should clear rect to be painted
        https://bugs.webkit.org/show_bug.cgi?id=89376

        Reviewed by Adrienne Walker.

        In r120346, a refactor moved a clearRect()/clip() call from ContentLayerPainter - which all
        ContentLayerChromiums use - out to OpaqueRectTrackingContentLayerDelegate - which all GraphicsLayerChromium
        backed layers use, but which callers using WebContentLayer directly do not use. This meant that the canvas
        wasn't cleared/clipped as WebContentLayerClient.h claimed it would be. This moves the clear and the clip
        into CanvasLayerTextureUpdater which all paths use, including layers that don't use the ContentLayerPainter.

        * platform/graphics/chromium/ContentLayerChromium.cpp:
        (WebCore::ContentLayerPainter::paint):
        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp:
        (WebCore::OpaqueRectTrackingContentLayerDelegate::paintContents):

2012-06-18  Igor Oliveira  <igor.o@sisa.samsung.com>

        Unreviewed, rolling out r120119.
        http://trac.webkit.org/changeset/120119

        Multiple regressions on ClusterFuzz

        * page/animation/AnimationBase.cpp:
        (WebCore::AnimationBase::updateStateMachine):
        * page/animation/AnimationController.cpp:
        (WebCore::AnimationControllerPrivate::updateAnimations):
        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
        (WebCore::AnimationController::cancelAnimations):
        (WebCore::AnimationController::updateAnimations):
        * page/animation/ImplicitAnimation.cpp:
        (WebCore::ImplicitAnimation::pauseAnimation):
        (WebCore::ImplicitAnimation::sendTransitionEvent):
        * page/animation/KeyframeAnimation.cpp:
        (WebCore::KeyframeAnimation::KeyframeAnimation):
        (WebCore::KeyframeAnimation::pauseAnimation):
        (WebCore::KeyframeAnimation::endAnimation):
        (WebCore::KeyframeAnimation::sendAnimationEvent):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::updateFirstLetterStyle):
        (WebCore::RenderBlock::createFirstLetterRenderer):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::clippedOverflowRectForRepaint):
        * rendering/RenderObject.cpp:
        * rendering/RenderObject.h:
        (RenderObject):

2012-06-18  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r118414): some pages on concursolutions.com doesn't show up
        https://bugs.webkit.org/show_bug.cgi?id=89399

        Reviewed by Adam Barth.

        The bug was caused by insertAdjacentHTML's not passing context element to createFragmentForInnerOuterHTML.

        Test: fast/html/adjacent-html-context-element.html

        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::insertAdjacentHTML):

2012-06-18  Zhenyao Mo  <zmo@google.com>

        Fix framebuffer-object-attachment.html failures
        https://bugs.webkit.org/show_bug.cgi?id=89387

        Reviewed by Kenneth Russell.

        * html/canvas/WebGLFramebuffer.cpp: fix detachment behavior with depth/stencil/depth_stencil conflicts
        (WebCore::WebGLFramebuffer::setAttachmentForBoundFramebuffer):
        (WebCore::WebGLFramebuffer::removeAttachmentFromBoundFramebuffer):
        * html/canvas/WebGLFramebuffer.h:
        (WebGLFramebuffer):
        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore):
        (WebCore::WebGLRenderingContext::framebufferRenderbuffer): move logic to WebGLFramebuffer
        (WebCore::WebGLRenderingContext::framebufferTexture2D): Ditto.
        (WebCore::WebGLRenderingContext::getParameter): Correct the wrong assumption that it's always checking the drawingbuffer's DEPTH_BITS/STENCIL_BITS
        * html/canvas/WebGLRenderingContext.h:
        (WebGLRenderingContext):

2012-06-18  Ian Vollick  <vollick@chromium.org>

        [chromium] Ensure that skipping frames during an accelerated animation doesn't cause starvation
        https://bugs.webkit.org/show_bug.cgi?id=87766

        Reviewed by James Robinson.

        Unit tests:
            CCLayerTreeHostTestCheckerboardDoesNotStarveDraws.runMultiThread
            CCSchedulerStateMachineTest.TestFailedDrawsWillEventuallyForceADrawAfterTheNextCommit

        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
        (WebCore::CCSchedulerStateMachine::CCSchedulerStateMachine):
        (WebCore::CCSchedulerStateMachine::updateState):
        (WebCore::CCSchedulerStateMachine::didDrawIfPossibleCompleted):
        (WebCore::CCSchedulerStateMachine::setMaximumNumberOfFailedDrawsBeforeDrawIsForced):
        (WebCore):
        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h:
        (CCSchedulerStateMachine):

2012-06-18  Nico Weber  <thakis@chromium.org>

        [chromium/mac] Unbreak smooth scrolling.
        https://bugs.webkit.org/show_bug.cgi?id=89327

        Reviewed by Dimitri Glazkov.

        Broken by Sam in r115589 / r115591.

        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::scrollAnimationEnabledForSystem):

2012-06-18  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120541, r120547, and r120548.
        http://trac.webkit.org/changeset/120541
        http://trac.webkit.org/changeset/120547
        http://trac.webkit.org/changeset/120548
        https://bugs.webkit.org/show_bug.cgi?id=89383

        This approach doesn't work for WebKit2 (Requested by abarth on
        #webkit).

        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::InternalSettings):
        (WebCore::InternalSettings::restoreTo):
        * testing/InternalSettings.h:
        (InternalSettings):

2012-06-18  Yong Li  <yoli@rim.com>

        [BlackBerry] NetworkJob::startNewJobWithRequest() should check the frame pointer
        https://bugs.webkit.org/show_bug.cgi?id=89369

        Reviewed by Antonio Gomes.

        NetworkJob::startNewJobWithRequest() should stop proceeding if the frame is null,
        which means it is a PingLoader job and should just finish now.

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::startNewJobWithRequest):

2012-06-18  Dan Bernstein  <mitz@apple.com>

        Ideographic comma and full-stops are mishandled in linebreak
        https://bugs.webkit.org/show_bug.cgi?id=87041

        Reviewed by Alexey Proskuryakov.

        Test: fast/text/line-breaks-after-ideographic-comma-or-full-stop-2.html

        Specifically, line breaks were always allowed after an ideographic comma or full stop, even
        before a closing bracket.

        * rendering/break_lines.cpp:
        (WebCore::shouldBreakAfter): Removed code that unconditionally allowed line breaks after
        ideographic commas and full stops, which was added for <http://webkit.org/b/17411> to work
        around an issue in Unicode 5.0. Current line break iterator implementations are based on
        newer versions of Unicode, which do not have that issue, so we can use them instead of the
        hardcoded approximate rule.

2012-06-18  Martin Robinson  <mrobinson@igalia.com>

        [TextureMapper] Rename shader variables to match the naming scheme of the newer filter shaders
        https://bugs.webkit.org/show_bug.cgi?id=89324

        Reviewed by Noam Rosenthal.

        Rename shader variables to align them with those in the new filter shaders.

        No new tests. This is just a simple refactor.

        * platform/graphics/texmap/TextureMapperShaderManager.cpp:
        Rename shader variables so that uniforms are prefixed by "u_", attributes by "a_",
        and texture samplers by "s_".

2012-06-18  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Implement native memory bar diagram
        https://bugs.webkit.org/show_bug.cgi?id=89106

        Reviewed by Pavel Feldman.

        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.NativeMemoryBarChart):
        (WebInspector.NativeMemoryBarChart.prototype._updateStats):
        (WebInspector.NativeMemoryBarChart.prototype.willHide):
        (WebInspector.NativeMemoryBarChart.prototype.wasShown):
        (WebInspector.NativeMemoryBarChart.prototype._updateView):
        * inspector/front-end/ProfileLauncherView.js:
        (WebInspector.ProfileLauncherView):
        * inspector/front-end/nativeMemoryProfiler.css:
        (.memory-bar-chart-name):
        (.memory-bar-chart-bar):
        (.memory-bar-chart-size):
        (.memory-bar-chart-total):

2012-06-18  Mike West  <mkwst@chromium.org>

        Crash in CSPSource::parseSource
        https://bugs.webkit.org/show_bug.cgi?id=89353

        Reviewed by Adam Barth.

        Test: http/tests/security/contentSecurityPolicy/source-list-parsing-malformed-meta.html

        * page/ContentSecurityPolicy.cpp:
        (WebCore::CSPSourceList::parseSource):
            Checking that we're not past the end of the string before deref.

2012-06-18  Robert Hogan  <robert@webkit.org>

        CSS 2.1 failure: table-height-algorithm-012 fails
        https://bugs.webkit.org/show_bug.cgi?id=85652

        Reviewed by Julien Chaffraix.

        Test: css2.1/20110323/table-height-algorithm-012.htm
              fast/css/vertical-align-baseline-rowspan-001.htm
              fast/css/vertical-align-baseline-rowspan-002.htm
              fast/css/vertical-align-baseline-rowspan-003.htm
              fast/css/vertical-align-baseline-rowspan-004.htm
              fast/css/vertical-align-baseline-rowspan-005.htm
              fast/css/vertical-align-baseline-rowspan-006.htm
              fast/css/vertical-align-baseline-rowspan-007.htm
              fast/css/vertical-align-baseline-rowspan-008.htm
              fast/css/vertical-align-baseline-rowspan-009.htm

        A spanning cell with Vertical-align set to 'baseline' should align the cell's content baseline 
        (which is the bottom of the first line of text or in-flow content) with the baseline of the first of the rows it spans.

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::calcRowLogicalHeight): Only calculate the baseline for the first row in a rowspan. This
          ensures that any height added to the rowspan from the baseline is only added to the first row in the span rather than
          to each of them.
        (WebCore::RenderTableSection::layoutRows): Rather than get the baseline for each row in a rowspan (with the result that
          only the baseline for the last row actually sticks), calculate it for the first row in the rowspan only. This function is
          inefficient when handling rowspans so this doesn't fix the fact that redundant calculations are performed on each subsequent
          row in the span - that should be done separately.

2012-06-18  Hayato Ito  <hayato@chromium.org>

        Event dispatcher should use InsertionPoint::hasDistribution instead of InsertinPoint::isActive in re-targeting.
        https://bugs.webkit.org/show_bug.cgi?id=89180

        Reviewed by Dimitri Glazkov.

        If an event is fired on a fallback element within a insertion
        point which does not select any nodes, the result of event's
        re-targeting will be wrong since it uses
        InsertionPoint::isActive() to judge an existence of a lower boundary.
        That must use InsertionPoint::hasDistribution().

        Test: fast/dom/shadow/shadow-dom-event-dispatching.html

        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::ensureEventAncestors):

2012-06-18  Tony Payne  <tpayne@chromium.org>

       [chromium] Add iccjpeg and qcms to chromium port
       https://bugs.webkit.org/show_bug.cgi?id=81974

       Reviewed by Adam Barth.

       Covered by existing layout tests which will be rebaselined.

       * WebCore.gyp/WebCore.gyp: Add qcms to the build.
       * platform/image-decoders/ImageDecoder.h:
       (WebCore::ImageDecoder::qcmsOutputDeviceProfile): Return an sRGB profile.
       On OSX, return the default RGB profile. Add FIXME to use the user's
       monitor profile and verify that profile for other platforms.

       * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
       (turboSwizzled): For libjpeg-turbo, JCS_EXT_BGRA and JCS_EXT_RGBA are the
       two known output color spaces for which the decoder uses a data swizzle.
       (colorSpaceHasAlpha): JPEG's have no alpha in the output color space. For
       libjpeg-turbo, alpha may be present in the swizzled output color space.

       (WebCore::JPEGImageReader::JPEGImageReader):
       (WebCore::JPEGImageReader::close):
       (WebCore::JPEGImageReader::decode): For QCMSLIB, create the color transform
       to use during decoding, and ensure we switch to inputing RGBA data to qcms
       even if the desired output data is BGRA: outputScanlines() sends BGRA data
       to the frame buffer following color correction if needed.
       (JPEGImageReader):
       (WebCore::JPEGImageReader::colorTransform): qcms color transform getter.
       (WebCore::JPEGImageReader::createColorTransform): Create color transform.
       Release the existing transform (if any) and assign to the color transform
       created from the color profile data.
       (WebCore::JPEGImageDecoder::outputScanlines): Minor style fix. Apply color
       transform to each decoded image row.

       * platform/image-decoders/png/PNGImageDecoder.cpp:
       (WebCore::PNGImageReader::PNGImageReader):
       (WebCore::PNGImageReader::close):
       (WebCore::PNGImageReader::currentBufferSize): Move this adjacent to other
       setters and getters.
       (WebCore::PNGImageReader::decodingSizeOnly): Ditto.
       (WebCore::PNGImageReader::setHasAlpha): Ditto.
       (WebCore::PNGImageReader::hasAlpha): Ditto.
       (WebCore::PNGImageReader::interlaceBuffer): Ditto.
       (WebCore::PNGImageReader::createRowBuffer): Creates a temporary row buffer,
       used when a color transform is applied to the decoded image pixels.
       (WebCore::PNGImageReader::rowBuffer): Return the temporary row buffer.
       (WebCore::PNGImageReader::colorTransform): qcms color transform getter.
       (WebCore::PNGImageReader::createColorTransform): Create color transform.
       Release the existing transform (if any) and assign to the color transform
       created from the color profile data.
       (WebCore::PNGImageDecoder::headerAvailable): For QCMSLIB, create the color
       transform to use for decoding. Clear m_colorProfile (not used anymore).
       (WebCore::PNGImageDecoder::rowAvailable): Create temporary row buffer if
       a color transform is needed for decoding. Apply color transform to each
       decoded image row.

       * platform/image-decoders/skia/ImageDecoderSkia.cpp:
       (WebCore::ImageFrame::setColorProfile): Old method of colorProfiles is no
       longer used. Add a FIXME to remove the old implementation.
       (WebCore::ImageFrame::setStatus): Remove old color correction code.

2012-06-18  Dan Bernstein  <mitz@apple.com>

        Column progression direction cannot be set independently of writing direction
        https://bugs.webkit.org/show_bug.cgi?id=89315

        Added a column-progression property, which can have the values 'normal' and 'reverse'. When
        set to 'reverse', the first column is positioned at the end side of the block, and
        subsequent columns go from the in the start direction (in the inline column axis case; in
        the block column axis case, the first column coincides with the block and subsequent columns
        go before the block).

        Reviewed by Darin Adler.

        Test: fast/multicol/progression-reverse.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Added handling of the new
        property.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue): Added validity check for the new property. The valid
        values are the identifiers 'normal' and 'reverse'.
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added this mapping from ColumnProgression
        enum values to the identifiers 'normal and 'reverse'.
        (WebCore::CSSPrimitiveValue::operator ColumnProgression): Added this mapping from the
        identifiers 'normal' and 'reverse' to ColumnProgression enum values.
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty): Added the new property to the set of
        non-inherited properties.
        * css/CSSPropertyNames.in: Added -webkit-column-progression.
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder): Added a handler for the new property.
        * rendering/ColumnInfo.h:
        (WebCore::ColumnInfo::ColumnInfo): Added an initializer for the m_progressionIsReversed
        member variable.
        (WebCore::ColumnInfo::progressionIsReversed): Added this accessor.
        (WebCore::ColumnInfo::setProgressionIsReversed): Ditto.
        (ColumnInfo): Added a m_progressionIsReversed member variable.
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::paintColumnRules): Changed to advance in the reverse direction if
        needed.
        (WebCore::RenderBlock::setDesiredColumnCountAndWidth): Added call to
        ColumnInfo::setProgressionIsReversed(), based on the new property.
        (WebCore::RenderBlock::columnRectAt): Changed to take the progression direction into
        account.
        * rendering/style/RenderStyle.h: Added accessors and initial value for column progression.
        * rendering/style/RenderStyleConstants.h: Added ColumnProgression enum.
        * rendering/style/StyleMultiColData.cpp:
        (WebCore::StyleMultiColData::StyleMultiColData): Added initializer for the m_progression
        member variable.
        (WebCore::StyleMultiColData::operator==): Added equality check for m_progression.
        * rendering/style/StyleMultiColData.h:
        (StyleMultiColData): Added m_progression member variable.

2012-06-18  Martin Robinson  <mrobinson@igalia.com>

        [TextureMapper] Replace the source transform with a flip uniform
        https://bugs.webkit.org/show_bug.cgi?id=89317

        Reviewed by Noam Rosenthal.

        No new tests. This should not change any observable behavior.

        * platform/graphics/texmap/TextureMapperGL.cpp: Instead of building and passing
        the m4src matrix to the shader, just pass a single uniform that says whether or
        not the texture should be flipped.
        * platform/graphics/texmap/TextureMapperShaderManager.cpp: Change the shader programs
        to deal with a flip variable rather than a source matrix.
        (WebCore::TextureMapperShaderProgram::TextureMapperShaderProgram): Instead of getting the location
        of the source matrix, get the location of the flip uniform.
        (WebCore::TextureMapperShaderProgramSimple::TextureMapperShaderProgramSimple): Ditto.
        (WebCore::TextureMapperShaderProgramRectSimple::TextureMapperShaderProgramRectSimple): Ditto.
        (WebCore::TextureMapperShaderProgramOpacityAndMask::TextureMapperShaderProgramOpacityAndMask): Ditto.
        (WebCore::TextureMapperShaderProgramRectOpacityAndMask::TextureMapperShaderProgramRectOpacityAndMask): Ditto.
        * platform/graphics/texmap/TextureMapperShaderManager.h:
        (WebCore::TextureMapperShaderProgram::flipLocation): Added this getter.
        (TextureMapperShaderProgram): Rename the source matrix location member to reflect above changes.

2012-06-18  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120598.
        http://trac.webkit.org/changeset/120598
        https://bugs.webkit.org/show_bug.cgi?id=89359

        Patch causes crashes on EFL and GTK release builds (Requested
        by zdobersek on #webkit).

        * platform/graphics/Pattern.h:
        (Pattern):
        * platform/graphics/cairo/PlatformContextCairo.cpp:
        (WebCore::PlatformContextCairo::prepareForFilling):
        * platform/graphics/cairo/PlatformContextCairo.h:

2012-06-18  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120592.
        http://trac.webkit.org/changeset/120592
        https://bugs.webkit.org/show_bug.cgi?id=89357

        Broke v8 bindings on windows. (Requested by atwilson__ on
        #webkit).

        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
        * bindings/js/ScriptDebugServer.cpp:
        * bindings/js/ScriptDebugServer.h:
        (ScriptDebugServer):
        * bindings/v8/DebuggerScript.js:
        (.):
        * bindings/v8/JavaScriptCallFrame.cpp:
        * bindings/v8/JavaScriptCallFrame.h:
        (JavaScriptCallFrame):
        * bindings/v8/ScriptDebugServer.cpp:
        * bindings/v8/ScriptDebugServer.h:
        * bindings/v8/ScriptFunctionCall.cpp:
        (WebCore::ScriptFunctionCall::call):
        * bindings/v8/custom/V8JavaScriptCallFrameCustom.cpp:
        * inspector/InjectedScript.cpp:
        * inspector/InjectedScript.h:
        (InjectedScript):
        * inspector/InjectedScriptSource.js:
        * inspector/Inspector.json:
        * inspector/InspectorDebuggerAgent.cpp:
        (WebCore::InspectorDebuggerAgent::setScriptSource):
        * inspector/InspectorDebuggerAgent.h:
        (InspectorDebuggerAgent):
        * inspector/JavaScriptCallFrame.idl:

2012-06-18  Julien Chaffraix  <jchaffraix@webkit.org>

        RenderTableSection wastes vector capacity
        https://bugs.webkit.org/show_bug.cgi?id=86561

        Reviewed by Antti Koivisto.

        Memory optimization, covered by existing tests.

        The issue is that addChild calls Vector::grow() which can over-allocate our row grid (especially
        for small tables as we allocate at least 16 entries). As we don't know if addChild is called
        in a loop (e.g. during parsing), we postpone the shrinkToFit call at layout time.

        (WebCore::RenderTableSection::layout):
        Added a shrinkToFit call with some explanation as to why it's good trade-off to do it now.

2012-06-18  Takashi Sakamoto  <tasak@google.com>

        webkit fails IETC border-radius-clip-002
        https://bugs.webkit.org/show_bug.cgi?id=83205

        Added addRoundedRectClip instead of just clip when clipToBorderRadius
        is true and bgLayer->clip() == ContentFillBox.

        Reviewed by Simon Fraser.

        This change is covered by the existing test: ietestcenter/css3/bordersbackgrounds/border-radius-clip-002.
        However expected images should be updated. I updated chromium-linux
        and chromium-mac's expected images and removed chromium-win,
        chromium-mac-leopard and chromium-mac-snowleopard's expected images.

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
        As the code for "clipping to content boxes as necessary" doesn't
        consider border-radius or not, added the code for checking
        clipToBorderRadius or not, and if so, modified to use
        getBackgroundRoundedRect for obtaining rounded rect and to use
        addRoundedRectClip by using the obtained rounded rect.

2012-06-18  Iain Merrick  <husky@google.com>

        Allow updateFixedElementsAfterScrolling() to run during layout.       
        https://bugs.webkit.org/show_bug.cgi?id=84965

        This is needed because HistoryController restores the previous scroll
        position during layout (because we don't want an ugly flash of wrongly-
        scrolled content).

        Reviewed by Simon Fraser.

        Test: compositing/fixed-position-scroll-offset-history-restore.html

        * page/FrameView.cpp:
        (WebCore::FrameView::updateFixedElementsAfterScrolling):

2012-06-18  Alexander Pavlov  <apavlov@chromium.org>

        CSSOM wrappers are not built for rules in the per-document and page group user stylesheets
        https://bugs.webkit.org/show_bug.cgi?id=89221

        Reviewed by Antti Koivisto.

        The issue manifested itself by not displaying injected page group stylesheet data in the Styles pane.

        Test: inspector/styles/inject-stylesheet.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-06-18  Dominik Röttsches  <dominik.rottsches@intel.com>

        [cairo] Fix LayoutTests/fast/canvas/patternfill-repeat.html
        https://bugs.webkit.org/show_bug.cgi?id=53085

        Reviewed by Martin Robinson.

        Clipping previously unlimited vertical and horizontal pattern repeats with
        a clip rectangle similar to the Qt Graphics Context.

        No new tests, this patch fixes
        canvas/philip/tests/2d.pattern.paint.repeat* tests.

        * platform/graphics/Pattern.h:
        (WebCore::Pattern::getPatternSpaceTransform): Adding constant getter method to be able to map to pattern space externally, needed by PlatformContextCairo::clipForPatternFilling.
        * platform/graphics/cairo/PlatformContextCairo.cpp:
        (WebCore::PlatformContextCairo::prepareForFilling):
        (WebCore::PlatformContextCairo::clipForPatternFilling): Clip pattern repeats if needed.
        * platform/graphics/cairo/PlatformContextCairo.h:

2012-06-18  Robert Kroeger  <rjkroege@chromium.org>

        Touch events with default actions should be handled.
        https://bugs.webkit.org/show_bug.cgi?id=89304.

        Reviewed by Kent Tamura.

        Covered by existing tests and tests in blocked bug
        https://bugs.webkit.org/show_bug.cgi?id=88807

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleTouchEvent): Return true that the touch event
        was handled for either preventDefault or defaultHandled.

2012-06-18  Silvia Pfeiffer  <silviapf@chromium.org>

        REGRESSION introduced in bug 88623: new shadowPseudoId elements need to get default styling.
        https://bugs.webkit.org/show_bug.cgi?id=89280

        Reviewed by Eric Carlson.

        No new tests; existing tests found this bug.

        * css/html.css:
        (input[type="range"]::-webkit-slider-container, input[type="range"]::-webkit-media-slider-container):
        Add -webkit-media-slider-container to the default styling.
        (input[type="range"]::-webkit-slider-thumb, input[type="range"]::-webkit-media-slider-thumb):
        Add -webkit-media-slider-thumb to the default styling.

2012-06-12  Kinuko Yasuda  <kinuko@chromium.org>

        Support File/DirectoryEntry access for <input type=file> if FileSystem API is enabled
        https://bugs.webkit.org/show_bug.cgi?id=88293

        Reviewed by Tony Chang.

        Proposal email on whatwg: http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2011-November/033814.html
        Proposal draft: http://wiki.whatwg.org/wiki/DragAndDropEntries

        Test: fast/forms/file/input-file-entries.html

        * Modules/filesystem/HTMLInputElementFileSystem.cpp: Added.
        * Modules/filesystem/HTMLInputElementFileSystem.h: Added.
        * Modules/filesystem/HTMLInputElementFileSystem.idl: Added.
        * WebCore.gypi:
        * html/FileInputType.cpp:
        (WebCore::FileInputType::receiveDroppedFiles): Retrieves dropped file
        system Id if the given DragData has it.
        (WebCore::FileInputType::droppedFileSystemId): Added. This returns
        dropped file system Id retrieved in receiveDroppedFiles, or an empty
        string if the platform does not support isolated file system for
        dropped files.
        * html/FileInputType.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::droppedFileSystemId): Added.
        * html/HTMLInputElement.h:
        * html/InputType.cpp:
        (WebCore::InputType::droppedFileSystemId): Added.
        * html/InputType.h:
        * platform/DragData.cpp:
        * platform/DragData.h:
        * platform/chromium/DragDataChromium.cpp:
        (WebCore::DragData::droppedFileSystemId): Added.

2012-06-18  Peter Rybin  <peter.rybin@gmail.com>

        Web Inspector: Support 'Restart frame' in protocol and backend
        https://bugs.webkit.org/show_bug.cgi?id=89147

        Reviewed by Yury Semikhatsky.

        Inspector.json got new command in Debugger domain.
        A call path from InspectorDebuggerAgent to V8 Debug.LiveEdit.RestartFrame API
        is built.
        JSC implementation is a stub with fix me (40300). 

        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
        (WebCore::JSJavaScriptCallFrame::restart):
        (WebCore):
        * bindings/js/JavaScriptCallFrame.h:
        (JavaScriptCallFrame):
        * bindings/js/ScriptDebugServer.cpp:
        (WebCore):
        (WebCore::ScriptDebugServer::updateCallStack):
        * bindings/js/ScriptDebugServer.h:
        (ScriptDebugServer):
        * bindings/v8/DebuggerScript.js:
        (.):
        * bindings/v8/JavaScriptCallFrame.cpp:
        (WebCore::JavaScriptCallFrame::restart):
        (WebCore):
        * bindings/v8/JavaScriptCallFrame.h:
        (JavaScriptCallFrame):
        * bindings/v8/ScriptDebugServer.cpp:
        (WebCore):
        (WebCore::ScriptDebugServer::updateCallStack):
        * bindings/v8/ScriptDebugServer.h:
        * bindings/v8/ScriptFunctionCall.cpp:
        (WebCore::ScriptFunctionCall::call):
        * bindings/v8/custom/V8JavaScriptCallFrameCustom.cpp:
        (WebCore::V8JavaScriptCallFrame::restartCallback):
        (WebCore):
        * inspector/InjectedScript.cpp:
        (WebCore::InjectedScript::restartFrame):
        (WebCore):
        * inspector/InjectedScript.h:
        (InjectedScript):
        * inspector/InjectedScriptSource.js:
        (.):
        * inspector/Inspector.json:
        * inspector/InspectorDebuggerAgent.cpp:
        (WebCore::InspectorDebuggerAgent::restartFrame):
        * inspector/InspectorDebuggerAgent.h:
        (InspectorDebuggerAgent):
        * inspector/JavaScriptCallFrame.idl:

2012-06-18  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120485 and r120582.
        http://trac.webkit.org/changeset/120485
        http://trac.webkit.org/changeset/120582
        https://bugs.webkit.org/show_bug.cgi?id=89345

        chromeos tree breakage (Requested by morrita on #webkit).

        * WebCore.gyp/WebCore.gyp:
        * platform/image-decoders/ImageDecoder.h:
        (ImageFrame):
        (ImageDecoder):
        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
        (turboSwizzled):
        (WebCore::JPEGImageReader::JPEGImageReader):
        (WebCore::JPEGImageReader::close):
        (WebCore::JPEGImageReader::decode):
        (JPEGImageReader):
        (WebCore::JPEGImageDecoder::outputScanlines):
        * platform/image-decoders/png/PNGImageDecoder.cpp:
        (WebCore::PNGImageReader::PNGImageReader):
        (WebCore::PNGImageReader::close):
        (WebCore::PNGImageReader::currentBufferSize):
        (PNGImageReader):
        (WebCore::PNGImageReader::decodingSizeOnly):
        (WebCore::PNGImageReader::interlaceBuffer):
        (WebCore::PNGImageReader::hasAlpha):
        (WebCore::PNGImageReader::setHasAlpha):
        (WebCore::PNGImageDecoder::headerAvailable):
        (WebCore::PNGImageDecoder::rowAvailable):
        * platform/image-decoders/skia/ImageDecoderSkia.cpp:
        (WebCore):
        (WebCore::resolveColorSpace):
        (WebCore::createColorSpace):
        (WebCore::ImageFrame::setColorProfile):
        (WebCore::ImageFrame::setStatus):

2012-06-18  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Add heap profiler owned memory to the pie chart
        https://bugs.webkit.org/show_bug.cgi?id=89203

        Heap profiler may consume considerable amount of memory
        which is currently falls into Unknown category.
        Give it a separate sector on the pie chart.

        Reviewed by Yury Semikhatsky.

        * bindings/js/ScriptProfiler.h:
        (WebCore::ScriptProfiler::profilerSnapshotsSize):
        * bindings/v8/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::profilerSnapshotsSize):
        (WebCore):
        * bindings/v8/ScriptProfiler.h:
        (ScriptProfiler):
        * inspector/InspectorMemoryAgent.cpp:
        (MemoryBlockName):
        (WebCore):
        (WebCore::inspectorData):
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.MemoryBlockViewProperties._initialize):

2012-06-18  Mario Sanchez Prada  <msanchez@igalia.com>

        [GTK] Get rid of DumpRenderTreeSupportGtk::{in|de}crementAccessibilityValue
        https://bugs.webkit.org/show_bug.cgi?id=89226

        Reviewed by Martin Robinson.

        Implement webkitAccessibleValueGetMinimumIncrement() properly,
        doing something similar to what is done in AccessibilityObject's
        increment() and decrement() functions.

        Also, added missing bits to webkitAccessibleValueSetCurrentValue
        to make sure we check the new value against range limits.

        * accessibility/gtk/WebKitAccessibleInterfaceValue.cpp:
        (webkitAccessibleValueGetCurrentValue):
        (webkitAccessibleValueGetMaximumValue):
        (webkitAccessibleValueGetMinimumValue):
        (webkitAccessibleValueSetCurrentValue):
        (webkitAccessibleValueGetMinimumIncrement):

2012-06-14  Kinuko Yasuda  <kinuko@chromium.org>

        [chromium] Cleanup: remove PlatformSupport::createAsyncFileSystem as it's no longer used
        https://bugs.webkit.org/show_bug.cgi?id=89083

        Reviewed by Kentaro Hara.

        No new tests as this has no functional changes.

        * platform/chromium/PlatformSupport.h:
        (PlatformSupport):

2012-06-18  Taiju Tsuiki  <tzik@chromium.org>

        Fix syntax of FileReader::readAsDataURL result
        https://bugs.webkit.org/show_bug.cgi?id=89330

        When readAsDataURL generates data URL without media type, it used to omit semicolon before
        "base64" keyword.  But this semicolor is required in this case, according to RFC2397.

        Reviewed by Kent Tamura.

        Test: fast/files/read-blob-async.html
              fast/files/workers/worker-read-blob-async.html:
              fast/files/workers/worker-read-blob-sync.html:

        * fileapi/FileReaderLoader.cpp:
        (WebCore::FileReaderLoader::convertToDataURL):

2012-06-18  MORITA Hajime  <morrita@google.com>

        Unreviewed chormium crash fix. This should be revisited.

        * platform/image-decoders/ImageDecoder.h:
        (WebCore::ImageDecoder::qcmsOutputDeviceProfile):

2012-06-18  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] fast/files/xhr-response-blob.html is crashing
        https://bugs.webkit.org/show_bug.cgi?id=89334

        Reviewed by Kentaro Hara.

        Call wrap() instead of createWrapper() in JSBlob's toJS()
        to avoid hitting the !getCachedWrapper ASSERT in 
        createWrapper() because we fail to use the cached wrapper.

        Test: fast/files/xhr-response-blob.html

        * bindings/js/JSBlobCustom.cpp:
        (WebCore::toJS):

2012-06-18  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: rename Unknown to Other in Native heap snapshot.
        https://bugs.webkit.org/show_bug.cgi?id=89306

        Cosmetic change.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.NativeMemoryProfileType.prototype.buttonClicked.didReceiveMemorySnapshot):
        (WebInspector.NativeMemoryProfileType.prototype.buttonClicked):
        (WebInspector.MemoryBlockViewProperties._initialize):

2012-06-18  Sergio Villar Senin  <svillar@igalia.com>

        TextureMapperLayer: invisible layers do not let their children to be painted
        https://bugs.webkit.org/show_bug.cgi?id=88786

        Reviewed by Noam Rosenthal.

        Do not early discard recursively painting children layers if the
        current layer is not visible.

        Changes already covered by compositing tests. This fixes both
        compositing/backface-visibility/backface-visibility-3d.html and
        compositing/backface-visibility/backface-visibility-non3d.html.

        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::computeTransformsRecursive):
        (WebCore::TextureMapperLayer::paintSelf):
        (WebCore::TextureMapperLayer::isVisible):

2012-06-15  Kinuko Yasuda  <kinuko@chromium.org>

        XHR_RESPONSE_BLOB is not enabled on some platforms
        https://bugs.webkit.org/show_bug.cgi?id=88859

        Reviewed by Adam Barth.

        Removing XHR_RESPONSE_BLOB since the current implementation has
        no platform-specific part.

        Test: http/tests/xmlhttprequest/blob-response-size.html

        * bindings/generic/RuntimeEnabledFeatures.cpp:
        (WebCore):
        * bindings/generic/RuntimeEnabledFeatures.h:
        (RuntimeEnabledFeatures):
        * bindings/js/JSXMLHttpRequestCustom.cpp:
        (WebCore::JSXMLHttpRequest::visitChildren):
        (WebCore::JSXMLHttpRequest::response):
        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
        (WebCore::V8XMLHttpRequest::responseAccessorGetter):
        * platform/chromium/PlatformSupport.h:
        (PlatformSupport):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::responseBlob):
        (WebCore::XMLHttpRequest::setResponseType):
        (WebCore::XMLHttpRequest::clearResponseBuffers):
        (WebCore::XMLHttpRequest::didReceiveData):
        * xml/XMLHttpRequest.h:
        (XMLHttpRequest):
        * xml/XMLHttpRequest.idl:

2012-06-17  Martin Robinson  <mrobinson@igalia.com>

        [TextureMapper] Reduce boilerplate code in the TextureMapperShaderManager
        https://bugs.webkit.org/show_bug.cgi?id=89293

        Reviewed by Noam Rosenthal.

        Refactor TextureMapperShaderManager to reduce boilerplate code, by:
        1. Making fragment and shader source arguments to the superclass constructor.
        2. Removing virtual methods (which should not be called in constructors) with
           constructor implementations. This exchanges a small amount of code duplication
           for a lot less boilerplate.
        3. Standardizing on the fooLocation name instead of fooVariable.
        4. Removing the ::prepare() series of methods for non-filter shaders. It's betters to
           have all the uniform and attribute binding in the same place.

        No new tests. This is just a refactor and shouldn't change any functionality.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        Handle binding the mask texture and opacity at both of the previous ::prepare callsites. Also
        rename "shaderInfo" to "program".
        * platform/graphics/texmap/TextureMapperShaderManager.cpp: Perform the refactoring described above.
        * platform/graphics/texmap/TextureMapperShaderManager.h: Ditto.

2012-06-17  Gregg Tavares  <gman@google.com>

        Fix Framebuffer restrictions
        https://bugs.webkit.org/show_bug.cgi?id=89320

        Reviewed by Kenneth Russell.

        No new tests, just fixing old ones

        * html/canvas/WebGLFramebuffer.cpp:
        (WebCore::WebGLFramebuffer::checkStatus):

2012-06-17  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Move search field related code to RenderSearchField from RenderTextControlSingleLine
        https://bugs.webkit.org/show_bug.cgi?id=88980

        Reviewed by Kent Tamura.

        This patch moves search field related methods in RenderTextControlSingleLine
        to new class RenderSearchField and changes related classes to use
        RenderSearchField.

        No new tests. This patch doesn't change behavior.

        * CMakeLists.txt: Added new file RenderSearchField.cpp
        * GNUmakefile.list.am: Added new file RenderSearchField.cpp and RenderSearchField.h
        * Target.pri: ditto
        * WebCore.gypi: ditto
        * WebCore.vcproj/WebCore.vcproj: ditto
        * WebCore.xcodeproj/project.pbxproj: ditto
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::subtreeHasChanged): Call RenderSearchField::updateCancelButtonVisibility
        (WebCore::HTMLInputElement::addSearchResult): Changed to call InputType::addSearchResult.
        * html/InputType.cpp:
        (WebCore::InputType::addSearchResult): Added.
        * html/InputType.h:
        * html/SearchInputType.cpp:
        (WebCore::SearchInputType::addSearchResult): Moved from HTMLInputElement.
        (WebCore::SearchInputType::createRenderer): Added to create RenderSearchField.
        (WebCore::SearchInputType::searchEventsShouldBeDispatched): Moved from HTMLInputElement.
        (WebCore::SearchInputType::subtreeHasChanged) Moved search related code from HTMLInputElement.
        * html/SearchInputType.h:
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler): Use RenderSearchField instead of RenderTextControlSingleLine.
        * loader/FormSubmission.cpp:
        (WebCore::FormSubmission::create): Got rid isSearchField() guard for addSearchResult().
        * rendering/RenderSearchField.cpp:
        (WebCore::RenderSearchField::RenderSearchField): Renamed to RenderSearchField.
        (WebCore::RenderSearchField::~RenderSearchField): ditto
        (WebCore::RenderSearchField::resultsButtonElement): ditto
        (WebCore::RenderSearchField::cancelButtonElement): ditto
        (WebCore::RenderSearchField::addSearchResult): ditto
        (WebCore::RenderSearchField::showPopup): ditto
        (WebCore::RenderSearchField::hidePopup): ditto
        (WebCore::RenderSearchField::computeControlHeight): Added.
        (WebCore::RenderSearchField::updateFromElement): Moved search field related code from RenderTextControlSingleLine.
        (WebCore::RenderSearchField::updateCancelButtonVisibility): Renamed to RenderSearchField.
        (WebCore::RenderSearchField::visibilityForCancelButton): ditto
        (WebCore::RenderSearchField::autosaveName): ditto
        (WebCore::RenderSearchField::valueChanged): ditto
        (WebCore::RenderSearchField::itemText): ditto
        (WebCore::RenderSearchField::itemLabel): ditto
        (WebCore::RenderSearchField::itemIcon): ditto
        (WebCore::RenderSearchField::itemIsEnabled): ditto
        (WebCore::RenderSearchField::itemStyle): ditto
        (WebCore::RenderSearchField::menuStyle): ditto
        (WebCore::RenderSearchField::clientInsetLeft): ditto
        (WebCore::RenderSearchField::clientInsetRight): ditto
        (WebCore::RenderSearchField::clientPaddingLeft): ditto
        (WebCore::RenderSearchField::clientPaddingRight): ditto
        (WebCore::RenderSearchField::listSize): ditto
        (WebCore::RenderSearchField::selectedIndex): ditto
        (WebCore::RenderSearchField::popupDidHide): ditto
        (WebCore::RenderSearchField::itemIsSeparator): ditto
        (WebCore::RenderSearchField::itemIsLabel): ditto
        (WebCore::RenderSearchField::itemIsSelected): ditto
        (WebCore::RenderSearchField::setTextFromItem): ditto
        (WebCore::RenderSearchField::fontSelector): ditto
        (WebCore::RenderSearchField::hostWindow): ditto
        (WebCore::RenderSearchField::createScrollbar): ditto
        (WebCore::RenderSearchField::computeHeightLimit): Added.
        (WebCore::RenderSearchField::centerContainerIfNeeded): Added.
        * rendering/RenderSearchField.h:
        (WebCore::toRenderSearchField): Added.
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine): Remove search field related code.
        (WebCore::RenderTextControlSingleLine::~RenderTextControlSingleLine): ditto.
        (WebCore::RenderTextControlSingleLine::computeHeightLimit): Added.
        (WebCore::RenderTextControlSingleLine::layout): Use new methods for removing isSearchField.
        (WebCore::RenderTextControlSingleLine::computeControlHeight): Added.
        (WebCore::RenderTextControlSingleLine::updateFromElement): Remove search field related code.
        * rendering/RenderTextControlSingleLine.h:
        (RenderTextControlSingleLine):
        (WebCore::RenderTextControlSingleLine::centerContainerIfNeeded): Added.
        (WebCore::RenderTextControlSingleLine::containerElement): Exposed for RenderSearchField.
        (WebCore::RenderTextControlSingleLine::innerBlockElement): Exposed for RenderSearchField.
        * rendering/RenderingAllInOne.cpp: Added RenderSearchField.cpp

2012-06-17  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Copy RenderTextControlSingleLine.{cpp,h} to RenderSearchFiled.{cpp,h}
        https://bugs.webkit.org/show_bug.cgi?id=89155

        This patch copies RenderTextControlSingleLine.cpp and .h into RenderSearchField.cpp
        and .h with just "cp" code. New files aren't compiled until bug 88980.

        No new tests. This patch doesn't change behavior.

        * rendering/RenderSearchField.cpp: Added.
        (WebCore):
        (WebCore::RenderTextControlInnerBlock::positionForPoint):
        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
        (WebCore::RenderTextControlSingleLine::~RenderTextControlSingleLine):
        (WebCore::RenderTextControlSingleLine::containerElement):
        (WebCore::RenderTextControlSingleLine::innerBlockElement):
        (WebCore::RenderTextControlSingleLine::innerSpinButtonElement):
        (WebCore::RenderTextControlSingleLine::resultsButtonElement):
        (WebCore::RenderTextControlSingleLine::cancelButtonElement):
        (WebCore::RenderTextControlSingleLine::textBaseStyle):
        (WebCore::RenderTextControlSingleLine::addSearchResult):
        (WebCore::RenderTextControlSingleLine::showPopup):
        (WebCore::RenderTextControlSingleLine::hidePopup):
        (WebCore::RenderTextControlSingleLine::paint):
        (WebCore::RenderTextControlSingleLine::layout):
        (WebCore::RenderTextControlSingleLine::nodeAtPoint):
        (WebCore::RenderTextControlSingleLine::styleDidChange):
        (WebCore::RenderTextControlSingleLine::capsLockStateMayHaveChanged):
        (WebCore::RenderTextControlSingleLine::hasControlClip):
        (WebCore::RenderTextControlSingleLine::controlClipRect):
        (WebCore::RenderTextControlSingleLine::getAvgCharWidth):
        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
        (WebCore::RenderTextControlSingleLine::computeControlHeight):
        (WebCore::RenderTextControlSingleLine::updateFromElement):
        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
        (WebCore::RenderTextControlSingleLine::createInnerBlockStyle):
        (WebCore::RenderTextControlSingleLine::updateCancelButtonVisibility):
        (WebCore::RenderTextControlSingleLine::visibilityForCancelButton):
        (WebCore::RenderTextControlSingleLine::textShouldBeTruncated):
        (WebCore::RenderTextControlSingleLine::autosaveName):
        (WebCore::RenderTextControlSingleLine::valueChanged):
        (WebCore::RenderTextControlSingleLine::itemText):
        (WebCore::RenderTextControlSingleLine::itemLabel):
        (WebCore::RenderTextControlSingleLine::itemIcon):
        (WebCore::RenderTextControlSingleLine::itemIsEnabled):
        (WebCore::RenderTextControlSingleLine::itemStyle):
        (WebCore::RenderTextControlSingleLine::menuStyle):
        (WebCore::RenderTextControlSingleLine::clientInsetLeft):
        (WebCore::RenderTextControlSingleLine::clientInsetRight):
        (WebCore::RenderTextControlSingleLine::clientPaddingLeft):
        (WebCore::RenderTextControlSingleLine::clientPaddingRight):
        (WebCore::RenderTextControlSingleLine::listSize):
        (WebCore::RenderTextControlSingleLine::selectedIndex):
        (WebCore::RenderTextControlSingleLine::popupDidHide):
        (WebCore::RenderTextControlSingleLine::itemIsSeparator):
        (WebCore::RenderTextControlSingleLine::itemIsLabel):
        (WebCore::RenderTextControlSingleLine::itemIsSelected):
        (WebCore::RenderTextControlSingleLine::setTextFromItem):
        (WebCore::RenderTextControlSingleLine::fontSelector):
        (WebCore::RenderTextControlSingleLine::hostWindow):
        (WebCore::RenderTextControlSingleLine::autoscroll):
        (WebCore::RenderTextControlSingleLine::scrollWidth):
        (WebCore::RenderTextControlSingleLine::scrollHeight):
        (WebCore::RenderTextControlSingleLine::scrollLeft):
        (WebCore::RenderTextControlSingleLine::scrollTop):
        (WebCore::RenderTextControlSingleLine::setScrollLeft):
        (WebCore::RenderTextControlSingleLine::setScrollTop):
        (WebCore::RenderTextControlSingleLine::scroll):
        (WebCore::RenderTextControlSingleLine::logicalScroll):
        (WebCore::RenderTextControlSingleLine::createScrollbar):
        (WebCore::RenderTextControlSingleLine::inputElement):
        * rendering/RenderSearchField.h: Added.
        (WebCore):
        (RenderTextControlSingleLine):
        (WebCore::RenderTextControlSingleLine::popupIsVisible):
        (WebCore::RenderTextControlSingleLine::isTextField):
        (WebCore::toRenderTextControlSingleLine):
        (RenderTextControlInnerBlock):
        (WebCore::RenderTextControlInnerBlock::RenderTextControlInnerBlock):
        (WebCore::RenderTextControlInnerBlock::hasLineIfEmpty):

2012-06-17  Yoshifumi Inoue  <yosin@chromium.org>

        Unreviewed, rolling out r120565.
        http://trac.webkit.org/changeset/120565
        https://bugs.webkit.org/show_bug.cgi?id=89155

        Bad commit message

        * rendering/RenderSearchField.cpp: Removed.
        * rendering/RenderSearchField.h: Removed.

2012-06-17  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Copy RenderTextControlSingleLine.{cpp,h} to RenderSearchFiled.{cpp,h}
        https://bugs.webkit.org/show_bug.cgi?id=89155

        This patch copies RenderTextControlSingleLine.cpp and .h into RenderSearchField.cpp
        and .h with just "cp" code. New files aren't compiled until bug 88980.

        No new tests. This patch doesn't change behavior.

        * rendering/RenderSearchField.cpp: Added.
        (WebCore):
        (WebCore::RenderTextControlInnerBlock::positionForPoint):
        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
        (WebCore::RenderTextControlSingleLine::~RenderTextControlSingleLine):
        (WebCore::RenderTextControlSingleLine::containerElement):
        (WebCore::RenderTextControlSingleLine::innerBlockElement):
        (WebCore::RenderTextControlSingleLine::innerSpinButtonElement):
        (WebCore::RenderTextControlSingleLine::resultsButtonElement):
        (WebCore::RenderTextControlSingleLine::cancelButtonElement):
        (WebCore::RenderTextControlSingleLine::textBaseStyle):
        (WebCore::RenderTextControlSingleLine::addSearchResult):
        (WebCore::RenderTextControlSingleLine::showPopup):
        (WebCore::RenderTextControlSingleLine::hidePopup):
        (WebCore::RenderTextControlSingleLine::paint):
        (WebCore::RenderTextControlSingleLine::layout):
        (WebCore::RenderTextControlSingleLine::nodeAtPoint):
        (WebCore::RenderTextControlSingleLine::styleDidChange):
        (WebCore::RenderTextControlSingleLine::capsLockStateMayHaveChanged):
        (WebCore::RenderTextControlSingleLine::hasControlClip):
        (WebCore::RenderTextControlSingleLine::controlClipRect):
        (WebCore::RenderTextControlSingleLine::getAvgCharWidth):
        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
        (WebCore::RenderTextControlSingleLine::computeControlHeight):
        (WebCore::RenderTextControlSingleLine::updateFromElement):
        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
        (WebCore::RenderTextControlSingleLine::createInnerBlockStyle):
        (WebCore::RenderTextControlSingleLine::updateCancelButtonVisibility):
        (WebCore::RenderTextControlSingleLine::visibilityForCancelButton):
        (WebCore::RenderTextControlSingleLine::textShouldBeTruncated):
        (WebCore::RenderTextControlSingleLine::autosaveName):
        (WebCore::RenderTextControlSingleLine::valueChanged):
        (WebCore::RenderTextControlSingleLine::itemText):
        (WebCore::RenderTextControlSingleLine::itemLabel):
        (WebCore::RenderTextControlSingleLine::itemIcon):
        (WebCore::RenderTextControlSingleLine::itemIsEnabled):
        (WebCore::RenderTextControlSingleLine::itemStyle):
        (WebCore::RenderTextControlSingleLine::menuStyle):
        (WebCore::RenderTextControlSingleLine::clientInsetLeft):
        (WebCore::RenderTextControlSingleLine::clientInsetRight):
        (WebCore::RenderTextControlSingleLine::clientPaddingLeft):
        (WebCore::RenderTextControlSingleLine::clientPaddingRight):
        (WebCore::RenderTextControlSingleLine::listSize):
        (WebCore::RenderTextControlSingleLine::selectedIndex):
        (WebCore::RenderTextControlSingleLine::popupDidHide):
        (WebCore::RenderTextControlSingleLine::itemIsSeparator):
        (WebCore::RenderTextControlSingleLine::itemIsLabel):
        (WebCore::RenderTextControlSingleLine::itemIsSelected):
        (WebCore::RenderTextControlSingleLine::setTextFromItem):
        (WebCore::RenderTextControlSingleLine::fontSelector):
        (WebCore::RenderTextControlSingleLine::hostWindow):
        (WebCore::RenderTextControlSingleLine::autoscroll):
        (WebCore::RenderTextControlSingleLine::scrollWidth):
        (WebCore::RenderTextControlSingleLine::scrollHeight):
        (WebCore::RenderTextControlSingleLine::scrollLeft):
        (WebCore::RenderTextControlSingleLine::scrollTop):
        (WebCore::RenderTextControlSingleLine::setScrollLeft):
        (WebCore::RenderTextControlSingleLine::setScrollTop):
        (WebCore::RenderTextControlSingleLine::scroll):
        (WebCore::RenderTextControlSingleLine::logicalScroll):
        (WebCore::RenderTextControlSingleLine::createScrollbar):
        (WebCore::RenderTextControlSingleLine::inputElement):
        * rendering/RenderSearchField.h: Added.
        (WebCore):
        (RenderTextControlSingleLine):
        (WebCore::RenderTextControlSingleLine::popupIsVisible):
        (WebCore::RenderTextControlSingleLine::isTextField):
        (WebCore::toRenderTextControlSingleLine):
        (RenderTextControlInnerBlock):
        (WebCore::RenderTextControlInnerBlock::RenderTextControlInnerBlock):
        (WebCore::RenderTextControlInnerBlock::hasLineIfEmpty):

2012-06-17  MORITA Hajime  <morrita@google.com>

        Unreviewed build fix.

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::removePassesWithCachedTextures):

2012-06-17  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] optimize ::naturalSize()
        https://bugs.webkit.org/show_bug.cgi?id=89314

        Reviewed by Martin Robinson.

        Keep track of the video-sink sinkpad in the MediaPlayerPrivate and
        adapt the webkitGstGetPadCaps API accordingly. The benefit of this
        change is to reduce the number of calls to
        gst_element_get_static_pad() and the corresponding gst_pad_unref().

        * platform/graphics/gstreamer/GStreamerVersioning.cpp:
        (webkitGstGetPadCaps):
        * platform/graphics/gstreamer/GStreamerVersioning.h:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::naturalSize):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
        (MediaPlayerPrivateGStreamer):

2012-06-17  Arvid Nilsson  <anilsson@rim.com>

        Don't mark main frame layer opaque if the frame view is transparent
        https://bugs.webkit.org/show_bug.cgi?id=88234

        Reviewed by Simon Fraser.

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::createPrimaryGraphicsLayer):

2012-06-17  Philip Rogers  <pdr@google.com>

        Prevent crash in SVGDocumentExtensions::removeAllElementReferencesForTarget.
        https://bugs.webkit.org/show_bug.cgi?id=88144

        Reviewed by Abhishek Arya.

        When iterating over referencing elements to rebuild after a reference change in
        SVGDocumentExtensions::removeAllElementReferencesForTarget, we can
        modify the underlying toBeNotified vector, invalidating it. This change checks
        that a vector element is valid before rebuilding, preventing a crash.

        Some definitions from SVGDocumentExtensions that may put this patch in context:
            An example of a "referenced elements" is a <path>.
            An example of a "referencing element" is a <textPath href='some_path_id'>.
            m_elementDependencies is a map from referenced elements (e.g., paths) to
            a set of referencing elements (e.g., textPaths).

        The check that the vector element is valid relies on checking if the referencing
        element is in m_elementDependencies. This check is allowed because in the
        destructor of SVGTextPathElement (and SVGFeImageElement),
        removeAllTargetReferencesForElement() is called, removing the referencing element
        from m_elementDependencies.

        Simply checking if the referencing element is anywhere in m_elementDependencies
        is enough to show it is valid, but that requires iterating over all referenced
        elements to see if the given referencing element is present. This change
        only checks if the textPath is still in the elements referencing the
        path being removed, and only removes the referenced element from
        m_elementDependencies after forcing the referencing elements to be rebuilt.

        Test: svg/text/textpath-reference-crash.html

        * svg/SVGDocumentExtensions.cpp:
        (WebCore::SVGDocumentExtensions::removeAllElementReferencesForTarget):

2012-06-17  Yoshifumi Inoue  <yosin@chromium.org>

        Unreviewed, rolling out r120390.
        http://trac.webkit.org/changeset/120390
        https://bugs.webkit.org/show_bug.cgi?id=89155

        Failed to copy merge history to RenderSerachField.{cpp,h}

        * rendering/RenderSearchField.cpp: Removed.
        * rendering/RenderSearchField.h: Removed.

2012-06-17  Yoshifumi Inoue  <yosin@chromium.org>

        Unreviewed, rolling out r120432.
        http://trac.webkit.org/changeset/120432
        https://bugs.webkit.org/show_bug.cgi?id=88980

        Failed to copy merge history to RenderSerachField.{cpp,h}

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::subtreeHasChanged):
        (WebCore::HTMLInputElement::searchEventsShouldBeDispatched):
        (WebCore):
        (WebCore::HTMLInputElement::addSearchResult):
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/InputType.cpp:
        * html/InputType.h:
        (InputType):
        * html/SearchInputType.cpp:
        * html/SearchInputType.h:
        (SearchInputType):
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
        * loader/FormSubmission.cpp:
        (WebCore::FormSubmission::create):
        * rendering/RenderSearchField.cpp:
        (WebCore::RenderTextControlInnerBlock::positionForPoint):
        (WebCore):
        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
        (WebCore::RenderTextControlSingleLine::~RenderTextControlSingleLine):
        (WebCore::RenderTextControlSingleLine::containerElement):
        (WebCore::RenderTextControlSingleLine::innerBlockElement):
        (WebCore::RenderTextControlSingleLine::innerSpinButtonElement):
        (WebCore::RenderTextControlSingleLine::resultsButtonElement):
        (WebCore::RenderTextControlSingleLine::cancelButtonElement):
        (WebCore::RenderTextControlSingleLine::textBaseStyle):
        (WebCore::RenderTextControlSingleLine::addSearchResult):
        (WebCore::RenderTextControlSingleLine::showPopup):
        (WebCore::RenderTextControlSingleLine::hidePopup):
        (WebCore::RenderTextControlSingleLine::paint):
        (WebCore::RenderTextControlSingleLine::layout):
        (WebCore::RenderTextControlSingleLine::nodeAtPoint):
        (WebCore::RenderTextControlSingleLine::styleDidChange):
        (WebCore::RenderTextControlSingleLine::capsLockStateMayHaveChanged):
        (WebCore::RenderTextControlSingleLine::hasControlClip):
        (WebCore::RenderTextControlSingleLine::controlClipRect):
        (WebCore::RenderTextControlSingleLine::getAvgCharWidth):
        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
        (WebCore::RenderTextControlSingleLine::computeControlHeight):
        (WebCore::RenderTextControlSingleLine::updateFromElement):
        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
        (WebCore::RenderTextControlSingleLine::createInnerBlockStyle):
        (WebCore::RenderTextControlSingleLine::updateCancelButtonVisibility):
        (WebCore::RenderTextControlSingleLine::visibilityForCancelButton):
        (WebCore::RenderTextControlSingleLine::textShouldBeTruncated):
        (WebCore::RenderTextControlSingleLine::autosaveName):
        (WebCore::RenderTextControlSingleLine::valueChanged):
        (WebCore::RenderTextControlSingleLine::itemText):
        (WebCore::RenderTextControlSingleLine::itemLabel):
        (WebCore::RenderTextControlSingleLine::itemIcon):
        (WebCore::RenderTextControlSingleLine::itemIsEnabled):
        (WebCore::RenderTextControlSingleLine::itemStyle):
        (WebCore::RenderTextControlSingleLine::menuStyle):
        (WebCore::RenderTextControlSingleLine::clientInsetLeft):
        (WebCore::RenderTextControlSingleLine::clientInsetRight):
        (WebCore::RenderTextControlSingleLine::clientPaddingLeft):
        (WebCore::RenderTextControlSingleLine::clientPaddingRight):
        (WebCore::RenderTextControlSingleLine::listSize):
        (WebCore::RenderTextControlSingleLine::selectedIndex):
        (WebCore::RenderTextControlSingleLine::popupDidHide):
        (WebCore::RenderTextControlSingleLine::itemIsSeparator):
        (WebCore::RenderTextControlSingleLine::itemIsLabel):
        (WebCore::RenderTextControlSingleLine::itemIsSelected):
        (WebCore::RenderTextControlSingleLine::setTextFromItem):
        (WebCore::RenderTextControlSingleLine::fontSelector):
        (WebCore::RenderTextControlSingleLine::hostWindow):
        (WebCore::RenderTextControlSingleLine::autoscroll):
        (WebCore::RenderTextControlSingleLine::scrollWidth):
        (WebCore::RenderTextControlSingleLine::scrollHeight):
        (WebCore::RenderTextControlSingleLine::scrollLeft):
        (WebCore::RenderTextControlSingleLine::scrollTop):
        (WebCore::RenderTextControlSingleLine::setScrollLeft):
        (WebCore::RenderTextControlSingleLine::setScrollTop):
        (WebCore::RenderTextControlSingleLine::scroll):
        (WebCore::RenderTextControlSingleLine::logicalScroll):
        (WebCore::RenderTextControlSingleLine::createScrollbar):
        (WebCore::RenderTextControlSingleLine::inputElement):
        * rendering/RenderSearchField.h:
        (RenderTextControlSingleLine):
        (WebCore::RenderTextControlSingleLine::isTextField):
        (WebCore::toRenderTextControlSingleLine):
        (WebCore):
        (RenderTextControlInnerBlock):
        (WebCore::RenderTextControlInnerBlock::RenderTextControlInnerBlock):
        (WebCore::RenderTextControlInnerBlock::hasLineIfEmpty):
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
        (WebCore::RenderTextControlSingleLine::~RenderTextControlSingleLine):
        (WebCore):
        (WebCore::RenderTextControlSingleLine::containerElement):
        (WebCore::RenderTextControlSingleLine::innerBlockElement):
        (WebCore::RenderTextControlSingleLine::resultsButtonElement):
        (WebCore::RenderTextControlSingleLine::cancelButtonElement):
        (WebCore::RenderTextControlSingleLine::addSearchResult):
        (WebCore::RenderTextControlSingleLine::showPopup):
        (WebCore::RenderTextControlSingleLine::hidePopup):
        (WebCore::RenderTextControlSingleLine::layout):
        (WebCore::RenderTextControlSingleLine::computeControlHeight):
        (WebCore::RenderTextControlSingleLine::updateFromElement):
        (WebCore::RenderTextControlSingleLine::updateCancelButtonVisibility):
        (WebCore::RenderTextControlSingleLine::visibilityForCancelButton):
        (WebCore::RenderTextControlSingleLine::autosaveName):
        (WebCore::RenderTextControlSingleLine::valueChanged):
        (WebCore::RenderTextControlSingleLine::itemText):
        (WebCore::RenderTextControlSingleLine::itemLabel):
        (WebCore::RenderTextControlSingleLine::itemIcon):
        (WebCore::RenderTextControlSingleLine::itemIsEnabled):
        (WebCore::RenderTextControlSingleLine::itemStyle):
        (WebCore::RenderTextControlSingleLine::menuStyle):
        (WebCore::RenderTextControlSingleLine::clientInsetLeft):
        (WebCore::RenderTextControlSingleLine::clientInsetRight):
        (WebCore::RenderTextControlSingleLine::clientPaddingLeft):
        (WebCore::RenderTextControlSingleLine::clientPaddingRight):
        (WebCore::RenderTextControlSingleLine::listSize):
        (WebCore::RenderTextControlSingleLine::selectedIndex):
        (WebCore::RenderTextControlSingleLine::popupDidHide):
        (WebCore::RenderTextControlSingleLine::itemIsSeparator):
        (WebCore::RenderTextControlSingleLine::itemIsLabel):
        (WebCore::RenderTextControlSingleLine::itemIsSelected):
        (WebCore::RenderTextControlSingleLine::setTextFromItem):
        (WebCore::RenderTextControlSingleLine::fontSelector):
        (WebCore::RenderTextControlSingleLine::hostWindow):
        (WebCore::RenderTextControlSingleLine::createScrollbar):
        * rendering/RenderTextControlSingleLine.h:
        (WebCore):
        (RenderTextControlSingleLine):
        (WebCore::RenderTextControlSingleLine::popupIsVisible):
        * rendering/RenderingAllInOne.cpp:

2012-06-15  Darin Adler  <darin@apple.com>

        REGRESSION (r111041): Missing element type check in RenderThemeMac::paintMediaFullscreenButton
        https://bugs.webkit.org/show_bug.cgi?id=89270

        Reviewed by Oliver Hunt.

        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintMediaFullscreenButton): Use the proper idiom for getting
        a media control element's type.

2012-06-17  Zeev Lieber  <zlieber@chromium.org>

        [Chromium] Compositor should avoid drawing quads when cached textures are available and contents unchanged
        https://bugs.webkit.org/show_bug.cgi?id=88482

        Reviewed by Adrienne Walker.

        Post-processing CCRenderPassList after it's been generated and
        removing all render surface quads for which there are
        cached textures, and whose content didn't change. Added a new
        flag to CCLayerImpl to differentiate surface property change and
        layer property change.

        The changes are covered by new unit tests that check that
        the removal algorithm functions propertly. No rendering
        behaviour change, so no new layout tests.

        * platform/graphics/chromium/cc/CCDamageTracker.cpp:
        (WebCore::layerNeedsToRedrawOntoItsTargetSurface):
        (WebCore):
        (WebCore::CCDamageTracker::extendDamageForLayer):
        (WebCore::CCDamageTracker::extendDamageForRenderSurface):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::CCLayerImpl):
        (WebCore::CCLayerImpl::layerSurfacePropertyChanged):
        (WebCore):
        (WebCore::CCLayerImpl::resetAllChangeTrackingForSubtree):
        (WebCore::CCLayerImpl::setOpacity):
        (WebCore::CCLayerImpl::setTransform):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::CCLayerTreeHostImpl::removeRenderPassesRecursive):
        (WebCore):
        (WebCore::CCLayerTreeHostImpl::removePassesWithCachedTextures):
        (WebCore::CCLayerTreeHostImpl::prepareToDraw):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (FrameData):
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCRenderPass.h:
        (CCRenderPass):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::prepareContentsTexture):
        (WebCore::CCRenderSurface::hasCachedContentsTexture):
        (WebCore):
        (WebCore::CCRenderSurface::contentsChanged):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (CCRenderSurface):

2012-06-17  Adam Barth  <abarth@webkit.org>

        Attempt to fix a large number of tests I broke with http://trac.webkit.org/changeset/120547

        We need to reset the device scale facter after each test.

        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::InternalSettings):
        (WebCore::InternalSettings::restoreTo):
        * testing/InternalSettings.h:
        (InternalSettings):

2012-06-16  Huang Dongsung  <luxtella@company100.net>

        [Texmap] Share gaussian formula between shaders in TextureMapperShaderManager.
        https://bugs.webkit.org/show_bug.cgi?id=89277

        This patch makes blur and drop shadow shader share gaussian formula.

        On the other hand, blur and drop shadow filter computed a gaussian weight in
        pixel shader. However, a gaussian kernal has always same values, so this patch
        computes the gaussian kernel only one time using CPU.
        It is more accurate and faster.

        Reviewed by Noam Rosenthal.

        Covered by existing tests, particularly css3/filters/.

        * platform/graphics/texmap/TextureMapperShaderManager.cpp:
        (WebCore):
        (WebCore::StandardFilterProgram::StandardFilterProgram):
        (WebCore::gauss):
        (WebCore::gaussianKernel):
        (WebCore::StandardFilterProgram::prepare):
        * platform/graphics/texmap/TextureMapperShaderManager.h:

2012-06-16  Robert Kroeger  <rjkroege@chromium.org>

        [chromium] Make the deviceScaleFactor dynamically adjustable.
        https://bugs.webkit.org/show_bug.cgi?id=88916

        Reviewed by James Robinson.

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp: Removed use of static
        deviceScaleFactor from settings with dyanmic m_deviceScaleFactor
        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
        (WebCore::CCLayerTreeHost::setViewportSize):
        (WebCore::CCLayerTreeHost::updateLayers):
        (WebCore::CCLayerTreeHost::setDeviceScaleFactor): Added function to
        set deviceScaleFactor.
        (WebCore):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::CCSettings::CCSettings): Removed static deviceScaleFactor
        (CCSettings):
        (CCLayerTreeHost): Added dynamic m_deviceScaleFactor in its place.
        (WebCore::CCLayerTreeHost::deviceScaleFactor):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp: Same as above.
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
        (WebCore::CCLayerTreeHostImpl::setViewportSize):
        (WebCore::CCLayerTreeHostImpl::setDeviceScaleFactor): Added function to
        set deviceScaleFactor.
        (WebCore):
        (WebCore::CCLayerTreeHostImpl::updateMaxScrollPosition):
        (WebCore::CCLayerTreeHostImpl::scrollBegin):
        (WebCore::CCLayerTreeHostImpl::computePinchZoomDeltas):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h: Added dynamic
        m_deviceScaleFactor instance variable.
        (WebCore::CCLayerTreeHostImpl::deviceScaleFactor):
        (CCLayerTreeHostImpl):

2012-06-16  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120536.
        http://trac.webkit.org/changeset/120536
        https://bugs.webkit.org/show_bug.cgi?id=89296

        Does not compile on chromium-linux (Requested by abarth on
        #webkit).

        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp:
        (WebCore):
        (WebCore::FontPlatformData::setHinting):
        (WebCore::FontPlatformData::setAutoHint):
        (WebCore::FontPlatformData::setUseBitmaps):
        (WebCore::FontPlatformData::setAntiAlias):
        (WebCore::FontPlatformData::setSubpixelRendering):
        (WebCore::FontPlatformData::setSubpixelPositioning):
        (WebCore::FontPlatformData::setupPaint):
        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h:
        (FontPlatformData):

2012-06-16  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120539.
        http://trac.webkit.org/changeset/120539
        https://bugs.webkit.org/show_bug.cgi?id=89295

        Does not compile on chromium-mac (Requested by abarth on
        #webkit).

        * platform/graphics/chromium/cc/CCDamageTracker.cpp:
        (WebCore::CCDamageTracker::extendDamageForLayer):
        (WebCore::CCDamageTracker::extendDamageForRenderSurface):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::CCLayerImpl):
        (WebCore::CCLayerImpl::resetAllChangeTrackingForSubtree):
        (WebCore::CCLayerImpl::setOpacity):
        (WebCore::CCLayerImpl::setTransform):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::CCLayerTreeHostImpl::prepareToDraw):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCRenderPass.h:
        (CCRenderPass):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::prepareContentsTexture):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (CCRenderSurface):

2012-06-16  Mike West  <mkwst@chromium.org>

        Ignore paths in Content Security Policy sources rather than failing to parse them.
        https://bugs.webkit.org/show_bug.cgi?id=89281

        Reviewed by Adam Barth.

        In short: `script-src http://example.com/` should allow scripts from
        http://example.com. Currently, it allows no scripts at all, as the
        terminal `/` isn't accepted as part of a hostname.

        This patch adjusts CSPSourceList::parseSource to accept paths (and
        discard them). Once this lands, the next step will be to keep the
        path, and use it when comparing source origins in the various
        allowXXXFromSource methods.

        Tests: http/tests/security/contentSecurityPolicy/source-list-parsing-05.html
               http/tests/security/contentSecurityPolicy/source-list-parsing-06.html

        * page/ContentSecurityPolicy.cpp:
        (CSPSourceList):
        (WebCore):
        (WebCore::CSPSourceList::parseSource):
            Reworked this method entirely to support paths.
        (WebCore::CSPSourceList::parsePath):
            More or less a no-op at the moment.
        (WebCore::CSPSourceList::parsePort):
            Moved the `:` assertion here from parseSource.

2012-06-16  Zeev Lieber  <zlieber@chromium.org>

        [Chromium] Compositor should avoid drawing quads when cached textures are available and contents unchanged
        https://bugs.webkit.org/show_bug.cgi?id=88482

        Reviewed by Adrienne Walker.

        Post-processing CCRenderPassList after it's been generated and
        removing all render surface quads for which there are
        cached textures, and whose content didn't change. Added a new
        flag to CCLayerImpl to differentiate surface property change and
        layer property change.

        The changes are covered by new unit tests that check that
        the removal algorithm functions propertly. No rendering
        behaviour change, so no new layout tests.

        * platform/graphics/chromium/cc/CCDamageTracker.cpp:
        (WebCore::layerNeedsToRedrawOntoItsTargetSurface):
        (WebCore):
        (WebCore::CCDamageTracker::extendDamageForLayer):
        (WebCore::CCDamageTracker::extendDamageForRenderSurface):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::CCLayerImpl):
        (WebCore::CCLayerImpl::layerSurfacePropertyChanged):
        (WebCore):
        (WebCore::CCLayerImpl::resetAllChangeTrackingForSubtree):
        (WebCore::CCLayerImpl::setOpacity):
        (WebCore::CCLayerImpl::setTransform):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::CCLayerTreeHostImpl::removeRenderPassesRecursive):
        (WebCore):
        (WebCore::CCLayerTreeHostImpl::removePassesWithCachedTextures):
        (WebCore::CCLayerTreeHostImpl::prepareToDraw):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (FrameData):
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCRenderPass.h:
        (CCRenderPass):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::prepareContentsTexture):
        (WebCore::CCRenderSurface::hasCachedContentsTexture):
        (WebCore):
        (WebCore::CCRenderSurface::contentsChanged):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (CCRenderSurface):

2012-06-16  Xianzhu Wang  <wangxianzhu@chromium.org>

        [Chromium] Move chromium/public/linuxish/WebFontRendering.h out of linuxish directory
        https://bugs.webkit.org/show_bug.cgi?id=89228

        Reverse the dependency originally from WebKit::WebFontRendering to WebCore::FontPlatformDataHarfBuzz
        so that WebKit::WebFontRendering can be platform-independent.

        Reviewed by Tony Chang.

        Refactory only. No new tests.

        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp:
        (WebCore::FontPlatformData::setupPaint):
        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h:
        (FontPlatformData):

2012-06-16  Adam Barth  <abarth@webkit.org>

        Settings::devicePixelRatio doesn't do anything and is confusing
        https://bugs.webkit.org/show_bug.cgi?id=89272

        Reviewed by James Robinson.

        Settings::devicePixelRatio is yet another piece of state trying to
        represent the device scale factor. The canonical place to store this
        state is Page::m_deviceScaleFactor. Nothing in WebCore references
        Settings::devicePixelRatio anymore, so we can remove it.

        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (Settings):

2012-06-16  Huang Dongsung  <luxtella@company100.net>

        [Texmap] SIGSEV in WebCore::TextureMapperGL::drawTexture.
        https://bugs.webkit.org/show_bug.cgi?id=89113

        TextureMapperTile::m_texture is created lazilly, so we need null check before
        using it.

        Reviewed by Noam Rosenthal.

        No new tests. This patch doesn't change behavior.

        * platform/graphics/texmap/TextureMapperBackingStore.cpp:
        (WebCore::TextureMapperTile::paint):

2012-06-16  Huang Dongsung  <luxtella@company100.net>

        [Texmap] Remove unused code in Texmap.
        https://bugs.webkit.org/show_bug.cgi?id=89265

        Reviewed by Noam Rosenthal.

        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
        (WebCore::GraphicsLayerTextureMapper::didSynchronize):
        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
        (GraphicsLayerTextureMapper):
        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::syncCompositingState):
        * platform/graphics/texmap/TextureMapperLayer.h:
        (TextureMapperLayer):

2012-06-16  Igor Oliveira  <igor.o@sisa.samsung.com>

        [TexmapGL] Reduce the number of glTexSubImage2D calls
        https://bugs.webkit.org/show_bug.cgi?id=83665

        Instead of copy the pixels row by row, put the pixels in a buffer and
        call glTexSubImage2D just once.

        Reviewed by Noam Rosenthal.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::BitmapTextureGL::updateContents):

2012-06-15  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120280.
        http://trac.webkit.org/changeset/120280
        https://bugs.webkit.org/show_bug.cgi?id=89273

        Enabling CSS regions broke all Windows tests (Requested by
        jhomeycutt on #webkit).

        * css/CSSPropertyNames.in:

2012-06-15  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120511.
        http://trac.webkit.org/changeset/120511
        https://bugs.webkit.org/show_bug.cgi?id=89255

        Breaks at least Android builder (Requested by wangxianzhu on
        #webkit).

        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp:
        (WebCore):
        (WebCore::FontPlatformData::setHinting):
        (WebCore::FontPlatformData::setAutoHint):
        (WebCore::FontPlatformData::setUseBitmaps):
        (WebCore::FontPlatformData::setAntiAlias):
        (WebCore::FontPlatformData::setSubpixelRendering):
        (WebCore::FontPlatformData::setSubpixelPositioning):
        (WebCore::FontPlatformData::setupPaint):
        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h:
        (FontPlatformData):

2012-06-15  Xianzhu Wang  <wangxianzhu@chromium.org>

        [Chromium] Move chromium/public/linuxish/WebFontRendering.h out of linuxish directory
        https://bugs.webkit.org/show_bug.cgi?id=89228

        Reverse the dependency originally from WebKit::WebFontRendering to WebCore::FontPlatformDataHarfBuzz
        so that WebKit::WebFontRendering can be platform-independent.

        Reviewed by Tony Chang.

        Refactory only. No new tests.

        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp:
        (WebCore::FontPlatformData::setupPaint):
        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h:
        (FontPlatformData):

2012-06-15  Adrienne Walker  <enne@google.com>

        [chromium] Fix composited scrollbars with transparent thumbs
        https://bugs.webkit.org/show_bug.cgi?id=89247

        Reviewed by James Robinson.

        On some platforms, the thumb of a scrollbar can be transparent. Fix by
        always drawing the thumb quad with blending.

        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
        (WebCore::CCScrollbarLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCTextureDrawQuad.cpp:
        (WebCore::CCTextureDrawQuad::setNeedsBlending):
        (WebCore):
        * platform/graphics/chromium/cc/CCTextureDrawQuad.h:
        (CCTextureDrawQuad):

2012-06-14  James Robinson  <jamesr@chromium.org>

        [chromium] Use SkBitmap in ImageLayerChromium
        https://bugs.webkit.org/show_bug.cgi?id=89134

        Reviewed by Adrienne Walker.

        GraphicsLayer::setContentsToImage(Image*) is called whenever an image layer's image is or might have changed.
        In Chromium, this used to hang on to a RefPtr<WebCore::Image> until the compositor was ready to upload texture contents.
        This is potentially a bit fishy since the Image itself might not be in exactly the same state when we get around
        to uploading textures and it also creates a bad dependency from ImageLayerChromium on WebCore::Image.

        This patch grabs the underlying SkBitmap in the setContentsTo call and passes that into ImageLayerChromium
        instead. I've also removed the venerable but redundant PlatformImage concept since all of chromium's images are
        skia bitmaps these days.

        Covered by existing tests, particularly compositing/images/ and compositing/color-matching/.

        * WebCore.gypi:
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::setContentsToImage):
        * platform/graphics/chromium/ImageLayerChromium.cpp:
        (WebCore::ImageLayerTextureUpdater::updateTextureRect):
        (WebCore::ImageLayerTextureUpdater::setBitmap):
        (ImageLayerTextureUpdater):
        (WebCore::ImageLayerChromium::ImageLayerChromium):
        (WebCore::ImageLayerChromium::setBitmap):
        (WebCore::ImageLayerChromium::update):
        (WebCore::ImageLayerChromium::contentBounds):
        (WebCore::ImageLayerChromium::drawsContent):
        * platform/graphics/chromium/ImageLayerChromium.h:
        (ImageLayerChromium):
        * platform/graphics/chromium/PlatformImage.cpp: Removed.
        * platform/graphics/chromium/PlatformImage.h: Removed.

2012-06-15  Eli Fidler  <efidler@rim.com>

        [BlackBerry] Use platform font settings for the standard settings.
        https://bugs.webkit.org/show_bug.cgi?id=89232

        Reviewed by Rob Buis.

        RIM PR 159708

        * page/blackberry/SettingsBlackBerry.cpp:
        (WebCore):
        (WebCore::Settings::initializeDefaultFontFamilies):

2012-06-15  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Raise exceptions when methods are called on deleted objects
        https://bugs.webkit.org/show_bug.cgi?id=89243

        Reviewed by Tony Chang.

        Implement the IDB spec requirement that InvalidStateError exceptions are 
        thrown when methods are called on objects (i.e. object stores and indexes)
        that have been deleted within a version change transaction.

        Test: storage/indexeddb/deleted-objects.html

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::deleteObjectStore): Don't relay to transaction if back-end failed.
        * Modules/indexeddb/IDBIndex.cpp: Check deleted state in methods, raise if set.
        (WebCore::IDBIndex::IDBIndex):
        (WebCore::IDBIndex::openCursor):
        (WebCore::IDBIndex::count):
        (WebCore::IDBIndex::openKeyCursor):
        (WebCore::IDBIndex::get):
        (WebCore::IDBIndex::getKey):
        * Modules/indexeddb/IDBIndex.h: Add flag to track deleted state, method to mark it.
        (WebCore::IDBIndex::markDeleted):
        (IDBIndex):
        * Modules/indexeddb/IDBObjectStore.cpp: Check deleted state in methods, raise if set.
        (WebCore::IDBObjectStore::IDBObjectStore):
        (WebCore::IDBObjectStore::get):
        (WebCore::IDBObjectStore::add):
        (WebCore::IDBObjectStore::put):
        (WebCore::IDBObjectStore::deleteFunction):
        (WebCore::IDBObjectStore::clear):
        (WebCore::IDBObjectStore::createIndex):
        (WebCore::IDBObjectStore::index):
        (WebCore::IDBObjectStore::deleteIndex): If the index being deleted has been instantiated,
        mark it as deleted.
        (WebCore::IDBObjectStore::openCursor):
        (WebCore::IDBObjectStore::count):
        * Modules/indexeddb/IDBObjectStore.h: Add flag to track deleted state, method to mark it.
        (WebCore::IDBObjectStore::markDeleted):
        (IDBObjectStore):
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::objectStore):
        (WebCore::IDBTransaction::objectStoreDeleted): If the store being deleted has been instantiated,
        mark it as deleted.

2012-06-15  James Robinson  <jamesr@chromium.org>

        [chromium] Fix LayoutTests/platform/chromium/compositing/accelerated-drawing/svg-filters.html
        https://bugs.webkit.org/show_bug.cgi?id=89126

        Reviewed by Stephen White.

        When drawing an image buffer into a deferred device context, we have to make a deep copy of the source (Skia
        can't for some reason). Stephen White fixed this in r101325 by adding a bit on PlatformContextSkia indicating if
        a given context is deferred, but I broke this again in r120346 by refactoring the SkCanvas creation to happen in
        a different location from the PlatformContextSkia construction.

        This moves the check into ImageBufferSkia and directly queries the state of the destination SkDevice to be more
        robust and work without needing special PlatformContextSkia setup.

        Covered by LayoutTests/platform/chromium/compositing/accelerated-drawing/svg-filters.html

        * platform/graphics/skia/ImageBufferSkia.cpp:
        (WebCore::drawNeedsCopy):
        * platform/graphics/skia/PlatformContextSkia.cpp:
        (WebCore::PlatformContextSkia::PlatformContextSkia):
        * platform/graphics/skia/PlatformContextSkia.h:
        (PlatformContextSkia):

2012-06-15  Ami Fischman  <fischman@chromium.org>

        [chromium] Compositor should be aware of |flipped| status of video textures per-platform
        https://bugs.webkit.org/show_bug.cgi?id=89189

        Reviewed by James Robinson.

        No new tests (sadly HW video decode is still only being tested manually for orientation).

        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::appendQuads):

2012-06-14  Ryosuke Niwa  <rniwa@webkit.org>

        The initial value of text-align should be start instead of -webkit-auto
        https://bugs.webkit.org/show_bug.cgi?id=79914

        Reviewed by Tony Chang.

        Change the initial value of text-align CSS property from -webkit-auto to start as specified in
        http://www.w3.org/TR/css3-text/#text-align

        In editing, we have to coerce start and end to left and right for now because match-parent,
        which is the text-align value of li in UA stylesheet is going to result in the computed values of
        left as supposed to start by default, and this causes editing code not being able to remove
        text-align: left when computing typing styles and preserving styles.

        In the long term, we should detect this specific case and ignore match-parent but that seemed like
        too much work to be done in a single patch also because the test result improved because of this change.

        This behavior change is covered by existing regression tests.

        * accessibility/gtk/WebKitAccessibleInterfaceText.cpp:
        (WebCore::getAttributeSetForAccessibilityObject):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): No longer supports TAAUTO since it's identical to TASTART.
        (WebCore::CSSPrimitiveValue::operator ETextAlign): Ditto. Parse -webkit-auto as start.
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList): Replace TAAUTO by TASTART.
        * editing/EditingStyle.cpp:
        (WebCore):
        (WebCore::textAlignResolvingStartAndEnd): Coerce start and end into left and right based on the directionality
        for editing. Otherwise, we end up adding lots of text-align: left due to li's UA style rule having match-parent
        as the text alignment and its descendent inherits this style. We need to handle it better in the future
        since start and left or end and right are semantically different.
        (WebCore::EditingStyle::prepareToApplyAt):
        (WebCore::getPropertiesNotIn):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::textAlignmentForLine): Justified text is aligned at start by default.
        (WebCore::RenderBlock::updateLogicalWidthForAlignment):
        (WebCore::RenderBlock::startAlignedOffsetForLine):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::localCaretRectForEmptyElement):
        * rendering/RenderListBox.cpp:
        (WebCore::itemOffsetForAlignment):
        * rendering/RenderMarquee.cpp:
        (WebCore::RenderMarquee::updateMarqueeStyle):
        * rendering/RenderRubyText.cpp:
        (WebCore::RenderRubyText::textAlignmentForLine):
        (WebCore::RenderRubyText::adjustInlineDirectionLineBounds):
        * rendering/RenderText.cpp:
        (WebCore::RenderText::localCaretRect):
        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyleConstants.h:

2012-06-15  Jian Li  <jianli@chromium.org>

        [File API] FileReader should work in sandbox iframe
        https://bugs.webkit.org/show_bug.cgi?id=89242

        Reviewed by Adam Barth.

        Test: fast/files/file-reader-sandbox-iframe.html

        * fileapi/ThreadableBlobRegistry.cpp: Should remove from map for all threads.
        (WebCore::ThreadableBlobRegistry::unregisterBlobURL):
        * page/SecurityOrigin.cpp:
        (WebCore::SecurityOrigin::canRequest): Check and use cached origin for blob URL first.

2012-06-15  David Barton  <dbarton@mathscribe.com>

        Inherit style changes in MathML anonymous renderers
        https://bugs.webkit.org/show_bug.cgi?id=88476

        Reviewed by Julien Chaffraix.

        A RenderObject that is not the main renderer() for a DOM node is called "anonymous".
        Standard WebCore practice is to mark such a renderer as isAnonymous(). For example,
        RenderBlock::styleDidChange calls propagateStyleToAnonymousChildren to flow style
        changes to such children, by re-initializing their styles and then inheriting from
        this->style(). A derived class' styleDidChange() can then set non-default style
        properties as needed.
        
        This patch implements this standard practice for RenderMathMLBlock classes, except
        RenderMathMLOperator which currently uses a RenderLayer, which reportedly means it
        should not be isAnonymous(). We also follow common practice and change
        isAnonymousBlock() to return false for RenderMathMLBlock classes, since
        isAnonymousBlock() is really used by RenderBlock to detect its own anonymous blocks for
        wrapping inline children, which RenderBlock then combines or deletes assuming this.
        
        Test: mathml/presentation/style-changed.html, also added to mathml/presentation/over.xhtml

        * rendering/RenderObject.h:
        (WebCore::RenderObject::isAnonymousBlock):
        * rendering/RenderTreeAsText.cpp:
        (WebCore::RenderTreeAsText::writeRenderObject):
        * rendering/mathml/RenderMathMLBlock.cpp:
        (WebCore::RenderMathMLBlock::createAnonymousMathMLBlock):
        (WebCore::RenderMathMLBlock::renderName):
        * rendering/mathml/RenderMathMLBlock.h:
        * rendering/mathml/RenderMathMLFenced.cpp:
        (WebCore::RenderMathMLFenced::createMathMLOperator):
        (WebCore::RenderMathMLFenced::makeFences):
        (WebCore::RenderMathMLFenced::addChild):
        (WebCore::RenderMathMLFenced::styleDidChange):
        * rendering/mathml/RenderMathMLFenced.h:
        * rendering/mathml/RenderMathMLFraction.cpp:
        (WebCore::RenderMathMLFraction::RenderMathMLFraction):
        (WebCore::RenderMathMLFraction::fixChildStyle):
        (WebCore::RenderMathMLFraction::addChild):
        (WebCore::RenderMathMLFraction::styleDidChange):
        * rendering/mathml/RenderMathMLFraction.h:
        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::styleDidChange):
        * rendering/mathml/RenderMathMLOperator.h:
        * rendering/mathml/RenderMathMLSquareRoot.h:
        * rendering/mathml/RenderMathMLSubSup.cpp:
        (WebCore::RenderMathMLSubSup::fixScriptsStyle):
        (WebCore::RenderMathMLSubSup::addChild):
        (WebCore::RenderMathMLSubSup::styleDidChange):
        * rendering/mathml/RenderMathMLSubSup.h:
        * rendering/mathml/RenderMathMLUnderOver.cpp:
        (WebCore::RenderMathMLUnderOver::addChild):
        (WebCore::RenderMathMLUnderOver::styleDidChange):
        * rendering/mathml/RenderMathMLUnderOver.h:

2012-06-13  Vincent Scheib  <scheib@chromium.org>

        Add new Pointer Lock spec webkitRequestPointerLock and webkitExitPointerLock methods.
        https://bugs.webkit.org/show_bug.cgi?id=88891

        Reviewed by Dimitri Glazkov.

        Part of a series of refactoring changes to update pointer lock API to
        the fullscreen locking style. https://bugs.webkit.org/show_bug.cgi?id=84402

        Entering and exiting mouse lock is provided in the new webkitRequestPointerLock and
        webkitExitPointerLock methods.

        Existing pointer-lock tests updated to use the new methods.

        * dom/Document.cpp:
        (WebCore::Document::webkitExitPointerLock):
        (WebCore):
        * dom/Document.h:
        (Document):
        * dom/Document.idl:
        * dom/Element.cpp:
        (WebCore):
        (WebCore::Element::webkitRequestPointerLock):
        * dom/Element.h:
        * dom/Element.idl:

2012-06-15  Tony Payne  <tpayne@chromium.org>

       [chromium] Add iccjpeg and qcms to chromium port
       https://bugs.webkit.org/show_bug.cgi?id=81974

       Reviewed by Adam Barth.

       Covered by existing layout tests which will be rebaselined.

       * WebCore.gyp/WebCore.gyp: Add qcms to the build.
       * platform/image-decoders/ImageDecoder.h:
       (WebCore::ImageDecoder::qcmsOutputDeviceProfile): Return an sRGB profile.
       On OSX, return the default RGB profile. Add FIXME to use the user's
       monitor profile and verify that profile for other platforms.

       * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
       (turboSwizzled): For libjpeg-turbo, JCS_EXT_BGRA and JCS_EXT_RGBA are the
       two known output color spaces for which the decoder uses a data swizzle.
       (colorSpaceHasAlpha): JPEG's have no alpha in the output color space. For
       libjpeg-turbo, alpha may be present in the swizzled output color space.

       (WebCore::JPEGImageReader::JPEGImageReader):
       (WebCore::JPEGImageReader::close):
       (WebCore::JPEGImageReader::decode): For QCMSLIB, create the color transform
       to use during decoding, and ensure we switch to inputing RGBA data to qcms
       even if the desired output data is BGRA: outputScanlines() sends BGRA data
       to the frame buffer following color correction if needed.
       (JPEGImageReader):
       (WebCore::JPEGImageReader::colorTransform): qcms color transform getter.
       (WebCore::JPEGImageReader::createColorTransform): Create color transform.
       Release the existing transform (if any) and assign to the color transform
       created from the color profile data.
       (WebCore::JPEGImageDecoder::outputScanlines): Minor style fix. Apply color
       transform to each decoded image row.

       * platform/image-decoders/png/PNGImageDecoder.cpp:
       (WebCore::PNGImageReader::PNGImageReader):
       (WebCore::PNGImageReader::close):
       (WebCore::PNGImageReader::currentBufferSize): Move this adjacent to other
       setters and getters.
       (WebCore::PNGImageReader::decodingSizeOnly): Ditto.
       (WebCore::PNGImageReader::setHasAlpha): Ditto.
       (WebCore::PNGImageReader::hasAlpha): Ditto.
       (WebCore::PNGImageReader::interlaceBuffer): Ditto.
       (WebCore::PNGImageReader::createRowBuffer): Creates a temporary row buffer,
       used when a color transform is applied to the decoded image pixels.
       (WebCore::PNGImageReader::rowBuffer): Return the temporary row buffer.
       (WebCore::PNGImageReader::colorTransform): qcms color transform getter.
       (WebCore::PNGImageReader::createColorTransform): Create color transform.
       Release the existing transform (if any) and assign to the color transform
       created from the color profile data.
       (WebCore::PNGImageDecoder::headerAvailable): For QCMSLIB, create the color
       transform to use for decoding. Clear m_colorProfile (not used anymore).
       (WebCore::PNGImageDecoder::rowAvailable): Create temporary row buffer if
       a color transform is needed for decoding. Apply color transform to each
       decoded image row.

       * platform/image-decoders/skia/ImageDecoderSkia.cpp:
       (WebCore::ImageFrame::setColorProfile): Old method of colorProfiles is no
       longer used. Add a FIXME to remove the old implementation.
       (WebCore::ImageFrame::setStatus): Remove old color correction code.

2012-06-15  Silvia Pfeiffer  <silviapf@chromium.org>

        Remove volume thumb for videos without audio track.
        https://bugs.webkit.org/show_bug.cgi?id=89093

        Reviewed by Eric Carlson.

        No new tests, since this was already tested in media/video-no-audio.html.

        * rendering/RenderMediaControlsChromium.cpp:
        (WebCore::paintMediaMuteButton):
        Change mute button when there is no audio or no source file.
        (WebCore::paintMediaVolumeSlider):
        Set volume slider to 0 when there is no audio or no source file.
        (WebCore::paintMediaVolumeSliderThumb):
        Don't paint the volume slider thumb when there is no audio or no source file.

2012-06-15  Abhishek Arya  <inferno@chromium.org>

        Cleanup empty anonymous block continuation.
        https://bugs.webkit.org/show_bug.cgi?id=74976

        Reviewed by Julien Chaffraix.

        Fix rendering on http://docs.google.com/demo.

        Test: fast/inline/inline-empty-block-continuation-remove.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removeChild): If we are removing our last child,
        and are an anonymous block which is part of a continuation chain, then
        we need to first fix our continuation chain by setting our previous
        continuation renderer to point to the next continuation renderer. Then,
        we reset our continuation pointer and destroy ourselves. Since we no
        longer are part of continuation chain, we will be removed and previous
        and next anonymous block will be merged automatically.
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::previousInPreOrder): add an argument to previousInOrder
        - stayWithin.
        (WebCore):
        * rendering/RenderObject.h:
        (RenderObject):

2012-06-15  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Move FileSystem frame management from frontend to backend
        https://bugs.webkit.org/show_bug.cgi?id=89190

        Reviewed by Vsevolod Vlasov.

        Test: http/tests/inspector/filesystem/read-directory.html

        * inspector/Inspector.json:
        * inspector/InspectorFileSystemAgent.cpp:
        (WebCore::InspectorFileSystemAgent::readDirectory):
        (WebCore::InspectorFileSystemAgent::InspectorFileSystemAgent):
        (WebCore::InspectorFileSystemAgent::scriptExecutionContextForOrigin):
        (WebCore):
        * inspector/InspectorFileSystemAgent.h:
        (WebCore):
        (InspectorFileSystemAgent):

2012-06-15  Alexander Pavlov  <apavlov@chromium.org>

        Unreviewed, build fix after r120469.

        * css/CSSPropertySourceData.h:
        (WebCore):

2012-06-15  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Add FileSystemRequestManager and FileSystemDispatcher
        https://bugs.webkit.org/show_bug.cgi?id=89191

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/FileSystemModel.js:
        (WebInspector.FileSystemModel):
        (WebInspector.FileSystemRequestManager):
        (WebInspector.FileSystemRequestManager.prototoype._requestId):
        (WebInspector.FileSystemRequestManager.prototoype.readDirectory):
        (WebInspector.FileSystemRequestManager.prototoype._didReadDirectory):
        (WebInspector.FileSystemDispatcher):
        (WebInspector.FileSystemDispatcher.prototype.gotFileSystemRoot):
        (WebInspector.FileSystemDispatcher.prototype.didReadDirectory):

2012-06-15  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: extension's Resource.getContent always returns original revision.
        https://bugs.webkit.org/show_bug.cgi?id=89219

        Reviewed by Vsevolod Vlasov.

        Fetching proper content from the UISourceCode now.

        * inspector/front-end/DebuggerResourceBinding.js:
        (WebInspector.DebuggerResourceBinding.prototype.canSetContent):
        (WebInspector.DebuggerResourceBinding.prototype.setContent):
        * inspector/front-end/DebuggerScriptMapping.js:
        (WebInspector.DebuggerScriptMapping.prototype._debuggerReset):
        * inspector/front-end/ExtensionServer.js:
        (WebInspector.ExtensionServer.prototype._onGetResourceContent):
        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource):
        * inspector/front-end/Resource.js:
        (WebInspector.Resource.prototype.isHidden):
        (WebInspector.Resource.prototype.uiSourceCode):
        (WebInspector.Resource.prototype.setUISourceCode):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode):

2012-06-15  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: CRASH when DebuggerAgent.setBreakpoint was called twice for the same location.
        https://bugs.webkit.org/show_bug.cgi?id=89225

        Reviewed by Pavel Feldman.

        * inspector/InspectorDebuggerAgent.cpp:
        (WebCore::InspectorDebuggerAgent::setBreakpoint):

2012-06-08  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: CSSParser::parseSheet() should provide ready-to-use source data
        https://bugs.webkit.org/show_bug.cgi?id=88646

        Reviewed by Antti Koivisto.

        This change moves the post-processing step from InspectorStyleSheet into CSSParser, so that
        CSSParser::parseSheet() will return a ready-to-use list with style rule source code data.
        Also, universal data structures are introduced, which allow for the full rule source data tree building.

        No new tests, as this is a refactoring.

        * css/CSSParser.cpp: Use universal data structures, which can be used for building the full rule tree.
        (WebCore::CSSParser::CSSParser):
        (WebCore::CSSParser::setupParser):
        (WebCore::CSSParser::parseSheet): Return ready-to-use source code data entries rather than an intermediate structure.
        (WebCore::CSSParser::parseDeclaration):
        (WebCore::CSSParser::addNewRuleToSourceTree):
        (WebCore):
        (WebCore::CSSParser::popRuleData):
        (WebCore::CSSParser::createStyleRule):
        (WebCore::CSSParser::fixUnparsedPropertyRanges): Moved in from InspectorStyleSheet.
        (WebCore::CSSParser::markSelectorListStart):
        (WebCore::CSSParser::markSelectorListEnd):
        (WebCore::CSSParser::markRuleBodyStart):
        (WebCore::CSSParser::markRuleBodyEnd):
        (WebCore::CSSParser::markPropertyEnd):
        * css/CSSParser.h:
        (CSSParser):
        (WebCore::CSSParser::resetPropertyRange): Renamed.
        (WebCore::CSSParser::isExtractingSourceData): A convenience check.
        * css/CSSPropertySourceData.h: Introduce the RuleSourceDataList typedef.
        (WebCore):
        * inspector/InspectorStyleSheet.cpp: Make use of RuleSourceDataList and follow the CSSParser::parse*() API changes.
        (ParsedStyleSheet::sourceData):
        (ParsedStyleSheet):
        (ParsedStyleSheet::setSourceData):
        (WebCore::InspectorStyleSheet::ensureSourceData): Remove source data postprocessing, follow the new parseSheet() API.
        * inspector/InspectorStyleSheet.h:
        (WebCore::InspectorCSSId::InspectorCSSId): Drive-by: uninitialized field fix.
        (WebCore::InspectorStyleProperty::InspectorStyleProperty): Ditto.
        (InspectorStyleSheet):

2012-06-15  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: Long frame urls make all/errors/warnings/logs buttons inaccessible.
        https://bugs.webkit.org/show_bug.cgi?id=88907

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/inspector.css:
        (#console-context):

2012-06-15  Florin Malita  <fmalita@chromium.org>

        Specular light filters produce dark results
        https://bugs.webkit.org/show_bug.cgi?id=89116

        Reviewed by Dirk Schulze.

        Tests: svg/filters/feSpecularLight-premultiplied-expected.svg
               svg/filters/feSpecularLight-premultiplied.svg

        Per spec (http://www.w3.org/TR/SVG/filters.html#feSpecularLightingElement),
        light filters should operate on pre-multiplied RGBA. Currently, the results
        are stored in the unmultiplied buffer but the alpha channel is calculated
        for premultiplied values (which causes a darkening of the result upon the
        subsequent unmultiplied->premultiplied conversion). This patch updates
        FELighting to generate premultiplied results.

        * platform/graphics/filters/FELighting.cpp:
        (WebCore::FELighting::platformApplySoftware):

2012-06-15  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: incorrect filtering of async timeline events
        https://bugs.webkit.org/show_bug.cgi?id=89214

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineOverviewPane.prototype.accept):

2012-06-15  Stephen Chenney  <schenney@chromium.org>

        SVG Composite of Offset filters incorrectly clips
        https://bugs.webkit.org/show_bug.cgi?id=77660

        Reviewed by Dirk Schulze.

        Prior to this patch, when a group of filtered objects was used as input to another filter,
        the filter only operated on the stroke boundary of the group, and hence excluded the results
        of filtering elements within the group, or extraneously included regions clipped from the
        elements in the group.

        This patch modifies the strokeBoundingBox of SVG container elements to
        be the union of the repaint rects for the children. This modifes the
        results returned for sizing filters and for absoluteRects, which will cause
        inline layout around the group to factor in the resources applied to
        the group's children.

        The relevant spec entry is this, in Section 3.7 of the SVG 1.1 spec: "...the result must be
        as though the paint operations had been applied to an intermediate canvas initialized to
        transparent black, of a size determined by the rules given in Filter Effects then filtered
        by the processes defined in Filter Effects." In this case the "paint operations" is implied
        to include the result of applying "paint" but no resources to the group, which in turn would
        have resources applied to the children of the group. This makes the most sense, as the current,
        incorrect behavior makes it extremely diffucult to understand the actions of filters on
        groups of filtered content.

        Tests: svg/filters/container-with-filters-expected.svg
               svg/filters/container-with-filters.svg

        * rendering/svg/RenderSVGContainer.cpp:
        (WebCore::RenderSVGContainer::updateCachedBoundaries):
        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::updateCachedBoundaries):
        * rendering/svg/SVGRenderSupport.cpp:
        (WebCore::SVGRenderSupport::computeContainerBoundingBoxes):

2012-06-15  David Kilzer  <ddkilzer@apple.com>

        Sort ENABLE(INSPECTOR) section of WebCore.exp.in

        * WebCore.exp.in: Sort ENABLE(INSPECTOR) symbols.

2012-06-15  David Kilzer  <ddkilzer@apple.com>

        Remove duplicate symbol from WebCore.exp.in

        * WebCore.exp.in: Remove duplicate symbol for:
        WebCore::Range::textQuads(WTF::Vector<WebCore::FloatQuad, 0ul>&, bool, WebCore::Range::RangeInFixedPosition*) const

2012-06-15  Florin Malita  <fmalita@chromium.org>

        [Chromium] Unreviewed debug build fix for r120457

        * platform/graphics/chromium/cc/CCDrawQuad.cpp:
        (WebCore::CCDrawQuad::toYUVVideoDrawQuad):

2012-06-15  'Pavel Feldman'  <pfeldman@chromium.org>

        Not reviewed: remove redundant Mac-specific style rule from inspector front-end.

        * inspector/front-end/helpScreen.css:

2012-06-15  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: fix help close button appearance on Mac
        https://bugs.webkit.org/show_bug.cgi?id=89208

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/helpScreen.css:
        (.help-close-button):
        (body.platform-mac .help-close-button):
        (body.platform-mac .help-window-main .tabbed-pane-header-contents):

2012-06-11  Dana Jansens  <danakj@chromium.org>

        [chromium] Create a CCYUVVideoDrawQuad and remove the now-unused generic CCVideoDrawQuad
        https://bugs.webkit.org/show_bug.cgi?id=88828

        Reviewed by Adrienne Walker.

        The CCVideoDrawQuad is now only used for YUV video, so we remove the
        class and replace it with CCYUVVideoDrawQuad. This class holds what is
        needed to draw a YUV video frame.

        No new tests, no change in behaviour.

        * WebCore.gypi:
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawQuad):
        (WebCore::LayerRendererChromium::drawYUVVideoQuad):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (WebCore):
        (LayerRendererChromium):
        * platform/graphics/chromium/cc/CCDrawQuad.cpp:
        (WebCore::CCDrawQuad::toYUVVideoDrawQuad):
        * platform/graphics/chromium/cc/CCDrawQuad.h:
        (WebCore):
        (CCDrawQuad):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCYUVVideoDrawQuad.cpp: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.cpp.
        (WebCore):
        (WebCore::CCYUVVideoDrawQuad::create):
        (WebCore::CCYUVVideoDrawQuad::CCYUVVideoDrawQuad):
        * platform/graphics/chromium/cc/CCYUVVideoDrawQuad.h: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.h.
        (WebCore):
        (CCYUVVideoDrawQuad):
        (WebCore::CCYUVVideoDrawQuad::yPlane):
        (WebCore::CCYUVVideoDrawQuad::uPlane):
        (WebCore::CCYUVVideoDrawQuad::vPlane):

2012-06-15  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: CRASH: getProfile is crashing for unknown profiles.
        https://bugs.webkit.org/show_bug.cgi?id=89202

        agents' functions have to set a value to errorString if it can't assign values to the mandatory out arguments.

        Reviewed by Pavel Feldman.

        Test: inspector/profiler/heap-snapshot-get-profile-crash.html

        * inspector/InspectorProfilerAgent.cpp:
        (WebCore::InspectorProfilerAgent::getProfile):

2012-06-15  Max Feil  <mfeil@rim.com>

        [BlackBerry] media volume slider in wrong position (master_38 regression)
        https://bugs.webkit.org/show_bug.cgi?id=89165

        Reviewed by Antonio Gomes.

        Due to upstream simplification of the volume slider (webkit.org
        bug 82150) it now appears in the wrong location below the
        media controls. The programmatic controls sizing we do in
        RenderThemeBlackBerry.cpp relies on absolute positioning of the
        volume slider container, so the best way to fix this is to set
        the bottom offset.

        No new tests since this is a regression fix. BlackBerry media
        controls are manually tested.

        * platform/blackberry/RenderThemeBlackBerry.cpp:
        (WebCore::RenderThemeBlackBerry::adjustMediaControlStyle):

2012-06-15  'Pavel Feldman'  <pfeldman@chromium.org>

        Not reviewed: remove garbage line from inspector view in docked-to-right mode.

        * inspector/front-end/inspectorCommon.css:
        (body.docked.dock-to-right.docked):
        (body.docked.dock-to-right.inactive):

2012-06-15  Zoltan Arvai  <zarvai@inf.u-szeged.hu>

        Buildfix for !ENABLE(BLOB) platforms after r120433.
        https://bugs.webkit.org/show_bug.cgi?id=78648

        Reviewed by Csaba Osztrogonác.

        * fileapi/ThreadableBlobRegistry.cpp:
        (WebCore::ThreadableBlobRegistry::registerBlobURL):

2012-06-15  Sami Kyostila  <skyostil@chromium.org>

        [chromium] Allow scrolling non-root layers in the compositor thread
        https://bugs.webkit.org/show_bug.cgi?id=73350

        Reviewed by James Robinson.

        This patch enables scrolling child layers in the compositor thread.
        Scroll deltas are accumulated for each scrolled CCLayerImpl and
        synchronized to the main thread.

        If a layer has no room to scroll in a given direction, one of its
        ancestor layers is scrolled instead if possible.

        Layer hit testing code by Shawn Singh.

        Added new unit tests to verify layer scrolling behavior:

            CCLayerTreeHostCommonTest.verifySubtreeSearch
            CCLayerTreeHostImplTest.clearRootRenderSurfaceAndScroll
            CCLayerTreeHostImplTest.inhibitScrollAndPageScaleUpdatesWhileAnimatingPageScale
            CCLayerTreeHostImplTest.inhibitScrollAndPageScaleUpdatesWhilePinchZooming
            CCLayerTreeHostImplTest.replaceTreeWhileScrolling
            CCLayerTreeHostImplTest.scrollBeforeRedraw
            CCLayerTreeHostImplTest.scrollBlockedByContentLayer
            CCLayerTreeHostImplTest.scrollChildAndChangePageScaleOnMainThread
            CCLayerTreeHostImplTest.scrollChildBeyondLimit
            CCLayerTreeHostImplTest.scrollChildCallsCommitAndRedraw
            CCLayerTreeHostImplTest.scrollEventBubbling
            CCLayerTreeHostImplTest.scrollMissesBackfacingChild
            CCLayerTreeHostImplTest.scrollMissesChild
            CCLayerTreeHostImplTest.scrollNonCompositedRoot
            CCLayerTreeHostImplTest.scrollRootAndChangePageScaleOnImplThread
            CCLayerTreeHostImplTest.scrollRootAndChangePageScaleOnMainThread
            CCLayerTreeHostImplTest.scrollRootIgnored
            CCLayerTreeHostImplTest.scrollWithoutRootLayer
            CCLayerTreeHostTestScrollChildLayer
            WebCompositorInputHandlerImplTest.gestureScrollOnMainThread

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::LayerChromium):
        (WebCore::LayerChromium::setMaxScrollPosition):
        (WebCore):
        (WebCore::LayerChromium::scrollBy):
        (WebCore::LayerChromium::pushPropertiesTo):
        * platform/graphics/chromium/LayerChromium.h:
        (WebCore):
        (LayerChromiumScrollDelegate):
        (WebCore::LayerChromiumScrollDelegate::~LayerChromiumScrollDelegate):
        (LayerChromium):
        (WebCore::LayerChromium::maxScrollPosition):
        (WebCore::LayerChromium::scrollable):
        (WebCore::LayerChromium::setLayerScrollDelegate):
        * platform/graphics/chromium/cc/CCInputHandler.h:
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::tryScroll):
        (WebCore):
        (WebCore::sortLayers):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
        (WebCore::findFirstScrollableLayer):
        (WebCore):
        (WebCore::CCLayerTreeHost::applyScrollAndScale):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.h:
        (CCLayerTreeHostCommon):
        (WebCore):
        (WebCore::CCLayerTreeHostCommon::findLayerInSubtree):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::~CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::startPageScaleAnimation):
        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::CCLayerTreeHostImpl::contentSize):
        (WebCore::CCLayerTreeHostImpl::prepareToDraw):
        (WebCore::CCLayerTreeHostImpl::drawLayers):
        (WebCore::findRootScrollLayer):
        (WebCore):
        (WebCore::findScrollLayerForContentLayer):
        (WebCore::CCLayerTreeHostImpl::setRootLayer):
        (WebCore::CCLayerTreeHostImpl::detachLayerTree):
        (WebCore::adjustScrollsForPageScaleChange):
        (WebCore::applyPageScaleDeltaToScrollLayers):
        (WebCore::CCLayerTreeHostImpl::setPageScaleFactorAndLimits):
        (WebCore::CCLayerTreeHostImpl::setPageScaleDelta):
        (WebCore::CCLayerTreeHostImpl::updateMaxScrollPosition):
        (WebCore::CCLayerTreeHostImpl::ensureRenderSurfaceLayerList):
        (WebCore::CCLayerTreeHostImpl::clearCurrentlyScrollingLayer):
        (WebCore::CCLayerTreeHostImpl::scrollBegin):
        (WebCore::CCLayerTreeHostImpl::scrollBy):
        (WebCore::CCLayerTreeHostImpl::scrollEnd):
        (WebCore::CCLayerTreeHostImpl::pinchGestureUpdate):
        (WebCore::CCLayerTreeHostImpl::computePinchZoomDeltas):
        (WebCore::CCLayerTreeHostImpl::makeScrollAndScaleSet):
        (WebCore::collectScrollDeltas):
        (WebCore::CCLayerTreeHostImpl::processScrollDeltas):
        (WebCore::CCLayerTreeHostImpl::animatePageScale):
        (WebCore::CCLayerTreeHostImpl::animateLayers):
        (WebCore::CCLayerTreeHostImpl::clearRenderSurfaces):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (FrameData):
        (CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::rootScrollLayer):

2012-06-15  Jian Li  <jianli@chromium.org>

        FileReader is dysfunctional in documents with "null" origin string
        https://bugs.webkit.org/show_bug.cgi?id=78648

        Reviewed by Adam Barth.

        The fix is to keep in-memory map from blob URL to SecurityOrigin for the
        unique origin case.

        Test: fast/files/file-reader-file-url.html

        * fileapi/Blob.cpp:
        (WebCore::Blob::Blob):
        * fileapi/BlobURL.cpp:
        (WebCore::BlobURL::getOrigin): Return the origin string embeded in the blob URL.
        (WebCore):
        (WebCore::BlobURL::createBlobURL): Remove the check for null origin string since it is handled now.
        * fileapi/BlobURL.h:
        (BlobURL):
        * fileapi/FileReaderLoader.cpp:
        (WebCore::FileReaderLoader::start):
        * fileapi/ThreadableBlobRegistry.cpp:
        (WebCore):
        (WebCore::originMap): Thread-specific in-memory map from the blob URL to the origin.
        (WebCore::ThreadableBlobRegistry::registerBlobURL): Add the map from the blob URL to the origin.
        (WebCore::ThreadableBlobRegistry::unregisterBlobURL): Remove the map for the unregistered blob URL.
        (WebCore::ThreadableBlobRegistry::getCachedOrigin): Retrieve the origin associated with the blob URL.
        * fileapi/ThreadableBlobRegistry.h:
        (WebCore):
        (ThreadableBlobRegistry):
        * html/DOMURL.cpp:
        (WebCore::DOMURL::createObjectURL):
        * page/SecurityOrigin.cpp:
        (WebCore::getCachedOrigin): Return the cached origin for the blob URL if it exists.
        (WebCore):
        (WebCore::SecurityOrigin::create): Call getCachedOrigin to get the cached origin first.

2012-06-15  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Move search field related code to RenderSearchField from RenderTextControlSingleLine
        https://bugs.webkit.org/show_bug.cgi?id=88980

        Reviewed by Kent Tamura.

        This patch moves search field related methods in RenderTextControlSingleLine
        to new class RenderSearchField and changes related classes to use
        RenderSearchField.

        No new tests. This patch doesn't change behavior.

        * CMakeLists.txt: Added new file RenderSearchField.cpp
        * GNUmakefile.list.am: Added new file RenderSearchField.cpp and RenderSearchField.h
        * Target.pri: ditto
        * WebCore.gypi: ditto
        * WebCore.vcproj/WebCore.vcproj: ditto
        * WebCore.xcodeproj/project.pbxproj: ditto
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::subtreeHasChanged): Call RenderSearchField::updateCancelButtonVisibility
        (WebCore::HTMLInputElement::addSearchResult): Changed to call InputType::addSearchResult.
        * html/InputType.cpp:
        (WebCore::InputType::addSearchResult): Added.
        * html/InputType.h:
        * html/SearchInputType.cpp:
        (WebCore::SearchInputType::addSearchResult): Moved from HTMLInputElement.
        (WebCore::SearchInputType::createRenderer): Added to create RenderSearchField.
        * html/SearchInputType.h:
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler): Use RenderSearchField instead of RenderTextControlSingleLine.
        * loader/FormSubmission.cpp:
        (WebCore::FormSubmission::create): Got rid isSearchField() guard for addSearchResult().
        * rendering/RenderSearchField.cpp:
        (WebCore::RenderSearchField::RenderSearchField): Renamed to RenderSearchField.
        (WebCore::RenderSearchField::~RenderSearchField): ditto
        (WebCore::RenderSearchField::resultsButtonElement): ditto
        (WebCore::RenderSearchField::cancelButtonElement): ditto
        (WebCore::RenderSearchField::addSearchResult): ditto
        (WebCore::RenderSearchField::showPopup): ditto
        (WebCore::RenderSearchField::hidePopup): ditto
        (WebCore::RenderSearchField::computeControlHeight): Added.
        (WebCore::RenderSearchField::updateFromElement): Moved search field related code from RenderTextControlSingleLine.
        (WebCore::RenderSearchField::updateCancelButtonVisibility): Renamed to RenderSearchField.
        (WebCore::RenderSearchField::visibilityForCancelButton): ditto
        (WebCore::RenderSearchField::autosaveName): ditto
        (WebCore::RenderSearchField::valueChanged): ditto
        (WebCore::RenderSearchField::itemText): ditto
        (WebCore::RenderSearchField::itemLabel): ditto
        (WebCore::RenderSearchField::itemIcon): ditto
        (WebCore::RenderSearchField::itemIsEnabled): ditto
        (WebCore::RenderSearchField::itemStyle): ditto
        (WebCore::RenderSearchField::menuStyle): ditto
        (WebCore::RenderSearchField::clientInsetLeft): ditto
        (WebCore::RenderSearchField::clientInsetRight): ditto
        (WebCore::RenderSearchField::clientPaddingLeft): ditto
        (WebCore::RenderSearchField::clientPaddingRight): ditto
        (WebCore::RenderSearchField::listSize): ditto
        (WebCore::RenderSearchField::selectedIndex): ditto
        (WebCore::RenderSearchField::popupDidHide): ditto
        (WebCore::RenderSearchField::itemIsSeparator): ditto
        (WebCore::RenderSearchField::itemIsLabel): ditto
        (WebCore::RenderSearchField::itemIsSelected): ditto
        (WebCore::RenderSearchField::setTextFromItem): ditto
        (WebCore::RenderSearchField::fontSelector): ditto
        (WebCore::RenderSearchField::hostWindow): ditto
        (WebCore::RenderSearchField::createScrollbar): ditto
        (WebCore::RenderSearchField::computeHeightLimit): Added.
        (WebCore::RenderSearchField::centerContainerIfNeeded): Added.
        * rendering/RenderSearchField.h:
        (WebCore::toRenderSearchField): Added.
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine): Remove search field related code.
        (WebCore::RenderTextControlSingleLine::~RenderTextControlSingleLine): ditto.
        (WebCore::RenderTextControlSingleLine::computeHeightLimit): Added.
        (WebCore::RenderTextControlSingleLine::layout): Use new methods for removing isSearchField.
        (WebCore::RenderTextControlSingleLine::computeControlHeight): Added.
        (WebCore::RenderTextControlSingleLine::updateFromElement): Remove search field related code.
        * rendering/RenderTextControlSingleLine.h:
        (RenderTextControlSingleLine):
        (WebCore::RenderTextControlSingleLine::centerContainerIfNeeded): Added.
        (WebCore::RenderTextControlSingleLine::containerElement): Exposed for RenderSearchField.
        (WebCore::RenderTextControlSingleLine::innerBlockElement): Exposed for RenderSearchField.
        * rendering/RenderingAllInOne.cpp: Added RenderSearchField.cpp

2012-06-15  Hironori Bono  <hbono@chromium.org>

        Allow platforms to choose whether to remove markers on editing
        https://bugs.webkit.org/show_bug.cgi?id=88838

        Reviewed by Hajime Morita.

        This change allows platforms to choose whether to remove markers on a word being
        edited. WebKit does not remove markers when we move a selection to a markered
        word on platforms that shouldEraseMarkersAfterChangeSelection returns false.
        On such platforms, WebKit expects to set WTF_USE_MARKER_REMOVAL_UPON_EDITING to
        1 so Editor::updateMarkersForWordsAffectedByEditing can remove markers. This
        change also checks the return value of shouldEraseMarkersAfterChangeSelection so
        platform can choose it. This change also adds grammar markers so it can also
        remove grammar markers.

        Test: editing/spelling/grammar-edit-word.html

        * editing/Editor.cpp:
        (WebCore::Editor::updateMarkersForWordsAffectedByEditing):

2012-06-15  Andrey Adaikin  <aandrey@chromium.org>

        Web Inspector: [WebGL] Simple implementation of the InjectedWebGLScriptSource to support capturing WebGL calls for a frame
        https://bugs.webkit.org/show_bug.cgi?id=89088

        Simple experimental implementation of the InjectedWebGLScriptSource.js that allows to wrap
        a WebGL context and capture names (for now) of the WebGL function calls for a frame being captured.

        Reviewed by Vsevolod Vlasov.

        * inspector/InjectedWebGLScriptSource.js:
        (.):

2012-06-15  Silvia Pfeiffer  <silviapf@chromium.org>

        Add fullscreen button to Chrome video controls for video.
        https://bugs.webkit.org/show_bug.cgi?id=88818

        Reviewed by Eric Carlson.

        No new tests, final patch will contain the rebaselined tests.

        The Chrome video controls are receiving a visual update.
        This patch includes a fullscreen button for video elements and the rendering of the controls
        in fullscreen including hiding them after 2 seconds when the mouse is out of the controls
        and not moved.

        * css/fullscreen.css:
        (video:-webkit-full-screen, audio:-webkit-full-screen):
        Add audio to the default fullscreen styling rules.
        * css/mediaControlsChromium.css:
        (video:-webkit-full-page-media::-webkit-media-controls-panel):
        Align controls to the bottom of the fullscreen page.
        (audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button):
        Include styling for the fullscreen button.
        * html/shadow/MediaControlRootElementChromium.cpp:
        (WebCore):
        Add a constant for when to hide the controls in fullscreen.
        (WebCore::MediaControlRootElementChromium::MediaControlRootElementChromium):
        Add member fields for fullscreen button, hiding timer and tracking of whether we are in fullscreen.
        (WebCore::MediaControlRootElementChromium::create):
        Add fullscreen button element to the visual layout.
        (WebCore::MediaControlRootElementChromium::setMediaController):
        Add fullscreen button element to the media controller.
        (WebCore::MediaControlRootElementChromium::reset):
        Show the fullscreen button if the controller supports fullscreen.
        (WebCore::MediaControlRootElementChromium::playbackStarted):
        Start the timer to hide the controls in fullscreen.
        (WebCore::MediaControlRootElementChromium::playbackStopped):
        Don't hide the controls when the video is paused in fullscreen.
        (WebCore::MediaControlRootElementChromium::reportedError):
        Hide the fullscreen button when we hit an error.
        (WebCore::MediaControlRootElementChromium::defaultEventHandler):
        Add logic for mouse events in fullscreen to start/stop the hiding timer.
        (WebCore::MediaControlRootElementChromium::startHideFullscreenControlsTimer):
        Start the fullscreen hiding timer.
        (WebCore::MediaControlRootElementChromium::hideFullscreenControlsTimerFired):
        Timer fired: hide the video controls in fullscreen.
        (WebCore::MediaControlRootElementChromium::stopHideFullscreenControlsTimer):
        Reset the fullscreen hiding timer.
        (WebCore::MediaControlRootElementChromium::enteredFullscreen):
        Add logic to enter fullscreen.
        (WebCore::MediaControlRootElementChromium::exitedFullscreen):
        Add logic to exit fullscreen.
        * html/shadow/MediaControlRootElementChromium.h:
        (MediaControlRootElementChromium):
        Add declaration of member functions and fields for fullscreen.
        * rendering/RenderMediaControlsChromium.cpp:
        (WebCore::paintMediaFullscreenButton):
        Use the new image for the fullscreen button.
        * rendering/RenderThemeChromiumMac.h:
        (RenderThemeChromiumMac):
        Declare the fullscreen painting function for Chrome Mac.
        * rendering/RenderThemeChromiumMac.mm:
        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
        Hook up the fullscreen paining function for Chrome Mac.
        * rendering/RenderThemeChromiumSkia.cpp:
        (WebCore::RenderThemeChromiumSkia::paintMediaFullscreenButton):
        Hook up the fullscreen paining function for Chrome Skia.
        * rendering/RenderThemeChromiumSkia.h:
        (RenderThemeChromiumSkia):
        Declare the fullscreen painting function for Chrome Skia.

2012-06-14  Kent Tamura  <tkent@chromium.org>

        Unreviewed, rolling out r110340.
        http://trac.webkit.org/changeset/110340
        https://bugs.webkit.org/show_bug.cgi?id=88749

        r110340 added a broken implementation of
        HTMLSelectElement::selectedOptions. This roll out removes
        HTMLSelectElement::selectedOptions.

        * html/CollectionType.h:
        * html/HTMLCollection.cpp:
        (WebCore::HTMLCollection::shouldIncludeChildren):
        (WebCore::HTMLCollection::isAcceptableElement):
        * html/HTMLSelectElement.cpp:
        * html/HTMLSelectElement.h:
        (HTMLSelectElement):
        * html/HTMLSelectElement.idl:

2012-06-14  Keishi Hattori  <keishi@webkit.org>

        Add color property to input type=range
        https://bugs.webkit.org/show_bug.cgi?id=89067

        Reviewed by Kent Tamura.

        Adding color property to input type=range in preparation for
        supporting tick marks for datalist for input type=range.

        * css/html.css:
        (input[type="range"]): Setting color property for input type=range.
        This will set the color of tick mark when we implement <datalist>.
        * css/themeChromiumLinux.css:
        (input[type=range]):
        * css/themeWin.css:
        (input[type="range"]):

2012-06-14  Kent Tamura  <tkent@chromium.org>

        Support file extensions in HTMLInputElement::accept
        https://bugs.webkit.org/show_bug.cgi?id=88298

        Reviewed by Hajime Morita.

        The WHATWG specification added file extensions supoprt for
        HTMLInputElement::accept recently.

        In the WebCore FileChooser interface, we rejected invalid MIME type
        strings in HTMLInputElement::acceptMIMETypes(), and platform file
        choosers don't expect that it containts file extensions. So, this patch
        introduces additional member "acceptFileExtensions" to
        FileChooserSettings, and it contains only file extensions specified by
        an accept attribute.

        * html/FileInputType.cpp:
        Sets HTMLInputElement::acceptFileExtensions() to
        FileChooserSettings::acceptFileExtensions.
        (WebCore::FileInputType::handleDOMActivateEvent):
        (WebCore::FileInputType::receiveDropForDirectoryUpload):
        * html/HTMLInputElement.cpp:
        (WebCore::isValidFileExtension): Added.
        (WebCore::parseAcceptAttribute):
        Common part for acceptMIMETyps() and acceptFileExtensions().
        (WebCore::HTMLInputElement::acceptMIMETypes):
        Uses parseAcceptAttribute() with isValidMIMEType().
        (WebCore::HTMLInputElement::acceptFileExtensions):
        Added. Uses parseAcceptAttribute() with isValidFileExtension().
        * html/HTMLInputElement.h:
        (HTMLInputElement): Add acceptFileExtensions().
        * platform/FileChooser.h:
        (FileChooserSettings): Add acceptFileExtensions and acceptTypes().
        * platform/FileChooser.cpp:
        (WebCore::FileChooserSettings::acceptTypes): Added.

2012-06-14  James Robinson  <jamesr@chromium.org>

        [chromium] Remove unused CanvasLayerChromium.h/cpp from the tree
        https://bugs.webkit.org/show_bug.cgi?id=89152

        Reviewed by Adrienne Walker.

        These files have been unused and not in the build system since r119769

        * platform/graphics/chromium/CanvasLayerChromium.cpp: Removed.
        * platform/graphics/chromium/CanvasLayerChromium.h: Removed.

2012-06-14  Emil A Eklund  <eae@chromium.org>

        Cast paddings to int in RenderTableCell
        https://bugs.webkit.org/show_bug.cgi?id=88918

        Reviewed by Levi Weintraub.

        Table layout uses integers throughout yet the TableCell paddingLeft/
        Right/Top/Bottom methods returns LayoutUnits. This causes inconsistent
        rounding as some call sites cast the numbers to ints before doing
        computation and others do computation before casting.

        By changing the methods to always cast the padding values to int we
        ensure consistent padding calculations.

        Ideally we'd change the type of the return value for the methods but as
        they are overriden that would likely cause more confusion.

        Test: fast/sub-pixel/table-cells-with-padding-do-not-wrap.html

        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::paddingTop):
        (WebCore::RenderTableCell::paddingBottom):
        (WebCore::RenderTableCell::paddingLeft):
        (WebCore::RenderTableCell::paddingRight):
        (WebCore::RenderTableCell::paddingBefore):
        (WebCore::RenderTableCell::paddingAfter):

2012-06-14  Kenichi Ishibashi  <bashi@chromium.org>

        [Chromium] Check the result of FontCache::getCachedFontPlatformData()
        https://bugs.webkit.org/show_bug.cgi?id=89141

        Reviewed by Kent Tamura.

        The value of FontCache::getCachedFontPlatformData() could be invalid,
        so we should check the value before use it.

        No new tests. No new functionality.

        * platform/graphics/skia/FontCacheSkia.cpp:
        (WebCore::FontCache::getFontDataForCharacters):

2012-06-14  Gregg Tavares  <gman@google.com>

        Fix framebuffer completeness test
        https://bugs.webkit.org/show_bug.cgi?id=89127

        Reviewed by Kenneth Russell.

        No new tests just fixing failing tests.

        * html/canvas/WebGLFramebuffer.cpp:
        (WebCore::WebGLFramebuffer::initializeAttachments):
        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore):
        (WebCore::WebGLRenderingContext::isTexInternalFormatColorBufferCombinationValid):
        * platform/graphics/GraphicsContext3D.cpp:
        (WebCore::GraphicsContext3D::getClearBitsByAttachmentType):
        (WebCore):
        (WebCore::GraphicsContext3D::getClearBitsByFormat):
        (WebCore::GraphicsContext3D::getChannelBitsByFormat):
        * platform/graphics/GraphicsContext3D.h:

2012-06-14  Adrienne Walker  <enne@google.com>

        [chromium] Make TiledLayerChromium robust to unexpected null tiles
        https://bugs.webkit.org/show_bug.cgi?id=89143

        Reviewed by James Robinson.

        Although there shouldn't ever be null tiles in the map, it appears to
        be occurring frequently enough to show up in crash reports. In the
        short term, be robust to this so the tiler doesn't crash. This should
        eventually be reverted.

        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::pushPropertiesTo):
        (WebCore::TiledLayerChromium::setLayerTreeHost):
        (WebCore::TiledLayerChromium::invalidateRect):
        (WebCore::TiledLayerChromium::updateTiles):
        (WebCore::TiledLayerChromium::resetUpdateState):

2012-06-14  Kent Tamura  <tkent@chromium.org>

        Validate form state strings in FormController::setStateForNewFormElements()
        https://bugs.webkit.org/show_bug.cgi?id=88768

        Reviewed by Hajime Morita.

        Reject invalid form state vectors. This state vectors are generated by
        WebKit itself. However it can be invalid because
        - Serialized state vectors can be corrupted
        - A future version of WebKit might change the format

        So we had better reject unexpected state vectors as possible.

        Test: fast/forms/state-restore-broken-state.html

        * WebCore.exp.in: Expose some symbols used by Internals.cpp.
        * html/FormController.cpp:
        (WebCore::isNotFormControlTypeCharacter): A helper for state validation.
        (WebCore::FormController::setStateForNewFormElements):
        Reject state vectors of which size is not a multiple of 3, or a type name is invalid.
        * testing/Internals.cpp:
        (WebCore::Internals::formControlStateOfPreviousHistoryItem):
        Returns a form state vector of the previous document.
        (WebCore::Internals::setFormControlStateOfPreviousHistoryItem):
        Sets a form state vector for the previous document.
        * testing/Internals.h: Declare new functions.
        * testing/Internals.idl: ditto.

2012-06-14  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120393.
        http://trac.webkit.org/changeset/120393
        https://bugs.webkit.org/show_bug.cgi?id=89163

        breaks cr-mac build (Requested by morrita on #webkit).

        * WebCore.gyp/WebCore.gyp:
        * platform/image-decoders/ImageDecoder.h:
        (ImageFrame):
        (ImageDecoder):
        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
        (turboSwizzled):
        (WebCore::JPEGImageReader::JPEGImageReader):
        (WebCore::JPEGImageReader::close):
        (WebCore::JPEGImageReader::decode):
        (JPEGImageReader):
        (WebCore::JPEGImageDecoder::outputScanlines):
        * platform/image-decoders/png/PNGImageDecoder.cpp:
        (WebCore::PNGImageReader::PNGImageReader):
        (WebCore::PNGImageReader::close):
        (WebCore::PNGImageReader::currentBufferSize):
        (PNGImageReader):
        (WebCore::PNGImageReader::decodingSizeOnly):
        (WebCore::PNGImageReader::interlaceBuffer):
        (WebCore::PNGImageReader::hasAlpha):
        (WebCore::PNGImageReader::setHasAlpha):
        (WebCore::PNGImageDecoder::headerAvailable):
        (WebCore::PNGImageDecoder::rowAvailable):
        * platform/image-decoders/skia/ImageDecoderSkia.cpp:
        (WebCore):
        (WebCore::resolveColorSpace):
        (WebCore::createColorSpace):
        (WebCore::ImageFrame::setColorProfile):
        (WebCore::ImageFrame::setStatus):

2012-06-14  Julien Chaffraix  <jchaffraix@webkit.org>

        RenderLayer subtrees without any self-painting layer shouldn't be walked during painting
        https://bugs.webkit.org/show_bug.cgi?id=88888

        Reviewed by Simon Fraser.

        Performance optimization, covered by existing tests.

        The gist of this change is to add a has-self-painting-layer-descendant flag (including an
        invalidation logic) that is used to avoid walking subtrees without any self-painting layer.

        On http://dglazkov.github.com/performance-tests/biggrid.html with a 100,000 rows
        by 100 columns table, it brings the paint time during scrolling from ~45ms to ~6ms
        on my machine. The test case is a pathologic example here but the optimization should
        apply in other cases.

        The new update logic piggy-backs on top of the existing updateVisibilityStatus() one that
        got repurposed and renamed as part of this change.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::RenderLayer):
        (WebCore::RenderLayer::addChild):
        (WebCore::RenderLayer::removeChild):
        (WebCore::RenderLayer::styleChanged):
        These functions were updated to dirty / set the new flag.

        (WebCore::RenderLayer::dirtyAncestorChainHasSelfPaintingLayerDescendantStatus):
        (WebCore::RenderLayer::setAncestorChainHasSelfPaintingLayerDescendant):
        Added those functions to handle setting / invalidating the new flag.

        (WebCore::RenderLayer::updateSelfPaintingLayerAfterStyleChange):
        Added this function to handle style update.

        (WebCore::RenderLayer::paintLayer):
        (WebCore::RenderLayer::paintLayerContentsAndReflection):
        (WebCore::RenderLayer::paintLayerContents):
        (WebCore::RenderLayer::paintList):
        Changed this logic to bail out if we have no self-painting descendants. This is what
        is giving the performance improvement. Also added some performance ASSERTs to ensure
        the methods are not called when they shouldn't.

        (WebCore::RenderLayer::updateDescendantDependentFlags):
        Renamed from updateVisibilityStatus to account for the new usage.

        (WebCore::RenderLayer::updateLayerPositions):
        (WebCore::RenderLayer::updateLayerPositionsAfterScroll):
        (WebCore::RenderLayer::collectLayers):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
        Updated after updateVisibilityStatus rename.

        * rendering/RenderLayer.h:
        (WebCore::RenderLayer::hasSelfPaintingLayerDescendant):
        Added the declaration of the new functions as well as the new flag and dirty bit.

2012-06-14  Tony Payne  <tpayne@chromium.org>

       [chromium] Add iccjpeg and qcms to chromium port
       https://bugs.webkit.org/show_bug.cgi?id=81974

       Reviewed by Adam Barth.

       Covered by existing layout tests which will be rebaselined.

       * WebCore.gyp/WebCore.gyp: Add qcms to the build.
       * platform/image-decoders/ImageDecoder.h:
       (WebCore::ImageDecoder::qcmsOutputDeviceProfile): Return an sRGB profile.
       On OSX, return the default RGB profile. Add FIXME to use the user's
       monitor profile and verify that profile for other platforms.

       * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
       (turboSwizzled): For libjpeg-turbo, JCS_EXT_BGRA and JCS_EXT_RGBA are the
       two known output color spaces for which the decoder uses a data swizzle.
       (colorSpaceHasAlpha): JPEG's have no alpha in the output color space. For
       libjpeg-turbo, alpha may be present in the swizzled output color space.

       (WebCore::JPEGImageReader::JPEGImageReader):
       (WebCore::JPEGImageReader::close):
       (WebCore::JPEGImageReader::decode): For QCMSLIB, create the color transform
       to use during decoding, and ensure we switch to inputing RGBA data to qcms
       even if the desired output data is BGRA: outputScanlines() sends BGRA data
       to the frame buffer following color correction if needed.
       (JPEGImageReader):
       (WebCore::JPEGImageReader::colorTransform): qcms color transform getter.
       (WebCore::JPEGImageReader::createColorTransform): Create color transform.
       Release the existing transform (if any) and assign to the color transform
       created from the color profile data.
       (WebCore::JPEGImageDecoder::outputScanlines): Minor style fix. Apply color
       transform to each decoded image row.

       * platform/image-decoders/png/PNGImageDecoder.cpp:
       (WebCore::PNGImageReader::PNGImageReader):
       (WebCore::PNGImageReader::close):
       (WebCore::PNGImageReader::currentBufferSize): Move this adjacent to other
       setters and getters.
       (WebCore::PNGImageReader::decodingSizeOnly): Ditto.
       (WebCore::PNGImageReader::setHasAlpha): Ditto.
       (WebCore::PNGImageReader::hasAlpha): Ditto.
       (WebCore::PNGImageReader::interlaceBuffer): Ditto.
       (WebCore::PNGImageReader::createRowBuffer): Creates a temporary row buffer,
       used when a color transform is applied to the decoded image pixels.
       (WebCore::PNGImageReader::rowBuffer): Return the temporary row buffer.
       (WebCore::PNGImageReader::colorTransform): qcms color transform getter.
       (WebCore::PNGImageReader::createColorTransform): Create color transform.
       Release the existing transform (if any) and assign to the color transform
       created from the color profile data.
       (WebCore::PNGImageDecoder::headerAvailable): For QCMSLIB, create the color
       transform to use for decoding. Clear m_colorProfile (not used anymore).
       (WebCore::PNGImageDecoder::rowAvailable): Create temporary row buffer if
       a color transform is needed for decoding. Apply color transform to each
       decoded image row.

       * platform/image-decoders/skia/ImageDecoderSkia.cpp:
       (WebCore::ImageFrame::setColorProfile): Old method of colorProfiles is no
       longer used. Add a FIXME to remove the old implementation.
       (WebCore::ImageFrame::setStatus): Remove old color correction code.

2012-06-14  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120384.
        http://trac.webkit.org/changeset/120384
        https://bugs.webkit.org/show_bug.cgi?id=89157

        breaks create-blob-url-from-data-url.html (Requested by
        morrita on #webkit).

        * fileapi/Blob.cpp:
        (WebCore::Blob::Blob):
        * fileapi/BlobURL.cpp:
        (WebCore::BlobURL::createBlobURL):
        * fileapi/BlobURL.h:
        (BlobURL):
        * fileapi/FileReaderLoader.cpp:
        (WebCore::FileReaderLoader::start):
        * fileapi/ThreadableBlobRegistry.cpp:
        (WebCore):
        (WebCore::ThreadableBlobRegistry::registerBlobURL):
        (WebCore::ThreadableBlobRegistry::unregisterBlobURL):
        * fileapi/ThreadableBlobRegistry.h:
        (WebCore):
        (ThreadableBlobRegistry):
        * html/DOMURL.cpp:
        (WebCore::DOMURL::createObjectURL):
        * page/SecurityOrigin.cpp:
        (WebCore::SecurityOrigin::create):

2012-06-14  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Copy RenderTextControlSingleLine.{cpp,h} to RenderSearchFiled.{cpp,h}
        https://bugs.webkit.org/show_bug.cgi?id=89155

        Reviewed by Kent Tamura.

        This patch copies RenderTextControlSingleLine.cpp and .h into RenderSearchField.cpp
        and .h with just "cp" code. New files aren't compiled until bug 88980.

        No new tests. This patch doesn't change behavior.

        * rendering/RenderSearchField.cpp: Added.
        (WebCore::RenderTextControlInnerBlock::positionForPoint):
        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
        (WebCore::RenderTextControlSingleLine::~RenderTextControlSingleLine):
        (WebCore::RenderTextControlSingleLine::containerElement):
        (WebCore::RenderTextControlSingleLine::innerBlockElement):
        (WebCore::RenderTextControlSingleLine::innerSpinButtonElement):
        (WebCore::RenderTextControlSingleLine::resultsButtonElement):
        (WebCore::RenderTextControlSingleLine::cancelButtonElement):
        (WebCore::RenderTextControlSingleLine::textBaseStyle):
        (WebCore::RenderTextControlSingleLine::addSearchResult):
        (WebCore::RenderTextControlSingleLine::showPopup):
        (WebCore::RenderTextControlSingleLine::hidePopup):
        (WebCore::RenderTextControlSingleLine::paint):
        (WebCore::RenderTextControlSingleLine::layout):
        (WebCore::RenderTextControlSingleLine::nodeAtPoint):
        (WebCore::RenderTextControlSingleLine::styleDidChange):
        (WebCore::RenderTextControlSingleLine::capsLockStateMayHaveChanged):
        (WebCore::RenderTextControlSingleLine::hasControlClip):
        (WebCore::RenderTextControlSingleLine::controlClipRect):
        (WebCore::RenderTextControlSingleLine::getAvgCharWidth):
        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
        (WebCore::RenderTextControlSingleLine::computeControlHeight):
        (WebCore::RenderTextControlSingleLine::updateFromElement):
        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
        (WebCore::RenderTextControlSingleLine::createInnerBlockStyle):
        (WebCore::RenderTextControlSingleLine::updateCancelButtonVisibility):
        (WebCore::RenderTextControlSingleLine::visibilityForCancelButton):
        (WebCore::RenderTextControlSingleLine::textShouldBeTruncated):
        (WebCore::RenderTextControlSingleLine::autosaveName):
        (WebCore::RenderTextControlSingleLine::valueChanged):
        (WebCore::RenderTextControlSingleLine::itemText):
        (WebCore::RenderTextControlSingleLine::itemLabel):
        (WebCore::RenderTextControlSingleLine::itemIcon):
        (WebCore::RenderTextControlSingleLine::itemIsEnabled):
        (WebCore::RenderTextControlSingleLine::itemStyle):
        (WebCore::RenderTextControlSingleLine::menuStyle):
        (WebCore::RenderTextControlSingleLine::clientInsetLeft):
        (WebCore::RenderTextControlSingleLine::clientInsetRight):
        (WebCore::RenderTextControlSingleLine::clientPaddingLeft):
        (WebCore::RenderTextControlSingleLine::clientPaddingRight):
        (WebCore::RenderTextControlSingleLine::listSize):
        (WebCore::RenderTextControlSingleLine::selectedIndex):
        (WebCore::RenderTextControlSingleLine::popupDidHide):
        (WebCore::RenderTextControlSingleLine::itemIsSeparator):
        (WebCore::RenderTextControlSingleLine::itemIsLabel):
        (WebCore::RenderTextControlSingleLine::itemIsSelected):
        (WebCore::RenderTextControlSingleLine::setTextFromItem):
        (WebCore::RenderTextControlSingleLine::fontSelector):
        (WebCore::RenderTextControlSingleLine::hostWindow):
        (WebCore::RenderTextControlSingleLine::autoscroll):
        (WebCore::RenderTextControlSingleLine::scrollWidth):
        (WebCore::RenderTextControlSingleLine::scrollHeight):
        (WebCore::RenderTextControlSingleLine::scrollLeft):
        (WebCore::RenderTextControlSingleLine::scrollTop):
        (WebCore::RenderTextControlSingleLine::setScrollLeft):
        (WebCore::RenderTextControlSingleLine::setScrollTop):
        (WebCore::RenderTextControlSingleLine::scroll):
        (WebCore::RenderTextControlSingleLine::logicalScroll):
        (WebCore::RenderTextControlSingleLine::createScrollbar):
        (WebCore::RenderTextControlSingleLine::inputElement):
        * rendering/RenderSearchField.h: Added.
        (RenderTextControlSingleLine):
        (WebCore::RenderTextControlSingleLine::popupIsVisible):
        (WebCore::RenderTextControlSingleLine::isTextField):
        (WebCore::toRenderTextControlSingleLine):
        (RenderTextControlInnerBlock):
        (WebCore::RenderTextControlInnerBlock::RenderTextControlInnerBlock):
        (WebCore::RenderTextControlInnerBlock::hasLineIfEmpty):

2012-06-14  Kent Tamura  <tkent@chromium.org>

        [JSC/V8] "DOMString[]" for function return values should not be null
        https://bugs.webkit.org/show_bug.cgi?id=89151

        Reviewed by Kentaro Hara.

        jsArray and v8Array are used for "DOMString[]", not "DOMString[]?". So
        we should not return JavaScript null object.

        No new tests. We have no plan to use this code in production code for
        now. It will be used for window.internals functions.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::jsArray): For null input, returns an empty array, not null.
        * bindings/v8/V8Binding.cpp:
        (WebCore::v8Array): Implement DOMStringList -> JavaScript array conversion.
        Like jsArray(), we don't return null object.
        * bindings/v8/V8Binding.h:
        (WebCore): Declare v8Array().

2012-06-14  Dale Curtis  <dalecurtis@chromium.org>

        Disable click/dbl-click on MediaDocument for Chromium. Fix layout test for all platforms.
        https://bugs.webkit.org/show_bug.cgi?id=89129

        As titled, click-to-pause and double-click-to-play behavior are unwanted on Chromium.  A
        long standing issue (~3 years) has been to disable this feature.

        Reviewed by Eric Carlson.

        Uses existing click/double-click test.

        * html/MediaDocument.cpp:
        (WebCore::MediaDocument::defaultEventHandler):

2012-06-14  Jian Li  <jianli@chromium.org>

        FileReader is dysfunctional in documents with "null" origin string
        https://bugs.webkit.org/show_bug.cgi?id=78648

        Reviewed by Adam Barth.

        The fix is to keep in-memory map from blob URL to SecurityOrigin for the
        unique origin case.

        Test: fast/files/file-reader-file-url.html

        * fileapi/Blob.cpp:
        (WebCore::Blob::Blob):
        * fileapi/BlobURL.cpp:
        (WebCore::BlobURL::getOrigin): Return the origin string embeded in the blob URL.
        (WebCore):
        (WebCore::BlobURL::createBlobURL): Remove the check for null origin string since it is handled now.
        * fileapi/BlobURL.h:
        (BlobURL):
        * fileapi/FileReaderLoader.cpp:
        (WebCore::FileReaderLoader::start):
        * fileapi/ThreadableBlobRegistry.cpp:
        (WebCore):
        (WebCore::originMap): Thread-specific in-memory map from the blob URL to the origin.
        (WebCore::ThreadableBlobRegistry::registerBlobURL): Add the map from the blob URL to the origin.
        (WebCore::ThreadableBlobRegistry::unregisterBlobURL): Remove the map for the unregistered blob URL.
        (WebCore::ThreadableBlobRegistry::cachedOrigin): Retrieve the origin associated with the blob URL.
        * fileapi/ThreadableBlobRegistry.h:
        (WebCore):
        (ThreadableBlobRegistry):
        * html/DOMURL.cpp:
        (WebCore::DOMURL::createObjectURL):
        * page/SecurityOrigin.cpp:
        (WebCore::cachedOrigin): Return the cached origin for the blob URL if it exists.
        (WebCore):
        (WebCore::SecurityOrigin::create): Call cachedOrigin to get the cached origin first.

2012-06-14  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>

        [CMAKE] Move JSDeprecatedPeerConnectionCustom.cpp from CMakeLists.txt to UseJSC.cmake
        https://bugs.webkit.org/show_bug.cgi?id=89015

        Reviewed by Antonio Gomes.

        Include JSDeprecatedPeerConnectionCustom.cpp in UseJSC.cmake
        instead of CMakeLists.txt.

        No change in functionality so no new tests.

        * CMakeLists.txt:
        * UseJSC.cmake:

2012-06-14  Xianzhu Wang  <wangxianzhu@chromium.org>

        [Chromium] Add setAutoHint() and setUseBitmaps() in WebFontRendering
        https://bugs.webkit.org/show_bug.cgi?id=89014

        Reviewed by James Robinson.

        No new tests because of no change of functionality.

        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp:
        (WebCore):
        (WebCore::FontPlatformData::setAutoHint):
        (WebCore::FontPlatformData::setUseBitmaps):
        (WebCore::FontPlatformData::setAntiAlias):
        (WebCore::FontPlatformData::setupPaint):
        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h:
        (FontPlatformData):

2012-06-14  Ryuan Choi  <ryuan.choi@samsung.com>

        [EFL] Move cursor related code from WidgetEfl to ewk_view and EflScreenUtilities.
        https://bugs.webkit.org/show_bug.cgi?id=88803

        Reviewed by Chang Shu.

        Because WebProcess can not control cursor,
        setCursor should be passed to ChromeClient like other ports.

        * platform/Widget.h:
        (Widget):
        * platform/efl/EflScreenUtilities.cpp:
        (WebCore::applyFallbackCursor): Moved from WidgetEfl.cpp.
        (WebCore):
        (WebCore::isUsingEcoreX): Moved from WidgetEfl.cpp.
        * platform/efl/EflScreenUtilities.h:
        (WebCore):
        * platform/efl/WidgetEfl.cpp: Removes cursor related codes.
        (WebCore::WidgetPrivate::WidgetPrivate):
        (WebCore::Widget::~Widget):
        (WebCore::Widget::setCursor): Redirect to HostWindow.
        (WebCore::Widget::setEvasObject):

2012-06-14  Ryosuke Niwa  <rniwa@webkit.org>

        Radio node lists do not get updated when inserted back into a document
        https://bugs.webkit.org/show_bug.cgi?id=88825

        Reviewed by Darin Adler.

        The bug was caused by RadioNodeList's m_node not being adjusted back to a document after
        it was removed from the document and inserted back. While we could be doing this adjustment again
        when the HTMLFormElement is inserted back into the document, this whole approach is fragile
        because adds a maintenance burden on root elements of RadioNodeList.

        Change the approach to the problem instead and detect when m_node is detached from the document.
        Now RadioNodeList and LabelsNodeList will always use its root element as m_node and
        DynamicSubtreeNodeList's node() will then determine whether it should use its document or not based
        on the flag (rootedAtDocument) passed by the constructor of the node list and m_node->inDocument().

        Also invalidate node lists rooted at the document level regardless where the DOM mutation took place.

        * dom/ClassNodeList.cpp:
        (WebCore::ClassNodeList::~ClassNodeList):
        * dom/Document.cpp:
        (WebCore::Document::registerDynamicSubtreeNodeList): Moved from Node.
        (WebCore::Document::unregisterDynamicSubtreeNodeList): Ditto.
        * dom/Document.h:
        (Document):
        * dom/DynamicNodeList.cpp:
        (WebCore::DynamicSubtreeNodeList::DynamicSubtreeNodeList): Takes DynamicNodeListRootType which tell us
        whether node() should return m_node's document by default or not.
        (WebCore::DynamicSubtreeNodeList::length): Refactor code to avoid node() multiple times.
        (WebCore::DynamicSubtreeNodeList::itemForwardsFromCurrent): Ditto.
        (WebCore::DynamicSubtreeNodeList::itemBackwardsFromCurrent): Ditto.
        (WebCore::DynamicNodeList::itemWithName): Ditto.
        * dom/DynamicNodeList.h:
        (WebCore::DynamicNodeList::DynamicNodeList):
        (WebCore::DynamicNodeList::node): Returns m_node->document() if m_node is still in the document and
        the node list was rooted at document.
        (WebCore::DynamicNodeList::Caches::Caches):
        (Caches):
        (DynamicNodeList):
        (DynamicSubtreeNodeList):
        * dom/NameNodeList.cpp:
        (WebCore::NameNodeList::~NameNodeList):
        * dom/Node.cpp:
        (WebCore):
        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged): Invalidate m_listsInvalidatedAtDocument
        at document instead of trying to invalidate it on every ancestor we traverse.
        (WebCore::Node::invalidateNodeListsCacheAfterChildrenChanged): Ditto.
        (WebCore::NodeListsNodeData::invalidateCachesForDocument): Extracted from
        invalidateCachesThatDependOnAttributes.
        (WebCore::NodeListsNodeData::invalidateCachesThatDependOnAttributes):
        (WebCore::Node::radioNodeList):
        * dom/Node.h:
        (Node):
        * dom/NodeRareData.h:
        (NodeListsNodeData):
        * dom/TagNodeList.cpp:
        (WebCore::TagNodeList::~TagNodeList):
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::removedFrom):
        * html/LabelsNodeList.cpp:
        (WebCore::LabelsNodeList::LabelsNodeList):
        * html/RadioNodeList.cpp:
        (WebCore::RadioNodeList::RadioNodeList): Takes Element* first since that's the order we use elsewhere.
        * html/RadioNodeList.h:
        (WebCore::RadioNodeList::create):
        (RadioNodeList):

2012-06-14  Tony Chang  <tony@chromium.org>

        Fix bit packing of StyleRareInheritedData on Windows
        https://bugs.webkit.org/show_bug.cgi?id=89112

        Reviewed by Ryosuke Niwa.

        On my machine (64 bit Chromium Linux), StyleRareInheritedData is 168 bytes.

        No new tests, added a compile assert to ensure correctness going forward.

        * rendering/style/StyleRareInheritedData.cpp:
        (SameSizeAsStyleRareInheritedData):
        (WebCore):
        * rendering/style/StyleRareInheritedData.h:
        (StyleRareInheritedData):

2012-06-14  Andreas Kling  <kling@webkit.org>

        Crashes below IconDatabase::performPendingRetainAndReleaseOperations().
        <http://webkit.org/b/88846>
        <rdar://problem/11629106>

        Reviewed by Brady Eidson.

        Put isolatedCopy() strings in the retain/release operation queues to make sure it's safe
        for secondary threads to ref/deref them in performPendingRetainAndReleaseOperations().
        Also added assertions as appropriate.

        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::retainIconForPageURL):
        (WebCore::IconDatabase::releaseIconForPageURL):
        (WebCore::IconDatabase::performPendingRetainAndReleaseOperations):

2012-06-14  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] For hit testing in CCLayerTreeHostCommon, need to check that the transform is invertible before inverting it.
        https://bugs.webkit.org/show_bug.cgi?id=89049

        Reviewed by Adrienne Walker.

        Unit test added to CCLayerTreeHostCommonTest.cpp:
          CCLayerTreeHostCommonTest.verifyHitTestingForUninvertibleTransform

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::pointHitsRect):

2012-06-14  Maciej Stachowiak  <mjs@apple.com>

        The whole world rebuilds when you touch any IDL file
        https://bugs.webkit.org/show_bug.cgi?id=89125

        Reviewed by Sam Weinig.

        No new tests; this only changes the build system and its dependencies.

        * bindings/scripts/preprocess-idls.pl: Optionally generate the
        dependencies for supplemental IDLs in Makefile format.
        * DerivedSources.make: Use the new feature of preprocess-idls.pl to generate
        the correct IDL dependencies created by Supplemental, then include it. This way,
        we avoid the situation where every bindings file implicitly depends on every single
        IDL file in the project.

2012-06-14  Ian Vollick  <vollick@chromium.org>

        [chromium] Certain settings in CCSettings could be global
        https://bugs.webkit.org/show_bug.cgi?id=88384

        Reviewed by James Robinson.

        No new tests. No new functionality.

        * WebCore.gypi:
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (Settings):
        * platform/graphics/chromium/ContentLayerChromium.cpp:
        (WebCore::ContentLayerChromium::createTextureUpdaterIfNeeded):
        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::addAnimation):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::initialize):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::updateTileSizeAndTilingOption):
        * platform/graphics/chromium/cc/CCDebugRectHistory.cpp:
        (WebCore::CCDebugRectHistory::enabled):
        (WebCore::CCDebugRectHistory::saveDebugRectsForCurrentFrame):
        * platform/graphics/chromium/cc/CCDebugRectHistory.h:
        (WebCore):
        (CCDebugRectHistory):
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
        (WebCore::CCHeadsUpDisplay::enabled):
        (WebCore::CCHeadsUpDisplay::showPlatformLayerTree):
        (WebCore::CCHeadsUpDisplay::showDebugRects):
        (WebCore::CCHeadsUpDisplay::draw):
        (WebCore::CCHeadsUpDisplay::drawHudContents):
        (WebCore::CCHeadsUpDisplay::drawDebugRects):
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.h:
        (WebCore):
        (CCHeadsUpDisplay):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::create):
        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::animateLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::CCLayerTreeSettings::CCLayerTreeSettings):
        (CCLayerTreeSettings):
        (CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::settings):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::create):
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
        (WebCore::CCLayerTreeHostImpl::animateLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (CCRendererClient):
        (WebCore::CCRenderer::settings):
        * platform/graphics/chromium/cc/CCSettings.cpp: Added.
        (WebCore):
        (WebCore::CCSettings::perTilePaintingEnabled):
        (WebCore::CCSettings::setPerTilePaintingEnabled):
        (WebCore::CCSettings::partialSwapEnabled):
        (WebCore::CCSettings::setPartialSwapEnabled):
        (WebCore::CCSettings::acceleratedAnimationEnabled):
        (WebCore::CCSettings::setAcceleratedAnimationEnabled):
        (WebCore::CCSettings::reset):
        * platform/graphics/chromium/cc/CCSettings.h: Added.
        (WebCore):
        (CCSettings):
        * testing/InternalSettings.cpp:
        * testing/InternalSettings.h:
        (InternalSettings):

2012-06-14  Alejandro G. Castro  <alex@igalia.com>

        [GTK] Add TextureMapper ImageBuffer support as a fallback from the hardware accelerated path
        https://bugs.webkit.org/show_bug.cgi?id=73634

        Remove the TextureMapperCairo classes, now we use
        TextureMapperImageBuffer to implement the software fallback. Add
        implementation for the 3D transformations in the 2D cairo graphics
        context.

        Reviewed by Martin Robinson.

        This patch adds a new implementation of already tested cases.

        * GNUmakefile.list.am:
        * platform/graphics/cairo/GraphicsContext3DPrivate.cpp:
        (WebCore):
        (WebCore::GraphicsContext3DPrivate::paintToTextureMapper):
        Required for compilation when WebGL is enabled.
        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::get3DTransform):
        (WebCore::GraphicsContext::concat3DTransform):
        (WebCore::GraphicsContext::set3DTransform):
        * platform/graphics/cairo/TextureMapperCairo.cpp: Removed.
        * platform/graphics/cairo/TextureMapperCairo.h: Removed.
        * platform/graphics/texmap/TextureMapperImageBuffer.cpp:
        (WebCore::BitmapTextureImageBuffer::updateContents):

2012-06-14  Jia Pu  <jpu@apple.com>

        Mark text with text alternative with blue underline.
        https://bugs.webkit.org/show_bug.cgi?id=83047

        Reviewed by Enrica Casucci.

        Tests: platform/mac/editing/input/edit-dictated-text-with-alternative.html
               platform/mac/editing/input/insert-dictated-text.html

        This patch implements visual indication on dictated text with alternatives, and provides UI
        to show alternative text on OS X. Majority of the changes is for generalizing existing AlternativeTextController
        class to handle dictation alternatives. The two new classes, AlternativeTextUIController and
        TextAlternativeWithRange, are used by both WebKit and WK2. So WebCore seems to be the natural place
        for them.

        * WebCore.exp.in:
        * WebCore.xcodeproj/project.pbxproj:
        * editing/AlternativeTextController.cpp: Expanded exising class interface to support dictation alternatives.
        (DictationAlternativeDetails): Marker detail class for dictation alternative mark.
        (WebCore::DictationAlternativeDetails::create):
        (WebCore::DictationAlternativeDetails::dictationContext):
        (WebCore::DictationAlternativeDetails::DictationAlternativeDetails):
        (WebCore::markerTypesForAppliedDictationAlternative):
        (WebCore::AlternativeTextController::applyAlternativeTextToRange): Generalized existing applyAlternativeTextToRange() to handle dictation alternatives.
        (WebCore::AlternativeTextController::timerFired): Expanded existing code to handle dictation alternatives.
        (WebCore::AlternativeTextController::handleAlternativeTextUIResult): Expanded existing code to handle dictation alternatives.
        (WebCore::AlternativeTextController::respondToChangedSelection): Moved part of the function into respondToMarkerAtEndOfWord() to improve readability.
        (WebCore::AlternativeTextController::shouldStartTimerFor):
        (WebCore::AlternativeTextController::respondToMarkerAtEndOfWord):
        (WebCore::AlternativeTextController::markerDescriptionForAppliedAlternativeText):
        (WebCore::AlternativeTextController::removeDictationAlternativesForMarker):
        (WebCore::AlternativeTextController::dictationAlternativesForMarker):
        (WebCore::AlternativeTextController::applyDictationAlternative):
        * editing/AlternativeTextController.h:
        * editing/Editor.cpp:
        (WebCore::Editor::notifyComponentsOnChangedSelection): Renamed existing respondToChangedSelection() function to avoid naming collision.
        (WebCore::Editor::appliedEditing):
        (WebCore::Editor::unappliedEditing):
        (WebCore::Editor::reappliedEditing):
        (WebCore::Editor::updateMarkersForWordsAffectedByEditing):
        (WebCore::Editor::changeSelectionAfterCommand):
        (WebCore::Editor::respondToChangedSelection):
        (WebCore::Editor::dictationAlternativesForMarker):
        (WebCore::Editor::applyDictationAlternativelternative):
        * editing/Editor.h:
        * editing/FrameSelection.h:
        * editing/mac/AlternativeTextUIController.h: Added. WK1 and WK2 use this class to keep track of text alternatives objects.
        (AlternativeTextUIController):
        (WebCore::AlternativeTextUIController::AlternativeTextUIController):
        (AlernativeTextContextController):
        (WebCore::AlternativeTextUIController::AlernativeTextContextController::AlernativeTextContextController):
        * editing/mac/AlternativeTextUIController.mm: Added.
        (WebCore::AlternativeTextUIController::AlernativeTextContextController::addAlternatives):
        (WebCore::AlternativeTextUIController::AlernativeTextContextController::alternativesForContext):
        (WebCore::AlternativeTextUIController::AlernativeTextContextController::removeAlternativesForContext):
        (WebCore::AlternativeTextUIController::AlernativeTextContextController::clear):
        (WebCore::AlternativeTextUIController::addAlternatives):
        (WebCore::AlternativeTextUIController::alternativesForContext):
        (WebCore::AlternativeTextUIController::clear):
        (WebCore::AlternativeTextUIController::showAlternatives):
        (WebCore::AlternativeTextUIController::handleAcceptedAlternative):
        (WebCore::AlternativeTextUIController::dismissAlternatives):
        (WebCore::AlternativeTextUIController::removeAlternatives):
        * editing/mac/TextAlternativeWithRange.h: Added.  A simple struct to make it easier to pass around a pair of text alternatives object and range.
        * editing/mac/TextAlternativeWithRange.mm: Added.
        (WebCore::TextAlternativeWithRange::TextAlternativeWithRange):
        (WebCore::collectDictationTextAlternatives):
        * page/AlternativeTextClient.h:
        * page/ContextMenuController.cpp: Added code to show alternative dictated text in context menu.
        (WebCore::ContextMenuController::contextMenuItemSelected):
        (WebCore::ContextMenuController::populate):
        (WebCore::ContextMenuController::checkOrEnableIfNeeded):
        * platform/ContextMenuItem.h:
        * rendering/HitTestResult.cpp:
        (WebCore::HitTestResult::dictationAlternatives):
        * rendering/HitTestResult.h:
        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::paintDocumentMarker):

2012-06-14  Emil A Eklund  <eae@chromium.org>

        Change RenderTableSection::calcRowLogicalHeight to round rather than floor height
        https://bugs.webkit.org/show_bug.cgi?id=88813

        Reviewed by Julien Chaffraix.

        Change RenderTableSection::calcRowLogicalHeight to round the
        logicalHeight instead of flooring it. This matches our rounding logic
        elsewhere and results in table rows better matching the expected height.

        Test: fast/sub-pixel/table-rows-have-stable-height.html

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::calcRowLogicalHeight):

2012-06-14  Andrey Adaikin  <aandrey@chromium.org>

        Web Inspector: Remove devtoolsInjectedScript hidden property
        https://bugs.webkit.org/show_bug.cgi?id=89087

        We use the devtoolsInjectedScript hidden property to reference a InjectedScript object
        for a given ScriptState, but we also have the same reference in the InjectedScriptManager's
        hash maps. Just use the hash maps and remove the hidden property from the global object.

        Reviewed by Pavel Feldman.

        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::visitChildren):
        * bindings/js/JSDOMGlobalObject.h:
        (JSDOMGlobalObject):
        * bindings/js/JSInjectedScriptManager.cpp:
        (WebCore::InjectedScriptManager::createInjectedScript):
        * bindings/v8/V8HiddenPropertyName.h:
        (WebCore):
        * bindings/v8/custom/V8InjectedScriptManager.cpp:
        * inspector/InjectedScriptManager.cpp:
        (WebCore::InjectedScriptManager::discardInjectedScripts):
        (WebCore::InjectedScriptManager::discardInjectedScriptsFor):
        (WebCore::InjectedScriptManager::injectedScriptFor):
        (WebCore):
        (WebCore::InjectedScriptManager::wrapWebGLRenderingContextForInstrumentation):
        * inspector/InjectedScriptManager.h:
        (InjectedScriptManager):

2012-06-14  James Robinson  <jamesr@chromium.org>

        [chromium] Move opaque rectangle tracking logic out of compositor core
        https://bugs.webkit.org/show_bug.cgi?id=89031

        Reviewed by Adrienne Walker.

        This moves the opaque paint tracking logic from the compositor (specifically CanvasLayerTextureUpdater) out to a
        dedicated class used by GraphicsLayerChromium for GraphicsContext-painted content. This changes the interface
        exposed by the compositor to pass a SkCanvas and let the user fill in an opaque rect if needed. Callers that are
        using GraphicsContext to paint can instantiate a PlatformContextSkia / GraphicsContext around this SkCanvas if
        they choose to, or use some other strategy, or not fill it in at all. This avoids creating extra wrapper classes
        if the eventual caller is going to use the underlying SkCanvas anyway (such as WebContentLayer) and breaks the
        dependency from the compositor code on GraphicsContext / PlatformContextSkia.

        OpaqueRectTrackingContentLayerDelegate is a helper class that wraps a ContentLayerDelegate implementation with
        PlatformContextSkia's opaque region tracking logic.

        * WebCore.gypi:
        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
        (WebCore::BitmapCanvasLayerTextureUpdater::BitmapCanvasLayerTextureUpdater):
        (WebCore::BitmapCanvasLayerTextureUpdater::prepareToUpdate):
        (WebCore::BitmapCanvasLayerTextureUpdater::updateTextureRect):
        (WebCore::BitmapCanvasLayerTextureUpdater::setOpaque):
        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h:
        (WebCore):
        (BitmapCanvasLayerTextureUpdater):
        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
        (WebCore::CanvasLayerTextureUpdater::paintContents):
        * platform/graphics/chromium/CanvasLayerTextureUpdater.h:
        (WebCore):
        (CanvasLayerTextureUpdater):
        * platform/graphics/chromium/ContentLayerChromium.cpp:
        (WebCore::ContentLayerPainter::paint):
        * platform/graphics/chromium/ContentLayerChromium.h:
        (ContentLayerDelegate):
        (WebCore):
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
        (WebCore::GraphicsLayerChromium::paint):
        * platform/graphics/chromium/GraphicsLayerChromium.h:
        (GraphicsLayerChromium):
        * platform/graphics/chromium/LayerPainterChromium.h:
        (LayerPainterChromium):
        * platform/graphics/chromium/LinkHighlight.cpp:
        (WebCore::LinkHighlight::paintContents):
        * platform/graphics/chromium/LinkHighlight.h:
        (LinkHighlight):
        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp: Added.
        (WebCore):
        (WebCore::OpaqueRectTrackingContentLayerDelegate::OpaqueRectTrackingContentLayerDelegate):
        (WebCore::OpaqueRectTrackingContentLayerDelegate::~OpaqueRectTrackingContentLayerDelegate):
        (WebCore::OpaqueRectTrackingContentLayerDelegate::paintContents):
        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h: Added.
        (WebCore):
        (GraphicsContextPainter):
        (WebCore::GraphicsContextPainter::~GraphicsContextPainter):
        (OpaqueRectTrackingContentLayerDelegate):
        (WebCore::OpaqueRectTrackingContentLayerDelegate::setOpaque):
        * platform/graphics/chromium/PlatformCanvas.cpp:
        (WebCore::PlatformCanvas::Painter::Painter):
        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::SkPictureCanvasLayerTextureUpdater::prepareToUpdate):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore):

2012-06-14  Justin Novosad  <junov@chromium.org>

        [Chromium] webkitImageSmoothingEnabled canvas property does not work on redraw
        https://bugs.webkit.org/show_bug.cgi?id=89018

        Reviewed by Stephen White.

        Test: fast/canvas/canvas-imageSmoothingEnabled-repaint.html

        When an accelerated canvas layer prepares its texture for the
        compositor, it must send a notification to skia to invalidate texture
        proprties that are cached by skia, since the compositor may modify them.
        The use case this fixes is when a canvas to canvas copy is performed
        with webkitImageSmoothingEnabled=false on the destination canvas.
        The backing texture of the source canvas will be set to "nearest"
        filtering by skia in order to perform the copy.  Then, the compositor
        sets filtering back to "linear" when the source canvas is drawn.
        Skia is designed to only update GL attributes when required, so errors
        occur when the skia-side GL state cache is out of sync.

        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
        (WebCore::Canvas2DLayerBridge::prepareTexture):

2012-06-14  Jon Honeycutt  <jhoneycutt@apple.com>

        Fix some failing tests on Windows by resetting the page scale factor
        between tests.
        https://bugs.webkit.org/show_bug.cgi?id=89078

        Reviewed by Dirk Pranke.

        * testing/Internals.cpp:
        (WebCore::Internals::reset):
        Set the scale factor to 1.0.

2012-06-14  Sami Kyostila  <skyostil@chromium.org>

        Register fixed position layers with ScrollingCoordinator
        https://bugs.webkit.org/show_bug.cgi?id=78864

        Reviewed by James Robinson.

        This patch makes ScrollingCoordinator aware of page elements that are
        either fixed positioned directly or through their ancestors and that
        also have their own composited backing layers. This allows the
        ScrollingCoordinator implementation to potentially enable fast
        scrolling even if there are fixed elements on the page, because the
        compositor can automatically reposition the fixed element layers after
        scrolling.

        Since fixed position layers need to be explicitly supported by the
        ScrollingCoordinator implementation, we add a new
        supportsFixedPositionLayers() query for checking this.

        * page/FrameView.cpp:
        (WebCore::FrameView::FrameView):
        (WebCore::FrameView::useSlowRepaints):
        (WebCore::FrameView::addFixedObject):
        (WebCore::FrameView::removeFixedObject):
        * page/FrameView.h:
        (FrameView):
        (WebCore::FrameView::fixedObjects):
        (WebCore::FrameView::hasFixedObjects):
        * page/scrolling/ScrollingCoordinator.cpp:
        (WebCore::ScrollingCoordinator::frameViewFixedObjectsDidChange):
        (WebCore::ScrollingCoordinator::hasNonLayerFixedObjects):
        (WebCore):
        (WebCore::ScrollingCoordinator::updateShouldUpdateScrollLayerPositionOnMainThread):
        (WebCore::ScrollingCoordinator::setLayerIsContainerForFixedPosition):
        (WebCore::ScrollingCoordinator::setLayerIsFixedToContainerLayer):
        * page/scrolling/ScrollingCoordinator.h:
        (ScrollingCoordinator):
        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        (WebCore::ScrollingCoordinator::setLayerIsContainerForFixedPosition):
        (WebCore):
        (WebCore::ScrollingCoordinator::setLayerIsFixedToContainerLayer):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::willBeDestroyed):
        (WebCore::RenderBox::styleWillChange):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateBacking):
        (WebCore):
        (WebCore::RenderLayerCompositor::fixedPositionedByAncestor):
        (WebCore::RenderLayerCompositor::ensureRootLayer):
        * rendering/RenderLayerCompositor.h:

2012-06-14  Alexey Proskuryakov  <ap@apple.com>

        [CFNetwork] XMLHttpRequest incorrectly returns cached responses even when there is a Vary header field
        https://bugs.webkit.org/show_bug.cgi?id=88925

        Reviewed by David Kilzer.

        Test: http/tests/cache/xhr-vary-header.html

        * platform/network/cf/ResourceHandleCFNet.cpp: (WebCore::willCacheResponse): Don't
        cache the response at all if there is a Vary header field. CFNetwork won't look at
        it if we allowed the response cached.

        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::createNSURLConnection): [NSURLResponse copy] is mutable
        in practice, but we should be nice, and use -mutableCopy.
        (-[WebCoreResourceHandleAsDelegate connection:willCacheResponse:]): Same fix as in
        CFNet code.

2012-06-13  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: use CSS gradients instead of images for timeline bars, checkboxes & bullets
        https://bugs.webkit.org/show_bug.cgi?id=89024

        Reviewed by Pavel Feldman.

        This brings a bunch of UI changes to the way Timeline bars and related controls are rendered:

        - introduce new color palette for categories;
        - replace images used to render timeline bars, list bullets and categories checkboxes with CSS gradients;
        - "flatten" timeline bars
        - make square list bullets, sharpen corners for lower pane bars;
        - make links on the list sidebar grey
        - add more space between categories checkboxes, make labels lighter.

        * WebCore.gypi: Remove old images, add tickMark.png.
        * inspector/front-end/Images/timelineBarBlue.png: Removed.
        * inspector/front-end/Images/timelineBarDarkGreen.png: Removed.
        * inspector/front-end/Images/timelineBarGray.png: Removed.
        * inspector/front-end/Images/timelineBarGreen.png: Removed.
        * inspector/front-end/Images/timelineBarLightPurple.png: Removed.
        * inspector/front-end/Images/timelineBarOrange.png: Removed.
        * inspector/front-end/Images/timelineBarPurple.png: Removed.
        * inspector/front-end/Images/timelineBarRed.png: Removed.
        * inspector/front-end/Images/timelineBarYellow.png: Removed.
        * inspector/front-end/Images/timelineCheckmarks.png: Removed.
        * inspector/front-end/Images/timelineDots.png: Removed.
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype.wasShown): 
        (WebInspector.TimelinePanel.prototype._closeRecordDetails): Fixed trailing spaces;
        (WebInspector.TimelinePanel.prototype._injectCategoryStyles): Inject generated styles for categories, if necessary.
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.categories):
        (WebInspector.TimelinePresentationModel.createFillStyle):
        (WebInspector.TimelinePresentationModel.createStyleRuleForCategory):
        * inspector/front-end/WebKit.qrc: Remove old images, add tickMark.png
        * inspector/front-end/inspector.css:
        (.sidebar-tree-section):
        * inspector/front-end/timelinePanel.css:
        (#timeline-container .webkit-html-resource-link):
        (.timeline-category-statusbar-item):
        (.timeline-category-statusbar-item .timeline-category-checkbox):
        (.timeline-category-statusbar-item .timeline-category-checkbox:checked::before):
        (.timeline-tree-item):
        (.timeline-tree-item .timeline-tree-icon):
        (.timeline-graph-bar):
        (.timeline-graph-bar.with-children):
        (.timeline-graph-bar.cpu):
        (.timeline-aggregated-category):
        * inspector/front-end/utilities.js:
        (Object.values): Return an array of object field's values.

2012-06-14  Silvia Pfeiffer  <silviapf@chromium.org>

        Change mute button and volume slider behaviour for new Chromium video controls.
        https://bugs.webkit.org/show_bug.cgi?id=88743

        Reviewed by Eric Carlson.

        No new tests, final patch will contain the rebaselined tests.

        The Chrome video controls are receiving a visual update. This patch makes the mute button and
        the volume slider interact with each other. When the user mutes the video through clicking the
        mute button, the volume slider animates to 0% volume. Upon unmute, the previous volume level
        is restored. Further, when the user drags the volume slider thumb or clicks on the slider and
        the video is muted, the video unmutes and sets the volume to the user's chosen level.

        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
        Add a member field to the volume slider to allow user interaction to unmute the video.
        (WebCore::MediaControlVolumeSliderElement::defaultEventHandler):
        Add the logic to unmute the video if the m_clearMutedOnUserInteraction member field is true.
        (WebCore::MediaControlVolumeSliderElement::setClearMutedOnUserInteraction):
        Add a member function to change the value of the m_clearMutedOnUserInteraction member field.
        * html/shadow/MediaControlElements.h:
        (MediaControlVolumeSliderElement):
        Add the setClearMutedOnUserInteraction member function and the m_clearMutedOnUserInteraction member field.
        * html/shadow/MediaControlRootElementChromium.cpp:
        (WebCore::MediaControlRootElementChromium::create):
        Activate unmute on user interaction on the Chromium video volume slider.
        (WebCore::MediaControlRootElementChromium::changedMute):
        Add logic to set volume slider to 0 when muted and reset to volume when unmuted.
        * rendering/RenderMediaControlsChromium.cpp:
        (WebCore::paintMediaVolumeSlider):
        Add logic to paint the volume slider active area as 0 when muted.

2012-06-14  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Breakpoints should not be set when UISourceCode content is diverged from VM version of the script.
        https://bugs.webkit.org/show_bug.cgi?id=89109

        Reviewed by Pavel Feldman.

        * inspector/front-end/BreakpointManager.js:
        (WebInspector.BreakpointManager.Breakpoint.prototype._updateBreakpoint):
        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource.prototype.isDivergedFromVM):
        (WebInspector.JavaScriptSource.prototype.workingCopyCommitted):

2012-06-14  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: DebuggerModel should support setting breakpoints without script by sourceURL only.
        https://bugs.webkit.org/show_bug.cgi?id=88988

        Reviewed by Pavel Feldman.

        This change allows setting all saved breakpoints in debugger model by url before the site
        with corresponding scripts was loaded (allows breaking in onload handler on first load).
        This change also simplifies implementation of snippets debugging.

        * inspector/front-end/BreakpointManager.js:
        * inspector/front-end/DebuggerModel.js:
        (WebInspector.DebuggerModel.prototype.setBreakpointByScriptLocation):

2012-06-14  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: refactor settings screen to move user agent and experiments out of general tab.
        https://bugs.webkit.org/show_bug.cgi?id=89101

        Reviewed by Vsevolod Vlasov.

        See image attached to the bug.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/SettingsScreen.js:
        (WebInspector.SettingsScreen.prototype.selectTab):
        (WebInspector.SettingsScreen.prototype._tabSelected):
        (WebInspector.SettingsScreen.prototype.set wasShown):
        (WebInspector.SettingsScreen.prototype.willHide):
        (WebInspector.SettingsTab):
        (WebInspector.SettingsTab.prototype._appendSection):
        (WebInspector.SettingsTab.prototype._createCustomSetting):
        (WebInspector.GenericSettingsTab):
        (WebInspector.GenericSettingsTab.prototype._showPaintRectsChanged):
        (WebInspector.GenericSettingsTab.prototype.get _updateScriptDisabledCheckbox):
        (WebInspector.GenericSettingsTab.prototype._javaScriptDisabledChanged):
        (WebInspector.UserAgentSettingsTab):
        (WebInspector.UserAgentSettingsTab.prototype._createUserAgentSelectRowElement.get const):
        (WebInspector.UserAgentSettingsTab.prototype._createUserAgentSelectRowElement.textDoubleClicked):
        (WebInspector.UserAgentSettingsTab.prototype._createUserAgentSelectRowElement.textChanged):
        (WebInspector.UserAgentSettingsTab.prototype._createUserAgentSelectRowElement.set checkboxClicked):
        (WebInspector.UserAgentSettingsTab.prototype._createDeviceMetricsElement):
        (WebInspector.ExperimentsSettingsTab):
        (WebInspector.ExperimentsSettingsTab.prototype._createExperimentsWarningSubsection):
        (WebInspector.ExperimentsSettingsTab.prototype._createExperimentCheckbox.listener):
        (WebInspector.ExperimentsSettingsTab.prototype._createExperimentCheckbox):
        * inspector/front-end/ShortcutsScreen.js:
        * inspector/front-end/TabbedPane.js:
        (WebInspector.TabbedPane.prototype.get headerContentsElement):
        * inspector/front-end/helpScreen.css:
        (.settings-tab.help-container):
        (.settings-tab .help-block):
        (.help-content fieldset):
        (#settings-screen .tabbed-pane-header-tabs):
        (#settings-screen .tabbed-pane-header-tab):

2012-06-13  Mark Hahnenberg  <mhahnenberg@apple.com>

        Worker tear-down can re-enter JSC during GC finalization pt. 2
        https://bugs.webkit.org/show_bug.cgi?id=88601

        Reviewed by David Levin.

        No new tests. Current regression tests are sufficient.

        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::WorkerMessagingProxy):
        (WebCore::WorkerMessagingProxy::workerObjectDestroyed): We clear the m_workerObject here because 
        we don't want anybody else trying to send messages to the Worker now that it has been destroyed.
        We also queue the asynchronous task for the various other cleanup that still needs to be done. 
        This allows us to avoid the problem of re-entrant JS code execution during GC.
        (WebCore):
        (WebCore::WorkerMessagingProxy::workerObjectDestroyedInternal): Here we set m_mayBeDestroyed to true.
        This is the point after which deleting the WorkerMessagingProxy in workerContextDestroyedInternal()
        is okay. It could happen during this function call if the worker thread has been shutdown already, or 
        it could be called later after we shut down the worker thread.
        (WebCore::WorkerMessagingProxy::workerContextDestroyedInternal): We check m_mayBeDestroyed here 
        instead of checking m_workerObject. This change effectively orthogonalizes the roles that m_workerObject 
        was filling. Since we were eagerly clearing m_workerObject, but we wanted to asynchronously call 
        workerObjectDestroyed(), we needed to make sure we didn't accidentally try to delete the WorkerMessagingProxy
        twice (once from destroying the Worker and once from destroying the WorkerContext). This boolean field 
        should fix that issue--we set it lazily like we wanted to do without being in danger of causing use-after-free
        issues with m_workerObject.
        * workers/WorkerMessagingProxy.h: Added the new field and function.
        (WorkerMessagingProxy):

2012-06-14  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Selector list start position is not extracted for style rules inside @media rules
        https://bugs.webkit.org/show_bug.cgi?id=89094

        Reviewed by Pavel Feldman.

        Selector list start is now marked inside the "ruleset" rule rather than separately, before its invocation(s).

        * css/CSSGrammar.y:

2012-06-14  Eric Penner  <epenner@google.com>

        [chromium] Fix race condition where animations start, finish and are deleted on the composite thread, all before the start even arrives on the main thread.
        https://bugs.webkit.org/show_bug.cgi?id=88439

        Reviewed by James Robinson.

        Scheduling behavior covered by existing tests.

        * platform/graphics/chromium/cc/CCActiveAnimation.cpp:
        (WebCore::CCActiveAnimation::isFinishedAt):
        * platform/graphics/chromium/cc/CCActiveAnimation.h:
        (WebCore::CCActiveAnimation::isFinished):
        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
        (WebCore::CCLayerAnimationController::suspendAnimations):
        (WebCore::CCLayerAnimationController::pushAnimationUpdatesTo):
        (WebCore::CCLayerAnimationController::animate):
        (WebCore::CCLayerAnimationController::hasActiveAnimation):
        (WebCore):
        (WebCore::CCLayerAnimationController::markAnimationsForDeletion):
        (WebCore::CCLayerAnimationController::purgeAnimationsMarkedForDeletion):
        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
        (CCLayerAnimationController):

2012-06-14  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: ConsoleView.evaluateUsingTextPrompt should evaluate without command line API.
        https://bugs.webkit.org/show_bug.cgi?id=89096

        Reviewed by Pavel Feldman.

        * inspector/front-end/ConsoleView.js:

2012-06-14  Silvia Pfeiffer  <silviapf@chromium.org>

        Update the time display of the new Chromium media controls.
        https://bugs.webkit.org/show_bug.cgi?id=88724

        Reviewed by Eric Carlson.

        No new tests, final patch will contain the rebaselined tests.

        The Chrome video controls are receiving a visual update. This patch changes
        the format of the time digits that are displayed. They are different for media
        files of different duration. For non-autoplaying videos, the duration is shown
        before playback is started.

        * css/mediaControlsChromium.css:
        (audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display):
        Format the new duration display the same as the current time display.
        * html/shadow/MediaControlRootElementChromium.cpp:
        (WebCore::MediaControlRootElementChromium::MediaControlRootElementChromium):
        Add a member field for the duration display.
        (WebCore::MediaControlRootElementChromium::create):
        Add an element for the duration display and initially hide the current time display.
        (WebCore::MediaControlRootElementChromium::setMediaController):
        Add the duration display to the controller.
        (WebCore::MediaControlRootElementChromium::reset):
        Add reset functionality for the duration display.
        (WebCore::MediaControlRootElementChromium::playbackStarted):
        Show the current time display and hide the duration display upon playback start.
        (WebCore::MediaControlRootElementChromium::updateTimeDisplay):
        Show the current time display and hide the duration display when current time is non-zero.
        * html/shadow/MediaControlRootElementChromium.h:
        (WebCore):
        Add the MediaControlTimeRemainingDisplayElement which provides use with the duration display.
        (MediaControlRootElementChromium):
        Add a duration member field, reusing the existing MediaControlTimeRemainingDisplayElement.
        * rendering/RenderMediaControlsChromium.cpp:
        (WebCore::formatChromiumMediaControlsTime):
        Formats a given time under the condition of a given duration.
        (WebCore::RenderMediaControlsChromium::formatMediaControlsTime):
        When formatting a single time, assume it to also provide the duration conditions.
        (WebCore::RenderMediaControlsChromium::formatMediaControlsCurrentTime):
        Format the current time given the duration.
        (WebCore::RenderMediaControlsChromium::formatMediaControlsRemainingTime):
        Format the remaining time from the current time given the duration.
        * rendering/RenderMediaControlsChromium.h:
        (RenderMediaControlsChromium):
        Declare the time formatting member functions.
        * rendering/RenderThemeChromiumMac.h:
        (RenderThemeChromiumMac):
        Declare the time formatting member functions for Chromium on the Mac.
        * rendering/RenderThemeChromiumMac.mm:
        (WebCore::RenderThemeChromiumMac::formatMediaControlsTime):
        (WebCore::RenderThemeChromiumMac::formatMediaControlsCurrentTime):
        (WebCore::RenderThemeChromiumMac::formatMediaControlsRemainingTime):
        Call the time formatting member functions of RenderMediaControlsChromium on the Mac.
        * rendering/RenderThemeChromiumSkia.cpp:
        (WebCore::formatMediaControlsTime):
        (WebCore::formatMediaControlsCurrentTime):
        (WebCore::formatMediaControlsRemainingTime):
        Call the time formatting member functions of RenderMediaControlsChromium on Skia.
        * rendering/RenderThemeChromiumSkia.h:
        (RenderThemeChromiumSkia):
        Declare the time formatting member functions for Chromium Skia.

2012-06-14  Eugene Klyuchnikov  <eustas.bug@gmail.com>

        Web Inspector: Refactor message loop instrumentation.
        https://bugs.webkit.org/show_bug.cgi?id=88978

        Reviewed by Pavel Feldman.

        1) Remove "messageLoop" term
        2) Reuse WebThread::TaskObserver interface
        3) Move implementation (from embedder) to platform code.

        * inspector/InspectorClient.h:
        (WebCore::InspectorClient::startMainThreadMonitoring): Renamed method.
        (WebCore::InspectorClient::stopMainThreadMonitoring): Ditto.
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::start):
        (WebCore::InspectorTimelineAgent::stop):

2012-06-14  Dominik Röttsches  <dominik.rottsches@intel.com>

        [svg] SVGResources applied to Text with Incorrect Transformations in non-CG Implementations
        https://bugs.webkit.org/show_bug.cgi?id=64966

        Reviewed by Nikolas Zimmermann.

        SVGInlineTextBox::paintTextWithShadows for non-CG implementations resets the scale aspect
        of the currently applied CTM. This leads to patterns and gradients being incorrectly downscaled.
        This way of resetting the CTM and drawing fonts "natively" scaled was introduced
        in r77485 to fix a number of issues with SVG font scaling.
        Unfortunately, this breaks scaling of patterns and gradients. To fix it,
        we need to push the transformation back into the pattern/gradient space transformation.

        Tests: svg/transforms/transformed-text-fill-gradient.html
               svg/transforms/transformed-text-fill-pattern.html

        * rendering/svg/RenderSVGInlineText.cpp:
        (WebCore::RenderSVGInlineText::computeNewScaledFontForStyle): Moving the scaling factor calculation out into SVGRenderingContext.
        * rendering/svg/RenderSVGResourceContainer.cpp:
        (WebCore::RenderSVGResourceContainer::shouldTransformOnTextPainting): Reusing the scaling factor calculation from SVGRenderingContext.
        (WebCore):
        * rendering/svg/RenderSVGResourceContainer.h:
        (RenderSVGResourceContainer):
        * rendering/svg/RenderSVGResourceGradient.cpp:
        (WebCore::RenderSVGResourceGradient::applyResource): If needed, push down transformation into gradient space.
        * rendering/svg/RenderSVGResourcePattern.cpp:
        (WebCore::RenderSVGResourcePattern::applyResource): If needed, push transformation into pattern space.
        * rendering/svg/SVGRenderingContext.cpp:
        (WebCore::SVGRenderingContext::calculateScreenFontSizeScalingFactor): Common scaling factor calculation for RenderSVGInlineText and RenderSVGResourceContainer.
        * rendering/svg/SVGRenderingContext.h:
        (SVGRenderingContext):

2012-06-14  Yoshifumi Inoue  <yosin@chromium.org>

        [Form] Replace InputNumber type to Decimal type and drop InputNumber
        https://bugs.webkit.org/show_bug.cgi?id=88746

        Reviewed by Kent Tamura.

        This patch removes InputNumber introduced by r119540 by replacing
        InputNumber type to Decimal type and changing convertDoubleToDecimal
        and convertDecimalToDouble to Decimal::fromDouble and
        Decimal::toDouble, respectively.

        No new tests. This patch doesn't change behavior.

        * html/BaseDateAndTimeInputType.cpp:
        (WebCore::BaseDateAndTimeInputType::setValueAsDecimal):
        (WebCore::BaseDateAndTimeInputType::defaultValueForStepUp):
        (WebCore::BaseDateAndTimeInputType::parseToNumber):
        (WebCore::BaseDateAndTimeInputType::serialize):
        (WebCore::BaseDateAndTimeInputType::serializeWithComponents):
        (WebCore::BaseDateAndTimeInputType::serializeWithMilliseconds):
        * html/BaseDateAndTimeInputType.h:
        (BaseDateAndTimeInputType):
        * html/DateInputType.cpp:
        (WebCore::DateInputType::createStepRange):
        * html/DateTimeInputType.cpp:
        (WebCore::DateTimeInputType::defaultValueForStepUp):
        (WebCore::DateTimeInputType::createStepRange):
        * html/DateTimeInputType.h:
        (DateTimeInputType):
        * html/DateTimeLocalInputType.cpp:
        (WebCore::DateTimeLocalInputType::createStepRange):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::getAllowedValueStep):
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/InputType.cpp:
        (WebCore::InputType::setValueAsDouble):
        (WebCore::InputType::setValueAsDecimal):
        (WebCore::InputType::rangeUnderflow):
        (WebCore::InputType::rangeOverflow):
        (WebCore::InputType::defaultValueForStepUp):
        (WebCore::InputType::minimum):
        (WebCore::InputType::maximum):
        (WebCore::InputType::isInRange):
        (WebCore::InputType::isOutOfRange):
        (WebCore::InputType::stepMismatch):
        (WebCore::InputType::validationMessage):
        (WebCore::InputType::parseToNumber):
        (WebCore::InputType::parseToNumberOrNaN):
        (WebCore::InputType::serialize):
        (WebCore::InputType::applyStep):
        (WebCore::InputType::getAllowedValueStep):
        (WebCore::InputType::stepUpFromRenderer):
        * html/InputType.h:
        (InputType):
        * html/MonthInputType.cpp:
        (WebCore::MonthInputType::defaultValueForStepUp):
        (WebCore::MonthInputType::createStepRange):
        (WebCore::MonthInputType::parseToNumber):
        * html/MonthInputType.h:
        (MonthInputType):
        * html/NumberInputType.cpp:
        (WebCore::NumberInputType::setValueAsDecimal):
        (WebCore::NumberInputType::createStepRange):
        (WebCore::NumberInputType::parseToNumber):
        (WebCore::NumberInputType::serialize):
        * html/NumberInputType.h:
        (NumberInputType):
        * html/RangeInputType.cpp:
        (WebCore::ensureMaximum):
        (WebCore::RangeInputType::setValueAsDecimal):
        (WebCore::RangeInputType::createStepRange):
        (WebCore::RangeInputType::handleKeydownEvent):
        (WebCore::RangeInputType::parseToNumber):
        (WebCore::RangeInputType::serialize):
        (WebCore::RangeInputType::sanitizeValue):
        * html/RangeInputType.h:
        (RangeInputType):
        * html/StepRange.cpp:
        (WebCore::StepRange::StepRange):
        (WebCore::StepRange::acceptableError):
        (WebCore::StepRange::alignValueForStep):
        (WebCore::StepRange::clampValue):
        (WebCore::StepRange::parseStep):
        (WebCore::StepRange::roundByStep):
        (WebCore::StepRange::stepMismatch):
        * html/StepRange.h:
        (WebCore::StepRange::StepDescription::defaultValue):
        (StepRange):
        (WebCore::StepRange::maximum):
        (WebCore::StepRange::minimum):
        (WebCore::StepRange::step):
        (WebCore::StepRange::stepBase):
        (WebCore::StepRange::defaultValue):
        (WebCore::StepRange::proportionFromValue):
        (WebCore::StepRange::valueFromProportion):
        * html/TimeInputType.cpp:
        (WebCore::TimeInputType::defaultValueForStepUp):
        (WebCore::TimeInputType::createStepRange):
        * html/TimeInputType.h:
        (TimeInputType):
        * html/WeekInputType.cpp:
        (WebCore::WeekInputType::createStepRange):
        * html/shadow/CalendarPickerElement.cpp:
        (WebCore::CalendarPickerElement::writeDocument):
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::sliderPosition):
        (WebCore::RenderSliderThumb::layout):
        (WebCore::SliderThumbElement::setPositionFromPoint):

2012-06-14  Jan Keromnes  <janx@linux.com>

        Web Inspector: Implement ExtensionPanel.show() method
        https://bugs.webkit.org/show_bug.cgi?id=88473

        Implemented ExtensionPanel.show() API method to allow extension
        developers to show their panel when needed.

        Reviewed by Pavel Feldman.

        Tests for this method are in:
        LayoutTests/inspector/extensions/extensions-panel.html

        * inspector/front-end/ExtensionAPI.js:
        (defineCommonExtensionSymbols):
        (injectedExtensionAPI.ExtensionPanelImpl.prototype.createStatusBarButton):
        (injectedExtensionAPI.ExtensionPanelImpl.prototype.show):
        * inspector/front-end/ExtensionServer.js:
        (WebInspector.ExtensionServer):
        (WebInspector.ExtensionServer.prototype._onShowPanel):

2012-06-14  Kent Tamura  <tkent@chromium.org>

        Fix a typo in r120304.
        https://bugs.webkit.org/show_bug.cgi?id=89070

        * bindings/scripts/CodeGeneratorV8.pm:
        (NativeToJSValue):
        * bindings/scripts/test/V8/V8TestObj.cpp:

2012-06-14  David Barr  <davidbarr@chromium.org>

        Add dpcm to css3-images image-resolution
        https://bugs.webkit.org/show_bug.cgi?id=85442

        Reviewed by Tony Chang.

        The css3-images module is at candidate recommendation.
        http://www.w3.org/TR/2012/CR-css3-images-20120417/#the-image-resolution

        No new tests; extended fast/css/image-resolution/image-resolution.html

        * css/CSSGrammar.y: Add DPCM token and unary term.
        * css/CSSParser.cpp: Extend range of units accepted for resolution and tokenize "dpcm".
        (WebCore::CSSParser::validUnit): Accept CSSPrimitiveValue::CSS_DPCM.
        (WebCore::CSSParser::createPrimitiveNumericValue): Accept CSSPrimitiveValue::CSS_DPCM.
        (WebCore::unitFromString): Map "dpcm" to CSSPrimitiveValue::CSS_DPCM.
        (WebCore::CSSParser::parseValidPrimitive): Accept CSSPrimitiveValue::CSS_DPCM.
        (WebCore::CSSParser::detectNumberToken): Map "dpcm" to CSSPrimitiveValue::CSS_DPCM.
        * css/CSSPrimitiveValue.cpp: Add CSSPrimitiveValue::CSS_DPCM as a numeric unit.
        (WebCore::isValidCSSUnitTypeForDoubleConversion): Accept CSSPrimitiveValue::CSS_DPCM.
        (WebCore::unitCategory): Map CSSPrimitiveValue::CSS_DPCM to CSSPrimitiveValue::UResolution.
        (WebCore::conversionToCanonicalUnitsScaleFactor): Scale CSSPrimitiveValue::CSS_DPCM to CSSPrimitiveValue::CSS_DPPX.
        (WebCore::CSSPrimitiveValue::customCssText): Format CSSPrimitiveValue::CSS_DPCM as "<num>dpcm".
        (WebCore::CSSPrimitiveValue::cloneForCSSOM): Accept CSSPrimitiveValue::CSS_DPCM as numeric unit.
        * css/CSSPrimitiveValue.h: Add CSSPrimitiveValue::CSS_DPCM.

2012-06-14  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: REGRESSION HeapProfiler can't remove heap snapshot from the list if Dominators view has been opened.
        https://bugs.webkit.org/show_bug.cgi?id=89080

        There was no dispose method on artificial ShowMoreDataGrid node.

        Reviewed by Pavel Feldman.

        * inspector/front-end/ShowMoreDataGridNode.js:
        (WebInspector.ShowMoreDataGridNode.prototype.nodeHeight):
        (WebInspector.ShowMoreDataGridNode.prototype.dispose):

2012-06-14  Kent Tamura  <tkent@chromium.org>

        [JSC/V8] Improve DOMString[] support
        https://bugs.webkit.org/show_bug.cgi?id=89070

        Reviewed by Kentaro Hara.

        Tests: new test case in TestObj.idl

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::jsArray): Implement jsArray() for DOMStringList.
        * bindings/js/JSDOMBinding.h: Declare jsArray() for DOMStringList.
        * bindings/scripts/CodeGeneratorJS.pm:
        (NativeToJSValue): Avoid to include JSDOMString.h and DOMString.h.
        * bindings/scripts/CodeGeneratorV8.pm:
        (GetNativeType): Move a check for DOMString[] because it's a RefPtr type
        and we'd like to avoid to generate RefPtr<DOMString[]>
        (%non_wrapper_types): DOMString[] is not a wrapper type. This is needed
        to avoid to generate unnecessary custom function template.
        (NativeToJSValue): Avoid to include V8DOMString.h and DOMString.h.

        * bindings/scripts/test/TestObj.idl: Add non-overload function using DOMString[].
        * bindings/scripts/test/JS/JSTestObj.cpp: Update expectation.
        * bindings/scripts/test/JS/JSTestObj.h: ditto.
        * bindings/scripts/test/V8/V8TestObj.cpp: ditto.

2012-06-14  Matt Falkenhagen  <falken@chromium.org>

        LocaleToScriptMappingDefault.cpp should also do what scriptCodeForFontSelection does in LocaleToScriptMappingICU.cpp
        https://bugs.webkit.org/show_bug.cgi?id=88845

        Reviewed by Kent Tamura.

        Test: fast/text/international/jpan-script-equivalence.html

        * platform/text/LocaleToScriptMappingDefault.cpp:
        (WebCore::scriptNameToCode):

2012-06-14  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: render dock-to-right icon in status bar.
        https://bugs.webkit.org/show_bug.cgi?id=89040

        Reviewed by Vsevolod Vlasov.

        Today we render dock to bottom icon for both actions (dock to bottom and dock to right).

        * inspector/front-end/Images/statusbarButtonGlyphs.png:
        * inspector/front-end/inspector.css:
        (button.dock-status-bar-item.status-bar-item.toggled-undock .glyph):
        (button.dock-status-bar-item.status-bar-item.toggled-bottom .glyph):
        (button.dock-status-bar-item.status-bar-item.toggled-right .glyph):
        * inspector/front-end/inspector.js:
        (WebInspector._createGlobalStatusBarItems):
        (WebInspector._installDockToRight.listener):
        (windowLoaded):
        (WebInspector.setDockingUnavailable):

2012-06-14  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: clear execution live before the text edit.
        https://bugs.webkit.org/show_bug.cgi?id=89016

        Reviewed by Vsevolod Vlasov.

        Otherwise we can't remove them after committing the edit.

        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.beforeTextChanged):
        (WebInspector.JavaScriptSourceFrame.prototype.clearExecutionLine):

2012-06-14  Min Qin  <qinmin@google.com>

        Remove the const keyword from MediaPlayerPrivate::enterFullscreen()
        https://bugs.webkit.org/show_bug.cgi?id=89044

        Reviewed by Adam Barth.

        enterFullscreen() and exitFullscreen() could both modify the player state.
        This change reverts the change we made in r120213.

        Just function declaration change, no test needed.

        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::enterFullscreen):

2012-06-14  Edaena Salinas Jasso  <edaena@apple.com>

        el.getAttribute('type') returns 'null' when setting el.type to null
        https://bugs.webkit.org/show_bug.cgi?id=89030

        Reviewed by Alexey Proskuryakov.

        Test: fast/dom/HTMLButtonElement/change-type.html

        * html/HTMLButtonElement.cpp:
        (WebCore::HTMLButtonElement::setType): Changed parameter to be AtomicString to 
        address an unrelated review comment from bug 14439 for slightly better performance.
        * html/HTMLButtonElement.h:
        (HTMLButtonElement): Changed parameter to be AtomicString to address an unrelated 
        review comment from bug 14439 for slightly better performance.
        * html/HTMLButtonElement.idl: Specified TreatNullAs NullString for the type attribute.

2012-06-14  Alec Flett  <alecflett@chromium.org>

        IndexedDB: Creating a transaction from within a transaction callback should fail
        https://bugs.webkit.org/show_bug.cgi?id=80547

        Reviewed by Tony Chang.

        Prevent creation of a transaction, via IDBDatabase.transaction()
        or IDBDatabase.setVersion(), from inside a setVersion()
        transaction, as per spec. Update many tests to deal with this.

        Test restructuring uncovered some inconsistencies in transaction
        mode handling. So also do some minor cleanup in the way the
        transaction mode is passed between the frontend and backend
        transaction objects, and add additional asserts.

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::update):
        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
        (WebCore::IDBCursorBackendImpl::update):
        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::setVersion):
        (WebCore::IDBDatabase::transaction):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::putInternal):
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::onSuccess):
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::create):
        (WebCore::IDBTransaction::IDBTransaction):
        (WebCore::IDBTransaction::stringToMode):
        (WebCore::IDBTransaction::modeToString):
        * Modules/indexeddb/IDBTransaction.h:
        (IDBTransaction):

2012-06-14  Li Yin  <li.yin@intel.com>

        [WebSocket] WebSocket object in Worker Context should fire error event when it fails connection.
        https://bugs.webkit.org/show_bug.cgi?id=88744

        Reviewed by Kent Tamura.

        Spec:http://dev.w3.org/html5/websockets/#feedback-from-the-protocol
        The behavior of firing error event in Document has been implemented in Committed r117944.
        WebSocket in WorkerContext is also required to fire error event.

        Test: http/tests/websocket/tests/hybi/workers/close.html

        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveMessageError):
        (WebCore):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveMessageErrorCallback):
        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:
        (ThreadableWebSocketChannelClientWrapper):
        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
        (WebCore::workerContextDidReceiveMessageError):
        (WebCore):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didReceiveMessageError):
        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
        (Peer):

2012-06-13  Kinuko Yasuda  <kinuko@chromium.org>

        Unreviewed build fix attempt for r120285

        * Modules/filesystem/DOMFileSystemBase.cpp:
        (WebCore):

2012-06-13  MORITA Hajime <morrita@google.com>

        Unreviewed expectation update.

        * bindings/scripts/test/V8/V8Float64Array.cpp:
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        * bindings/scripts/test/V8/V8TestException.cpp:
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        * bindings/scripts/test/V8/V8TestNode.cpp:
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::V8TestObj::installPerContextProperties):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:

2012-06-13  Kinuko Yasuda  <kinuko@chromium.org>

        Move isolated file system code out of chromium-specific directory
        https://bugs.webkit.org/show_bug.cgi?id=88997

        Reviewed by Adam Barth.

        The code does not need to be chromium-specific.  Any platforms that
        have file system implementation and manage mappings from file system
        id to a set of files should share the code.

        No new tests as this has no functional/behavioral changes.

        * Modules/filesystem/DOMFileSystem.cpp:
        (WebCore::DOMFileSystem::createIsolatedFileSystem):
        (WebCore):
        * Modules/filesystem/DOMFileSystem.h:
        (DOMFileSystem):
        * Modules/filesystem/DOMFileSystemBase.h:
        (DOMFileSystemBase):
        * Modules/filesystem/FileSystemType.h:
        * Modules/filesystem/chromium/DOMFileSystemChromium.cpp:
        * Modules/filesystem/chromium/DOMFileSystemChromium.h: Removed.
        * Modules/filesystem/chromium/DraggedIsolatedFileSystem.cpp:
        (WebCore::DraggedIsolatedFileSystem::getDOMFileSystem):
        * WebCore.gypi:

2012-06-07  Kinuko Yasuda  <kinuko@chromium.org>

        File::lastModifiedDate should use NaN or separate boolean flag for null Date value
        https://bugs.webkit.org/show_bug.cgi?id=87826

        Reviewed by Kent Tamura.

        Test: http/tests/local/fileapi/file-last-modified-after-delete.html

        * fileapi/File.cpp:
        (WebCore::File::File):
        (WebCore::File::captureSnapshot):
        (WebCore::File::lastModifiedDate):
        (WebCore::File::lastModifiedDateForBinding): Removed.
        * fileapi/File.h:
        (File):
        * fileapi/File.idl:
        * platform/FileMetadata.h:
        (WebCore::FileMetadata::FileMetadata):
        * platform/FileSystem.h:
        * platform/FileStream.cpp:
        (WebCore::FileStream::getSize):
        * platform/chromium/support/WebHTTPBody.cpp:
        (WebKit::WebHTTPBody::elementAt):
        * platform/network/BlobData.h:
        (WebCore::BlobDataItem::doNotCheckFileChange): Removed.
        * platform/network/BlobData.cpp:
        * platform/network/cf/FormDataStreamCFNet.cpp:
        (WebCore::advanceCurrentStream):
        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::blobIsOutOfDate):

2012-06-13  Eli Fidler  <efidler@rim.com>

        Fix CMake build with SMOOTH_SCROLLING enabled
        https://bugs.webkit.org/show_bug.cgi?id=89032

        Reviewed by Antonio Gomes.

        SMOOTH_SCROLLING pulls in ScrollAnimatorNone.cpp, which has
        dependencies on platform/ActivePlatformGestureAnimation.cpp and
        platform/TouchpadFlingPlatformGestureCurve.cpp

        * CMakeLists.txt:

2012-06-13  Mihai Balan  <mibalan@adobe.com>

        Touched CSSPropertyNames.in to trigger a proper rebuild

        [CSS Regions] Adding feature defines for CSS Regions & exclusions for Windows
        https://bugs.webkit.org/show_bug.cgi?id=88645

        Reviewed by Sam Weinig.

        Previous work on #87442 added feature defines to allow proper disabling of CSS Regions and
        exclusions (previously even with the feature disabled, parsing still worked). However, the
        feature defines were enabled on Mac only - they were broken on Windows. This
        patch adds the feature defines to (re)enable regions and exclusions on Windows.

        * css/CSSPropertyNames.in: Touched to trigger a proper rebuild. Incremental builds were broken on Windows.

2012-06-13  Arnaud Renevier  <arno@renevier.net>

        make sure headers are included only once per file
        https://bugs.webkit.org/show_bug.cgi?id=88931

        Reviewed by Darin Adler.

        * Modules/indexeddb/IDBDatabase.cpp:
        * WebCorePrefix.h:
        * bindings/js/JSHTMLAllCollectionCustom.cpp:
        * bindings/v8/V8Utilities.cpp:
        * bindings/v8/custom/V8LocationCustom.cpp:
        * bridge/NP_jsobject.cpp:
        * editing/Editor.cpp:
        * html/HTMLMediaElement.cpp:
        * platform/graphics/cairo/PlatformContextCairo.cpp:
        * rendering/InlineFlowBox.cpp:

2012-06-13  MORITA Hajime  <morrita@google.com>

        Unreviewed typo fix.

        * platform/RefCountedSupplement.h:

2012-06-13  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120268.
        http://trac.webkit.org/changeset/120268
        https://bugs.webkit.org/show_bug.cgi?id=89060

        WebCompositor::setPerTilePaintingEnabled hits an assertion in
        DEBUG (Requested by dominicc|work on #webkit).

        * WebCore.gypi:
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (WebCore::Settings::setPerTileDrawingEnabled):
        (WebCore::Settings::perTileDrawingEnabled):
        (Settings):
        (WebCore::Settings::setPartialSwapEnabled):
        (WebCore::Settings::partialSwapEnabled):
        (WebCore::Settings::setThreadedAnimationEnabled):
        (WebCore::Settings::threadedAnimationEnabled):
        * platform/graphics/chromium/ContentLayerChromium.cpp:
        (WebCore::ContentLayerChromium::createTextureUpdaterIfNeeded):
        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::addAnimation):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::initialize):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::updateTileSizeAndTilingOption):
        * platform/graphics/chromium/cc/CCDebugRectHistory.cpp:
        (WebCore::CCDebugRectHistory::enabled):
        (WebCore::CCDebugRectHistory::saveDebugRectsForCurrentFrame):
        * platform/graphics/chromium/cc/CCDebugRectHistory.h:
        (WebCore):
        (CCDebugRectHistory):
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
        (WebCore::CCHeadsUpDisplay::enabled):
        (WebCore::CCHeadsUpDisplay::showPlatformLayerTree):
        (WebCore::CCHeadsUpDisplay::showDebugRects):
        (WebCore::CCHeadsUpDisplay::draw):
        (WebCore::CCHeadsUpDisplay::drawHudContents):
        (WebCore::CCHeadsUpDisplay::drawDebugRects):
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.h:
        (WebCore):
        (CCHeadsUpDisplay):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::create):
        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::animateLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::CCSettings::CCSettings):
        (CCSettings):
        (CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::settings):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::create):
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
        (WebCore::CCLayerTreeHostImpl::animateLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (CCRendererClient):
        (WebCore::CCRenderer::settings):
        * platform/graphics/chromium/cc/CCSettings.cpp: Removed.
        * platform/graphics/chromium/cc/CCSettings.h: Removed.
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::setPerTileDrawingEnabled):
        (WebCore):
        * testing/InternalSettings.h:
        (InternalSettings):

2012-06-13  Ian Vollick  <vollick@chromium.org>

        [chromium] Certain settings in CCSettings could be global
        https://bugs.webkit.org/show_bug.cgi?id=88384

        Reviewed by James Robinson.

        No new tests. No new functionality.

        * WebCore.gypi:
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (Settings):
        * platform/graphics/chromium/ContentLayerChromium.cpp:
        (WebCore::ContentLayerChromium::createTextureUpdaterIfNeeded):
        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::addAnimation):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::initialize):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::updateTileSizeAndTilingOption):
        * platform/graphics/chromium/cc/CCDebugRectHistory.cpp:
        (WebCore::CCDebugRectHistory::enabled):
        (WebCore::CCDebugRectHistory::saveDebugRectsForCurrentFrame):
        * platform/graphics/chromium/cc/CCDebugRectHistory.h:
        (WebCore):
        (CCDebugRectHistory):
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
        (WebCore::CCHeadsUpDisplay::enabled):
        (WebCore::CCHeadsUpDisplay::showPlatformLayerTree):
        (WebCore::CCHeadsUpDisplay::showDebugRects):
        (WebCore::CCHeadsUpDisplay::draw):
        (WebCore::CCHeadsUpDisplay::drawHudContents):
        (WebCore::CCHeadsUpDisplay::drawDebugRects):
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.h:
        (WebCore):
        (CCHeadsUpDisplay):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::create):
        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::animateLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::CCLayerTreeSettings::CCLayerTreeSettings):
        (CCLayerTreeSettings):
        (CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::settings):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::create):
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
        (WebCore::CCLayerTreeHostImpl::animateLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (CCRendererClient):
        (WebCore::CCRenderer::settings):
        * platform/graphics/chromium/cc/CCSettings.cpp: Added.
        (WebCore):
        (WebCore::CCSettings::perTilePaintingEnabled):
        (WebCore::CCSettings::setPerTilePaintingEnabled):
        (WebCore::CCSettings::partialSwapEnabled):
        (WebCore::CCSettings::setPartialSwapEnabled):
        (WebCore::CCSettings::acceleratedAnimationEnabled):
        (WebCore::CCSettings::setAcceleratedAnimationEnabled):
        (WebCore::CCSettings::reset):
        * platform/graphics/chromium/cc/CCSettings.h: Added.
        (WebCore):
        (CCSettings):
        * testing/InternalSettings.cpp:
        * testing/InternalSettings.h:
        (InternalSettings):

2012-06-13  Crystal Zhang  <haizhang@rim.com>

        [BlackBerry] Apply New Style and JS for Select Popup
        https://bugs.webkit.org/show_bug.cgi?id=89020

        Reviewed by Rob Buis.

        PR 162854

        Use new python script for data generating, as the old one is too simple and problematic.

        * PlatformBlackBerry.cmake:

2012-06-13  Dana Jansens  <danakj@chromium.org>

        [chromium] Assert if iterating an invalid RenderSurfaceLayerList, where a layer in the list has no RenderSurface
        https://bugs.webkit.org/show_bug.cgi?id=89004

        Reviewed by Adrienne Walker.

        A RenderSurfaceLayerList expects that all layers in the list own a
        RenderSurface. If an invalid RSLL is iterated over, the
        CCLayerIterator class will now ASSERT in debug mode, as well as
        considering the list empty in release mode.

        We will be adding code to CCLayerTreeHostImpl to save a RSLL across
        frames, so adding a clearRenderSurfaces() method with a FIXME comment
        to make it clear that we should clear the RSLL when we remove
        RenderSurfaces from the layers in the saved RSLL.

        * platform/graphics/chromium/cc/CCLayerIterator.h:
        (WebCore::CCLayerIterator::CCLayerIterator):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::~CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
        (WebCore::clearRenderSurfacesOnCCLayerImplRecursive):
        (WebCore::CCLayerTreeHostImpl::clearRenderSurfaces):
        (WebCore):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):

2012-06-13  Yael Aharon  <yael.aharon@nokia.com>

        Remove redundant code from RenderView and RenderBlock
        https://bugs.webkit.org/show_bug.cgi?id=89019

        Reviewed by Abhishek Arya.

        As pointed out in https://bugs.webkit.org/show_bug.cgi?id=83981#c7 , RenderView::insertFixedPositionedObject()
        is redundant and should be removed.
        No new tests.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::insertPositionedObject):
        (WebCore::RenderBlock::removePositionedObject):
        * rendering/RenderView.cpp:
        (WebCore):
        * rendering/RenderView.h:
        (RenderView):

2012-06-13  Dana Jansens  <danakj@chromium.org>

        [chromium] Create a CCStreamVideoDrawQuad used for StreamTexture video output
        https://bugs.webkit.org/show_bug.cgi?id=88826

        Reviewed by Adrienne Walker.

        Remove the matrix from the CCVideoDrawQuad, and create a new quad
        specifically for StreamTexture video decoder output. This quad
        contains only the fields needed for display - textureId and the
        matrix to be applied to texture coords.

        Removes the (0, 0, 1, 1) "transform" from the shader used for these
        quads, as it was a no-op.

        No new tests, no change in behaviour.

        * WebCore.gypi:
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawQuad):
        (WebCore::LayerRendererChromium::drawStreamVideoQuad):
        (WebCore::LayerRendererChromium::drawVideoQuad):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (WebCore):
        (LayerRendererChromium):
        * platform/graphics/chromium/ShaderChromium.cpp:
        (WebCore::VertexShaderVideoTransform::VertexShaderVideoTransform):
        (WebCore::VertexShaderVideoTransform::init):
        (WebCore::VertexShaderVideoTransform::getShaderString):
        * platform/graphics/chromium/ShaderChromium.h:
        (VertexShaderVideoTransform):
        * platform/graphics/chromium/cc/CCDrawQuad.cpp:
        (WebCore::CCDrawQuad::toStreamVideoDrawQuad):
        (WebCore):
        * platform/graphics/chromium/cc/CCDrawQuad.h:
        (WebCore):
        (CCDrawQuad):
        * platform/graphics/chromium/cc/CCStreamVideoDrawQuad.cpp: Added.
        (WebCore):
        (WebCore::CCStreamVideoDrawQuad::create):
        (WebCore::CCStreamVideoDrawQuad::CCStreamVideoDrawQuad):
        * platform/graphics/chromium/cc/CCStreamVideoDrawQuad.h: Added.
        (WebCore):
        (CCStreamVideoDrawQuad):
        (WebCore::CCStreamVideoDrawQuad::textureId):
        (WebCore::CCStreamVideoDrawQuad::matrix):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::appendQuads):

2012-06-13  Martin Robinson  <mrobinson@igalia.com>

        [GTK] Add an accelerated compositing implementation for WebKit2
        https://bugs.webkit.org/show_bug.cgi?id=86037

        Reviewed by Alejandro G. Castro.

        No new tests. These changes are covered by the compositing tests, which
        we will gradually try to turn on for the bots.

        Add a new GLContext method for getting to current default framebuffer size, which
        is quite useful for preventing composited content quivering while resizing.

        * platform/graphics/cairo/GLContext.h:
        * platform/graphics/glx/GLContextGLX.cpp:
        (WebCore::GLContextGLX::defaultFrameBufferSize): Added this implementation for X11
        which asks the X server for the window size.
        * platform/graphics/glx/GLContextGLX.h:

2012-06-13  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Implement hit-testing for impl-side input handling in accelerated compositor
        https://bugs.webkit.org/show_bug.cgi?id=88972

        Reviewed by Adrienne Walker.

        The original hit testing code by Sami Kyostila.

        This patch implements a simple impl-side hit-testing helper
        function. At this time, the main motivation for this is so that
        composited scrollable layers can be scrolled by the impl thread --
        and a prerequisite for that is the ability to hit-test on the impl
        thread, to determine where the scrolling action should be applied.

        To implement the actual hit test, it's possible to compute the hit
        test in two equivalent ways: (a) inverse-project the point into
        local space, or (b) forward-transform the rect to screen space
        It's not obvious which one would perform better, or which one
        would be more robust to w < 0 homogeneous clipping issues. For
        this patch, we simply opt for the inverse-projection approach.

        10 unit tests added to CCLayerTreeHostCommonTest.cpp:
          CCLayerTreeHostCommonTest.verifyHitTestingForEmptyLayerList
          CCLayerTreeHostCommonTest.verifyHitTestingForSingleLayer
          CCLayerTreeHostCommonTest.verifyHitTestingForSinglePositionedLayer
          CCLayerTreeHostCommonTest.verifyHitTestingForSingleRotatedLayer
          CCLayerTreeHostCommonTest.verifyHitTestingForSinglePerspectiveLayer
          CCLayerTreeHostCommonTest.verifyHitTestingForSingleLayerWithScaledContents
          CCLayerTreeHostCommonTest.verifyHitTestingForSimpleClippedLayer
          CCLayerTreeHostCommonTest.verifyHitTestingForMultiClippedRotatedLayer
          CCLayerTreeHostCommonTest.verifyHitTestingForMultipleLayers
          CCLayerTreeHostCommonTest.verifyHitTestingForMultipleLayerLists
        
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::pointHitsRect):
        (WebCore):
        (WebCore::pointIsClippedBySurfaceOrClipRect):
        (WebCore::CCLayerTreeHostCommon::findLayerThatIsHitByPoint):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.h:
        (CCLayerTreeHostCommon):
        * platform/graphics/chromium/cc/CCMathUtil.cpp:
        (WebCore::projectHomogeneousPoint):
        (WebCore::mapHomogeneousPoint):
        (WebCore::CCMathUtil::mapClippedRect):
        (WebCore::CCMathUtil::projectClippedRect):
        (WebCore::CCMathUtil::mapClippedQuad):
        (WebCore::CCMathUtil::mapQuad):
        (WebCore::CCMathUtil::projectPoint):
        (WebCore):
        * platform/graphics/chromium/cc/CCMathUtil.h:
        (WebCore):
        (CCMathUtil):

2012-06-13  Charles Wei  <charles.wei@torchmobile.com.cn>

        Need customized toDOMStringList for IndexedDB JSC binding.
        https://bugs.webkit.org/show_bug.cgi?id=87965

        Reviewed by Kentaro Hara.

        IndexedDB database interface uses DOMStringList as the input parameter.
        The generated toDOMStringList() can't convert an JSArray of Strings to
        native DOMStringList. We need a custom function to do this.

        Because this patch adds one new file (JSDOMStringList.cpp), all build systems
        are updated accordingly to pick up this file.

         Tests: Corresponding bindings/scripts/test/JS files have been updated accordingly.

        * GNUmakefile.list.am:
        * Target.pri:
        * UseJSC.cmake:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSDOMStringListCustom.cpp: Added.
        (WebCore):
        (WebCore::toDOMStringList):
        * bindings/scripts/CodeGeneratorJS.pm:
        (IndexGetterReturnsStrings):
        (GenerateHeader):
        (GetNativeType):
        (GetNativeTypeForCallbacks):
        (JSValueToNative):
        * bindings/scripts/test/JS/JSTestCallback.cpp:
        (WebCore::JSTestCallback::callbackWithStringList):
        * bindings/scripts/test/JS/JSTestCallback.h:
        (JSTestCallback):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod6):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod7):
        * dom/DOMStringList.idl:

2012-06-13  Jeffrey Pfau  <jpfau@apple.com>

        Padding and borders can cause integer overflow in block layouts
        https://bugs.webkit.org/show_bug.cgi?id=88820
        <rdar://problem/11328762>

        Reviewed by Tony Chang.

        Tests: fast/block/block-size-integer-overflow.html
               fast/flexbox/box-size-integer-overflow.html
               fast/table/table-size-integer-overflow.html

        * rendering/AutoTableLayout.cpp: Decreased max int.
        (WebCore::AutoTableLayout::computePreferredLogicalWidths):
        * rendering/FixedTableLayout.cpp: Use shared constant.
        (WebCore::FixedTableLayout::computePreferredLogicalWidths):
        * rendering/RenderBlock.cpp: Removed unused constant.
        * rendering/TableLayout.h: Add shared constant.
        (TableLayout):

2012-06-13  Gregg Tavares  <gman@google.com>

        Refactor WebGLFramebuffer to handle texture attachments
        https://bugs.webkit.org/show_bug.cgi?id=88697

        Reviewed by Adrienne Walker.
        
        In order to add support for depth textures WebGLFramebuffer
        needed to be refactored to handle textures as attachments.

        No new tests as no new functionality. 

        * html/canvas/WebGLFramebuffer.cpp:
        (WebCore::WebGLFramebuffer::WebGLAttachment::WebGLAttachment):
        (WebCore):
        (WebCore::WebGLFramebuffer::WebGLAttachment::~WebGLAttachment):
        (WebCore::WebGLFramebuffer::WebGLFramebuffer):
        (WebCore::WebGLFramebuffer::setAttachmentForBoundFramebuffer):
        (WebCore::WebGLFramebuffer::attach):
        (WebCore::WebGLFramebuffer::getAttachmentObject):
        (WebCore::WebGLFramebuffer::getAttachment):
        (WebCore::WebGLFramebuffer::removeAttachmentFromBoundFramebuffer):
        (WebCore::WebGLFramebuffer::getColorBufferWidth):
        (WebCore::WebGLFramebuffer::getColorBufferHeight):
        (WebCore::WebGLFramebuffer::getColorBufferFormat):
        (WebCore::WebGLFramebuffer::checkStatus):
        (WebCore::WebGLFramebuffer::onAccess):
        (WebCore::WebGLFramebuffer::hasStencilBuffer):
        (WebCore::WebGLFramebuffer::deleteObjectImpl):
        (WebCore::WebGLFramebuffer::initializeAttachments):
        * html/canvas/WebGLFramebuffer.h:
        (WebGLAttachment):
        (WebGLFramebuffer):
        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore):
        (WebCore::WebGLRenderingContext::framebufferRenderbuffer):
        (WebCore::WebGLRenderingContext::reattachDepthStencilAttachments):
        (WebCore::WebGLRenderingContext::framebufferTexture2D):
        (WebCore::WebGLRenderingContext::getFramebufferAttachmentParameter):
        * html/canvas/WebGLRenderingContext.h:
        (WebGLRenderingContext):

2012-06-13  Konrad Piascik  <kpiascik@rim.com>

        Remove return statement in void method
        https://bugs.webkit.org/show_bug.cgi?id=88998

        Reviewed by Andreas Kling

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::collectStyleForAttribute):

2012-06-13  Benjamin Poulain  <benjamin@webkit.org>

        Implement the simple constructors WTFURL's KURL
        https://bugs.webkit.org/show_bug.cgi?id=85724

        Reviewed by Adam Barth.

        This patch implement the correct initialization of KURL from an absolute URL.
        The URL correctness is also relaxed in order to have KURLWTFURL works similarily to KURL.

        * platform/KURLWTFURL.cpp:
        (WebCore::KURL::KURL):
        (WebCore::KURL::isValid):
        (WebCore::KURL::string):
        (WebCore::KURL::protocol):
        (WebCore::KURL::host):
        (WebCore::KURL::port): Fix a bug where invalidPortNumber was returned if no port was defined.
        (WebCore::KURL::hasFragmentIdentifier):
        (WebCore::KURL::fragmentIdentifier):
        (WebCore::KURL::protocolIs):
        (WebCore::KURL::removeFragmentIdentifier):
        (WebCore):
        (WebCore::KURL::print):
        * platform/cf/KURLCFNet.cpp:
        (WebCore::KURL::KURL):
        (WebCore::KURL::createCFURL):
        (WebCore):
        * platform/mac/KURLMac.mm:
        (WebCore::KURL::KURL):
        (WebCore::KURL::createCFURL):
        (WebCore):
        Use the code of KURL to make the conversion from WTFURL to NSURL.

2012-06-12  Vincent Scheib  <scheib@chromium.org>

        Remove duplicate webkitpointerlockchange events when unlocking.
        https://bugs.webkit.org/show_bug.cgi?id=88917

        Reviewed by Dimitri Glazkov.

        Subsequent patches adding the new API for entering and exiting
        pointer lock would be burdened by handling multiple change events
        when the lock target is changed. This change introduces
        temporary code to suppress duplicate change events.

        Existing tests simplified by removing the duplicate change events.

        * page/PointerLockController.cpp:
        (WebCore::PointerLockController::requestPointerLock):
        (WebCore::PointerLockController::didLosePointerLock):
        * page/PointerLockController.h:
        (PointerLockController):

2012-06-13  Silvia Pfeiffer  <silviapf@chromium.org>

        Update range sliders rendering for volume and playback position of new Chrome video controls.
        https://bugs.webkit.org/show_bug.cgi?id=88623

        Reviewed by Eric Carlson.

        No new tests, final patch will contain the rebaselined tests.

        The Chrome video controls are receiving a visual update. This patch contains updates to the
        rendering of the range sliders for the playback position and the volume. This includes the
        creation of a shadowPseudoId to be able to style the range sliders via CSS, the rendering
        of the slider background and the highlighted ranges.

        * css/mediaControlsChromium.css:
        (input[type="range"]::-webkit-media-slider-container):
        Adjust the styling of the slider container backgrounds.
        (input[type="range"]::-webkit-media-slider-thumb):
        Adjust the styling of the slider thumbs.
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::sliderThumbShadowPseudoId):
        Add an accessor function for the slider thumb shadowPseudoId.
        (WebCore::mediaSliderThumbShadowPseudoId):
        Add an accessor function for the media slider thumb shadowPseudoId.
        (WebCore::SliderThumbElement::shadowPseudoId):
        Add a different CSS pseudo-class name to the media slider thumbs.
        (WebCore::TrackLimiterElement::shadowPseudoId):
        Add a different CSS pseudo-class name to the media slider thumbs.
        (WebCore::SliderContainerElement::shadowPseudoId):
        Add a different CSS pseudo-class name to the media slider background container.
        * rendering/RenderMediaControlsChromium.cpp:
        (WebCore::paintRoundedSliderBackground):
        Add function to draw rounded background of sliders in a dark color.
        (WebCore::paintSliderRangeHighlight):
        Add function to draw a highlighted grey region on the sliders, which is rounded only at
        its ends.
        (WebCore::paintMediaSlider):
        Update the background and buffered range renderings on the playback position slider by making
        use of the new helper functions.
        (WebCore::paintMediaVolumeSlider):
        Update the background and buffered range renderings on the volume slider by making
        use of the new helper functions.

2012-06-13  Christopher Hutten-Czapski  <chutten@rim.com>

        2012-06-13  Christopher Hutten-Czapski  <chutten@rim.com>

        [BlackBerry] Update Select Popup's styling
        https://bugs.webkit.org/show_bug.cgi?id=89005

        Reviewed by Rob Buis.

        Add in some nicely-styled CSS and JS for the BlackBerry port's <select>

        * Resources/blackberry/popupControlBlackBerry.css:
        (body):
        (.popup-area):
        (.popup-area>:first-child):
        (.popup-buttons):
        (.popup-button-divider):
        (.popup-button):
        (.popup-button:active):
        (.popup-button:first-child:active):
        (.popup-button:last-child:active):
        (.popup-button:only-child:active):
        * Resources/blackberry/selectControlBlackBerry.css: Added.
        (.select-area):
        (.select-area:last-child):
        (.option):
        (.optgroup:last-child):
        (.selected):
        (.optgroup):
        (.optgroup .option):
        * Resources/blackberry/selectControlBlackBerry.js: Added.

2012-06-13  Alec Flett  <alecflett@chromium.org>

        [V8] IndexedDB: Cursor value modifications should be preserved until cursor iterates
        https://bugs.webkit.org/show_bug.cgi?id=83526

        Reviewed by Kentaro Hara.

        Cache the 'value' attribute of IDBCursorWithValue with policy
        determined by IDBCursor.cpp, to follow spec behavior of keeping a
        consistent script object until the cursor advances. See
        http://www.w3.org/TR/IndexedDB/#widl-IDBCursorWithValueSync-value
        for details.

        Test: storage/indexeddb/cursor-value.html

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::IDBCursor):
        (WebCore::IDBCursor::value):
        (WebCore::IDBCursor::setValueReady):
        * Modules/indexeddb/IDBCursor.h:
        (IDBCursor):
        (WebCore::IDBCursor::valueIsDirty):
        * Modules/indexeddb/IDBCursorWithValue.idl:
        * WebCore.gypi:
        * bindings/v8/IDBCustomBindings.cpp: Added.
        (WebCore):
        (WebCore::V8IDBCursorWithValue::valueAccessorGetter):

2012-06-13  Silvia Pfeiffer  <silviapf@chromium.org>

        Code cleanup from bug 88881 to share the SliderVerticalPart code.
        https://bugs.webkit.org/show_bug.cgi?id=88930

        Reviewed by Eric Carlson.

        No new tests - this is just code cleanup.

        * html/shadow/SliderThumbElement.cpp:
        (WebCore::hasVerticalAppearance):
        Avoid having two ifdef-ed returns in the code depending on ENABLE(VIDEO).

2012-06-13  Mark Mentovai  <mark@chromium.org>

        [chromium mac] Don't include things in subframeworks of
        ApplicationServices.framework.

        A CoreText #include (with quotes instead of brackets, even) sprung up
        in r120506, bug 69826.

        https://bugs.webkit.org/show_bug.cgi?id=88569

        Reviewed by Stephen White.

        No new tests.

        * platform/graphics/harfbuzz/ng/HarfBuzzFaceCoreText.cpp:

2012-06-13  Eriq Augustine  <eaugusti@chromium.org>

        Removing an extra HandleScope in V8Proxy::evaluateInIsolatedWorld
        https://bugs.webkit.org/show_bug.cgi?id=88451

        Reviewed by Adam Barth.

        Any values retuned by the evaluation will get destroyed with the extra
        HandleScope.

        I was unable to cause a test failure, however this feature is tested by:
        platform/chromium/http/tests/misc/execute-and-return-value.html

        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::evaluateInIsolatedWorld):

2012-06-13  Zan Dobersek  <zandobersek@gmail.com>

        [Gtk] Enable link prefetch support in the developer builds
        https://bugs.webkit.org/show_bug.cgi?id=89011

        Reviewed by Martin Robinson.

        Handle the ENABLE_LINK_PREFETCH conditional in standard way.

        No new tests - covered by existing link prefetch tests.

        * GNUmakefile.am:

2012-06-13  Amy Ousterhout  <aousterh@chromium.org>

        Rename currentDeviceMotion to lastMotion in DeviceMotionClient
        https://bugs.webkit.org/show_bug.cgi?id=88854

        Reviewed by Adam Barth.

        Rename the function currentDeviceMotion to lastMotion in DeviceMotionClient.
        This makes it consistent with the similar function lastOrientation in DeviceOrientationClient.

        Just a rename, so does not require any new tests.

        * dom/DeviceMotionClient.h:
        (DeviceMotionClient):
        * dom/DeviceMotionController.cpp:
        (WebCore::DeviceMotionController::timerFired):
        (WebCore::DeviceMotionController::addListener):
        * loader/EmptyClients.h:
        (WebCore::EmptyDeviceMotionClient::lastMotion):
        * platform/qt/DeviceMotionClientQt.cpp:
        (WebCore::DeviceMotionClientQt::lastMotion):
        * platform/qt/DeviceMotionClientQt.h:
        (DeviceMotionClientQt):
        * platform/qt/DeviceMotionProviderQt.h:
        (WebCore::DeviceMotionProviderQt::lastMotion):

2012-06-13  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Breakpoint's _uiLocationRemoved() method is never called.
        https://bugs.webkit.org/show_bug.cgi?id=89003

        Reviewed by Pavel Feldman.

        * inspector/front-end/BreakpointManager.js:
        (WebInspector.BreakpointManager.prototype.breakpointLocationsForUISourceCode):
        (WebInspector.BreakpointManager.Breakpoint):
        (WebInspector.BreakpointManager.Breakpoint.prototype._locationUpdated):
        (WebInspector.BreakpointManager.Breakpoint.prototype._resetLocations):
        (WebInspector.BreakpointManager.Breakpoint.prototype._fakeBreakpointAtPrimaryLocation):
        * inspector/front-end/FileSystemModel.js: Drive by compilation fix.
        (WebInspector.FileSystemModel):

2012-06-13  David Grogan  <dgrogan@chromium.org>

        IndexedDB: Add tests, an assert, and some comments around open/close/setVersion call sequencing
        https://bugs.webkit.org/show_bug.cgi?id=88829

        Reviewed by Tony Chang.

        Test: storage/indexeddb/three-setversion-calls.html

        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::processPendingCalls):

2012-06-09  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Errors when pending console messages are attached to JavaScriptSourceFrame.
        https://bugs.webkit.org/show_bug.cgi?id=88712

        Reviewed by Pavel Feldman.

        * inspector/front-end/PresentationConsoleMessageHelper.js:
        (WebInspector.PresentationConsoleMessageHelper):
        (WebInspector.PresentationConsoleMessageHelper.prototype._addPendingConsoleMessage):
        (WebInspector.PresentationConsoleMessageHelper.prototype._parsedScriptSource):

2012-06-13  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Support user attributes in DOMNode
        https://bugs.webkit.org/show_bug.cgi?id=88706

        Reviewed by Pavel Feldman.

        This change allows clients to store arbitrary properties on DOMNodes and know if there are descendants
        (and how many of them) having a certain property set.

        Test: inspector/elements/user-attributes.html

        * inspector/front-end/DOMAgent.js:
        (WebInspector.DOMNode.prototype._removeChild):
        (WebInspector.DOMNode.prototype._updateChildUserPropertyCountsOnRemoval):
        (WebInspector.DOMNode.prototype._updateDescendantUserPropertyCount):
        (WebInspector.DOMNode.prototype.setUserProperty):
        (WebInspector.DOMNode.prototype.removeUserProperty):
        (WebInspector.DOMNode.prototype.getUserProperty):
        (WebInspector.DOMNode.prototype.descendantUserPropertyCount):

2012-06-13  Vineet Chaudhary  <vineet.chaudhary@motorola.com>

        REGRESSION:Bindings sequence<T> in Console.idl, Internals.idl and ScriptProfileNode.idl should be T[]
        https://bugs.webkit.org/show_bug.cgi?id=84863

        Reviewed by Kentaro Hara.

        With reference to http://www.w3.org/TR/WebIDL/#idl-sequence
        "Sequences must not be used as the type of an attribute, constant or exception field."
        So we should use T[] instead of sequence<T>.

        Tests: bindings/scripts/test/TestObj.idl
               fast/harness/user-preferred-language.html
               inspector/profiler/cpu-profiler-profiling-without-inspector.html
               media/track/track-language-preference.html

        * bindings/scripts/CodeGenerator.pm:
        (GetSequenceType): Getter for getting sequence type.
        (GetArrayType): Getter for getting array type.
        (AssertNotSequenceType): Check sequences must not be used as the type of an attribute,
        constant or exception field.
        * bindings/scripts/CodeGeneratorCPP.pm:
        (SkipFunction): Exclude bindings code for type sequence.
        (SkipAttribute): Check for sequences must not be used as the type of an attribute,
        constant or exception field.
        (AddIncludesForType): Exclude header inclusion code for type array/sequence.
        * bindings/scripts/CodeGeneratorGObject.pm:
        (SkipAttribute): Check for sequences must not be used as the type of an attribute,
        constant or exception field.
        (SkipFunction): Exclude bindings code for type sequence.
        * bindings/scripts/CodeGeneratorJS.pm:
        (AddIncludesForType): Exclude header inclusion code for type array/sequence.
        (GenerateImplementation):  Check for sequences must not be used as the type of an attribute,
        constant or exception field.
        (GetNativeType):
        (JSValueToNative):
        (NativeToJSValue):
        * bindings/scripts/CodeGeneratorObjC.pm:
        (SkipFunction): Exclude bindings code for type sequence.
        (SkipAttribute): Exclude bindings code for type array.
        (AddForwardDeclarationsForType):
        (AddIncludesForType):
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrGetter):
        (GetNativeType):
        (JSValueToNative):
        (CreateCustomSignature):
        (NativeToJSValue):
        * bindings/scripts/test/JS/JSTestObj.cpp: Updated code from run-bindings-tests.
        (WebCore):
        (WebCore::jsTestObjPrototypeFunctionMethodWithSequenceArg):
        * bindings/scripts/test/JS/JSTestObj.h: Updated code from run-bindings-tests.
        (WebCore):
        * bindings/scripts/test/TestObj.idl: Tests.
        * bindings/scripts/test/V8/V8TestObj.cpp:  Updated code from run-bindings-tests.
        (TestObjV8Internal):
        (WebCore::TestObjV8Internal::methodWithSequenceArgCallback):
        (WebCore):
        * inspector/ScriptProfileNode.idl: Using sequence<T> for children().
        * page/Console.idl: Using Array[T] for profiles attribute.
        * testing/Internals.idl: Using sequence<T> for userPreferredLanguages().

2012-06-13  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] Remove dependency to QtScript for the Qt 5 build
        https://bugs.webkit.org/show_bug.cgi?id=88993

        Reviewed by Kenneth Rohde Christiansen.

        Replace the use of QScriptEngine::ValueOwnership with an enum local
        to the class where it is used (QtInstance).

        * Target.pri:
        * bindings/js/ScriptControllerQt.cpp:
        (WebCore::ScriptController::createScriptInstanceForWidget):
        * bridge/qt/qt_instance.cpp:
        (JSC::Bindings::QtInstance::QtInstance):
        (JSC::Bindings::QtInstance::~QtInstance):
        (JSC::Bindings::QtInstance::getQtInstance):
        * bridge/qt/qt_instance.h:
        (QtInstance):
        (JSC::Bindings::QtInstance::create):
        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::convertQVariantToValue):
        * bridge/qt/qt_runtime_qt4.cpp:
        (JSC::Bindings::convertQVariantToValue):

2012-06-13  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>

        [Qt] Save a JSGlobalContextRef instead of a JSContextRef in QtConnectionObject
        https://bugs.webkit.org/show_bug.cgi?id=88905

        Make QtConnectionObject use JSContextGetGlobalContext and store the
        JSGlobalContextRef. Previous code was working but saving JSContextRef was wrong in terms of
        API.

        There's an assumption that JSGlobalContextRef will outlive the connection objects, and
        because of it no JSGlobalContextRetain/Release calls were added.

        Reviewed by Noam Rosenthal.

        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::QtRuntimeConnectionMethod::call):
        (JSC::Bindings::QtConnectionObject::QtConnectionObject):
        * bridge/qt/qt_runtime.h:
        (QtConnectionObject):
        * bridge/qt/qt_runtime_qt4.cpp:
        (JSC::Bindings::QtRuntimeConnectionMethod::call):
        (JSC::Bindings::QtConnectionObject::QtConnectionObject):

2012-06-13  David Barr  <davidbarr@chromium.org>

        Add dpi to css3-images image-resolution
        https://bugs.webkit.org/show_bug.cgi?id=85439

        Reviewed by Tony Chang.

        No new tests; extended fast/css/image-resolution/image-resolution.html

        * css/CSSGrammar.y:
        * css/CSSParser.cpp:
        (WebCore::CSSParser::validUnit):
        (WebCore::CSSParser::createPrimitiveNumericValue):
        (WebCore::unitFromString):
        (WebCore::CSSParser::parseValidPrimitive):
        (WebCore::CSSParser::detectNumberToken):
        * css/CSSPrimitiveValue.cpp:
        (WebCore::isValidCSSUnitTypeForDoubleConversion):
        (WebCore::unitCategory):
        (WebCore::conversionToCanonicalUnitsScaleFactor):
        (WebCore::CSSPrimitiveValue::customCssText):
        (WebCore::CSSPrimitiveValue::cloneForCSSOM):
        * css/CSSPrimitiveValue.h:

2012-06-13  Li Yin  <li.yin@intel.com>

        FileAPI: type should be converted to be lower case in Blob constructor.
        https://bugs.webkit.org/show_bug.cgi?id=88696

        Reviewed by Kentaro Hara.

        Spec: http://dev.w3.org/2006/webapi/FileAPI/#dfn-BlobPropertyBag
        Spec: http://dev.w3.org/2006/webapi/FileAPI/#attributes-blob
        The ASCII-encoded string in lower case representing the media type of the Blob.

        Test: fast/files/blob-constructor.html

        * bindings/js/JSBlobCustom.cpp:
        (WebCore::JSBlobConstructor::constructJSBlob):
        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::V8Blob::constructorCallback):

2012-06-13  Robin Cao  <robin.cao@torchmobile.com.cn>

        [BlackBerry] Enable MEDIA_STREAM by default
        https://bugs.webkit.org/show_bug.cgi?id=88849

        Reviewed by Antonio Gomes.

        Covered by existing test cases.

        * CMakeLists.txt:
        * PlatformBlackBerry.cmake:
        * platform/mediastream/blackberry/DeprecatedPeerConnectionHandler.cpp: Added.
        (WebCore):
        (WebCore::DeprecatedPeerConnectionHandler::create):
        (WebCore::DeprecatedPeerConnectionHandler::DeprecatedPeerConnectionHandler):
        (WebCore::DeprecatedPeerConnectionHandler::~DeprecatedPeerConnectionHandler):
        (WebCore::DeprecatedPeerConnectionHandler::produceInitialOffer):
        (WebCore::DeprecatedPeerConnectionHandler::handleInitialOffer):
        (WebCore::DeprecatedPeerConnectionHandler::processSDP):
        (WebCore::DeprecatedPeerConnectionHandler::processPendingStreams):
        (WebCore::DeprecatedPeerConnectionHandler::sendDataStreamMessage):
        (WebCore::DeprecatedPeerConnectionHandler::stop):
        * platform/mediastream/blackberry/MediaStreamCenterBlackBerry.cpp: Added.
        (WebCore):
        (WebCore::MediaStreamCenter::instance):
        (WebCore::MediaStreamCenterBlackBerry::MediaStreamCenterBlackBerry):
        (WebCore::MediaStreamCenterBlackBerry::~MediaStreamCenterBlackBerry):
        (WebCore::MediaStreamCenterBlackBerry::queryMediaStreamSources):
        (WebCore::MediaStreamCenterBlackBerry::didSetMediaStreamTrackEnabled):
        (WebCore::MediaStreamCenterBlackBerry::didStopLocalMediaStream):
        (WebCore::MediaStreamCenterBlackBerry::didCreateMediaStream):
        (WebCore::MediaStreamCenterBlackBerry::constructSDP):
        * platform/mediastream/blackberry/MediaStreamCenterBlackBerry.h: Added.
        (WebCore):
        (MediaStreamCenterBlackBerry):

2012-06-13  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: working copy should be committed even if domain binding returns error.
        https://bugs.webkit.org/show_bug.cgi?id=88884

        Reviewed by Vsevolod Vlasov.

        Committing working copy is about saving file. It should always succeed.

        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode.prototype.commitWorkingCopy):

2012-06-12  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: show revisions of all modified files in local modifications view
        https://bugs.webkit.org/show_bug.cgi?id=88864

        Reviewed by Vsevolod Vlasov.

        This change allows all local modifications to be seen in a single view. View is now
        singleton, listening to all revisions being added. Revert captions were reworked
        (see the screenshot).

        * English.lproj/localizedStrings.js:
        * inspector/front-end/Resource.js:
        * inspector/front-end/RevisionHistoryView.js:
        (WebInspector.RevisionHistoryView.populateRevisions):
        (WebInspector.RevisionHistoryView):
        (WebInspector.RevisionHistoryView.showHistory):
        (WebInspector.RevisionHistoryView.reset):
        (WebInspector.RevisionHistoryView.prototype._createResourceItem.clearHistory):
        (WebInspector.RevisionHistoryView.prototype._createResourceItem):
        (WebInspector.RevisionHistoryView.prototype._revisionAdded.get if):
        (WebInspector.RevisionHistoryView.prototype._revisionAdded):
        (WebInspector.RevisionHistoryView.prototype._revealResource.get if):
        (WebInspector.RevisionHistoryView.prototype._revealResource):
        (WebInspector.RevisionHistoryView.prototype._reset):
        (WebInspector.RevisionHistoryTreeElement):
        (WebInspector.RevisionHistoryTreeElement.prototype.onattach):
        (WebInspector.RevisionHistoryTreeElement.prototype.oncollapse):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._reset):
        (WebInspector.ScriptsPanel.prototype._editorSelected):
        * inspector/front-end/revisionHistory.css:
        (.revision-history-link-row):
        (.revision-history-drawer li.revision-history-revision):

2012-06-13  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: Make "Go to source and line" possible with "go to file" dialog
        https://bugs.webkit.org/show_bug.cgi?id=88740

        Reviewed by Vsevolod Vlasov.

        Selection dialog now allows search query rewrite and uses line number
        suffix to go to a particular line.

        * inspector/front-end/FilteredItemSelectionDialog.js:
        (WebInspector.FilteredItemSelectionDialog.prototype.onEnter):
        (WebInspector.FilteredItemSelectionDialog.prototype._createSearchRegExp):
        (WebInspector.SelectionDialogContentProvider.prototype.selectItem):
        (WebInspector.SelectionDialogContentProvider.prototype.rewriteQuery):
        (WebInspector.JavaScriptOutlineDialog.prototype.selectItem):
        (WebInspector.JavaScriptOutlineDialog.prototype.rewriteQuery):
        (WebInspector.OpenResourceDialog.prototype.selectItem):
        (WebInspector.OpenResourceDialog.prototype.rewriteQuery):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.showUISourceCode):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StyleSheetOutlineDialog.prototype.selectItem):
        (WebInspector.StyleSheetOutlineDialog.prototype.rewriteQuery):

2012-06-12  Hans Wennborg  <hans@chromium.org>

        Speech JavaScript API: Add test for constructing SpeechRecognitionError events
        https://bugs.webkit.org/show_bug.cgi?id=88868

        Reviewed by Adam Barth.

        This adds a test for constructing SpeechRecognitionError events, and
        code to make it work.

        Test: fast/events/constructors/speech-recognition-error-constructor.html

        * Modules/speech/SpeechRecognitionError.cpp:
        (WebCore::SpeechRecognitionError::create):
        (WebCore):
        (WebCore::SpeechRecognitionError::SpeechRecognitionError):
        (WebCore::SpeechRecognitionErrorInit::SpeechRecognitionErrorInit):
        * Modules/speech/SpeechRecognitionError.h:
        (SpeechRecognitionErrorInit):
        (WebCore):
        (SpeechRecognitionError):
        (WebCore::SpeechRecognitionError::code):
        * Modules/speech/SpeechRecognitionError.idl:

2012-06-13  Taiju Tsuiki  <tzik@chromium.org>

        Implement InspectorFileSystemAgent::readDirectory for FileSystem support.
        https://bugs.webkit.org/show_bug.cgi?id=87724

        Reviewed by Vsevolod Vlasov.

        Test: http/tests/inspector/filesystem/read-directory.html

        * inspector/Inspector.json:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        * inspector/InspectorFileSystemAgent.cpp:
        (InspectorFileSystemAgent::FrontendProvider):
        (WebCore):
        (WebCore::InspectorFileSystemAgent::create):
        (WebCore::InspectorFileSystemAgent::readDirectory):
        (WebCore::InspectorFileSystemAgent::InspectorFileSystemAgent):
        * inspector/InspectorFileSystemAgent.h:
        (WebCore):
        (InspectorFileSystemAgent):

2012-06-13  Silvia Pfeiffer  <silviapf@chromium.org>

        Change the styling of the Chromium video controls.
        https://bugs.webkit.org/show_bug.cgi?id=88297

        Reviewed by Eric Carlson.

        No new tests, final patch will contain the rebaselined tests.

        The Chrome video controls are receiving a visual update. This patch includes CSS changes,
        the removal of the now no longer needed controls background div, and the introduction of
        new images for the buttons.

        * css/mediaControlsChromium.css:
        (audio):
        Adjust height of audio controls.
        (::-webkit-media-controls):
        Use flexbox on media controls shadow DOM.
        (audio::-webkit-media-controls-enclosure, video::-webkit-media-controls-enclosure):
        Adjust height, max-width, text-indent and box-sizing, and reset padding to 0.
        (video::-webkit-media-controls-enclosure):
        Use 5px padding only for video controls and adjust height accordingly.
        (audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel):
        Use flexbox on panel, adjust bottom alignment, height, background color and border radius.
        (audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button):
        Display buttons inline with fixed width and height, vertically centered, no padding and
        6px space to next controls element (this will be 15px incl the space in the image).
        (audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button):
        Display buttons inline with fixed width and height, vertically centered, no padding and
        9px space to next controls element (this will be 15px incl the space in the image).
        (audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display):
        Display text as block, without broder, adjusted height, font-family, font-size and 9px space
        to next controls element (this will be 15px incl the space in the image).
        (audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline):
        Adjust height, padding, background-color, min-wdith and 15px space to next controls element.
        (audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider):
        Adjust height, max- and min-width, background-color and 15px space to next controls element.
        * html/shadow/MediaControlRootElementChromium.cpp:
        (WebCore::MediaControlRootElementChromium::MediaControlRootElementChromium):
        Remove timeline container, which is not necessary any longer because of the use of flexbox.
        (WebCore::MediaControlRootElementChromium::create):
        Remove timeline container, which is not necessary any longer because of the use of flexbox.
        (WebCore::MediaControlRootElementChromium::setMediaController):
        Remove timeline container, which is not necessary any longer because of the use of flexbox.
        (WebCore::MediaControlRootElementChromium::reset):
        Show the timeline instead of the timeline container when resetting.
        (WebCore::MediaControlRootElementChromium::reportedError):
        Hide the timeline instead of the timeline container when running into an error.
        * rendering/RenderMediaControlsChromium.cpp:
        (WebCore::paintMediaMuteButton):
        Introduce new image resources for the mute button and adjust it based on volume levels.
        (WebCore::paintMediaPlayButton):
        Introduce new image resources for the play button.
        (WebCore::getMediaSliderThumb):
        Introduce new image resources for the position slider thumb.
        (WebCore::paintMediaVolumeSliderThumb):
        Introduce new image resources for the volume slider thumb.
        Remove timeline container rendering.
        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart):
        Add timeline container painting to the "not reached" elements.
        (WebCore):
        Provide size settings for the position and volume sliders.
        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
        Calculate correct width and height settings for the new image resources of the position and volume
        slider thumbs.
        * rendering/RenderThemeChromiumMac.h:
        (RenderThemeChromiumMac):
        Remove timeline container rendering (i.e. the media controls background).
        * rendering/RenderThemeChromiumMac.mm:
        Remove timeline container rendering (i.e. the media controls background).
        * rendering/RenderThemeChromiumSkia.cpp:
        Remove timeline container rendering (i.e. the media controls background).
        * rendering/RenderThemeChromiumSkia.h:
        (RenderThemeChromiumSkia):
        Remove timeline container rendering (i.e. the media controls background).

2012-06-13  Kinuko Yasuda  <kinuko@chromium.org>

        Unreviewed, fixing English nits suggested by review for r120165.

        * fileapi/Blob.cpp:
        (WebCore::Blob::webkitSlice):
        * fileapi/Blob.h:
        (Blob):

2012-06-13  MORITA Hajime  <morrita@google.com>

        REGRESSION(r118098): <content> element does not render distributed children when cloned from another document
        https://bugs.webkit.org/show_bug.cgi?id=88148

        Reviewed by Dimitri Glazkov.

        The shadow DOM availability was decided through FrameLoaderClient.
        But there are documents which don't have any associated frames, in
        which any shadow DOM related elements cannot be constructed.  That
        resulsted the regression.

        This change introduces a Page-based client called
        ContextFeaturesClient which takes the role from FrameLoaderClient
        to decide the feature availability, and ContextFeatures which is a
        proxy of ContextFeaturesClient.  ContextEnabledFeatures is is
        replaced with ContextFeatures.

        Each ContextFeatures object is owned by a Page, and is attached to
        each Document in the page even if the page itself has no referenct
        to Frames or Pages. With ContextFeatures, each Document can decide
        the feature availability even if it cannot reach Page or Frame.

        On RefCountedSupplement: Document instance can live longer than a
        Page where it is shwon. This means that ContextFeatures instance
        needs to survive after owner Page destruction because it's
        referenced from possibly surviving Documents. RefCountedSupplement
        is introduced to cover this scenario: It allows supplement classes
        to live after Page's destruction.

        RefCountedSupplement::hostDestroyed() is notified when the hosting
        page is gone. ContextFeatures clears its reference to the client
        using this notification.

        Test: fast/dom/shadow/elements-in-frameless-document.html

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateImplementation):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::determineScope):
        * dom/ContextFeatures.cpp: Added.
        (WebCore):
        (WebCore::ContextFeaturesClient::empty):
        (WebCore::ContextFeatures::supplementName):
        (WebCore::ContextFeatures::defaultSwitch):
        (WebCore::ContextFeatures::shadowDOMEnabled):
        (WebCore::ContextFeatures::styleScopedEnabled):
        (WebCore::ContextFeatures::pagePopupEnabled):
        (WebCore::provideContextFeaturesTo):
        (WebCore::provideContextFeaturesToDocumentFrom):
        * dom/ContextFeatures.h: Added.
        (WebCore):
        (ContextFeatures):
        (WebCore::ContextFeatures::ContextFeatures):
        (WebCore::ContextFeatures::hostDestroyed):
        (ContextFeaturesClient):
        (WebCore::ContextFeaturesClient::~ContextFeaturesClient):
        (WebCore::ContextFeaturesClient::isEnabled):
        (WebCore::ContextFeatures::create):
        (WebCore::ContextFeatures::isEnabled):
        * dom/DOMAllInOne.cpp:
        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::createDocument):
        (WebCore::DOMImplementation::createHTMLDocument):
        * dom/Document.h:
        (WebCore::Document::contextFeatures):
        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore::Document::setContextFeatures):
        * dom/Position.cpp:
        (WebCore::Position::Position):
        (WebCore::Position::findParent):
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::getSelection):
        * dom/make_names.pl:
        (printConstructorInterior):
        (printFactoryCppFile):
        (printWrapperFunctions):
        (printWrapperFactoryCppFile):
        * editing/markup.cpp:
        (WebCore::createFragmentFromMarkupWithContext):
        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::registerWithScopingNode):
        (WebCore::HTMLStyleElement::unregisterWithScopingNode):
        * html/shadow/HTMLContentElement.cpp:
        (WebCore::contentTagName):
        * inspector/DOMPatchSupport.cpp:
        (WebCore::DOMPatchSupport::patchDocument):
        * loader/FrameLoaderClient.h:
        * platform/RefCountedSupplement.h: Copied from Source/WebCore/platform/Supplementable.h.
        (WebCore):
        (RefCountedSupplement):
        (WebCore::RefCountedSupplement::hostDestroyed):
        (Wrapper):
        (WebCore::RefCountedSupplement::Wrapper::Wrapper):
        (WebCore::RefCountedSupplement::Wrapper::~Wrapper):
        (WebCore::RefCountedSupplement::Wrapper::wrapped):
        (WebCore::RefCountedSupplement::provideTo):
        (WebCore::RefCountedSupplement::from):
        * platform/Supplementable.h:
        (WebCore::Supplement::isRefCountedWrapper):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::responseXML):

2012-06-11  Kinuko Yasuda  <kinuko@chromium.org>

        Unprefix Blob.webkitSlice
        https://bugs.webkit.org/show_bug.cgi?id=78111

        Reviewed by Adam Barth.

        Add unprefixed Blob.slice and start showing a deprecation message when webkitSlice is called.

        No new tests: existing tests that call webkitSlice() are converted to slice(). They should keep running.

        * bindings/gobject/WebKitDOMCustom.cpp:
        (webkit_dom_blob_slice): Removed.
        (webkit_dom_blob_webkit_slice): Added.
        * fileapi/Blob.cpp:
        (WebCore::Blob::slice):
        (WebCore):
        (WebCore::Blob::webkitSlice):
        (WebCore::Blob::sliceInternal): Added.
        * fileapi/Blob.h:
        (WebCore):
        (Blob):
        * fileapi/Blob.idl:

2012-06-12  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120036.
        http://trac.webkit.org/changeset/120036
        https://bugs.webkit.org/show_bug.cgi?id=88965

        "assert failed in debug build" (Requested by maryw on
        #webkit).

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::handleNotifyDataReceived):

2012-06-12  Wei James  <james.wei@intel.com>

        webcore should depend on webcore_arm_neon for only arm target_arch
        https://bugs.webkit.org/show_bug.cgi?id=88839

        Reviewed by Adam Barth.

        * WebCore.gyp/WebCore.gyp:

2012-06-12  Edaena Salinas Jasso  <edaena@apple.com>

        Can't set el.type on a <button> element
        https://bugs.webkit.org/show_bug.cgi?id=14439

        Reviewed by Darin Adler.

        Test: fast/dom/HTMLButtonElement/change-type.html

        * bindings/objc/PublicDOMInterfaces.h:
        * html/HTMLButtonElement.cpp:
        (WebCore::HTMLButtonElement::setType): Added implementation of setType method.
        (WebCore):
        * html/HTMLButtonElement.h:
        (HTMLButtonElement): Added setType method.
        * html/HTMLButtonElement.idl: Removed readonly restriction to the type variable.

2012-06-12  Kenichi Ishibashi  <bashi@chromium.org>

        [Chromium] Implement font shaping with font-feature-settings on Mac
        https://bugs.webkit.org/show_bug.cgi?id=69826

        Reviewed by Tony Chang.

        Add HarfBuzz-ng text shaper.
        Chromium mac port uses it as secondary text shaper to support OpenType features.
        HarfBuzz-ng is only used when -webkit-font-feature-settings is specified and
        corresponding font is not an AAT font.

        No new tests. css3/font-feature-settings-rendering.html should pass on Chromium mac port.

        * WebCore.gyp/WebCore.gyp: Added harfbuzz-ng dependencies.
        * WebCore.gypi: Added harfbuzz-ng files.
        * platform/graphics/FontPlatformData.h:
        (FontPlatformData): Added m_harfbuzzFace.
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        (WebCore::FontPlatformData::platformDataInit): Copy m_harfbuzzFace.
        (WebCore::FontPlatformData::platformDataAssign): Ditto.
        (WebCore):
        (WebCore::isAATFont):
        (WebCore::FontPlatformData::harfbuzzFace):
        * platform/graphics/harfbuzz/ng/HarfBuzzFace.cpp: Added.
        (WebCore):
        (WebCore::harfbuzzFaceCache):
        (WebCore::HarfBuzzFace::HarfBuzzFace):
        (WebCore::HarfBuzzFace::~HarfBuzzFace):
        * platform/graphics/harfbuzz/ng/HarfBuzzFace.h: Added.
        (WebCore):
        (HarfBuzzFace):
        (WebCore::HarfBuzzFace::create):
        * platform/graphics/harfbuzz/ng/HarfBuzzFaceCoreText.cpp: Added.
        (WebCore):
        (WebCore::floatToHarfBuzzPosition):
        (WebCore::getGlyph):
        (WebCore::getGlyphHorizontalAdvance):
        (WebCore::getGlyphHorizontalOrigin):
        (WebCore::getGlyphExtents):
        (WebCore::harfbuzzCoreTextGetFontFuncs):
        (WebCore::releaseTableData):
        (WebCore::harfbuzzCoreTextGetTable):
        (WebCore::HarfBuzzFace::createFace):
        (WebCore::HarfBuzzFace::createFont):
        (WebCore::HarfBuzzShaper::createGlyphBufferAdvance):
        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp: Added.
        (WebCore):
        (WebCore::harfbuzzPositionToFloat):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::HarfBuzzRun):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::setGlyphAndPositions):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::characterIndexForXPosition):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::xPositionForOffset):
        (WebCore::HarfBuzzShaper::HarfBuzzShaper):
        (WebCore::HarfBuzzShaper::~HarfBuzzShaper):
        (WebCore::HarfBuzzShaper::setFontFeatures):
        (WebCore::HarfBuzzShaper::shape):
        (WebCore::HarfBuzzShaper::setupHarfBuzzRun):
        (WebCore::HarfBuzzShaper::shapeHarfBuzzRun):
        (WebCore::HarfBuzzShaper::setGlyphPositionsForHarfBuzzRun):
        (WebCore::HarfBuzzShaper::offsetForPosition):
        (WebCore::HarfBuzzShaper::selectionRect):
        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.h: Added.
        (WebCore):
        (HarfBuzzShaper):
        (WebCore::HarfBuzzShaper::totalWidth):
        (HarfBuzzRun):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::create):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::setWidth):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::numCharacters):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::numGlyphs):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::width):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::rtl):
        * platform/graphics/mac/FontComplexTextMac.cpp:
        (WebCore):
        (WebCore::preferHarfBuzz): Added.
        (WebCore::Font::selectionRectForComplexText): Use HarfBuzzShaper if font-feature-settings exists.
        (WebCore::Font::drawComplexText): Ditto.
        (WebCore::Font::floatWidthForComplexText): Ditto.
        (WebCore::Font::offsetForPositionForComplexText): Ditto.

2012-06-12  Luke Macpherson  <macpherson@chromium.org>

        WIP: Implement CSS Variables Standard.
        https://bugs.webkit.org/show_bug.cgi?id=85580

        Reviewed by Ojan Vafai.

        Implement CSS Variables Module Level 1. (See http://www.w3.org/TR/css-variables/)

        A HashMap of properties is referenced by RenderStyle, and used to store variables as strings.
        That HashMap is copy-on-write, and unless new variables are defined is simply a pointer to the
        parent's definitions. At usage time the variable's value is parsed according to the CSS property
        where it is used.
        Variables can:
               Define lists of values (ie. entire shorthand values).
               Define individual values.
               Refer to other variables. (Cycle detection is implemented).
        Please see the supplied test cases for example usage.

        Missing features:
               CSS variables cannot yet be used inside some functions such as -webkit-calc.

        Covered by existing test suite under fast/css/variables.

        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSGrammar.y:
        * css/CSSParser.cpp:
        (WebCore):
        (WebCore::filterProperties):
        (WebCore::CSSParser::createStylePropertySet):
        (WebCore::CSSParser::validUnit):
        (WebCore::CSSParser::createPrimitiveNumericValue):
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::storeVariableDeclaration):
        (WebCore::CSSParser::detectDashToken):
        (WebCore::CSSParser::lex):
        * css/CSSParser.h:
        (CSSParser):
        * css/CSSParserValues.cpp:
        (WebCore::CSSParserValue::createCSSValue):
        * css/CSSPrimitiveValue.cpp:
        (WebCore::isValidCSSUnitTypeForDoubleConversion):
        (WebCore::CSSPrimitiveValue::getStringValue):
        (WebCore::CSSPrimitiveValue::customSerializeResolvingVariables):
        (WebCore):
        * css/CSSPrimitiveValue.h:
        (CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::isVariableName):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSValue.cpp:
        (WebCore::CSSValue::serializeResolvingVariables):
        (WebCore):
        (WebCore::CSSValue::destroy):
        * css/CSSValue.h:
        (CSSValue):
        (WebCore::CSSValue::isVariableValue):
        * css/CSSValueList.cpp:
        (WebCore):
        (WebCore::CSSValueList::customSerializeResolvingVariables):
        * css/CSSValueList.h:
        (CSSValueList):
        * css/CSSVariableValue.h: Added.
        (WebCore):
        (CSSVariableValue):
        (WebCore::CSSVariableValue::create):
        (WebCore::CSSVariableValue::name):
        (WebCore::CSSVariableValue::value):
        (WebCore::CSSVariableValue::CSSVariableValue):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleResolver.h:
        * css/WebKitCSSTransformValue.cpp:
        (WebCore):
        (WebCore::WebKitCSSTransformValue::customSerializeResolvingVariables):
        * css/WebKitCSSTransformValue.h:
        (WebKitCSSTransformValue):
        * css/makeprop.pl:
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleVariableData.h: Added.
        (WebCore):
        (StyleVariableData):
        (WebCore::StyleVariableData::create):
        (WebCore::StyleVariableData::copy):
        (WebCore::StyleVariableData::operator==):
        (WebCore::StyleVariableData::operator!=):
        (WebCore::StyleVariableData::setVariable):
        (WebCore::StyleVariableData::StyleVariableData):

2012-06-12  MORITA Hajime  <morrita@google.com>

        Shadow Pseudo ID should be able to nest to point nested shadow DOM.
        https://bugs.webkit.org/show_bug.cgi?id=62218

        Reviewed by Dimitri Glazkov.

        - updateSpecifiersWithElementName() didn't take nesting into account.
          tag history can contain selector entries which isn't marked as ShadowDescendant yet.
          such entry can be found by investigating isUnknownPseudoElement().
        - SelectorChecker::checkSelector() was too strict. Unknown pseudo elements are essentially a kind of class or id
          in implementation perspective. For such, rejecting by missing elementStyle doesn't make sense:
          It isn't a pseudo but a real element for WebCore after all.
        - Added Internals::setShadowPseudoId() to create a test harness whose DOM tree contains pseudo shadow ids.

        Before this change, following selecdtor chain is created for "p::-shadow-child::-nested-shadow-child":

          [both tag name and -shadow-id are set] <-(ShadowDescendant)- [-nested-shadow-id]

        What we want, which is created by this change is:

          [tag] <-(ShadowDescendant)- [-shadow-id is set] <-(ShadowdescenDant)- [-nested-shadow-id]

        Test: fast/dom/shadow/shadow-nested-pseudo-id.html

        * WebCore.exp.in:
        * css/CSSParser.cpp:
        (WebCore::CSSParser::updateSpecifiersWithElementName):
        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOneSelector):
        * testing/Internals.cpp:
        (WebCore::Internals::setShadowPseudoId):
        (WebCore):
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-06-12  Christophe Dumez  <christophe.dumez@intel.com>

        [soup] Prevent setting or editing httpOnly cookies from JavaScript
        https://bugs.webkit.org/show_bug.cgi?id=88760

        Reviewed by Gustavo Noronha Silva.

        Prevent setting or overwriting httpOnly cookies from JavaScript.
        Fix setCookies() so that it parses all the cookies and not just
        the first one.

        Test: http/tests/cookies/js-get-and-set-http-only-cookie.html

        * platform/network/soup/CookieJarSoup.cpp:
        (WebCore::httpOnlyCookieExists):
        (WebCore):
        (WebCore::setCookies):

2012-06-12  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] Enable SHADOW_DOM flag
        https://bugs.webkit.org/show_bug.cgi?id=87732

        Reviewed by Kentaro Hara.

        Test: fast/dom/shadow/shadow-root-innerHTML.html

        * dom/ShadowRoot.idl: Add JSGenerateToJSObject extended attribute so
        that the ShadowRoot properties are accessible on JS side.
        * testing/Internals.idl: Fix SHADOW_DOM ifdef check.

2012-06-12  Leo Yang  <leo.yang@torchmobile.com.cn>

        Dynamic hash table in DOMObjectHashTableMap is wrong in multiple threads
        https://bugs.webkit.org/show_bug.cgi?id=87334

        Reviewed by Geoffrey Garen.

        Adapt to JSC::HashTable::copy to avoid copy dynamic table member of a HashTable.
        The dynamic table may be allocated on other thread and contains thread specific
        identifiers. For example, a hash table of JSEntryArray was first initialized on a
        worker thread, and then the user reloaded the page, another worker thread is
        created due to reload, the dynamic allocated table in *staticTable* is specific
        to the first worker thread which has died. If the user reload the page again,
        the dynamic table will be freed and memory corruption will occur.

        No functionalities changed, no new tests.

        * bindings/js/DOMObjectHashTableMap.h:
        (WebCore::DOMObjectHashTableMap::get):

2012-06-12  James Robinson  <jamesr@chromium.org>

        [chromium] Port Canvas2DLayerBridge over to WebExternalTextureLayer
        https://bugs.webkit.org/show_bug.cgi?id=88597

        Reviewed by Adrienne Walker.

        This converts Canvas2DLayerBridge to using public WebLayer API types instead of LayerChromium types.

        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
        (WebCore::AcceleratedDeviceContext::AcceleratedDeviceContext):
        (WebCore::AcceleratedDeviceContext::prepareForDraw):
        (AcceleratedDeviceContext):
        (WebCore::Canvas2DLayerBridge::Canvas2DLayerBridge):
        (WebCore::Canvas2DLayerBridge::~Canvas2DLayerBridge):
        (WebCore::Canvas2DLayerBridge::skCanvas):
        (WebCore::Canvas2DLayerBridge::prepareTexture):
        (WebCore::Canvas2DLayerBridge::context):
        (WebCore::Canvas2DLayerBridge::layer):
        (WebCore::Canvas2DLayerBridge::contextAcquired):
        * platform/graphics/chromium/Canvas2DLayerBridge.h:
        (WebCore):
        (Canvas2DLayerBridge):

2012-06-12  Alexis Menard  <alexis.menard@openbossa.org>

        Fix packing in StyleBoxData for Windows.
        https://bugs.webkit.org/show_bug.cgi?id=88858

        Reviewed by Tony Chang.

        MSVC doesn't pack bitfields if the types are mixed.
        We can safely change the bool type to an unsigned so
        the packing will happen. I have added a compile assert
        for future regressions.

        No new tests : we should not see any regressions.

        * rendering/style/StyleBoxData.h:
        * rendering/style/StyleBoxData.cpp:
        (StyleBoxData):

2012-06-12  Adrienne Walker  <enne@google.com>

        [chromium] Paint scrollbars on WebKit thread and composite those textures
        https://bugs.webkit.org/show_bug.cgi?id=88145

        Reviewed by James Robinson.

        Scrollbars were previously painted and uploaded on the compositor
        thread. This isn't possible to do for many scrollbar themes. This
        patch changes ScrollbarLayerChromium to paint the scrollbar into two
        parts: the thumb, and everything else. These are uploaded into
        textures and synced over to the CCScrollbarImpl where they are
        composited and drawn.

        Mac and overlay scrollbars are still not enabled to have compositor
        thread-updated scrollbars.

        As a bonus, fix LayerRendererChromium::drawTextureQuad to draw quads
        that do not fill the entire layer bounds.

        Tested by existing layout and unit tests by removing the condition
        that these scrollbar layers are only created when the threaded proxy
        exists.

        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        (WebCore::scrollbarLayerDidChange):
        * platform/ScrollbarThemeComposite.cpp:
        (WebCore::ScrollbarThemeComposite::thumbRect):
        (WebCore):
        * platform/ScrollbarThemeComposite.h:
        (ScrollbarThemeComposite):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawTextureQuad):
        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
        (WebCore::ScrollbarLayerChromium::ScrollbarLayerChromium):
        (WebCore::ScrollbarLayerChromium::theme):
        (WebCore):
        (WebCore::ScrollbarLayerChromium::pushPropertiesTo):
        (ScrollbarBackgroundPainter):
        (WebCore::ScrollbarBackgroundPainter::create):
        (WebCore::ScrollbarBackgroundPainter::paint):
        (WebCore::ScrollbarBackgroundPainter::ScrollbarBackgroundPainter):
        (ScrollbarThumbPainter):
        (WebCore::ScrollbarThumbPainter::create):
        (WebCore::ScrollbarThumbPainter::paint):
        (WebCore::ScrollbarThumbPainter::ScrollbarThumbPainter):
        (WebCore::ScrollbarLayerChromium::setLayerTreeHost):
        (WebCore::ScrollbarLayerChromium::createTextureUpdaterIfNeeded):
        (WebCore::ScrollbarLayerChromium::updatePart):
        (WebCore::ScrollbarLayerChromium::update):
        * platform/graphics/chromium/ScrollbarLayerChromium.h:
        (WebCore):
        (ScrollbarLayerChromium):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
        (WebCore::CCScrollbarLayerImpl::CCScrollbarLayerImpl):
        (WebCore::CCScrollbarLayerImpl::appendQuads):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
        (WebCore::CCScrollbarLayerImpl::setBackgroundTextureId):
        (WebCore::CCScrollbarLayerImpl::setThumbTextureId):
        (CCScrollbarLayerImpl):

2012-06-12  Tony Chang  <tony@chromium.org>

        Replaced items in a flexbox should be coerced to display:block
        https://bugs.webkit.org/show_bug.cgi?id=87068

        Reviewed by Ojan Vafai.

        The flexbox spec lists HTML tags that should automatically be converted
        to display:block when a flex child. It also says that atomic inline-level
        children should become block (e.g., inline-table should be treated as table).
        http://dev.w3.org/csswg/css3-flexbox/#flex-items

        Test: css3/flexbox/flexitem.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-06-12  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: ObjectStore/Index shouldn't hold reference to backing store
        https://bugs.webkit.org/show_bug.cgi?id=83074

        Reviewed by Tony Chang.

        We should be able to collect and close the leveldb backing store as soon as the database
        connection is closed, but the IDBObjectStoreBackendImpl and IDBIndexBackendImpl were
        holding RefPtrs, and those objects are kept alive by script references.

        Replaced RefPtrs to the IDBBackingStore with pointers to the IDBDatabase. On the back end,
        IDBDatabaseBackendImpl maintains a RefPtr to the IDBObjectStoreBackendImpl object, so
        a raw pointer back is safe. On the front end, the IDBObjectStore maintains a RefPtr to
        the IDBDatabase so script can navigate upwards. Ditto on both ends for the ObjectStore/Index
        relationship. The frontend objects maintain RefPtrs to the backend objects, so the backend
        objects and their owners are maintained as long as there's a script reference. To ensure
        that all LevelDB objects are destructed in the right order, transactions indirectly track all
        open cursors and ensure they are closed when the transaction finishes, and database closing
        is explicitly prevented from occurring until transactions are complete.

        Also made IDBDatabaseBackendImpl handle a null IDBFactoryBackendImpl pointer, for testing.

        Tests: storage/indexeddb/database-close.html
               storage/indexeddb/persistence.html
               [Chromium] webkit_unit_tests --gtest_filter=IDBDatabaseBackendTest.BackingStoreRetention

        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
        (WebCore::IDBCursorBackendImpl::close): Release LevelDB resources when closed to allow backing store to close.
        * Modules/indexeddb/IDBCursorBackendImpl.h:
        (WebCore):
        * Modules/indexeddb/IDBDatabase.cpp: Ensure connection close deferred until all transactions are finished.
        (WebCore::IDBDatabase::transactionCreated): Accounting.
        (WebCore::IDBDatabase::transactionFinished): Accounting.
        (WebCore::IDBDatabase::close):
        (WebCore):
        (WebCore::IDBDatabase::closeConnection):
        * Modules/indexeddb/IDBDatabase.h:
        (IDBDatabase):
        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp: Track outstanding transactions for forced-close scenarios.
        (WebCore::IDBDatabaseBackendImpl::~IDBDatabaseBackendImpl):
        (WebCore::IDBDatabaseBackendImpl::createObjectStore): Don't pass in backing store reference.
        (WebCore::IDBDatabaseBackendImpl::setVersion): Use transaction() for consistent accounting.
        (WebCore::IDBDatabaseBackendImpl::transactionFinished): Accounting.
        (WebCore::IDBDatabaseBackendImpl::transaction): Accounting.
        (WebCore::IDBDatabaseBackendImpl::close): Unregister from factory when last connection is closed.
        (WebCore::IDBDatabaseBackendImpl::loadObjectStores): Don't pass in backing store reference.
        (WebCore::IDBDatabaseBackendImpl::removeObjectStoreFromMap):
        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
        (WebCore):
        (IDBDatabaseBackendImpl):
        * Modules/indexeddb/IDBFactoryBackendImpl.cpp:
        (WebCore::IDBFactoryBackendImpl::deleteDatabase): Don't hang on to deleted databases eternally.
        * Modules/indexeddb/IDBFactoryBackendImpl.h: Backend map controls IDBDatabaseBackend lifetimes.
        (IDBFactoryBackendImpl):
        * Modules/indexeddb/IDBIndexBackendImpl.cpp: Don't hold backing store references.
        (WebCore::IDBIndexBackendImpl::IDBIndexBackendImpl):
        * Modules/indexeddb/IDBIndexBackendImpl.h:
        (WebCore::IDBIndexBackendImpl::create):
        (IDBIndexBackendImpl):
        (WebCore::IDBIndexBackendImpl::backingStore):
        (WebCore::IDBIndexBackendImpl::databaseId):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp: Don't hold backing store references.
        (WebCore::IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl):
        (WebCore::IDBObjectStoreBackendImpl::createIndex):
        (WebCore::IDBObjectStoreBackendImpl::loadIndexes):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
        (WebCore::IDBObjectStoreBackendImpl::create):
        (IDBObjectStoreBackendImpl):
        (WebCore::IDBObjectStoreBackendImpl::backingStore):
        (WebCore::IDBObjectStoreBackendImpl::databaseId):
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::onSuccess):
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::IDBTransaction): For IDBDatabase accounting, allow ref during ctor.
        (WebCore::IDBTransaction::onAbort): Accounting.
        (WebCore::IDBTransaction::onComplete): Accounting.
        * Modules/indexeddb/IDBTransaction.h:
        (WebCore::IDBTransaction::isVersionChange): Convenience function.
        (IDBTransaction):
        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
        (WebCore::IDBTransactionBackendImpl::abort): Cleanup ordering to allow backing store to close.
        (WebCore::IDBTransactionBackendImpl::commit): Cleanup ordering to allow backing store to close.

2012-06-12  Adrienne Walker  <enne@google.com>

        [chromium] Don't set visible layer rect in CCLayerTreeHost paint iteration
        https://bugs.webkit.org/show_bug.cgi?id=88895

        Reviewed by James Robinson.

        We should only set visible layer rects during the recursion in
        CClayerTreeHostCommon and not while we're painting. This is one last
        straggling piece of code that never got moved.

        Tested by existing mask-related layout tests.

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::paintMasksForRenderSurface):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateVisibleAndScissorRectsInternal):

2012-06-12  Dana Jansens  <danakj@chromium.org>

        [chromium] Return empty visibleLayerRect for layers with empty content bounds
        https://bugs.webkit.org/show_bug.cgi?id=88901

        Reviewed by Adrienne Walker.

        This change should only affect tests. Currently if you set up a
        CCLayerImpl with some bounds, but don't set the contentBounds, then
        they are empty by default. In this case the visibleLayerRect gets
        set inappropriately to the layer's target surface contentRect which
        in a completely different coordinate space.

        Fixed up tests that were passing bogusly and failed after this change.

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateVisibleLayerRect):

2012-06-12  Adrienne Walker  <enne@google.com>

        [chromium] ScrollingCoordinator::setScrollLayer should update scroll layer ids
        https://bugs.webkit.org/show_bug.cgi?id=88882

        Reviewed by James Robinson.

        Tested manually, as scrollbar layers are currently only created when
        threaded compositing is enabled and none of those layout tests trigger
        this bug.

        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        (WebCore::ScrollingCoordinatorPrivate::setScrollLayer):
        (ScrollingCoordinatorPrivate):
        (WebCore::ScrollingCoordinatorPrivate::setHorizontalScrollbarLayer):
        (WebCore::ScrollingCoordinatorPrivate::setVerticalScrollbarLayer):
        (WebCore::createScrollbarLayer):
        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
        * platform/graphics/chromium/ScrollbarLayerChromium.h:
        (WebCore::ScrollbarLayerChromium::setScrollLayerId):
        (ScrollbarLayerChromium):
        * platform/graphics/chromium/TreeSynchronizer.cpp:
        (WebCore::TreeSynchronizer::updateScrollbarLayerPointersRecursive):

2012-06-12  Mark Mentovai  <mark@chromium.org>

        [chromium mac] Don't include things in subframeworks of
        ApplicationServices.framework.

        Subframeworks move around from SDK to SDK and OS release to OS
        release, but just using the top-level umbrella framework guarantees
        forward compatibility. When building for Chromium Mac, just #include
        <ApplicationServices/ApplicationServices.h> instead of reaching in to
        subframeworks.

        https://bugs.webkit.org/show_bug.cgi?id=88569

        Reviewed by Stephen White.

        No new tests.

        * platform/graphics/GlyphBuffer.h:
        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
        * platform/graphics/skia/GraphicsContextSkia.cpp:

2012-06-12  Igor Oliveira  <igor.o@sisa.samsung.com>

        Apply animations and transitions for first-letter element
        https://bugs.webkit.org/show_bug.cgi?id=85253

        Add animations and transitions support for the first-letter
        pseudo element.
        Instead of calling RenderOject::node() in the animations code,
        now we need to call RenderObject::styledGeneratingNode() because
        pseudo elements does not have a Node associated with the
        RenderObject.

        Initial patch by Simon Fraser

        Reviewed by Simon Fraser.

        Tests: animations/first-letter-animation.html
               animations/first-letter-play-state.html
               transitions/first-letter-color-transition.html
               transitions/first-letter-transition.html

        * page/animation/AnimationBase.cpp:
        (WebCore::AnimationBase::updateStateMachine):
        * page/animation/AnimationController.cpp:
        (WebCore::AnimationControllerPrivate::updateAnimations):
        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
        (WebCore::AnimationController::cancelAnimations):
        (WebCore::AnimationController::updateAnimations):
        * page/animation/ImplicitAnimation.cpp:
        (WebCore::ImplicitAnimation::pauseAnimation):
        (WebCore::ImplicitAnimation::sendTransitionEvent):
        * page/animation/KeyframeAnimation.cpp:
        (WebCore::KeyframeAnimation::KeyframeAnimation):
        (WebCore::KeyframeAnimation::pauseAnimation):
        (WebCore::KeyframeAnimation::endAnimation):
        (WebCore::KeyframeAnimation::sendAnimationEvent):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::updateFirstLetterStyle):
        (WebCore::RenderBlock::createFirstLetterRenderer):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::clippedOverflowRectForRepaint):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::setAnimatableStyle):
        (WebCore::RenderObject::styledGeneratingNode):
        (WebCore):
        * rendering/RenderObject.h:
        (RenderObject):

2012-06-12  Kent Tamura  <tkent@chromium.org>

        Checking a radio button doesn't uncheck other buttons in the same group in some cases.
        https://bugs.webkit.org/show_bug.cgi?id=88835

        Reviewed by Ryosuke Niwa.

        This change fixes a bug that checking a radio button in a radio button
        group in a form detached from a document tree doesn't uncheck another
        checked radio button in the radio button group.

        A radio button participates in a radio button group in the following
        conditions:
        - If it is owned by a form element regardless of the form is in a
        document tree or not, or

        - If it is not owned by any form elements and it is in a document tree.
        A radio button group for the radio button is owned by the document.

        For HTMLInputElement::removedFrom():
        The old code always unregistered the radio button if it was removed from
        the document tree. It was incorrect because we don't need to unregister
        it if it has an owner form and the owner form is not changed by
        removedFrom().
        If the owner form is cleared by removedFrom(), willChangeForm()
        unregisters the radio button. So what we should do in removedFrom() is
        to unregister the radio button only if the radio button group is owned
        by the document.

        For HTMLInputElement::insertedInto():
        The old code always registered the radio button if it is inserted into
        the document tree. It was incorrect because we don't need to register it
        if it has an owner form and the owner form is not changed by
        insertedInto().
        If the owner form is changed by insertedInto(), didChangeForm()
        registers the radio button. So We should register the radio button only
        if its radio button group will be owned by the document.

        Test: Add test cases to fast/forms/radio/radio-group.html

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::insertedInto):
        Register this to CheckedRadioButtons only if new group owner is Document.
        (WebCore::HTMLInputElement::removedFrom):
        Unregister this from CheckedRadioButtons only if old group owner was Document.

2012-06-12  James Robinson  <jamesr@chromium.org>

        [chromium] REGRESSION(119769): Canvas2DLayerBridge may go away before its TextureLayerChromium
        https://bugs.webkit.org/show_bug.cgi?id=88910

        Reviewed by Adrienne Walker.

        Unregister the bridge as its TextureLayerChromium client when going away.

        Covered by new unit test in Canvas2DLayerBridgeTest.cpp.

        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
        (WebCore::Canvas2DLayerBridge::~Canvas2DLayerBridge):

2012-06-12  Alec Flett  <alecflett@chromium.org>

        IndexedDB: Error codes, phase two
        https://bugs.webkit.org/show_bug.cgi?id=88690

        Reviewed by Tony Chang.

        Update the next phase of IndexedDB error codes to match the spec.
        This update is mostly focused on DATA_ERR vs CONSTRAINT_ERR.

        Also moves some of the error checking for the transaction mode
        into the frontend and replaces the backend checks with asserts, so that
        we can consolidate error checking in one place.

        This also removes a few FIXME's that are no longer true (about 
        I/O errors - the spec was updated and our implementation was
        already correct)

        No new tests, existing tests cover changed behavior.

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::deleteFunction):
        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
        (WebCore::IDBCursorBackendImpl::deleteFunction):
        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::setVersionInternal):
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::add):
        (WebCore::IDBObjectStore::put):
        (WebCore::IDBObjectStore::deleteFunction):
        (WebCore::IDBObjectStore::clear):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::put):
        (WebCore::IDBObjectStoreBackendImpl::putInternal):
        (WebCore::IDBObjectStoreBackendImpl::deleteFunction):
        (WebCore::IDBObjectStoreBackendImpl::clear):
        * Modules/indexeddb/IDBTransaction.h:
        (WebCore::IDBTransaction::enumMode):
        * Modules/indexeddb/IDBTransactionBackendImpl.h:

2012-06-12  Min Qin  <qinmin@google.com>

        Disable autoplay when user gesture is required for media playback
        https://bugs.webkit.org/show_bug.cgi?id=88897

        Reviewed by Adam Barth.

        When user gesture is required for media playback, we should block autoplay.
        Otherwise, people will use autoplay instead of video.play() to bypass the gesture requirement.
        Test: media/no-autoplay-with-user-gesture-requirement.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::setReadyState):

2012-06-12  Shrey Banga  <banga@chromium.org>

        HTML parser should yield more to improve perceived page load time
        https://bugs.webkit.org/show_bug.cgi?id=86165

        Reviewed by Tony Gentilcore.

        Test: fast/events/event-yield-timing.html

        We want the parser to yield at least every 500ms to keep the page somewhat responsive and allow painting.
        Since it would be too expensive to check the time after each token, the previous heuristic was to check every 4,096 tokens.
        That works fine for most tokens, but a script may spend an arbitrary amount of time executing.

        This patch fixes the issue by causing the parser to check the elapsed time immediately after executing a script.

        * html/parser/HTMLParserScheduler.cpp:
        (WebCore::HTMLParserScheduler::checkForYieldBeforeScript):
        * html/parser/HTMLParserScheduler.h:
        (WebCore::PumpSession::PumpSession):
        (PumpSession):
        (WebCore::HTMLParserScheduler::checkForYieldBeforeToken):

2012-06-12  Sami Kyostila  <skyostil@chromium.org>

        [chromium] Don't crash in CCLayerIterator if the root layer doesn't have a render surface
        https://bugs.webkit.org/show_bug.cgi?id=88886

        Reviewed by James Robinson.

        If we are iterating over a render render surface layer list where the
        root layer does not have a render surface, fail gracefully instead of
        crashing.

        Tests: CCLayerIteratorTest.{emptyTree,rootLayerWithoutRenderSurface}

        * platform/graphics/chromium/cc/CCLayerIterator.h:
        (WebCore::CCLayerIterator::CCLayerIterator):

2012-06-06  Ojan Vafai  <ojan@chromium.org>

        Change default for flex-grow back to 0
        https://bugs.webkit.org/show_bug.cgi?id=88443

        Reviewed by Tony Chang.

        * rendering/style/RenderStyle.h:

2012-06-12  Brady Eidson  <beidson@apple.com>

        <rdar://problem/11593686> and https://bugs.webkit.org/show_bug.cgi?id=88683
        Garbage collection of an <img> element can cause reentrant event dispatch.

        Reviewed by Darin Adler.

        The most straightforward solution is for ImageLoader to keep its Element alive
        with ref/deref any time the Image is actually loading.

        ImageLoader should always do this for all Elements, and if those Elements want/need
        different behavior for when they are detached then they need to manually stop their
        loads.

        Tests: http/tests/loading/embed-image-load-outlives-gc-without-crashing.html
               http/tests/loading/image-input-type-outlives-gc-without-crashing.html
               http/tests/loading/image-load-outlives-gc-without-crashing.html
               http/tests/loading/object-image-load-outlives-gc-without-crashing.html
               http/tests/loading/svg-image-load-outlives-gc-without-crashing.html
               http/tests/loading/video-poster-image-load-outlives-gc-without-crashing.html

        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::ImageLoader):
        (WebCore::ImageLoader::~ImageLoader):
        (WebCore::ImageLoader::setImage):
        (WebCore::ImageLoader::updateFromElement):
        (WebCore::ImageLoader::notifyFinished):
        (WebCore::ImageLoader::updatedHasPendingLoadEvent):
        (WebCore::ImageLoader::dispatchPendingBeforeLoadEvent):
        (WebCore::ImageLoader::dispatchPendingLoadEvent):
        * loader/ImageLoader.h:
        (ImageLoader):

2012-06-12  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Make damage tracking more robust to early exits
        https://bugs.webkit.org/show_bug.cgi?id=84803

        Reviewed by James Robinson.

        All CCDamageTrackerTest unit tests updated;
        One new unit test added:
           CCDamageTrackerTest.verifyDamageAccumulatesUntilReset

        Damage tracking inherently needs to be aware of all changes that
        occur for every frame. Before this patch, anyone modifying details
        of CCLayerTreeHostImpl and the drawing phases of the compositor
        needed to be careful to avoid early exiting once draw is
        initiated, otherwise running the risk of damage tracking's state
        getting out-of-sync from actual changes. This patch makes the
        damage tracker API more asynchronous-like, so that damage will
        continue to accumulate until it is explicitly notified that
        damaged areas have been drawn. This will allow more freedom in
        designing and restructuing drawing code in the compositor, without
        worrying as much about damage tracking getting out-of-sync.

        * platform/graphics/chromium/cc/CCDamageTracker.h:
        (WebCore::CCDamageTracker::didDrawDamagedArea):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::drawLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):

2012-06-12  Mike West  <mkwst@chromium.org>

        Make document.documentURI readonly from JavaScript
        https://bugs.webkit.org/show_bug.cgi?id=65187

        Reviewed by Alexey Proskuryakov.

        The DOM4 working draft marks the documentURI attribute as read only
        (http://www.w3.org/TR/dom/#document). Firefox has shipped with this
        behavior since https://hg.mozilla.org/mozilla-central/rev/3bc751906409
        landed in October 2011, IE9 doesn't support the property, and
        Opera throws a NO_MODIFICATION_ALLOWED_ERR. This patch changes WebKit
        to silently fail (matching Firefox's behavior) by setting the property
        to readonly in the IDL.

        Document::setDocumentURI and the m_documentURI property are retained
        for compatibility with ObjC clients, and the readonly attribute is
        ifdeffed out for ObjC.

        This patch adds a single test to verify the behavior, and removes a
        variety of tests that depended on the writable behavior. In particular,
        potential security issues involving the document.baseURL property are
        avoided completely as long as this property can't be changed.

        Test: fast/dom/documenturi-readonly.html

        * dom/Document.cpp:
        (WebCore::Document::setDocumentURI):
            Adds a comment explaining that the fallback is necessary only to
            support ObjC, not for JS calls.
        * dom/Document.cpp:
        (WebCore::Document::updateBaseURL):
            Ditto.
        (Document):
        * dom/Document.idl:
            Add readonly to the attribute and drop null value when not in
            LANGUAGE_OBJECTIVE_C.

2012-06-12  Silvia Pfeiffer  <silviapf@chromium.org>

        Support !ENABLE(VIDEO) builds with horizontally layed out video controls.
        https://bugs.webkit.org/show_bug.cgi?id=88881

        Reviewed by Csaba Osztrogonác.

        No new tests as this is a regression from WK87835.

        * html/shadow/SliderThumbElement.cpp:
        (WebCore::hasVerticalAppearance):
        Ifdef out video related functionality, since usesVerticalVolumeSlider
        does not exist in that case.

2012-06-12  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: show revisions of all modified files in local modifications view
        https://bugs.webkit.org/show_bug.cgi?id=88864

        Reviewed by Vsevolod Vlasov.

        This change allows all local modifications to be seen in a single view. View is now
        singleton, listening to all revisions being added. Revert captions were reworked
        (see the screenshot).

        * English.lproj/localizedStrings.js:
        * inspector/front-end/Resource.js:
        * inspector/front-end/RevisionHistoryView.js:
        (WebInspector.RevisionHistoryView.populateRevisions):
        (WebInspector.RevisionHistoryView):
        (WebInspector.RevisionHistoryView.showHistory):
        (WebInspector.RevisionHistoryView.reset):
        (WebInspector.RevisionHistoryView.prototype._createResourceItem.clearHistory):
        (WebInspector.RevisionHistoryView.prototype._createResourceItem):
        (WebInspector.RevisionHistoryView.prototype._revisionAdded.get if):
        (WebInspector.RevisionHistoryView.prototype._revisionAdded):
        (WebInspector.RevisionHistoryView.prototype._revealResource.get if):
        (WebInspector.RevisionHistoryView.prototype._revealResource):
        (WebInspector.RevisionHistoryView.prototype._reset):
        (WebInspector.RevisionHistoryTreeElement):
        (WebInspector.RevisionHistoryTreeElement.prototype.onattach):
        (WebInspector.RevisionHistoryTreeElement.prototype.oncollapse):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._reset):
        (WebInspector.ScriptsPanel.prototype._editorSelected):
        * inspector/front-end/revisionHistory.css:
        (.revision-history-link-row):
        (.revision-history-drawer li.revision-history-revision):

2012-06-12  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: allow clearing revision history.
        https://bugs.webkit.org/show_bug.cgi?id=88847

        Reviewed by Vsevolod Vlasov.

        This change also renames "Revision history" to "Local modifications".
        I intend to list modifications to all files in that view in the subsequent change.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/Resource.js:
        (WebInspector.Resource._clearResourceHistory):
        * inspector/front-end/RevisionHistoryView.js:
        (WebInspector.RevisionHistoryView.else.clearHistory):
        (WebInspector.RevisionHistoryView):
        (WebInspector.RevisionHistoryView.prototype._revisionAdded):
        (WebInspector.RevisionHistoryTreeElement):
        (WebInspector.RevisionHistoryTreeElement.prototype._createLine):
        (WebInspector.RevisionHistoryTreeElement.prototype.allowRevert):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.appendApplicableItems):

2012-06-12  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: use jsdifflib for revision diff calculation.
        https://bugs.webkit.org/show_bug.cgi?id=88791

        Reviewed by Vsevolod Vlasov.

        Present diff calculation is incomplete, it does not properly handle the following case:
            [a, b, c, d, e, f, g, h] => [c, d, e, f, g, h, a, b]
        We should not be implementing diff by ourselves. I imported jsdifflib from
        https://github.com/cemerick/jsdifflib. It has BSD license that is compatible with WebKit.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/front-end/RevisionHistoryView.js:
        (WebInspector.RevisionHistoryTreeElement.prototype.onexpand.step2):
        (WebInspector.RevisionHistoryTreeElement.prototype.onexpand):
        (WebInspector.RevisionHistoryTreeElement.prototype._createLine.appendLineNumber):
        (WebInspector.RevisionHistoryTreeElement.prototype._createLine):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/externs.js:
        (difflib.stringAsLines):
        (difflib.SequenceMatcher):
        (difflib.SequenceMatcher.prototype.get_opcodes):
        * inspector/front-end/inspector.html:
        * inspector/front-end/jsdifflib.js: Added.
        (difflib.defaultJunkFunction):
        (difflib.stripLinebreaks):
        (difflib.stringAsLines):
        (difflib.__reduce):
        (difflib.__ntuplecomp):
        (difflib.__calculate_ratio):
        (difflib.__dictget):
        (difflib.SequenceMatcher.this.set_seqs):
        (difflib.SequenceMatcher.this.set_seq1):
        (difflib.SequenceMatcher.this.set_seq2):
        (difflib.SequenceMatcher.this.__chain_b):
        (difflib.SequenceMatcher.this.find_longest_match):
        (difflib.SequenceMatcher.this.get_matching_blocks):
        (difflib.SequenceMatcher.this.get_opcodes):
        (difflib.SequenceMatcher.this.get_grouped_opcodes):
        (difflib.SequenceMatcher.this.quick_ratio):
        (difflib.SequenceMatcher.this.real_quick_ratio):
        * inspector/front-end/revisionHistory.css:
        (.revision-history-line-separator .webkit-line-number):

2012-06-12  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: use jsdifflib for revision diff calculation.
        https://bugs.webkit.org/show_bug.cgi?id=88791

        Reviewed by Vsevolod Vlasov.

        Present diff calculation is incomplete, it does not properly handle the following case:
            [a, b, c, d, e, f, g, h] => [c, d, e, f, g, h, a, b]
        We should not be implementing diff by ourselves. I imported jsdifflib from
        https://github.com/cemerick/jsdifflib. It has BSD license that is compatible with WebKit.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/front-end/RevisionHistoryView.js:
        (WebInspector.RevisionHistoryTreeElement.prototype.onexpand.step2):
        (WebInspector.RevisionHistoryTreeElement.prototype.onexpand):
        (WebInspector.RevisionHistoryTreeElement.prototype._createLine.appendLineNumber):
        (WebInspector.RevisionHistoryTreeElement.prototype._createLine):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/externs.js:
        (difflib.stringAsLines):
        (difflib.SequenceMatcher):
        (difflib.SequenceMatcher.prototype.get_opcodes):
        * inspector/front-end/inspector.html:
        * inspector/front-end/jsdifflib.js: Added.
        (difflib.defaultJunkFunction):
        (difflib.stripLinebreaks):
        (difflib.stringAsLines):
        (difflib.__reduce):
        (difflib.__ntuplecomp):
        (difflib.__calculate_ratio):
        (difflib.__dictget):
        (difflib.SequenceMatcher.this.set_seqs):
        (difflib.SequenceMatcher.this.set_seq1):
        (difflib.SequenceMatcher.this.set_seq2):
        (difflib.SequenceMatcher.this.__chain_b):
        (difflib.SequenceMatcher.this.find_longest_match):
        (difflib.SequenceMatcher.this.get_matching_blocks):
        (difflib.SequenceMatcher.this.get_opcodes):
        (difflib.SequenceMatcher.this.get_grouped_opcodes):
        (difflib.SequenceMatcher.this.quick_ratio):
        (difflib.SequenceMatcher.this.real_quick_ratio):
        * inspector/front-end/revisionHistory.css:
        (.revision-history-line-separator .webkit-line-number):

2012-06-12  Christophe Dumez  <christophe.dumez@intel.com>

        [GStreamer] http/tests/media/video-buffered-range-contains-currentTime.html is failing
        https://bugs.webkit.org/show_bug.cgi?id=87575

        Reviewed by Philippe Normand.

        When EOS is reached in forward playback, the position does not necessarily
        match the duration. This confuses HTMLMediaElement and causes the "ended"
        event not to be fired. To avoid this, we synchronize position and duration
        values in this case.

        Test: http/tests/media/video-buffered-range-contains-currentTime.html

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

2012-06-12  Kinuko Yasuda  <kinuko@chromium.org>

        Refactor InputType::receiveDroppedFiles to take DragData
        https://bugs.webkit.org/show_bug.cgi?id=88860

        Reviewed by Kent Tamura.

        So that we can centralize the file paths related code into FileInputType
        and makes it easier to extract more data from DragData for
        <input type=file> (like bug 88293 for directory drag-and-drop).

        No new tests as this has no behavioral changes.

        * html/FileInputType.cpp:
        (WebCore::FileInputType::receiveDroppedFiles):
        * html/FileInputType.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::receiveDroppedFiles):
        * html/HTMLInputElement.h:
        * html/InputType.cpp:
        (WebCore::InputType::receiveDroppedFiles):
        * html/InputType.h:
        * page/DragController.cpp:
        (WebCore::DragController::concludeEditDrag):

2012-06-12  Thiago Marcos P. Santos  <thiago.santos@intel.com>

        Generate -webkit-box-decoration-break property only when the feature is enabled
        https://bugs.webkit.org/show_bug.cgi?id=88861

        Reviewed by Alexis Menard.

        Otherwise it will hit an assertion if the property is present on the
        style but the feature disabled. Also fixes a compilation warning when
        the feature is disabled.

        * css/CSSPropertyNames.in:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-06-12  Darin Adler  <darin@apple.com>

        Tweaked the Mac export file a bit more, adding more-correct iOS cases.

        Reviewed by David Kilzer.

        * WebCore.exp.in: Rearrangement.

2012-06-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>

        Using extrernal ICU library on case unsensitive drives will not work
        https://bugs.webkit.org/show_bug.cgi?id=70913

        Reviewed by Csaba Osztrogonác.

        * platform/graphics/surfaces/GraphicsSurface.h:

2012-06-11  Dana Jansens  <danakj@chromium.org>

        [chromium] Use TextureDrawQuad for video layer output when it produces a single GL texture
        https://bugs.webkit.org/show_bug.cgi?id=88814

        Reviewed by Adrienne Walker.

        When a CCVideLayerImpl produces quads for a frame that is contained
        in a single GL texture, then use the TextureDrawQuad instead of the
        VideoDrawQuad. Moves the computation for the RGBA(software) and
        NativeTexture (hardware) cases from LayerRendererChromium into
        CCVideoLayerImpl, so it can embed these values in the TextureDrawQuad.

        No new tests, behaviour should be the same.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawStreamTexture):
        (WebCore::LayerRendererChromium::drawVideoQuad):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::appendQuads):

2012-06-12  Silvia Pfeiffer  <silviapf@chromium.org>

        Change the volume slider to horizontal rendering for Chrome video controls.
        https://bugs.webkit.org/show_bug.cgi?id=87835

        Reviewed by Eric Carlson.

        No new tests - final patch in the Chrome controls update series will contain rebaselined tests.

        The Chrome video controls are receiving a visual update. The volume slider is moved into
        the controls with horizontal rendering, the volume slider container is removed. The visual
        update itself is in a separate patch.

        * css/mediaControlsChromium.css:
        (audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button):
        Removed relative positioning to render all controls elements equally in DOM order.
        (audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button):
        Removed absolute positioning to render all controls elements equally in DOM order.
        (audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container):
        Removed absolute positioning to render all controls elements equally in DOM order.
        (audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container):
        Removed volume slider container - it's not necessary any more.
        (audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display):
        Remove flexbox and introduce inline display to always display this field.
        (audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider):
        Removed absolute positioning to render all controls elements equally in DOM order.
        * html/shadow/MediaControlRootElementChromium.cpp:
        (WebCore::MediaControlRootElementChromium::MediaControlRootElementChromium):
        Removed volume slider container - it's not necessary any more.
        (WebCore::MediaControlRootElementChromium::create):
        Appended the volume slider and the mute button directly to the panel, removed volume slider container.
        (WebCore::MediaControlRootElementChromium::setMediaController):
        Removed volume slider container.
        (WebCore::MediaControlRootElementChromium::reportedError):
        Removed volume slider container.
        (WebCore::MediaControlRootElementChromium::showVolumeSlider):
        Removed volume slider container.
        * html/shadow/MediaControlRootElementChromium.h:
        (WebCore):
        (MediaControlRootElementChromium):
        Removed volume slider container.
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::hasVerticalAppearance):
        Allow use of horizontal media volume slider.
        (WebCore::RenderSliderThumb::layout):
        Reuse hasVerticalAppearance function.
        * rendering/RenderMediaControlsChromium.cpp:
        (WebCore::RenderMediaControlsChromium::paintMediaVolumeSlider):
        Change line drawing from vertical to horizontal.
        * rendering/RenderTheme.h:
        (WebCore::RenderTheme::usesVerticalVolumeSlider):
        Add usesVerticalVolumeSlider function to allow horizontal volume sliders.
        * rendering/RenderThemeChromiumMac.h:
        (WebCore::RenderThemeChromiumMac::usesVerticalVolumeSlider):
        Add usesVerticalVolumeSlider function to allow horizontal volume sliders.
        Add usesVerticalVolumeSlider function to allow horizontal volume sliders.
        * rendering/RenderThemeChromiumSkia.h:
        (WebCore::RenderThemeChromiumSkia::usesVerticalVolumeSlider):
        Add usesVerticalVolumeSlider function to allow horizontal volume sliders.

2012-06-12  Andrei Bucur  <abucur@adobe.com>

        [CSSRegions]NamedFlow::overset should return true when there's no region chain attached
        https://bugs.webkit.org/show_bug.cgi?id=88515

        The CSS Regions specifies that the "overset" attribute needs to return true if the content overflows, there's no region attached to the flow
        or if the NamedFlow is in the NULL state:
        http://www.w3.org/TR/css3-regions/#dom-named-flow-overset

        This patch updates WebKit's behavior in the last two situations to match the one in the spec.

        Reviewed by Andreas Kling.

        Test: fast/regions/webkit-named-flow-overset.html was updated

        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::RenderFlowThread):
        (WebCore::RenderFlowThread::computeOverflowStateForRegions): If the last valid region is null, the flow has not region chain attached or it's in the NULL state.

2012-06-12  Rahul Tiwari  <rahultiwari.cse.iitr@gmail.com>

        Web Inspector: Provide context menu for deleting recorded profile on Profiles Panel
        https://bugs.webkit.org/show_bug.cgi?id=88286

        Added the context menu to delete the selected profile.

        Reviewed by Pavel Feldman.

        No new tests required as UI related change

        * English.lproj/localizedStrings.js: Removed property svn:mime-type.
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfileSidebarTreeElement.prototype.handleContextMenuEvent):

2012-06-12  Pavel Feldman  <pfeldman@chromium.org>

        Not reviewed: removed svn:mime-type property from English.lproj/localizedStrings.js

        * English.lproj/localizedStrings.js

2012-06-12  Dan Bernstein  <mitz@apple.com>

        Tried to fix the notification-enabled build after r120044.

        * notifications/NotificationController.cpp:
        (WebCore::NotificationController::NotificationController):
        (WebCore::NotificationController::create):
        (WebCore::provideNotification):
        * notifications/NotificationController.h:
        (NotificationController):

2012-06-12  Huang Dongsung  <luxtella@company100.net>

        [Qt][Texmap] Falling leaves demo missing clipping.
        https://bugs.webkit.org/show_bug.cgi?id=88704

        The bug originated from begining native painting mode of QPainter after enabling
        scissor test, because begining native painting mode disables scissor test.

        Covered by existing compositing tests.

        Reviewed by Noam Rosenthal.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::beginPainting):

2012-06-12  Csaba Osztrogonác  <ossy@webkit.org>

        [Qt][Win] Buildfix related to fromWinHBITMAP
        https://bugs.webkit.org/show_bug.cgi?id=88863

        Reviewed by Jocelyn Turcotte.

        * platform/graphics/qt/GraphicsContextQt.cpp: Add qt_pixmapFromWinHBITMAP and HBitmapFormat enum.
        (WebCore):
        (WebCore::GraphicsContext::releaseWindowsContext):
        * platform/graphics/qt/ImageQt.cpp:
        (WebCore): Move qt_pixmapFromWinHBITMAP to outside of WebCore namespace. (Fix after r119924.)

2012-06-12  Takashi Sakamoto  <tasak@google.com>

        [Shadow DOM] <style> inside Shadow subtree should be scoped inside the subtree.
        https://bugs.webkit.org/show_bug.cgi?id=87805

        Modified HTMLStyleElement to be treated as a scoped style independent
        of its "scoped" attribute's value if HTMLStyleElement is in shadow
        subtree. HTMLStyleElement has the following four cases talking about
        "scoped" attribute and whether is in shadow subtree or not:
        1, HTMLStyleElement is "scoped" and is in document tree,
        2, HTMLStyleElement is "scoped" and is in shadow subtree,
        3, HTMLStyleElement is not "scoped" and is in document tree, and
        4, HTMLStyleElement is not "scoped" and is in shadow subtree.
        The case 1 and 2 are not changed. This patch affected the case 4.
        At the case 4, the HTMLStyleElement's scoping node is the shadow root.
        This change is the first step for fixing style scope bug,
        i.e. HTMLStyleElements in shadow subtree are applied to any element
        in document tree.

        Reviewed by Dimitri Glazkov.

        Test: fast/css/style-scoped/style-scoped-change-scoped-in-shadow.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::determineScope):
        Modified to return a shadow root if a targeted stylesheet owner node is
        not scoped but in some shadow DOM subtree.
        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::HTMLStyleElement):
        (WebCore::HTMLStyleElement::parseAttribute):
        Modified to use the below scopedAttributeChanged when a changed
        attribute's name is "scoped".
        (WebCore::HTMLStyleElement::scopedAttributeChanged):
        Newly added. According to new scoped value and isInShadowTree,
        add or remove style rules to/from scopedAuthorRules via
        registerWithScopingNode or unregisterWithScopingNode.
        (WebCore::HTMLStyleElement::registerWithScopingNode):
        Added one boolean argument to determine whether HTMLStyleElement is
        scoped or not. The reason why not using scoped() is the comment:
        "We cannot rely on the scoped element already being present when this
        method is invoked. Therefore we cannot rely on scoped()"
        (WebCore::HTMLStyleElement::unregisterWithScopingNode):
        Changed the code for updating m_isRegisteredWithScopingNode. Now
        set m_scopedStyleRegistrationState to be NotRegistered.
        (WebCore::HTMLStyleElement::insertedInto):
        Modified to invoke registerWithScopingNode when an element is not
        scoped but in some shadow subtree.
        (WebCore::HTMLStyleElement::removedFrom):
        Modified to invoke unregisterWithScopingNode when an element is not
        scoped but in some shadow subtree.
        * html/HTMLStyleElement.h:
        (HTMLStyleElement):
        Modified the type of m_isRegisteredWithScopingNode from bool to
        enum and renamed to m_scopedStyleRegistrationState. Now the member
        variable keeps what HTMLStyleElement's scoping node is, i.e.
        none (this means, not in shadow subtree and not scoped), shadow root or
        parent node.
        Added one new method scopedAttributeChanged's declaration and
        modified the declaration of registerWithScopingNode.

2012-06-12  Amy Ousterhout  <aousterh@chromium.org>

        Removing unused parameter Page
        https://bugs.webkit.org/show_bug.cgi?id=88848

        Reviewed by Kentaro Hara.

        Removed the unused parameter Page* supplied to the create function
        and constructor in DeviceOrientationController.

        The parameter Page* was previously stored in an instance variable
        m_page, but this was removed (see https://bugs.webkit.org/show_bug.cgi?id=88812).

        No new tests because the removed parameter was unused and untested.

        * dom/DeviceOrientationController.cpp:
        (WebCore::DeviceOrientationController::DeviceOrientationController):
        (WebCore::DeviceOrientationController::create):
        (WebCore::provideDeviceOrientationTo):
        * dom/DeviceOrientationController.h:
        (DeviceOrientationController):

2012-06-12  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r120051.
        http://trac.webkit.org/changeset/120051
        https://bugs.webkit.org/show_bug.cgi?id=88852

        some tests are crashing (Requested by morrita on #webkit).

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/generic/ContextEnabledFeatures.cpp: Renamed from Source/WebKit/chromium/src/ContextFeaturesClientImpl.cpp.
        (WebCore):
        (WebCore::ContextEnabledFeatures::shadowDOMEnabled):
        (WebCore::ContextEnabledFeatures::styleScopedEnabled):
        (WebCore::ContextEnabledFeatures::pagePopupEnabled):
        * bindings/generic/ContextEnabledFeatures.h: Renamed from Source/WebKit/chromium/src/ContextFeaturesClientImpl.h.
        (WebCore):
        (ContextEnabledFeatures):
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateImplementation):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::determineScope):
        * dom/ContextFeatures.cpp: Removed.
        * dom/ContextFeatures.h: Removed.
        * dom/DOMAllInOne.cpp:
        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::createDocument):
        (WebCore::DOMImplementation::createHTMLDocument):
        * dom/Document.cpp:
        (WebCore::Document::Document):
        * dom/Document.h:
        (WebCore):
        (Document):
        * dom/Position.cpp:
        (WebCore::Position::Position):
        (WebCore::Position::findParent):
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::getSelection):
        * dom/make_names.pl:
        (printConstructorInterior):
        (printFactoryCppFile):
        (printWrapperFunctions):
        (printWrapperFactoryCppFile):
        * editing/markup.cpp:
        (WebCore::createFragmentFromMarkupWithContext):
        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::registerWithScopingNode):
        (WebCore::HTMLStyleElement::unregisterWithScopingNode):
        * html/shadow/HTMLContentElement.cpp:
        (WebCore::contentTagName):
        * inspector/DOMPatchSupport.cpp:
        (WebCore::DOMPatchSupport::patchDocument):
        * loader/FrameLoaderClient.h:
        (WebCore::FrameLoaderClient::allowShadowDOM):
        (WebCore::FrameLoaderClient::allowStyleScoped):
        (FrameLoaderClient):
        (WebCore::FrameLoaderClient::allowPagePopup):
        * platform/RefCountedSupplement.h: Removed.
        * platform/Supplementable.h:
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::responseXML):

2012-06-11  Kaustubh Atrawalkar  <kaustubh@motorola.com>

        [DRT] LTC:: counterValueForElementById() could be moved to Internals.
        https://bugs.webkit.org/show_bug.cgi?id=84406

        Reviewed by Hajime Morita.

        Move the counterValueForElementById from LayoutTestCotroller to Internals and
        remove the old platform specific implementations as it exclusively tests WebCore functionality.

        Covered by existing test cases.

        * testing/Internals.cpp:
        (WebCore::Internals::counterValue):
        (WebCore):
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-06-11  Hans Wennborg  <hans@chromium.org>

        Speech JavaScript API: Make SpeechRecognitionError an Event
        https://bugs.webkit.org/show_bug.cgi?id=88784

        Reviewed by Adam Barth.

        Make SpeechRecognitionError an Event. The spec was updated to make it
        an event in its own right, rather than an attribute of
        SpeechRecognitionEvent.

        Test: fast/speech/scripted/speechrecognition-errors.html

        * Modules/speech/SpeechRecognition.cpp:
        (WebCore::SpeechRecognition::didReceiveError):
        * Modules/speech/SpeechRecognitionError.cpp:
        (WebCore::SpeechRecognitionError::SpeechRecognitionError):
        (WebCore::SpeechRecognitionError::interfaceName):
        (WebCore):
        * Modules/speech/SpeechRecognitionError.h:
        (WebCore::SpeechRecognitionError::create):
        (SpeechRecognitionError):
        * Modules/speech/SpeechRecognitionError.idl:
        * Modules/speech/SpeechRecognitionEvent.cpp:
        (WebCore::SpeechRecognitionEvent::SpeechRecognitionEvent):
        * Modules/speech/SpeechRecognitionEvent.h:
        (SpeechRecognitionEventInit):
        (SpeechRecognitionEvent):
        * Modules/speech/SpeechRecognitionEvent.idl:
        * dom/EventNames.in:

2012-06-12  MORITA Hajime  <morrita@google.com>

        REGRESSION(r118098): <content> element does not render distributed children when cloned from another document
        https://bugs.webkit.org/show_bug.cgi?id=88148

        Reviewed by Dimitri Glazkov.

        The shadow DOM availability was decided through FrameLoaderClient.
        But there are documents which don't have any associated frames, in
        which any shadow DOM related elements cannot be constructed.  That
        resulsted the regression.

        This change introduces a Page-based client called
        ContextFeaturesClient which takes the role from FrameLoaderClient
        to decide the feature availability, and ContextFeatures which is a
        proxy of ContextFeaturesClient.  ContextEnabledFeatures is is
        replaced with ContextFeatures.

        Each ContextFeatures object is owned by a Page, and is attached to
        each Document in the page even if the page itself has no referenct
        to Frames or Pages. With ContextFeatures, each Document can decide
        the feature availability even if it cannot reach Page or Frame.

        On RefCountedSupplement: Document instance can live longer than a
        Page where it is shwon. This means that ContextFeatures instance
        needs to survive after owner Page destruction because it's
        referenced from possibly surviving Documents. RefCountedSupplement
        is introduced to cover this scenario: It allows supplement classes
        to live after Page's destruction.

        RefCountedSupplement::hostDestroyed() is notified when the hosting
        page is gone. ContextFeatures clears its reference to the client
        using this notification.

        Test: fast/dom/shadow/elements-in-frameless-document.html

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateImplementation):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::determineScope):
        * dom/ContextFeatures.cpp: Added.
        (WebCore):
        (WebCore::ContextFeaturesClient::empty):
        (WebCore::ContextFeatures::supplementName):
        (WebCore::ContextFeatures::defaultSwitch):
        (WebCore::ContextFeatures::shadowDOMEnabled):
        (WebCore::ContextFeatures::styleScopedEnabled):
        (WebCore::ContextFeatures::pagePopupEnabled):
        (WebCore::provideContextFeaturesTo):
        (WebCore::provideContextFeaturesToDocumentFrom):
        * dom/ContextFeatures.h: Added.
        (WebCore):
        (ContextFeatures):
        (WebCore::ContextFeatures::ContextFeatures):
        (WebCore::ContextFeatures::hostDestroyed):
        (ContextFeaturesClient):
        (WebCore::ContextFeaturesClient::~ContextFeaturesClient):
        (WebCore::ContextFeaturesClient::isEnabled):
        (WebCore::ContextFeatures::create):
        (WebCore::ContextFeatures::isEnabled):
        * dom/DOMAllInOne.cpp:
        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::createDocument):
        (WebCore::DOMImplementation::createHTMLDocument):
        * dom/Document.h:
        (WebCore::Document::contextFeatures):
        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore::Document::setContextFeatures):
        * dom/Position.cpp:
        (WebCore::Position::Position):
        (WebCore::Position::findParent):
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::getSelection):
        * dom/make_names.pl:
        (printConstructorInterior):
        (printFactoryCppFile):
        (printWrapperFunctions):
        (printWrapperFactoryCppFile):
        * editing/markup.cpp:
        (WebCore::createFragmentFromMarkupWithContext):
        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::registerWithScopingNode):
        (WebCore::HTMLStyleElement::unregisterWithScopingNode):
        * html/shadow/HTMLContentElement.cpp:
        (WebCore::contentTagName):
        * inspector/DOMPatchSupport.cpp:
        (WebCore::DOMPatchSupport::patchDocument):
        * loader/FrameLoaderClient.h:
        * platform/RefCountedSupplement.h: Copied from Source/WebCore/platform/Supplementable.h.
        (WebCore):
        (RefCountedSupplement):
        (WebCore::RefCountedSupplement::hostDestroyed):
        (Wrapper):
        (WebCore::RefCountedSupplement::Wrapper::Wrapper):
        (WebCore::RefCountedSupplement::Wrapper::~Wrapper):
        (WebCore::RefCountedSupplement::Wrapper::wrapped):
        (WebCore::RefCountedSupplement::provideTo):
        (WebCore::RefCountedSupplement::from):
        * platform/Supplementable.h:
        (WebCore::Supplement::isRefCountedWrapper):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::responseXML):

2012-06-12  Kent Tamura  <tkent@chromium.org>

        Remove unnecessary functions: setName() and formControlName()
        https://bugs.webkit.org/show_bug.cgi?id=88392

        Reviewed by Kentaro Hara.

        'name' IDL attributes of form-related elements should be [Reflected],
        and we don't need to have setName(). We used formControlName() for
        name() implementation, and formControlName() is not needed because it
        just converts a null attribute to an empty string. Our binding code does it.

        We don't remove FormAssociatedElement::name() because many C++ code use it.

        FormAssociatedElement::name() is virtual, and HTMLInputElement overrides
        it so that it returns a cache of the name attribtue value because
        CheckedRadioButtons class needs to know an old name attribute value when
        the name attribtue is changed.

        References:
        http://www.whatwg.org/specs/web-apps/current-work/multipage/the-iframe-element.html#dom-object-name
        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#dom-form-name
        http://www.whatwg.org/specs/web-apps/current-work/multipage/association-of-controls-and-forms.html#dom-fe-name

        Test: fast/forms/name-attribute.html

        * dom/Element.h: Remove formControlName().
        * html/FormAssociatedElement.cpp:
        (WebCore::FormAssociatedElement::name):
        Copied from formControlName() implementation of HTMLFormControlElement.
        * html/FormAssociatedElement.h:
        (FormAssociatedElement): Make name() virtual, remove formControlName().
        * html/FormController.cpp:
        (WebCore::FormController::formElementsState):
        Use name() instead of formControlName().
        * html/HTMLFormControlElement.cpp:
        Remove formControlName() and setName().
        * html/HTMLFormControlElement.h: ditto.
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::name): Renamed from formControlName().
        * html/HTMLInputElement.h:
        (HTMLInputElement): Renamed formControlName() to name(), and make it public.
        * html/HTMLKeygenElement.idl: Make 'name' [Reflected].
        * html/HTMLObjectElement.cpp: Remove formControlName().
        * html/HTMLObjectElement.h: ditto.
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::appendFormData):
        Use name() instead of formControlName().
        * html/HTMLSelectElement.idl: Make 'name' [Reflected].
        * html/HTMLTextAreaElement.idl: Make 'name' [Reflected].

2012-06-11  Nico Weber  <thakis@chromium.org>

        Remove unused member variables found by clang's -Wunused-private-field
        https://bugs.webkit.org/show_bug.cgi?id=88812

        Reviewed by Anders Carlsson.

        Change a few |class|s that were used only to pin down the size of
        existing classes to |struct|, so that clang doesn't warn about these
        memvars.

        No intended behavior change.

        * Modules/geolocation/GeolocationController.cpp:
        (WebCore::GeolocationController::GeolocationController):
        * Modules/geolocation/GeolocationController.h:
        (GeolocationController):
        * Modules/webaudio/AudioContext.h:
        (AudioContext):
        * Modules/webaudio/AudioParamTimeline.h:
        (AudioParamTimeline):
        * accessibility/AccessibilityScrollbar.h:
        (AccessibilityScrollbar):
        * bindings/v8/ScriptScope.cpp:
        (WebCore::ScriptScope::ScriptScope):
        * bindings/v8/ScriptScope.h:
        (ScriptScope):
        * css/CSSValue.cpp:
        * css/StylePropertySet.cpp:
        * dom/DeviceOrientationController.cpp:
        (WebCore::DeviceOrientationController::DeviceOrientationController):
        * dom/DeviceOrientationController.h:
        (DeviceOrientationController):
        * editing/ReplaceSelectionCommand.cpp:
        (ReplacementFragment):
        (WebCore::ReplacementFragment::ReplacementFragment):
        * editing/TextIterator.cpp:
        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
        * editing/TextIterator.h:
        (SimplifiedBackwardsTextIterator):
        (BackwardsCharacterIterator):
        * html/HTMLFormCollection.cpp:
        (WebCore::HTMLFormCollection::HTMLFormCollection):
        * html/HTMLFormCollection.h:
        (HTMLFormCollection):
        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement):
        * html/shadow/MediaControlElements.h:
        (MediaControlFullscreenButtonElement):
        * html/shadow/MediaControlRootElementChromium.cpp:
        (WebCore::MediaControlRootElementChromium::MediaControlRootElementChromium):
        * html/shadow/MediaControlRootElementChromium.h:
        (MediaControlRootElementChromium):
        * html/track/LoadableTextTrack.cpp:
        (WebCore::LoadableTextTrack::LoadableTextTrack):
        * html/track/LoadableTextTrack.h:
        (LoadableTextTrack):
        * inspector/CodeGeneratorInspector.py:
        (Generator.go):
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::InspectorCSSAgent):
        * inspector/InspectorCSSAgent.h:
        (InspectorCSSAgent):
        * inspector/InspectorDOMDebuggerAgent.cpp:
        (WebCore::InspectorDOMDebuggerAgent::InspectorDOMDebuggerAgent):
        * inspector/InspectorDOMDebuggerAgent.h:
        (InspectorDOMDebuggerAgent):
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore::InspectorMemoryAgent::InspectorMemoryAgent):
        * inspector/InspectorMemoryAgent.h:
        (InspectorMemoryAgent):
        * notifications/NotificationController.cpp:
        (WebCore::NotificationController::NotificationController):
        * notifications/NotificationController.h:
        (NotificationController):
        * page/animation/CompositeAnimation.h:
        (WebCore::CompositeAnimation::CompositeAnimation):
        (CompositeAnimation):
        * platform/Length.cpp:
        * platform/audio/ReverbConvolver.cpp:
        (WebCore::ReverbConvolver::ReverbConvolver):
        * platform/audio/ReverbConvolver.h:
        (ReverbConvolver):
        * platform/audio/ReverbConvolverStage.cpp:
        (WebCore::ReverbConvolverStage::ReverbConvolverStage):
        * platform/audio/ReverbConvolverStage.h:
        (ReverbConvolverStage):
        * platform/graphics/TextRun.cpp:
        (ExpectedTextRunSize):
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (CCThreadProxy):
        * platform/graphics/filters/FECustomFilter.cpp:
        (WebCore::FECustomFilter::FECustomFilter):
        * platform/graphics/filters/FECustomFilter.h:
        (FECustomFilter):
        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
        (JPEGImageReader):
        * platform/leveldb/LevelDBTransaction.cpp:
        (WebCore::LevelDBTransaction::TreeIterator::next):
        * platform/text/TextCodecICU.cpp:
        (WebCore::TextCodecICU::TextCodecICU):
        * platform/text/TextCodecICU.h:
        (TextCodecICU):
        * rendering/InlineBox.cpp:
        * rendering/InlineFlowBox.cpp:
        * rendering/RenderText.cpp:
        * rendering/style/KeyframeList.h:
        (WebCore::KeyframeList::KeyframeList):
        (KeyframeList):
        * rendering/svg/RenderSVGTextPath.cpp:
        (WebCore::RenderSVGTextPath::RenderSVGTextPath):
        * rendering/svg/RenderSVGTextPath.h:
        * rendering/svg/SVGInlineTextBox.cpp:
        * svg/SVGPathByteStreamSource.cpp:
        * svg/SVGPathByteStreamSource.h:
        * svg/SVGPathTraversalStateBuilder.cpp:
        (WebCore::SVGPathTraversalStateBuilder::SVGPathTraversalStateBuilder):
        * svg/SVGPathTraversalStateBuilder.h:
        (SVGPathTraversalStateBuilder):
        * xml/XSLStyleSheet.h:

2012-06-11  Kinuko Yasuda  <kinuko@chromium.org>

        XHR returns size==0 Blob
        https://bugs.webkit.org/show_bug.cgi?id=88750

        Reviewed by Alexey Proskuryakov.

        Response Blob's .size field must have the correct response size.

        Test: http/tests/xmlhttprequest/response-blob-size.html

        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::responseBlob):

2012-06-11  Silvia Pfeiffer  <silviapf@chromium.org>

        Introduce an Enclosure Element for Chromium video controls.
        https://bugs.webkit.org/show_bug.cgi?id=87683

        Reviewed by Eric Carlson.

        Updated tests.

        The Chrome video controls are receiving a visual update. A new enclosure div is required
        to provide for a offset space from the video's boundaries. The visual update itself is in
        a separate patch.

        * css/mediaControlsChromium.css:
        (video::-webkit-media-controls-enclosure):
        Introduce CSS for enclosure div so it doesn't show yet.
        * html/shadow/MediaControlRootElementChromium.cpp:
        (WebCore::MediaControlChromiumEnclosureElement::MediaControlChromiumEnclosureElement):
        Definition of the new enclosure element.
        (WebCore::MediaControlChromiumEnclosureElement::create):
        Definition of a create operator for the new enclosure element.
        (WebCore::MediaControlChromiumEnclosureElement::shadowPseudoId):
        Definition of the shadowPseudoId of -webkit-media-controls-enclosure for the enclosure div.
        (WebCore::MediaControlRootElementChromium::MediaControlRootElementChromium):
        Initialize member element for enclosure div.
        (WebCore::MediaControlRootElementChromium::create):
        Instantiate enclosure div and add into DOM between controls and panel elements.
        (WebCore::MediaControlRootElementChromium::setMediaController):
        Set media controller for enclosure div.
        (WebCore::MediaControlRootElementChromium::createTextTrackDisplay):
        Insert text track display container to enclosure rather than panel.
        * html/shadow/MediaControlRootElementChromium.h:
        (WebCore):
        (MediaControlChromiumEnclosureElement):
        (WebCore::MediaControlChromiumEnclosureElement::setMediaController):
        (WebCore::MediaControlChromiumEnclosureElement::mediaController):
        (WebCore::MediaControlChromiumEnclosureElement::isMediaControlElement):
        Add declaration of the new enclosure element and its member functions.
        (MediaControlRootElementChromium):
        Add member variable to controls root element to hold the enclosure element.

2012-06-11  Elliott Sprehn  <esprehn@gmail.com>

        WebKit doesn't allow replacing the document element with a DocumentFragment containing one element
        https://bugs.webkit.org/show_bug.cgi?id=88681

        Reviewed by Ojan Vafai.

        Fix bug where replacing an immediate child of a Document with a DocumentFragment
        would throw a HIERARCHY_REQUEST_ERR instead of replacing the node as required by DOM4.
        http://www.w3.org/TR/domcore/#mutation-algorithms

        * dom/Document.cpp:
        (WebCore::Document::canReplaceChild):
            When the newChild was a DocumentFragment we incorrectly
            iterated over the document's children twice instead of the
            fragment when counting the total number of elements and
            doctypes to enfoce that there's only one of each.

2012-06-11  Mary Wu  <mary.wu@torchmobile.com.cn>

        [BlackBerry] Add handling of notifyDataReceived in NetworkJob even there's no data inside
        https://bugs.webkit.org/show_bug.cgi?id=88773

        Reviewed by Rob Buis.

        Handling notifyDataReceived event even if there is no data inside.
        This event was critical because it gives downloadFilterStream a chance
        to follow up NetworkStream close event, and it also make pluginView in
        FrameLoaderBlackBerry return normal logic.

        RIM PR# 164563

        Reviewed internally by Leo Yang.

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::handleNotifyDataReceived):

2012-06-11  Mary Wu  <mary.wu@torchmobile.com.cn>

        [BlackBerry] Wrong mimetype for empty file link
        https://bugs.webkit.org/show_bug.cgi?id=88642

        Reviewed by Rob Buis.

        RIM PR# 164164

        For empty file link, we shouldn't give "application/octet-stream"
        which will lead to download.

        Reviewed internally by Charles Wei.

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::sendResponseIfNeeded):

2012-06-11  Jin Yang  <jin.a.yang@intel.com>

        GeneratorGeneratedImage should cache images for the non-tiled case
        https://bugs.webkit.org/show_bug.cgi?id=87094

        Reviewed by Simon Fraser.

        We cache the generated image if generator is not changed. By compared
        with generating image on the fly, it will lose a little pixel precision
        and several layout tests should be rebaselined. With this patch, the IE test
        drive benchmark "Bayou" can gain about 50%.

        No new tests. Performance optimization.

        * platform/graphics/GeneratorGeneratedImage.cpp:
        (WebCore::GeneratorGeneratedImage::draw):

2012-06-11  Vincent Scheib  <scheib@chromium.org>

        Add new Pointer Lock spec attribute webkitPointerLockElement.
        https://bugs.webkit.org/show_bug.cgi?id=88799

        Reviewed by Dimitri Glazkov.

        Part of a series of refactoring changes to update pointer lock API to
        the fullscreen locking style. https://bugs.webkit.org/show_bug.cgi?id=84402

        New attribute webkitPointerLockElement added. Follow up patches
        will remove the previous isLocked attribute. Tests updated to use
        the new attribute.

        * bindings/generic/RuntimeEnabledFeatures.h:
        (WebCore::RuntimeEnabledFeatures::webkitPointerLockElementEnabled):
        * dom/Document.cpp:
        (WebCore):
        (WebCore::Document::webkitPointerLockElement):
        * dom/Document.h:
        (Document):
        * dom/Document.idl:
        * page/PointerLockController.h:
        (WebCore::PointerLockController::element):

2012-06-11  Vincent Scheib  <scheib@chromium.org>

        Consolidate Pointer Lock runtime enabled flags to just one.
        https://bugs.webkit.org/show_bug.cgi?id=88810

        Reviewed by Dimitri Glazkov.

        No new tests.

        * bindings/generic/RuntimeEnabledFeatures.h:
        (WebCore::RuntimeEnabledFeatures::pointerLockEnabled):
        (WebCore::RuntimeEnabledFeatures::setPointerLockEnabled):
        * dom/MouseEvent.idl:
        * page/Navigator.idl:

2012-06-11  Alexis Menard  <alexis.menard@openbossa.org>

        [CSS3 Backgrounds and Borders] Protect box-decoration-break behind a feature flag.
        https://bugs.webkit.org/show_bug.cgi?id=88804

        Reviewed by Tony Chang.

        Protect box-decoration-break behind a feature flag enabled by default.

        No new tests : no behavior change here.

        * Configurations/FeatureDefines.xcconfig:
        * GNUmakefile.am:
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore):
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSValueKeywords.in:
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleBoxData.cpp:
        (WebCore::StyleBoxData::StyleBoxData):
        (WebCore::StyleBoxData::operator==):
        * rendering/style/StyleBoxData.h:
        (StyleBoxData):

2012-06-11  James Robinson  <jamesr@chromium.org>

        [chromium] Port DrawingBufferChromium from TextureLayerChromium over to WebExternalTextureLayer
        https://bugs.webkit.org/show_bug.cgi?id=86273

        Reviewed by Adrienne Walker.

        This converts more WebCore code over to using public APIs instead of internal compositor layer types.

        Refactor only, no change in behavior thus no new tests.

        * platform/graphics/chromium/DrawingBufferChromium.cpp:
        (WebCore::DrawingBufferPrivate::DrawingBufferPrivate):
        (WebCore::DrawingBufferPrivate::~DrawingBufferPrivate):
        (WebCore::DrawingBufferPrivate::layer):
        (DrawingBufferPrivate):
        * platform/graphics/chromium/TextureLayerChromium.cpp:
        (WebCore::TextureLayerChromium::~TextureLayerChromium):
        (WebCore::TextureLayerChromium::setRateLimitContext):
        (WebCore::TextureLayerChromium::setNeedsDisplayRect):
        (WebCore::TextureLayerChromium::update):
        * platform/graphics/chromium/TextureLayerChromium.h:
        (WebKit):
        (TextureLayerChromiumClient):

2012-06-11  Max Feil  <mfeil@rim.com>

        [BlackBerry] Seek calls are being unnecessarily delayed
        https://bugs.webkit.org/show_bug.cgi?id=88732

        Reviewed by Antonio Gomes.

        There is a problem with the way the m_userDrivenSeekTimer is
        implemented. When MediaPlayerPrivate::seek() is called, there
        is always a 100ms delay even if the timer is not running. The
        timer is supposed to space out (i.e. throttle) repeated seeks
        that come in too soon after a previous seek, but currently it
        is slowing down even single seeks and seeks that come in with
        adequate delay after a previous seek. I fixed this in my patch
        by improving the way the timer fired function is called.
        
        A note on the new m_lastSeekTimePending flag: This flag is
        needed so that userDrivenSeekTimerFired() knows whether or not
        to perform the seek. The only case where this flag will not be
        set is if no MediaPlayerPrivate::seek() call came in while the
        timer was active, in which case it's important to do nothing.
        I could encode this flag's information into the m_lastSeekTime
        float, for example by initializing it and resetting it to NAN
        and using isnan(). But I feel that using a separate bool is a
        more portable approach.

        No new tests. I would like to propose not including a layout test
        with this fix. Doing timing tests for 100ms delays is tricky
        from Javascript, and I don't think the benefit of such a test
        outweighs the extra time it would take to develop one. The test
        would also be a problem to maintain as it may give different
        results over different runs and across different target hardware.

        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
        (WebCore::MediaPlayerPrivate::seek):
        (WebCore::MediaPlayerPrivate::userDrivenSeekTimerFired):
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
        (MediaPlayerPrivate):

2012-06-11  Max Feil  <mfeil@rim.com>

        [BlackBerry] Unexpected repeats of short media
        https://bugs.webkit.org/show_bug.cgi?id=88733

        Reviewed by Antonio Gomes.

        The m_userDrivenSeekTimer is causing unwanted repeats of short
        media such as sound effects because it is causing the current
        time to not reflect that the media has finished playing.
        This problem only affects media whose duration is close to
        or less than the SeekSubmissionDelay, which is currently
        set to 100ms. My fix is to ignore the userDrivenSeekTimer in
        MediaPlayerPrivate::currentTime() if the duration of the media
        is within twice the SeekSubmissionDelay. Seek drag smoothness
        is a non-issue for such short media.

        Test: platform/blackberry/media/short-media-repeats-correctly.html

        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
        (WebCore):
        (WebCore::MediaPlayerPrivate::currentTime):
        (WebCore::MediaPlayerPrivate::seek):
        (WebCore::MediaPlayerPrivate::userDrivenSeekTimerFired):
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
        (MediaPlayerPrivate):

2012-06-11  Julien Chaffraix  <jchaffraix@webkit.org>

        Account for margin after when laying out <legend> element
        https://bugs.webkit.org/show_bug.cgi?id=35981

        Reviewed by Abhishek Arya.

        Tests: fast/forms/legend-after-margin-horizontal-writing-mode.html
               fast/forms/legend-after-margin-vertical-writing-mode.html
               fast/forms/legend-after-margin-with-before-border-horizontal-mode.html
               fast/forms/legend-small-after-margin-before-border-horizontal-mode.html

        The existing code would ignore margin after when layouting out the <legend>. This
        change only adds the code to handle the margin after, the margin before is still
        ignored as it's not obvious how it should be working.

        * rendering/RenderFieldset.cpp:
        (WebCore::RenderFieldset::layoutSpecialExcludedChild):
        Split the code in 2 code paths to reflect how we position and size. Those are covered by the
        tests above.

2012-06-11  James Robinson  <jamesr@chromium.org>

        [chromium] Use WebGraphicsContext3D in rate limiting logic inside compositor
        https://bugs.webkit.org/show_bug.cgi?id=86259

        Reviewed by Adrienne Walker.

        This refactors the compositor's rate limiting implementation to use the Platform API's WebGraphicsContext3D
        directly instead of WebCore::GraphicsContext3D to cut down on the number of spurious WebCore dependencies in the
        compositor.  The one change in contract is that the caller to CCLayerTreeHost::startRateLimit() now has to call
        CCLayerTreeHost::stopRateLimit() before allowing the referenced context to go away since CCLayerTreeHost no
        longer retains a reference, but this was always happening already.

        * platform/graphics/chromium/Canvas2DLayerChromium.cpp:
        (WebCore::Canvas2DLayerChromium::~Canvas2DLayerChromium):
        (WebCore::Canvas2DLayerChromium::setNeedsDisplayRect):
        * platform/graphics/chromium/RateLimiter.cpp:
        (WebCore::RateLimiter::create):
        (WebCore::RateLimiter::RateLimiter):
        (WebCore::RateLimiter::start):
        (WebCore::RateLimiter::rateLimitContext):
        * platform/graphics/chromium/RateLimiter.h:
        (WebKit):
        (RateLimiter):
        * platform/graphics/chromium/TextureLayerChromium.cpp:
        (WebCore::TextureLayerChromium::~TextureLayerChromium):
        (WebCore::TextureLayerChromium::setRateLimitContext):
        (WebCore::TextureLayerChromium::setNeedsDisplayRect):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::startRateLimiter):
        (WebCore::CCLayerTreeHost::stopRateLimiter):
        (WebCore::CCLayerTreeHost::rateLimit):
        (WebCore):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHost):

2012-06-11  Dana Jansens  <danakj@chromium.org>

        [chromium] Separate CCVideoDrawQuad and from the layer tree and video provider by removing ManagedTexture and WebVideoFrame pointers from the quad
        https://bugs.webkit.org/show_bug.cgi?id=88363

        Reviewed by Adrienne Walker.

        CCVideoDrawQuad should not contain any pointers to data in the layer
        tree so we are able to serialize it across process boundaries. This
        patch removes the ManagedTexture pointers from the quad class,
        replacing them with texture ids. It removes the WebVideoFrame* from
        the quad, replacing it with the frame provider's texture id included
        in the WebVideoFrame structure. And it uses a WebTransformationMatrix
        instead of a pointer to an array of floats.

        Texture allocation is done in CCVideoLayerImpl via the
        contentsTextureAllocator, so that the memory usage can be tracked.

        We move the copyPlaneToTextures() method back from LayerRendererChromium
        to CCVideoLayerImpl, as this method uses the texture data pointer in the
        WebVideoFrame, and we do not want to give this pointer to the quad
        class. Instead, this method makes use of the LayerTextureSubImage class
        to copy the pixel data into the texture.

        LayerTextureSubImage is updated to allow non-4byte texture formats.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawYUV):
        (WebCore::LayerRendererChromium::drawRGBA):
        (WebCore::LayerRendererChromium::drawNativeTexture2D):
        (WebCore::LayerRendererChromium::drawStreamTexture):
        (WebCore::LayerRendererChromium::drawVideoQuad):
        * platform/graphics/chromium/LayerTextureSubImage.cpp:
        (WebCore::LayerTextureSubImage::uploadWithTexSubImage):
        (WebCore::LayerTextureSubImage::uploadWithMapTexSubImage):
        * platform/graphics/chromium/TextureCopier.cpp:
        * platform/graphics/chromium/cc/CCVideoDrawQuad.cpp:
        (WebCore::CCVideoDrawQuad::create):
        (WebCore::CCVideoDrawQuad::CCVideoDrawQuad):
        * platform/graphics/chromium/cc/CCVideoDrawQuad.h:
        (CCVideoDrawQuad):
        (WebCore::CCVideoDrawQuad::planes):
        (WebCore::CCVideoDrawQuad::frameProviderTextureId):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
        (WebCore::CCVideoLayerImpl::willDraw):
        (WebCore::CCVideoLayerImpl::willDrawInternal):
        (WebCore::CCVideoLayerImpl::appendQuads):
        (WebCore::CCVideoLayerImpl::didDraw):
        (WebCore::CCVideoLayerImpl::FramePlane::allocateData):
        (WebCore):
        (WebCore::CCVideoLayerImpl::FramePlane::freeData):
        (WebCore::CCVideoLayerImpl::allocatePlaneData):
        (WebCore::CCVideoLayerImpl::copyPlaneData):
        (WebCore::CCVideoLayerImpl::freePlaneData):
        (WebCore::CCVideoLayerImpl::freeUnusedPlaneData):
        (WebCore::CCVideoLayerImpl::didLoseContext):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
        (FramePlane):
        (WebCore::CCVideoLayerImpl::FramePlane::FramePlane):

2012-06-11  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Object stores are not successfully deleted
        https://bugs.webkit.org/show_bug.cgi?id=88788

        Reviewed by Tony Chang.

        Discovered while working on http://webkit.org/b/83074 - object stores are not
        being deleted from the backing store. Deletion would succeed in the in-memory
        data structures, but after closing/re-opening the backing store the object store
        (but not its indexes/data) would reappear. Due to 83074, this isn't detectable
        by DRT without a full restart.

        Test: [chromium] webkit_unit_tests --gtest_filter='IDBLevelDBCodingTest.ComparisonTest'

        * Modules/indexeddb/IDBLevelDBCoding.cpp:
        (WebCore::IDBLevelDBCoding::ObjectStoreMetaDataKey::compare):

2012-06-05  Eric Uhrhane <ericu@chromium.org>

        Crash in fast/files/read tests during Garbage Collection
        https://bugs.webkit.org/show_bug.cgi?id=87165

        Reviewed by Michael Saboff

        Fix previous fix for hasPendingActivity, and fix a bug in a complex
        abort case as well--abort during the final progress event of a write
        would hang the writer.

        * Modules/filesystem/FileWriter.cpp:
        (WebCore::FileWriter::stop):
        (WebCore::FileWriter::write):
        (WebCore::FileWriter::truncate):
        (WebCore::FileWriter::didWrite):
        (WebCore::FileWriter::didTruncate):
        (WebCore::FileWriter::didFail):
        (WebCore::FileWriter::completeAbort):
        (WebCore::FileWriter::doOperation):
        (WebCore::FileWriter::signalCompletion):

2012-06-11  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Implement position:fixed in compositor thread
        https://bugs.webkit.org/show_bug.cgi?id=70103

        Reviewed by Adrienne Walker.

        Significant contributions to this patch by Alpha Lam and Sami Kyostila.

        This patch is the compositor-side change that adds support for
        fixed-position layers to be composited layers. Before this patch,
        fixed-position elements were positioned only by WebCore (i.e. main
        thread when painting), and the compositor did not have enough
        knowledge on its own to position it properly. This patch adds the
        necessary math and plumbs the necessary layer information so that
        the impl thread can properly position fixed-position elements on
        its own. This support is necessary for correctness of composited
        fixed-position elements, which can greatly help to avoid
        repainting container layers when scrolling with a fixed-position
        layer.

        There also needs to be WebCore-side support for this, which is
        addressed in https://bugs.webkit.org/show_bug.cgi?id=78864

        Unit tests added to CCLayerTreeHostCommonTest:
          CCLayerTreeHostCommonTest.verifyScrollCompensationForFixedPositionLayerWithDirectContainer
          CCLayerTreeHostCommonTest.verifyScrollCompensationForFixedPositionLayerWithTransformedDirectContainer
          CCLayerTreeHostCommonTest.verifyScrollCompensationForFixedPositionLayerWithDistantContainer
          CCLayerTreeHostCommonTest.verifyScrollCompensationForFixedPositionLayerWithDistantContainerAndTransforms
          CCLayerTreeHostCommonTest.verifyScrollCompensationForFixedPositionLayerWithMultipleScrollDeltas
          CCLayerTreeHostCommonTest.verifyScrollCompensationForFixedPositionLayerWithIntermediateSurfaceAndTransforms
          CCLayerTreeHostCommonTest.verifyScrollCompensationForFixedPositionLayerWithMultipleIntermediateSurfaces
          CCLayerTreeHostCommonTest.verifyScrollCompensationForFixedPositionLayerWithContainerLayerThatHasSurface
          CCLayerTreeHostCommonTest.verifyScrollCompensationForFixedPositionLayerThatIsAlsoFixedPositionContainer
          CCLayerTreeHostCommonTest.verifyScrollCompensationForFixedPositionLayerThatHasNoContainer

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::LayerChromium):
        (WebCore::LayerChromium::pushPropertiesTo):
        * platform/graphics/chromium/LayerChromium.h:
        (WebCore::LayerChromium::setIsContainerForFixedPositionLayers):
        (WebCore::LayerChromium::isContainerForFixedPositionLayers):
        (LayerChromium):
        (WebCore::LayerChromium::setFixedToContainerLayerVisibleRect):
        (WebCore::LayerChromium::fixedToContainerLayerVisibleRect):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore::CCLayerImpl::setIsContainerForFixedPositionLayers):
        (WebCore::CCLayerImpl::isContainerForFixedPositionLayers):
        (CCLayerImpl):
        (WebCore::CCLayerImpl::setFixedToContainerLayerVisibleRect):
        (WebCore::CCLayerImpl::fixedToContainerLayerVisibleRect):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::computeScrollCompensationForThisLayer):
        (WebCore):
        (WebCore::computeScrollCompensationMatrixForChildren):
        (WebCore::calculateDrawTransformsInternal):
        (WebCore::CCLayerTreeHostCommon::calculateDrawTransforms):

2012-06-11  Sam Weinig  <sam@webkit.org>

        Remove support for disconnected/excluded from search frames, they are not used by Safari anymore
        https://bugs.webkit.org/show_bug.cgi?id=88723

        Reviewed by Dan Bernstein.

        * WebCore.exp.in:
        Update export.
        * editing/Editor.cpp:
        (WebCore::Editor::rangeOfString):
        (WebCore::Editor::countMatchesForText):
        * editing/Editor.h:
        (Editor):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::findFrameForNavigation):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::parent):
        (WebCore::DOMWindow::top):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::hitTestResultAtPoint):
        * page/Frame.cpp:
        (WebCore::Frame::Frame):
        * page/Frame.h:
        (Frame):
        * page/FrameTree.cpp:
        (WebCore::FrameTree::parent):
        (WebCore::FrameTree::top):
        * page/FrameTree.h:
        (FrameTree):
        * page/Location.cpp:
        (WebCore::Location::ancestorOrigins):
        * xml/XMLTreeViewer.cpp:
        (WebCore::XMLTreeViewer::hasNoStyleInformation):
        Update for the removal of disconnected frames and text search exclusions concepts.

2012-06-11  Xianzhu Wang  <wangxianzhu@chromium.org>

        SVGImageCache leaks image data
        https://bugs.webkit.org/show_bug.cgi?id=87792

        There are two functions to remove a client from a CachedImage:
        - CachedResource::removeClient()
        - CachedImage::removeClientForRenderer().
        It's easy to make error to call the former which will leak the cached
        image buffers in SVGImageCache.

        This change combined the two by adding the virtual 
        CachedResource::didRemoveClient(). CachedImage will do SVGImageCache
        cleanup in the function.

        Reviewed by Nikolas Zimmermann.

        Test: svg/as-image/svg-image-leak-cached-data.html

        * loader/cache/CachedFont.h:
        (WebCore::CachedFontClient::resourceClientType): Added 'const'.
        * loader/cache/CachedImage.cpp:
        (WebCore):
        (WebCore::CachedImage::didRemoveClient): Removes the client from SVGImageCache.
        (WebCore::CachedImage::lookupOrCreateImageForRenderer):
        * loader/cache/CachedImage.h:
        (CachedImage):
        (WebCore::CachedImageClient::resourceClientType): Added 'const'.
        * loader/cache/CachedRawResource.h:
        (WebCore::CachedRawResourceClient::resourceClientType): Added 'const'.
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::removeClient): Added invocation of didRemoveClient().
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::didRemoveClient): Added for subclasses to do additional works.
        * loader/cache/CachedResourceClient.h:
        (WebCore::CachedResourceClient::resourceClientType): Added 'const'.
        * loader/cache/CachedSVGDocument.h:
        (WebCore::CachedSVGDocumentClient::resourceClientType): Added 'const'.
        * loader/cache/CachedStyleSheetClient.h:
        (WebCore::CachedStyleSheetClient::resourceClientType): Added 'const'.
        * rendering/style/StyleCachedImage.cpp:
        (WebCore::StyleCachedImage::removeClient):
        * rendering/style/StyleCachedImageSet.cpp:
        (WebCore::StyleCachedImageSet::removeClient):
        * svg/graphics/SVGImageCache.cpp:
        (WebCore::SVGImageCache::~SVGImageCache): Added checking for leaks.
        (WebCore::SVGImageCache::removeClientFromCache):
        (WebCore::SVGImageCache::setRequestedSizeAndScales): 
        (WebCore::SVGImageCache::requestedSizeAndScales):
        (WebCore::SVGImageCache::lookupOrCreateBitmapImageForClient):
        * svg/graphics/SVGImageCache.h:
        (WebCore):
        (SVGImageCache):

2012-06-11  Mark Pilgrim  <pilgrim@chromium.org>

        [Chromium] Call shared timer functions directly
        https://bugs.webkit.org/show_bug.cgi?id=88781

        Reviewed by Adam Barth.

        Part of a refactoring series. See tracking bug 82948.

        * platform/chromium/PlatformSupport.h:
        (PlatformSupport):
        * platform/chromium/SharedTimerChromium.cpp:
        (WebCore::setSharedTimerFiredFunction):
        (WebCore::setSharedTimerFireInterval):

2012-06-11  Pravin D  <pravind.2k4@gmail.com>

        Relative pos. input fields in columns vanish when you start typing in them
        https://bugs.webkit.org/show_bug.cgi?id=76834

        Reviewed by Julien Chaffraix.

        Test: fast/multicol/multicol-with-child-renderLayer-for-input.html

        * page/FrameView.cpp:
        (WebCore::updateLayerPositionFlags):
        Helper function to prepare the UpdateLayerPositionsFlags based on the input parameters.
        If didFullRepaint flag is set, then CheckForRepaints flag is removed from the default flags.
        Also during a relayout of a subtree, if the RenderLayer of the subtree root is paginated then updatePagination flag is
        included in the flags. 

        (WebCore):
        (WebCore::FrameView::layout):
        Now uses the helper function updateLayerPositionFlags() to get the final set of UpdateLayerPositionsFlags.

        * rendering/RenderLayer.h:
        (WebCore::RenderLayer::isPaginated):
        (RenderLayer):
        isPaginated function is made public so that FrameView class can use it prepare UpdateLayerPositionsFlags.

2012-06-11  Mark Pilgrim  <pilgrim@chromium.org>

        [Chromium] Remove some dead code in PasteboardChromium
        https://bugs.webkit.org/show_bug.cgi?id=88782

        Reviewed by Adam Barth.

        Part of a refactoring series. See tracking bug 82948.
        Leftover detritus from bug 88038.

        * platform/chromium/PasteboardChromium.cpp:
        (WebCore::Pasteboard::documentFragment):

2012-06-11  Peter Beverloo  <peter@chromium.org>

        [Chromium] Theme updates for Android in menu list rendering and selection backgrounds
        https://bugs.webkit.org/show_bug.cgi?id=88775

        Reviewed by Adam Barth.

        For Chrome on Android, use the width of the scrollbar down arrow instead
        of the scrollbar's width for determining the arrow padding to apply for
        menu list rendering, as WebKit isn't drawing a scrollbar (thus width=0).

        Furthermore, change the default active selection background color to be
        equal to the tap highlighting color.

        These changes should be covered by existing layout tests.

        * rendering/RenderThemeChromiumAndroid.cpp:
        (WebCore::RenderThemeChromiumAndroid::menuListArrowPadding):
        (WebCore): Retrieve the scrollbar down arrow's size via PlatformSupport.
        * rendering/RenderThemeChromiumAndroid.h: Override the menuListArrowPadding
            and platformActiveSelectionBackgroundColor methods, and add a static
            static RGBA32 color for the default active selection bg color.
        * rendering/RenderThemeChromiumSkia.cpp:
        (WebCore::RenderThemeChromiumSkia::menuListArrowPadding): Default to
            the scrollbar thickness, not changing behavior for non-Android.
        (WebCore::RenderThemeChromiumSkia::menuListInternalPadding): Instead
            of polling the scrollbar thickness, call menuListArrowPadding().
        * rendering/RenderThemeChromiumSkia.h: 
        (RenderThemeChromiumSkia): Add the menuListArrowPadding() as a protected method.

2012-06-11  David Barr  <davidbarr@chromium.org>

        Add css3-images image-resolution (dppx only)
        https://bugs.webkit.org/show_bug.cgi?id=85332

        Reviewed by Tony Chang.

        The css3-images module is at candidate recommendation.
        http://www.w3.org/TR/2012/CR-css3-images-20120417/#image-resolution

        Test: fast/css/image-resolution.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore):
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSGrammar.y:
        * css/CSSParser.cpp:
        (WebCore::CSSParser::validUnit):
        (WebCore::CSSParser::createPrimitiveNumericValue):
        (WebCore::unitFromString):
        (WebCore::CSSParser::parseValidPrimitive):
        (WebCore::CSSParser::parseValue):
        (WebCore):
        (WebCore::CSSParser::parseImageResolution):
        (WebCore::CSSParser::detectNumberToken):
        * css/CSSParser.h:
        * css/CSSPrimitiveValue.cpp:
        (WebCore::isValidCSSUnitTypeForDoubleConversion):
        (WebCore::unitCategory):
        (WebCore::CSSPrimitiveValue::canonicalUnitTypeForCategory):
        (WebCore::CSSPrimitiveValue::customCssText):
        (WebCore::CSSPrimitiveValue::cloneForCSSOM):
        * css/CSSPrimitiveValue.h:
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/StyleBuilder.cpp:
        (WebCore):
        (ApplyPropertyImageResolution):
        (WebCore::ApplyPropertyImageResolution::applyInheritValue):
        (WebCore::ApplyPropertyImageResolution::applyInitialValue):
        (WebCore::ApplyPropertyImageResolution::applyValue):
        (WebCore::ApplyPropertyImageResolution::createHandler):
        (WebCore::StyleBuilder::StyleBuilder):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::styleDidChange):
        (WebCore::RenderImage::imageDimensionsChanged):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::diff):
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleRareInheritedData.cpp:
        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
        (WebCore::StyleRareInheritedData::operator==):
        * rendering/style/StyleRareInheritedData.h:
        (StyleRareInheritedData):

2012-06-05  Dana Jansens  <danakj@chromium.org>

        [chromium] Free texture from CCIOSurfaceLayerImpl when it is destroyed
        https://bugs.webkit.org/show_bug.cgi?id=88371

        Reviewed by James Robinson.

        Unit test: CCLayerTreeHostImplTest.layersFreeTextures

        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
        (WebCore::CCIOSurfaceLayerImpl::~CCIOSurfaceLayerImpl):
        (WebCore::CCIOSurfaceLayerImpl::willDraw):

2012-06-11  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix make distcheck issues.

        * GNUmakefile.am: Add idl files in editing dir to EXTRA_DIST.
        * GNUmakefile.list.am: Add missing header file.

2012-06-11  Dan Bernstein  <mitz@apple.com>

        Reverted r119940 because it caused multiple media tests to fail on Lion.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::prepareForLoad):
        (WebCore):
        (WebCore::HTMLMediaElement::userCancelledLoad):
        * html/HTMLMediaElement.h:
        (HTMLMediaElement):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::commonMovieAttributes):

2012-06-11  Zoltan Horvath  <zoltan@webkit.org>

        [Qt] Add config tests for WEBP imagedecoder library, modify HAVE(decoderlibrary) to USE(...)$
        https://bugs.webkit.org/show_bug.cgi?id=87841

        Reviewed by Simon Hausmann.

        No new tests were needed.

        * Target.pri:
        * WebCore.pri:
        * platform/image-decoders/ImageDecoder.cpp:
        (WebCore::ImageDecoder::create):

2012-06-11  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Add QML api for setting device width and height
        https://bugs.webkit.org/show_bug.cgi?id=88777

        Reviewed by Simon Hausmann.

        Change the default values for deviceWidth/Height to be 0 (unset). The
        original values were introduced by Qt and 0 makes it possible to
        detect if a value has never been set and therefore fall back.

        Only Qt depended on the former values.

        * page/Settings.cpp:
        (WebCore::Settings::Settings):

2012-06-11  Csaba Osztrogonác  <ossy@webkit.org>

        [Qt][Win] Fix UString related build problem in Source/WebCore/bridge/qt/qt_instance.cpp
        https://bugs.webkit.org/show_bug.cgi?id=88310

        Reviewed by Simon Hausmann.

        * bridge/qt/qt_instance.cpp:
        (JSC::Bindings::QtInstance::getPropertyNames):

2012-06-11  Michael Brüning  <michael.bruning@nokia.com>

        [Qt][WK2] Compute and set cache capacities using the current CacheModel
        https://bugs.webkit.org/show_bug.cgi?id=73918

        Unreviewed build fix.

        No new tests added as this is a build fix.

        * platform/qt/FileSystemQt.cpp:

2012-06-11  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Rect-based hittesting doesn't work in tables.
        https://bugs.webkit.org/show_bug.cgi?id=86605

        Reviewed by Julien Chaffraix.

        The existing code only performed a single binary lookup for the central
        hit-test point. This meant area-based hit-testing did not work across
        table-cell borders. All cells spanned by a hit-test area must be hit
        tested.

        This patch introduces three auxilary functions to help calculate rows
        and columns spanned by an rect. These are intended to also be used by
        repaint logic in a later patch.

        For point-based hit-testing we maintain unchanged behavior and still
        only hit test a single column in a single row.

        Test: fast/dom/nodesFromRect-table.html

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::logicalRectForWritingModeAndDirection):
        (WebCore::RenderTableSection::spannedRows):
        (WebCore::RenderTableSection::spannedColumns):
        (WebCore::RenderTableSection::nodeAtPoint):
        * rendering/RenderTableSection.h:
        (RenderTableSection):

2012-06-11  Min Qin  <qinmin@google.com>

        Adding a flag to show fullscreen media controls in chromium
        https://bugs.webkit.org/show_bug.cgi?id=88266

        Reviewed by Adam Barth.

        The default chromium shadow DOM for media element does not contain fullscreen button.
        This change adds a flag to display the fullscreen button.
        It will be used by the android port.

        No new tests needed. We will use the same layout tests as desktop chromium.
        However, new test result expections will be added later.

        * html/shadow/MediaControlRootElementChromium.cpp:
        (WebCore::MediaControlRootElementChromium::MediaControlRootElementChromium):
        (WebCore::MediaControlRootElementChromium::create):
        (WebCore::MediaControlRootElementChromium::setMediaController):
        (WebCore::MediaControlRootElementChromium::reset):
        (WebCore::MediaControlRootElementChromium::reportedError):
        * html/shadow/MediaControlRootElementChromium.h:
        (MediaControlRootElementChromium):

2012-06-11  Michael Brüning  <michael.bruning@nokia.com>

        [Qt][WK2] Compute and set cache capacities using the current CacheModel
        https://bugs.webkit.org/show_bug.cgi?id=73918

        Reviewed by Kenneth Rohde Christiansen.

        No new tests needed / applicable (using operating system functionality).

        Added method to read free file system space for a path to support cache model
        implementation in Qt WK 2.

        * platform/FileSystem.h:
        (WebCore):
        * platform/qt/FileSystemQt.cpp:
        (WebCore::getVolumeFreeSizeForPath): Added for Qt ports.
        (WebCore):

2012-06-11  Peter Wang  <peter.wang@torchmobile.com.cn>

        [JSC] Web Inspector: implement breaking from native callback
        https://bugs.webkit.org/show_bug.cgi?id=43332

        Reviewed by Pavel Feldman.

        These test cases were enabled:
        LayoutTests/inspector/debugger/dom-breakpoints.html
        LayoutTests/inspector/debugger/event-listener-breakpoints.html
        LayoutTests/inspector/debugger/step-through-event-listeners.html
        LayoutTests/inspector/debugger/xhr-breakpoints.html

        * bindings/js/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::breakProgram):
        * bindings/js/ScriptDebugServer.h:
        (WebCore::supportsNativeBreakpoints):

2012-06-11  MORITA Hajime  <morrita@google.com>

        Spellchecker crash in async scenario.
        https://bugs.webkit.org/show_bug.cgi?id=88617

        Reviewed by Tony Chang.

        SpellCheckRequest::invokeRequest() can be reached after the frame is detached.
        SpellCheckRequest should ignore such a request since TextCheckerClient is not available
        for detached Frames.

        No new tests. It's hard to reproduce this.

        * editing/SpellChecker.cpp:
        (WebCore::SpellChecker::invokeRequest):

2012-06-11  Ryuan Choi  <ryuan.choi@samsung.com>

        [EFL] Extract CursorMap from WidgetEfl.cpp.
        https://bugs.webkit.org/show_bug.cgi?id=88633

        Reviewed by Ryosuke Niwa.

        In order to share CursorMap in WebKit/efl and UIProcess of WebKit2/Efl,
        extract it and expose getEcoreCursor.

        No new tests, refactoring only.

        * platform/efl/EflScreenUtilities.cpp:
        (WebCore):
        (CursorMap):
        (WebCore::CursorMap::cursor):
        (WebCore::CursorMap::CursorMap):
        (WebCore::getEcoreCursor):
        * platform/efl/EflScreenUtilities.h:
        (WebCore):
        * platform/efl/WidgetEfl.cpp:
        (WebCore::Widget::applyFallbackCursor):

2012-06-10  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119955.
        http://trac.webkit.org/changeset/119955
        https://bugs.webkit.org/show_bug.cgi?id=88758

        Breaks Chromium compile - Chromium depends on removed API
        (Requested by dominicc on #webkit).

        * WebCore.exp.in:
        * editing/Editor.cpp:
        (WebCore::Editor::insideVisibleArea):
        (WebCore):
        (WebCore::Editor::firstVisibleRange):
        (WebCore::Editor::lastVisibleRange):
        (WebCore::Editor::nextVisibleRange):
        (WebCore::Editor::rangeOfString):
        (WebCore::Editor::countMatchesForText):
        * editing/Editor.h:
        (Editor):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::findFrameForNavigation):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::parent):
        (WebCore::DOMWindow::top):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::hitTestResultAtPoint):
        * page/Frame.cpp:
        (WebCore::Frame::Frame):
        * page/Frame.h:
        (Frame):
        (WebCore::Frame::isDisconnected):
        (WebCore):
        (WebCore::Frame::setIsDisconnected):
        (WebCore::Frame::excludeFromTextSearch):
        (WebCore::Frame::setExcludeFromTextSearch):
        * page/FrameTree.cpp:
        (WebCore::FrameTree::parent):
        (WebCore::FrameTree::top):
        * page/FrameTree.h:
        (FrameTree):
        * page/Location.cpp:
        (WebCore::Location::ancestorOrigins):
        * xml/XMLTreeViewer.cpp:
        (WebCore::XMLTreeViewer::hasNoStyleInformation):

2012-06-08  Kinuko Yasuda  <kinuko@chromium.org>

        Using BlobBuilder should show a deprecation warning message (if it is enabled)
        https://bugs.webkit.org/show_bug.cgi?id=88644

        Reviewed by Jian Li.

        Mac has already disabled BlobBuilder, but Chromium still has it.
        We should start showing a warning to let people migrate to using Blob constructor.

        Tests: fast/files/blob-builder-crash.html

        * fileapi/WebKitBlobBuilder.cpp:
        (WebCore):
        (WebCore::WebKitBlobBuilder::create):
        * fileapi/WebKitBlobBuilder.h:
        (WebCore):
        (WebKitBlobBuilder):
        * fileapi/WebKitBlobBuilder.idl:

2012-06-10  Sam Weinig  <sam@webkit.org>

        Remove support for disconnected/excluded from search frames, they are not used by Safari anymore
        https://bugs.webkit.org/show_bug.cgi?id=88723

        Reviewed by Dan Bernstein.

        * WebCore.exp.in:
        Update export.
        * editing/Editor.cpp:
        (WebCore::Editor::rangeOfString):
        (WebCore::Editor::countMatchesForText):
        * editing/Editor.h:
        (Editor):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::findFrameForNavigation):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::parent):
        (WebCore::DOMWindow::top):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::hitTestResultAtPoint):
        * page/Frame.cpp:
        (WebCore::Frame::Frame):
        * page/Frame.h:
        (Frame):
        * page/FrameTree.cpp:
        (WebCore::FrameTree::parent):
        (WebCore::FrameTree::top):
        * page/FrameTree.h:
        (FrameTree):
        * page/Location.cpp:
        (WebCore::Location::ancestorOrigins):
        * xml/XMLTreeViewer.cpp:
        (WebCore::XMLTreeViewer::hasNoStyleInformation):
        Update for the removal of disconnected frames and text search exclusions concepts.

2012-06-07  Kinuko Yasuda  <kinuko@google.com>

        Move Quota related code out of DOMWindow and into the quota/ folder
        https://bugs.webkit.org/show_bug.cgi?id=88512

        Reviewed by Adam Barth.

        No new tests: no visible changes.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * DerivedSources.pri:
        * Modules/quota/DOMWindowQuota.cpp: Added.
        * Modules/quota/DOMWindowQuota.h: Added.
        * Modules/quota/DOMWindowQuota.idl: Added.
        * Modules/quota/StorageInfo.cpp: Renamed from Source/WebCore/storage/StorageInfo.cpp.
        * Modules/quota/StorageInfo.h: Renamed from Source/WebCore/storage/StorageInfo.h.
        * Modules/quota/StorageInfo.idl: Renamed from Source/WebCore/storage/StorageInfo.idl.
        * Modules/quota/StorageInfoErrorCallback.h: Renamed from Source/WebCore/storage/StorageInfoErrorCallback.h.
        * Modules/quota/StorageInfoErrorCallback.idl: Renamed from Source/WebCore/storage/StorageInfoErrorCallback.idl.
        * Modules/quota/StorageInfoQuotaCallback.h: Renamed from Source/WebCore/storage/StorageInfoQuotaCallback.h.
        * Modules/quota/StorageInfoQuotaCallback.idl: Renamed from Source/WebCore/storage/StorageInfoQuotaCallback.idl.
        * Modules/quota/StorageInfoUsageCallback.h: Renamed from Source/WebCore/storage/StorageInfoUsageCallback.h.
        * Modules/quota/StorageInfoUsageCallback.idl: Renamed from Source/WebCore/storage/StorageInfoUsageCallback.idl.
        * Target.pri:
        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * WebCore.pri:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.vcproj/WebCoreCommon.vsprops:
        * WebCore.vcproj/copyForwardingHeaders.cmd:
        * WebCore.xcodeproj/project.pbxproj:
        * page/DOMWindow.cpp:
        * page/DOMWindow.h:
        * page/DOMWindow.idl:

2012-06-10  Hayato Ito  <hayato@chromium.org>

        An inheritance of '-webkit-user-modify' does not stop at shadow boundary.
        https://bugs.webkit.org/show_bug.cgi?id=88514

        Reviewed by Ryosuke Niwa.

        In StyleResolver::styleForElement(), we reset '-webkit-user-modify'
        CSS property after inheriting a parent style, but that is not
        enough.  We also have to reset '-webkit-user-modify' when we use a
        cached result in applying matched properties.

        Test: fast/dom/shadow/user-modify-inheritance.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::applyMatchedProperties):
        (WebCore::StyleResolver::styleForElement):
        * css/StyleResolver.h:
        (StyleResolver):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::inheritFrom):
        * rendering/style/RenderStyle.h:

2012-06-10  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Introduce Decimal behind the InputNumber type
        https://bugs.webkit.org/show_bug.cgi?id=88383

        Reviewed by Kent Tamura.

        This patch introduces decimal arithmetic for steppable input types,
        e.g. date, datetime, number, range, and so on, to avoid rounding error
        caused by base 2 floating point representation, e.g. C/C++ double type.

        Most of decimal arithmetic calculations are implemented in StepRange
        class, replacing "double" with "Decimal", InputType::applyStep, and
        InputType::stepFromRenderer.

        Changes introduced by this patch are still intermediate state.
        Following patch will replace InputNumber type to Decimal type for
        completion of introducing decimal arithmetic.

        Test: fast/forms/range/range-value-rounding.html

        * html/BaseDateAndTimeInputType.cpp:
        (WebCore::BaseDateAndTimeInputType::serialize): Changed for Decimal type.
        (WebCore::BaseDateAndTimeInputType::serializeWithComponents): ditto.
        * html/DateInputType.cpp:
        (WebCore::DateInputType::createStepRange): Replaced NumberWithDecimalPlaces to InputNumber.
        * html/DateTimeInputType.cpp:
        (WebCore::DateTimeInputType::createStepRange): Replaced NumberWithDecimalPlaces to InputNumber.
        * html/DateTimeLocalInputType.cpp:
        (WebCore::DateTimeLocalInputType::createStepRange): Replaced NumberWithDecimalPlaces to InputNumber.
        * html/InputType.cpp:
        (WebCore::InputType::rangeUnderflow): Changed for Decimal type.
        (WebCore::InputType::rangeOverflow): Changed for Decimal type.
        (WebCore::InputType::minimum): Changed for Decimal type.
        (WebCore::InputType::maximum): ditto.
        (WebCore::InputType::isInRange): ditto.
        (WebCore::InputType::isOutOfRange): ditto.
        (WebCore::InputType::stepMismatch): ditto.
        (WebCore::InputType::validationMessage): ditto.
        (WebCore::InputType::parseToNumberOrNaN): ditto.
        (WebCore::InputType::applyStep): ditto.
        (WebCore::InputType::stepUpFromRenderer): ditto.
        * html/InputType.h:
        (InputType): Removed parseToNumberWIthDecimaplPlaces.
        * html/MonthInputType.cpp:
        (WebCore::MonthInputType::createStepRange): Changed for Decimal type.
        * html/NumberInputType.cpp:
        (WebCore::RealNumberRenderSize): Added for calculateRenderSize.
        (WebCore::calculateRenderSize): Added. This function replacess lengthBeforeDecimalPoint.
        (WebCore::NumberInputType::createStepRange): Changed for Decimal type.
        (WebCore::NumberInputType::sizeShouldIncludeDecoration): Changed to use calculateRenderSize.
        (WebCore::NumberInputType::parseToNumber): Changed for Decimal type.
        (WebCore::NumberInputType::serialize): ditto.
        * html/NumberInputType.h:
        (NumberInputType): Removed parseToNumberWIthDecimaplPlaces.
        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::createStepRange): Changed for Decimal type.
        (WebCore::RangeInputType::handleKeydownEvent): ditto.
        (WebCore::RangeInputType::parseToNumber): ditto.
        (WebCore::RangeInputType::serialize): ditto.
        * html/StepRange.cpp:
        (WebCore::StepRange::StepRange): Removed decimal places and changed for Decimal type.
        (WebCore::StepRange::acceptableError): Changed for Decimal type.
        (WebCore::StepRange::alignValueForStep): ditto.
        (WebCore::StepRange::clampValue): Changed for Decimal type and std::min/max.
        (WebCore::StepRange::parseStep): Changed for Decimal type and removed NumberWithDecimalPlaces.
        (WebCore::StepRange::stepMismatch): Changed for Decimal type.
        (WebCore::convertDoubleToInputNumber): Changed to real implementation.
        (WebCore::convertInputNumberToDouble):  Changed to real implementation.
        * html/StepRange.h:
        (InputNumber): Replacement of NumberWithDecimalPlaces.
        (WebCore::StepRange::InputNumber::InputNumber):
        * html/TimeInputType.cpp:
        (WebCore::TimeInputType::createStepRange): Changed for Decimal type.
        * html/WeekInputType.cpp:
        (WebCore::WeekInputType::createStepRange): Changed for Decimal type.
        * html/parser/HTMLParserIdioms.cpp:
        (WebCore::serializeForNumberType): Added Decimal version.
        (WebCore::parseToDecimalForNumberType): Added.
        * html/parser/HTMLParserIdioms.h: Updated comments for parseToDoubleForNumberType.
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::sliderPosition): Changed for Decimal type.

2012-06-10  Jason Liu  <jason.liu@torchmobile.com.cn>

        [BlackBerry] Possible to clobber httponly cookie.
        https://bugs.webkit.org/show_bug.cgi?id=86067

        Reviewed by Rob Buis.

        If a cookie is set by javaScript and there is already a same httpOnly cookie in cookieManager,
        we should reject it. If it has a httpOnly property, we reject it, too.

        Test: http/tests/cookies/js-get-and-set-http-only-cookie.html

        * platform/blackberry/CookieJarBlackBerry.cpp:
        (WebCore::setCookies):
        * platform/blackberry/CookieManager.cpp:
        (WebCore::CookieManager::setCookies):
        (WebCore::CookieManager::checkAndTreatCookie):
        (WebCore::CookieManager::addCookieToMap):
        (WebCore::CookieManager::setPrivateMode):
        * platform/blackberry/CookieManager.h:
        * platform/blackberry/CookieMap.cpp:
        (WebCore::CookieMap::addOrReplaceCookie):
        (WebCore::CookieMap::removeCookie):
        * platform/blackberry/CookieMap.h:
        (CookieMap):

2012-06-10  Pablo Flouret  <pablof@motorola.com>

        Access control allow lists starting with a comma are parsed incorrectly (CORS)
        https://bugs.webkit.org/show_bug.cgi?id=88461

        Reviewed by Adam Barth.

        The parsing algorithm would stop parsing at the first comma (being an
        empty entry, of sorts) and bail out, effectively ignoring the whole
        header.

        Test: http/tests/xmlhttprequest/access-control-allow-lists-starting-with-comma.html

        * loader/CrossOriginPreflightResultCache.cpp:
        (WebCore::parseAccessControlAllowList):

2012-06-10  Darin Adler  <darin@apple.com>

        Some additional tweaks to keep TreeShared code simple/clean
        https://bugs.webkit.org/show_bug.cgi?id=88738

        Reviewed by Adam Barth.

        * platform/TreeShared.h: Make constructor and destructor both protected.
        It's slightly dangerous to have a public non-virtual destructor, and there
        is no reason it needs to be public.
        (WebCore::TreeShared::~TreeShared): Make debug-only destructor non-virtual;
        we were getting no value from it being virtual. Now that it's non-virtual,
        there is no need to use an #if on it since it's an empty inline destructor
        in non-debug builds.

2012-06-06  Jer Noble  <jer.noble@apple.com>

        REGRESSION: Setting invalid media "src" does not cause "error" event
        https://bugs.webkit.org/show_bug.cgi?id=88423

        Reviewed by Eric Carlson.

        Test: http/tests/media/video-src-invalid-error.html

        Two problems here.  When the loadTimer is scheduled, the m_pendingLoadFlags
        variable is set to specify what type of load is scheduled.  It is cleared
        when the loadTimer fires. But, when prepareForLoad() stops the loadTimer,
        it does not clear the m_pendingLoadFlags variable, so the next time
        scheduleLoad() is called (when the src is changed to an invalid URL)
        prepareForLoad() is not called again.

        Second problem: Due to a bug in QTKit (<rdar://problem/11606415>), the
        QTMovieLoadStateChangedNotification is never fired for an invalid http
        URL if QTMovieOpenAsyncRequiredAttribute:YES is not passed when creating
        the QTMovie.

        Add a new utility method which both stops the m_loadTimer and clears the 
        m_pendingLoadFlags, and use it in all the places where m_loadTimer was 
        stopped explicitly:

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::prepareForLoad):
        (WebCore::HTMLMediaElement::stopLoadTimer): Added
        (WebCore::HTMLMediaElement::userCancelledLoad):
        * html/HTMLMediaElement.h:

        And pass QTMovieOpenAsyncRequiredAttribute:YES when creating the QTMovie:

        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::commonMovieAttributes):

2012-06-06  Jer Noble  <jer.noble@apple.com>

        Add logging functions to MediaPlayerPrivateQTKit.
        https://bugs.webkit.org/show_bug.cgi?id=88425

        Reviewed by Eric Carlson.

        No new tests; adds logging functions to aide debugging.

        MediaPlayerPrivateQTKit should emit the same kind of logging messages as 
        other MediaPlayerPrivate engines to aide in debugging.

        Distinguish between loadedRangesChanged() and loadStateChanged() for logging
        purposes:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::loadedRangesChanged):
        (-[WebCoreMovieObserver loadedRangesChanged:]):

        Add LOG messages for each of the following functions:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::~MediaPlayerPrivateQTKit):
        (WebCore::MediaPlayerPrivateQTKit::createQTMovie):
        (WebCore::MediaPlayerPrivateQTKit::createQTMovieView):
        (WebCore::MediaPlayerPrivateQTKit::detachQTMovieView):
        (WebCore::MediaPlayerPrivateQTKit::createQTVideoRenderer):
        (WebCore::MediaPlayerPrivateQTKit::destroyQTVideoRenderer):
        (WebCore::MediaPlayerPrivateQTKit::createQTMovieLayer):
        (WebCore::MediaPlayerPrivateQTKit::destroyQTMovieLayer):
        (WebCore::MediaPlayerPrivateQTKit::setUpVideoRendering):
        (WebCore::MediaPlayerPrivateQTKit::tearDownVideoRendering):
        (WebCore::MediaPlayerPrivateQTKit::load):
        (WebCore::MediaPlayerPrivateQTKit::prepareToPlay):
        (WebCore::MediaPlayerPrivateQTKit::play):
        (WebCore::MediaPlayerPrivateQTKit::pause):
        (WebCore::MediaPlayerPrivateQTKit::seek):
        (WebCore::MediaPlayerPrivateQTKit::cancelSeek):
        (WebCore::MediaPlayerPrivateQTKit::setVolume):
        (WebCore::MediaPlayerPrivateQTKit::setRate):
        (WebCore::MediaPlayerPrivateQTKit::setPreservesPitch):
        (WebCore::MediaPlayerPrivateQTKit::cancelLoad):
        (WebCore::MediaPlayerPrivateQTKit::prepareForRendering):
        (WebCore::MediaPlayerPrivateQTKit::updateStates):
        (WebCore::MediaPlayerPrivateQTKit::loadStateChanged):
        (WebCore::MediaPlayerPrivateQTKit::rateChanged):
        (WebCore::MediaPlayerPrivateQTKit::sizeChanged):
        (WebCore::MediaPlayerPrivateQTKit::timeChanged):
        (WebCore::MediaPlayerPrivateQTKit::didEnd):
        (WebCore::MediaPlayerPrivateQTKit::clearMediaCache):
        (WebCore::MediaPlayerPrivateQTKit::clearMediaCacheForSite):
        (WebCore::MediaPlayerPrivateQTKit::disableUnsupportedTracks):

2012-06-07  Jer Noble  <jer.noble@apple.com>

        WebCore should use a single definition of an invalid media time.
        https://bugs.webkit.org/show_bug.cgi?id=88572

        Reviewed by Eric Carlson.

        No new tests; no change in functionality, so covered by existing tests.

        Add a new, universal definition for an invalid media time:
        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayer::invalidTime):

        Use this new definition instead of the hodge podge of (identical) local
        definitions for an invalid media time:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):
        (WebCore::HTMLMediaElement::invalidateCachedTime):
        (WebCore::HTMLMediaElement::currentTime):
        (WebCore::HTMLMediaElement::initialTime):
        (WebCore::HTMLMediaElement::playbackProgressTimerFired):
        (WebCore::HTMLMediaElement::prepareMediaFragmentURI):
        (WebCore::HTMLMediaElement::applyMediaFragmentURI):
        * html/MediaFragmentURIParser.cpp:
        (WebCore::MediaFragmentURIParser::invalidTimeValue):
        (WebCore::MediaFragmentURIParser::MediaFragmentURIParser):
        (WebCore::MediaFragmentURIParser::startTime):
        (WebCore::MediaFragmentURIParser::endTime):
        (WebCore::MediaFragmentURIParser::parseTimeFragment):
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation):
        (WebCore::MediaPlayerPrivateAVFoundation::duration):
        (WebCore::MediaPlayerPrivateAVFoundation::seeking):
        (WebCore::MediaPlayerPrivateAVFoundation::seekCompleted):
        (WebCore::MediaPlayerPrivateAVFoundation::invalidateCachedDuration):
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
        (MediaPlayerPrivateAVFoundation):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::platformDuration):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::duration):
        (WebCore::MediaPlayerPrivateQTKit::updateStates):
        (WebCore::MediaPlayerPrivateQTKit::timeChanged):

2012-06-10  Darin Adler  <darin@apple.com>

        Remove unneeded callRemovedLastRef function from TreeShared refactoring
        https://bugs.webkit.org/show_bug.cgi?id=88653

        Reviewed by Sam Weinig.

        * WebCore.exp.in: Updated to remove callRemovedLastRef and add removedLastRef.

        * dom/ContainerNode.cpp: Removed callRemovedLastRef, which is no longer
        needed and also had a bad cast in it.

        * dom/Document.h: Made removedLastRef private and non-virtual and made Node
        a friend so it can call the private function.

        * dom/Node.cpp:
        (WebCore::Node::removedLastRef): Moved here. This should not be an inline
        function. Added comments explaining why it should not be inlined. Also added
        explicit code to call to Document::removedLastRef, and added a comment why
        that's the right thing to do here.
        * dom/Node.h: Inherit from TreeShared<Node, ContainerNode>. Made the
        removedLastRef function non-virtual and removed it from the header file.
        Updated TreeShared using statements. Made the TreeShared template class a
        friend so it can call the private removedLastRef.

        * html/HTMLFormControlElement.h: Updated TreeShared using statements to specify
        Node instead, which accomplishes the same thing.
        * html/HTMLObjectElement.h: Ditto.

        * platform/TreeShared.h: Made TreeShared take two template arguments for the
        node type and the parent node type. Removed the callRemovedLastRef functions and
        the extra forward declarations it required. Removed the private unused
        removedLastRef function; not sure why it was left in here at all.
        (WebCore::TreeShared::deref): Call removedLastRef instead of callRemovedLastRef.
        (WebCore::TreeShared::setParent): Use ParentNodeType.
        (WebCore::TreeShared::parent): Ditto.
        (WebCore::adopted): Updated to have both template arguments.

        * svg/SVGElementInstance.cpp:
        (WebCore::SVGElementInstance::removedLastRef): Replaced callRemovedLastRef with
        this. Moved the body out of the header and added a comment explaining why the
        function should not be inlined.
        * svg/SVGElementInstance.h: Made removedLastRef non-virtual, non-inline, and
        private. Made TreeShared a friend so it can call the private removedLastRef.
        Updated TreeShared using statements.

2012-06-10  Darin Adler  <darin@apple.com>

        * WebCore.exp.in: Re-sorted and alphabetized the file.

2012-06-10  Balazs Kelemen  <kbalazs@webkit.org>

        [Qt][Win] Fix building Source/WebCore/plugins/win/PluginViewWin.cpp
        https://bugs.webkit.org/show_bug.cgi?id=88308

        Reviewed by Simon Hausmann.

        No new tests, just a build fix.

        Use ownerWindow() from page client. It has been
        introduced for x11 plugins to solve exactly the
        same problem.

        * plugins/win/PluginViewWin.cpp:
        (windowHandleForPageClient):

2012-06-10  Balazs Kelemen  <kbalazs@webkit.org>

        [Qt][Win] Fix building ImageQt.cpp
        https://bugs.webkit.org/show_bug.cgi?id=88306

        Reviewed by Simon Hausmann.

        No new tests, this is just a build fix.

        * platform/graphics/qt/ImageQt.cpp:
        (WebCore):
        (WebCore::BitmapImage::create):
        Adapt to the "API" changes in Qt.

2012-06-09  Gregg Tavares  <gman@google.com>

        Make WebGL mark draws for compositing even if the draw count is zero
        https://bugs.webkit.org/show_bug.cgi?id=88718

        Reviewed by Kenneth Russell.

        No new tests as no new functionality.

        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore):
        (WebCore::WebGLRenderingContext::drawArrays):
        (WebCore::WebGLRenderingContext::drawElements):

2012-06-09  Dominic Cooney  <dominicc@chromium.org>

        [Chromium] Remove JavaScriptCore dependencies from gyp
        https://bugs.webkit.org/show_bug.cgi?id=88510

        Reviewed by Adam Barth.

        Chromium doesn't support JSC any more and there doesn't seem to be
        a strong interest in using GYP as the common build system in other
        ports.

        No new functionality => No new tests.

        * gyp/WebCore.gyp: Removed.
        * gyp/copy-forwarding-and-icu-headers.sh: Removed.
        * gyp/copy-inspector-resources.sh: Removed.
        * gyp/generate-derived-sources.sh: Removed.
        * gyp/generate-webcore-export-file-generator.sh: Removed.
        * gyp/gtk.gyp: Removed.
        * gyp/run-if-exists.sh: Removed.
        * gyp/streamline-inspector-source.sh: Removed.
        * gyp/update-info-plist.sh: Removed.

2012-06-07  Darin Adler  <darin@apple.com>

        Refactor and improve code style in TextResourceDecoder to prepare for buffering improvement
        https://bugs.webkit.org/show_bug.cgi?id=88566

        Reviewed by Alexey Proskuryakov.

        * loader/TextResourceDecoder.cpp:
        (WebCore::bytesEqual): Added helper function to make comparing against sequences of bytes
        easier to read at the call site.
        (WebCore::KanjiCode::judge): Changed to use bytesEqual in a few places, merged multiple if
        statements, got rid of else after goto.
        (WebCore::TextResourceDecoder::checkForCSSCharset): Changed to use early return instead of
        nesting the whole function. Changed to use bytesEqual.
        (WebCore::skipComment): Changed to use early return for more cases. Changed to use bytesEqual.
        (WebCore::TextResourceDecoder::checkForHeadCharset): Changed to use bytesEqual.
        (WebCore::TextResourceDecoder::decode): Changed to use emptyString() instead of "", since
        the former is more efficient.

2012-06-09  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118618 and r119353.
        http://trac.webkit.org/changeset/118618
        http://trac.webkit.org/changeset/119353
        https://bugs.webkit.org/show_bug.cgi?id=88720

        Caused at least 30 different crashes on ClusterFuzz (Requested
        by inferno-sec on #webkit).

        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::checkForHTTPStatusCodeError):
        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::allClientsRemoved):
        * loader/cache/CachedFont.cpp:
        (WebCore::CachedFont::allClientsRemoved):
        * loader/cache/CachedFont.h:
        (WebCore::CachedFontClient::resourceClientType):
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::removeClientForRenderer):
        (WebCore):
        (WebCore::CachedImage::allClientsRemoved):
        (WebCore::CachedImage::lookupOrCreateImageForRenderer):
        * loader/cache/CachedImage.h:
        (CachedImage):
        (WebCore::CachedImageClient::resourceClientType):
        * loader/cache/CachedRawResource.cpp:
        (WebCore::CachedRawResource::allClientsRemoved):
        (WebCore):
        * loader/cache/CachedRawResource.h:
        (CachedRawResource):
        (WebCore::CachedRawResourceClient::resourceClientType):
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::removeClient):
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::allClientsRemoved):
        * loader/cache/CachedResourceClient.h:
        (WebCore::CachedResourceClient::resourceClientType):
        * loader/cache/CachedSVGDocument.h:
        (WebCore::CachedSVGDocumentClient::resourceClientType):
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::allClientsRemoved):
        * loader/cache/CachedStyleSheetClient.h:
        (WebCore::CachedStyleSheetClient::resourceClientType):
        * rendering/style/StyleCachedImage.cpp:
        (WebCore::StyleCachedImage::removeClient):
        * rendering/style/StyleCachedImageSet.cpp:
        (WebCore::StyleCachedImageSet::removeClient):
        * svg/graphics/SVGImageCache.cpp:
        (WebCore::SVGImageCache::~SVGImageCache):
        (WebCore::SVGImageCache::removeRendererFromCache):
        (WebCore::SVGImageCache::setRequestedSizeAndScales):
        (WebCore::SVGImageCache::requestedSizeAndScales):
        (WebCore::SVGImageCache::lookupOrCreateBitmapImageForRenderer):
        * svg/graphics/SVGImageCache.h:
        (WebCore):
        (SVGImageCache):

2012-06-09  Florin Malita  <fmalita@chromium.org>

        Fixed-position foreignObject descendants should be relative to the foreignObject viewport
        https://bugs.webkit.org/show_bug.cgi?id=88547

        Reviewed by Abhishek Arya.

        Tests: svg/foreignObject/fO-fixed-position-crash.html
               svg/foreignObject/fixed-position-expected.svg
               svg/foreignObject/fixed-position.svg

        Fixed position elements are currently registered with the top level
        RenderView even when embedded within an SVG foreignOject. This patch
        changes containingBlock() & container() to return the containing
        foreignObject renderer instead.

        The new foreignObject fixed position behavior matches that of current
        FireFox and Opera versions and is consistent with the spec:
        http://www.w3.org/TR/CSS2/visuren.html#fixed-positioning
        http://www.w3.org/TR/SVG/coords.html#EstablishingANewViewport

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::containingBlock):
        (WebCore::RenderObject::container):

2012-06-09  Adam Barth  <abarth@webkit.org>

        Can't use eval in iframes sanbdoxed via CSP header
        https://bugs.webkit.org/show_bug.cgi?id=88450

        Reviewed by Mihai Parparita.

        The initial empty document in a frame inherits the security context of
        its parent (including the CSP policy).  When we load the real document,
        in some cases we'll do a "secure transition" to the new document.  That
        means that we leave the global object in place in case the parent
        document has created any properties that it expects will be visible to
        the new document.

        If the parent document has a CSP policy that blocks eval, the "no eval"
        bit will be set on the global object of the initial document.  When we
        perform a "secure transition" to the new document, we'll keep the bit,
        which is wrong.  In this patch, we reset the bit by always enabling
        eval when clearing the context, regardless of whether we're performing
        a "secure transition".

        Test: http/tests/security/contentSecurityPolicy/iframe-inside-csp.html

        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::enableEval):
        (WebCore):
        * bindings/js/ScriptController.h:
        (ScriptController):
        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::enableEval):
        (WebCore):
        (WebCore::ScriptController::disableEval):
        * bindings/v8/ScriptController.h:
        (ScriptController):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::clear):

2012-06-09  Pablo Flouret  <pablof@motorola.com>

        The value in Access-Control-Allow-Origin is not being matched correctly for CORS-enabled requests
        https://bugs.webkit.org/show_bug.cgi?id=88139

        Reviewed by Adam Barth.

        Compare a request's origin with the value given in any
        Access-Control-Allow-Origin headers in an exact, case-sensitive manner,
        instead of using SecurityOrigin::isSameSchemeHostPort(). Per step 3 of
        the resource sharing check algorithm in
        http://dvcs.w3.org/hg/cors/raw-file/tip/Overview.html#resource-sharing-check

        Test: http/tests/xmlhttprequest/origin-exact-matching.html

        * loader/CrossOriginAccessControl.cpp:
        (WebCore::passesAccessControlCheck):

2012-06-09  Huang Dongsung  <luxtella@company100.net>

        [Qt][Texmap] All layers with backingStore are opaque when using TextureMapperGL.
        https://bugs.webkit.org/show_bug.cgi?id=88703

        The bug originated from StillImage that is not override
        Image::currentFrameHasAlpha(), so it always returns false.
        StillImage is used by ImageBuffer, and if Texmap draws contents on ImageBuffer,
        TextureMapperBackingStore thinks contents does not have alpha.

        Covered by existing compositing tests.

        Reviewed by Noam Rosenthal.

        * platform/graphics/qt/StillImageQt.cpp:
        (WebCore::StillImage::currentFrameHasAlpha):
        (WebCore):
        * platform/graphics/qt/StillImageQt.h:
        (StillImage):

2012-06-09  Victor Carbune  <victor@rosedu.org>

        Basic support for timestamps within a TextTrackCue
        https://bugs.webkit.org/show_bug.cgi?id=88187

        Implemented support for timestamps within a TextTrackCue.
        This enables rendering functionality for Karaoke and Paint-on captions.

        Reviewed by Eric Carlson.

        Test: media/track/track-cue-rendering-inner-timestamps.html

        * css/mediaControls.css: Remove the background shadow pseudo-id and
        added two others, which can be further used for styling past / future
        contents of the cue.
        (video::-webkit-media-text-track-past-nodes): Used to style elements
        within the cue that are before the current movie time.
        (video::-webkit-media-text-track-future-nodes): Used to style elements
        within the cue that are after the current movie time.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::updateActiveTextTrackCues): Regardless of whether
        the active set changed or not, the current cues need to be informed of the current
        movie time.
        * html/track/TextTrackCue.cpp:
        (WebCore::TextTrackCue::TextTrackCue): Initiliazed past and future containers.
        (WebCore::TextTrackCue::getCueAsHTML): Checked whether the current cue text has
        inner timestamps or not, in order to render faster if no timestamps are there.
        (WebCore::TextTrackCue::updateDisplayTree): Added method that keeps the past and future
        containers up to date, given a current movie time.
        (WebCore):
        (WebCore::TextTrackCue::getDisplayTree): Replaced the cue background container with the
        past cues container. The *internal* display tree of the cue now has two containers,
        representing past and future elements.
        * html/track/TextTrackCue.h: Added several variables to support the new functionality.
        (TextTrackCue):
        * html/track/WebVTTParser.cpp:
        (WebCore::WebVTTParser::constructTreeFromToken): Updated representation for this patch.
        * html/track/WebVTTParser.h:
        (WebVTTParser): Made public the collectTimeStamp method, as this is required for
        parsing timestamps within a cue as well.

2012-06-09  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Open links in Sources panel by default and fallback to Resources and Network panel otherwise.
        https://bugs.webkit.org/show_bug.cgi?id=88710

        Reviewed by Pavel Feldman.

        * inspector/front-end/inspector.js:
        (WebInspector.documentClick.followLink):
        (WebInspector.documentClick):
        (WebInspector._showAnchorLocation):

2012-06-09  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Only expand root domain in Sources/Scripts panel
        https://bugs.webkit.org/show_bug.cgi?id=88135

        Reviewed by Pavel Feldman.

        * inspector/front-end/NavigatorView.js:
        (WebInspector.NavigatorTreeOutline._treeElementsCompare.compare.typeWeight):
        (WebInspector.NavigatorTreeOutline._treeElementsCompare):
        (WebInspector.NavigatorFolderTreeElement.prototype.onattach):

2012-06-09  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Pretty print should respect text editor indent setting.
        https://bugs.webkit.org/show_bug.cgi?id=88713

        Reviewed by Pavel Feldman.

        * inspector/front-end/ScriptFormatter.js:

2012-06-09  Dan Bernstein  <mitz@apple.com>

        Fixed the build after r119895.

        * WebCore.xcodeproj/project.pbxproj:

2012-06-09  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: [refactoring] rename TimelineVerticalOverview into TimelineFrameOverview
        https://bugs.webkit.org/show_bug.cgi?id=88708

        Reviewed by Vsevolod Vlasov.

        - rename TimelineVerticalOverview to TimelineFrameOverview;
        - rename associated fields, parameters, CSS classes etc;
        - rename overview mode designators to match the UI;
        - drop unused CSS rules for old-style mode selector;

        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineOverviewPane):
        (WebInspector.TimelineOverviewPane.prototype._showEvents):
        (WebInspector.TimelineOverviewPane.prototype._showFrames):
        (WebInspector.TimelineOverviewPane.prototype._showMemoryGraph):
        (WebInspector.TimelineOverviewPane.prototype._setFrameMode):
        (WebInspector.TimelineOverviewPane.prototype._onCategoryVisibilityChanged):
        (WebInspector.TimelineOverviewPane.prototype._update):
        (WebInspector.TimelineOverviewPane.prototype.addFrame):
        (WebInspector.TimelineOverviewPane.prototype.zoomToFrame):
        (WebInspector.TimelineOverviewPane.prototype._reset):
        (WebInspector.TimelineOverviewPane.prototype._onWindowChanged):
        (WebInspector.TimelineFrameOverview):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel):
        (WebInspector.TimelinePanel.prototype._shouldShowFrames):
        (WebInspector.TimelinePanel.prototype.revealRecordAt):
        * inspector/front-end/timelinePanel.css:
        (.timeline-frame-overview #timeline-overview-grid):
        (.timeline-frame-overview .timeline-overview-window):
        (.timeline-frame-overview .timeline-overview-dividers-background):
        (.timeline-frame-overview #timeline-overview-memory):
        (.timeline-frame-overview-status-bar-item.toggled-on .glyph):
        (.timeline-frame-overview-bars):
        (.timeline.timeline-frame-overview .resources-divider):
        (.sidebar-tree-item .timeline-frame-overview-status-bar-item):

2012-06-08  Vsevolod Vlasov  <vsevik@chromium.org>

        IndexedDB: Inspector should handle null, string, and array keyPaths
        https://bugs.webkit.org/show_bug.cgi?id=84303

        Reviewed by Pavel Feldman.

        Supported different key path types and updated tests to cover each case.
        Key path strings are now highlighted in the DataGrid column headers.

        * inspector/Inspector.json:
        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore):
        * inspector/front-end/IndexedDBModel.js:
        (WebInspector.IndexedDBModel.idbKeyPathFromKeyPath):
        (WebInspector.IndexedDBModel.keyPathStringFromIDBKeyPath):
        (WebInspector.IndexedDBModel.prototype._loadDatabase.callback):
        (WebInspector.IndexedDBModel.prototype._loadDatabase):
        (WebInspector.IndexedDBModel.ObjectStore.prototype.get keyPathString):
        (WebInspector.IndexedDBModel.Index.prototype.get keyPathString):
        * inspector/front-end/IndexedDBViews.js:
        (WebInspector.IDBDataView.prototype._createDataGrid):
        (WebInspector.IDBDataView.prototype._keyColumnHeaderFragment):
        (WebInspector.IDBDataView.prototype._keyPathStringFragment):
        (WebInspector.IDBDataGridNode.prototype.createCell):
        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.IDBObjectStoreTreeElement.prototype._updateTooltip):
        (WebInspector.IDBIndexTreeElement.prototype._updateTooltip):

2012-06-08  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Increase size limits for resource content cached in InspectorResourceAgent.
        https://bugs.webkit.org/show_bug.cgi?id=88674

        Reviewed by Pavel Feldman.

        * inspector/NetworkResourcesData.cpp:

2012-05-25  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Limit DebuggerAgent.Location use to DebuggerModel only, introduce WebInspector.RawLocation to be used elsewhere.
        https://bugs.webkit.org/show_bug.cgi?id=87270

        Reviewed by Pavel Feldman.

        Introduced WebInspector.RawLocation interface, a generic raw location independent from concrete domain (Styles, Debugger).
        Made WebInspector.DebuggerModel.Location implement it and switched all debugger related methods to it.

        * inspector/front-end/BreakpointManager.js:
        (WebInspector.BreakpointManager.prototype._breakpointResolved):
        * inspector/front-end/CompilerScriptMapping.js:
        (WebInspector.CompilerScriptMapping.prototype.rawLocationToUILocation):
        * inspector/front-end/DebuggerModel.js:
        (WebInspector.DebuggerModel.Location):
        (WebInspector.DebuggerModel.prototype.continueToLocation):
        (WebInspector.DebuggerModel.prototype.setBreakpointByScriptLocation):
        (WebInspector.DebuggerModel.prototype.setBreakpoint.didSetBreakpoint):
        (WebInspector.DebuggerModel.prototype.setBreakpoint):
        (WebInspector.DebuggerModel.prototype.setBreakpointBySourceId):
        (WebInspector.DebuggerModel.prototype._breakpointResolved):
        (WebInspector.DebuggerModel.prototype.createRawLocation):
        (WebInspector.DebuggerModel.prototype.createRawLocationByURL):
        (WebInspector.DebuggerModel.prototype.setSelectedCallFrame):
        (WebInspector.DebuggerModel.prototype.createLiveLocation):
        (WebInspector.DebuggerModel.CallFrame.prototype.get location):
        (WebInspector.DebuggerModel.CallFrame.prototype.createLiveLocation):
        * inspector/front-end/DebuggerResourceBinding.js:
        (WebInspector.DebuggerResourceBinding.setScriptSource.didEditScriptSource):
        (WebInspector.DebuggerResourceBinding.setScriptSource):
        (WebInspector.DebuggerResourceBinding.prototype.setContent.get if):
        (WebInspector.DebuggerResourceBinding.prototype.setContent):
        (WebInspector.DebuggerResourceBinding.prototype._setContentWithInitialContent):
        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource.prototype.uiLocationToRawLocation):
        * inspector/front-end/Linkifier.js:
        * inspector/front-end/ObjectPopoverHelper.js:
        (WebInspector.ObjectPopoverHelper.prototype._showObjectPopover.showObjectPopover.):
        (WebInspector.ObjectPopoverHelper.prototype._showObjectPopover):
        * inspector/front-end/PresentationConsoleMessageHelper.js:
        * inspector/front-end/RawSourceCode.js:
        * inspector/front-end/ResourceScriptMapping.js:
        (WebInspector.ResourceScriptMapping.prototype.rawLocationToUILocation):
        * inspector/front-end/Script.js:
        (WebInspector.Script.prototype.rawLocationToUILocation):
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.SnippetScriptMapping.prototype.rawLocationToUILocation):
        * inspector/front-end/SourceMapping.js:
        * inspector/front-end/UISourceCode.js:
        (WebInspector.RawLocation):

2012-06-09  Eugene Klyuchnikov  <eustas.bug@gmail.com>

        Web Inspector: Add message loop instrumentation to public API and timeline agent
        https://bugs.webkit.org/show_bug.cgi?id=88639

        Reviewed by Vsevolod Vlasov.

        Message loop instrumentation will show when the render thread is busy.
        That way developer can discover if a render thread business causes low fps, or not.

        * inspector/InspectorClient.h:
        (WebCore::InspectorClient::startMessageLoopMonitoring): Starts observer.
        (WebCore::InspectorClient::stopMessageLoopMonitoring): Stops observer.
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        Changed timeline agent constructor parameters.
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::willProcessTaskImpl):
        Forwards observer notification.
        (WebCore):
        (WebCore::InspectorInstrumentation::didProcessTaskImpl):
        Ditto.
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        (WebCore::InspectorInstrumentation::willProcessTask):
        Ditto.
        (WebCore):
        (WebCore::InspectorInstrumentation::didProcessTask):
        Ditto.
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::start):
        Starts observer.
        (WebCore::InspectorTimelineAgent::stop):
        Stops observer.
        (WebCore::InspectorTimelineAgent::supportsFrameInstrumentation):
        Changed result origin.
        (WebCore::InspectorTimelineAgent::willProcessTask):
        Noop implementqation.
        (WebCore):
        (WebCore::InspectorTimelineAgent::didProcessTask):
        Noop implementqation.
        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
        Changed constructor parameters.
        * inspector/InspectorTimelineAgent.h:
        (WebCore::InspectorTimelineAgent::create):
        Ditto.
        (InspectorTimelineAgent):
        * inspector/WorkerInspectorController.cpp:
        (WebCore::WorkerInspectorController::WorkerInspectorController):
        Changed timeline agent constructor parameters.

2012-06-08  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: optimize timeline's frame mode overview appearance for 30fps
        https://bugs.webkit.org/show_bug.cgi?id=88556

        Reviewed by Vsevolod Vlasov.

        - adjust frame overview scale to 30fps == full height by default;
        - provide a fall-back auto-scale mode when median frame is longer than 1/30s;
        - add horizontal lines for 30 and 60fps;
        - drive-by fix: always use same order of categories in frame bars.

        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineVerticalOverview.prototype.update):
        (WebInspector.TimelineVerticalOverview.prototype._aggregateFrames):
        (WebInspector.TimelineVerticalOverview.prototype._renderBars):
        (WebInspector.TimelineVerticalOverview.prototype._drawFPSMarks):
        (WebInspector.TimelineVerticalOverview.prototype._renderBar):


2012-06-09  Sukolsak Sakshuwong  <sukolsak@google.com>

        Add UNDO_MANAGER flag
        https://bugs.webkit.org/show_bug.cgi?id=87908

        Reviewed by Tony Chang.

        Add undoManager property to document behind the UNDO_MANAGER flag and
        add placeholders for some methods of undoManager.

        Test: editing/undomanager/document-has-undomanager.html

        * CMakeLists.txt:
        * Configurations/FeatureDefines.xcconfig:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.am:
        * GNUmakefile.list.am:
        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore):
        (WebCore::Document::undoManager):
        * dom/Document.h:
        (WebCore):
        (Document):
        * dom/Document.idl:
        * editing/UndoManager.cpp: Added.
        (WebCore):
        (WebCore::UndoManager::create):
        (WebCore::UndoManager::UndoManager):
        (WebCore::UndoManager::undo):
        (WebCore::UndoManager::redo):
        (WebCore::UndoManager::clearUndo):
        (WebCore::UndoManager::clearRedo):
        * editing/UndoManager.h: Added.
        (WebCore):
        (UndoManager):
        * editing/UndoManager.idl: Added.

2012-06-08  Levi Weintraub  <leviw@chromium.org>

        RenderLayer::paintChildLayerIntoColumns doesn't properly pixel snap
        https://bugs.webkit.org/show_bug.cgi?id=88554

        Reviewed by Darin Adler.

        Column handling code in RenderLayer and RenderBlock was improperly clipping and translating
        using floats derived from FractionalLayoutUnits without pixel snapping. RenderLayer also
        improperly stored render tree offsets in ints instead of LayoutUnits. This corrects this
        issue.

        Test: fast/sub-pixel/column-clipping.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::paintColumnContents):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::paintChildLayerIntoColumns):

2012-06-08  Rakesh KN  <rakesh.kn@motorola.com>

        REGRESSION(r116487?): HTMLFormElement::elements['name'] is empty if the form is detached from the document tree
        https://bugs.webkit.org/show_bug.cgi?id=88632

        Reviewed by Ryosuke Niwa.

        Update root node of RadioNodeList when the form element is detached from dom tree.

        Test: fast/forms/radionodelist-whose-form-element-detached-from-domtree.html

        * dom/Node.cpp:
        (WebCore::Node::resetCachedRadioNodeListRootNode):
        New function to update the root node of RadioNodeLists to form element from document.
        * dom/Node.h: Ditto.
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::removedFrom):
        On detach, we update the root node of all RadioNodeLists of this form element.
        * html/RadioNodeList.cpp:
        (WebCore::RadioNodeList::setRootElement):
        Setter for updating root node.
        * html/RadioNodeList.h:
        (RadioNodeList): Ditto.

2012-06-08  David Reveman  <reveman@chromium.org>

        [Chromium] Compositor doesn't support translucent root layers.
        https://bugs.webkit.org/show_bug.cgi?id=87821

        Reviewed by James Robinson.

        Forward the isTransparent WebView setting to WebLayerTreeView,
        CCLayerTreeHost and CCLayerTreeHostImpl as hasTransparentBackground.
        Use hasTransparentBackground setting to determine how to clear the
        root render pass and draw the background. Set opaque flag correctly
        on the NonCompositedContentHost's graphics layer to make sure
        sub-pixel rendering is not used with a transparent WebView.

        Unit tests: CCLayerTreeHostImplTest.hasTransparentBackground
                    LayerRendererChromiumTest2.opaqueRenderPass
                    LayerRendererChromiumTest2.transparentRenderPass

        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
        (WebCore::BitmapCanvasLayerTextureUpdater::prepareToUpdate):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::clearRenderPass):
        (WebCore::LayerRendererChromium::drawRenderPass):
        (WebCore::LayerRendererChromium::drawBackgroundFilters):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::SkPictureCanvasLayerTextureUpdater::prepareToUpdate):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::CCLayerTreeHost::setHasTransparentBackground):
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (WebCore::CCLayerTreeHostImpl::hasTransparentBackground):
        (WebCore::CCLayerTreeHostImpl::setHasTransparentBackground):
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::CCRenderPass):
        * platform/graphics/chromium/cc/CCRenderPass.h:
        (WebCore::CCRenderPass::hasTransparentBackground):
        (WebCore::CCRenderPass::setHasTransparentBackground):
        (CCRenderPass):

2012-06-08  Ian Vollick  <vollick@chromium.org>

        [chromium] Single thread proxy's animation timer should short circuit if the layer renderer has not been initialized
        https://bugs.webkit.org/show_bug.cgi?id=88668

        Reviewed by James Robinson.

        Unit test: CCSingleThreadProxyTestDidAddAnimationBeforeInitializingLayerRenderer.runSingleThreaded

        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:

2012-06-08  Shezan Baig  <shezbaig.wk@gmail.com>

        Caret is not rendered in empty inline contenteditable elements
        https://bugs.webkit.org/show_bug.cgi?id=85793

        Reviewed by Ryosuke Niwa.

        Override localCaretRect in RenderInline. The implementation was almost
        identical to localCaretRect in RenderBlock for empty block elements, so
        I refactored RenderBlock::localCaretRect and moved the logic to a new
        method 'localCaretRectForEmptyElement' in RenderBoxModelObject. The
        implementation of 'localCaretRect' in RenderBlock and RenderInline both
        use this helper method in RenderBoxModelObject.

        Tests: editing/selection/caret-in-empty-inline-1.html
               editing/selection/caret-in-empty-inline-2.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::localCaretRect):
        Modified to use RenderBoxModelObject::localCaretRectForEmptyElement.
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::localCaretRectForEmptyElement):
        (WebCore):
        * rendering/RenderBoxModelObject.h:
        (RenderBoxModelObject):
        Add localCaretRectForEmptyElement helper method.
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::localCaretRect):
        (WebCore):
        * rendering/RenderInline.h:
        (RenderInline):
        Override localCaretRect using localCaretRectForEmptyElement.

2012-06-08  Mike West  <mkwst@chromium.org>

        Treat blob: and filesystem: URLs generated via secure origins as secure.
        https://bugs.webkit.org/show_bug.cgi?id=84054

        Loading a blob: or filesystem: URL into an iframe or image that's
        contained on an HTTPS page shouldn't generate a mixed content warning.
        This change adds a SecurityOrigin::isSecure to check both against a
        URLs protocol, and the protocol of it's so-called "inner URL" if it's
        the type of URL that has such a thing. These sorts of URLs which are
        generated from secure sources will themselves be treated as secure.

        Reviewed by Adam Barth.

        Tests: http/tests/security/mixedContent/blob-url-in-iframe.html
               http/tests/security/mixedContent/filesystem-url-in-iframe.html

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::isMixedContent):
        * page/SecurityOrigin.cpp:
        (WebCore):
        (WebCore::SecurityOrigin::isSecure):
        * page/SecurityOrigin.h:
        (SecurityOrigin):

2012-06-08  Martin Robinson  <mrobinson@igalia.com>

        [Cairo] [TextureMapperGL] Nvidia card does not update WebGL texture when interacting with canvas
        https://bugs.webkit.org/show_bug.cgi?id=87797

        Reviewed by Philippe Normand.

        No new tests. WebGL is already covered by WebGL tests and this
        bug is only present on certain hardware.

        After resolving multisampling before drawing the texture via the
        TextureMapper, first rebind the multisampling framebuffer. This ensures
        that the texture isn't active in two framebuffers at a time.

        * platform/graphics/cairo/GraphicsContext3DPrivate.cpp:
        (WebCore::GraphicsContext3DPrivate::paintToTextureMapper): Rebind the multisampling
        framebuffer.

2012-06-08  Alexey Proskuryakov  <ap@apple.com>

        <rdar://problem/11412294> Add appropriate iOS default font settings

        Reviewed by Dan Bernstein.

        * page/mac/SettingsMac.mm: (WebCore::Settings::initializeDefaultFontFamilies):

2012-06-08  Charles Wei  <charles.wei@torchmobile.com.cn>

        IndexedDB: Transactions without any request scheduled should abort itself.
        https://bugs.webkit.org/show_bug.cgi?id=88052

        Reviewed by Kentaro Hara.

        This is needed for indexedDB to make it work for JSC. We need to clean up all the
        pending transactions(transactions without any request scheduled) when leaving Javascript context.

        Manually tested using the existing test LayoutTests/storage/indexeddb/tutorial.html

        * bindings/js/JSMainThreadExecState.cpp:
        (WebCore):
        (WebCore::JSMainThreadExecState::didLeaveScriptContext):
        * bindings/js/JSMainThreadExecState.h:
        (WebCore::JSMainThreadExecState::~JSMainThreadExecState):
        (JSMainThreadExecState):

2012-06-08  Ryosuke Niwa  <rniwa@webkit.org>

        Crash in WebCore::CompositeEditCommand::breakOutOfEmptyListItem
        https://bugs.webkit.org/show_bug.cgi?id=88361

        Reviewed by Levi Weintraub.

        Use RefPtr instead of raw pointers across DOM mutations.

        No tests are added for the lack of a reliable reduction.

        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem):

2012-06-08  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119514.
        http://trac.webkit.org/changeset/119514
        https://bugs.webkit.org/show_bug.cgi?id=88664

        Broke JSFiddle.net (Requested by arv on #webkit).

        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::V8DOMWindowShell::initContextIfNeeded):
        * bindings/v8/WorkerContextExecutionProxy.cpp:
        (WebCore::WorkerContextExecutionProxy::initIsolate):

2012-06-08  Ryosuke Niwa  <rniwa@webkit.org>

        Crash in WebCore::InsertParagraphSeparatorCommand::doApply
        https://bugs.webkit.org/show_bug.cgi?id=88108

        Reviewed by Levi Weintraub.

        Use NodeVector instead of walking through siblings as we mutate the DOM.

        No new tests are added since there is no reliable reduction.

        * editing/BreakBlockquoteCommand.cpp:
        (WebCore::BreakBlockquoteCommand::doApply):
        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::moveRemainingSiblingsToNewParent):
        (WebCore):
        * editing/CompositeEditCommand.h:
        (CompositeEditCommand):
        * editing/InsertParagraphSeparatorCommand.cpp:
        (WebCore::InsertParagraphSeparatorCommand::doApply):

2012-06-08  David Grogan  <dgrogan@chromium.org>

        IndexedDB: rename some instances of open to registerFrontendCallbacks
        https://bugs.webkit.org/show_bug.cgi?id=88611

        We should still make the change in the WebKit API.

        Reviewed by Tony Chang.

        No new tests, just a method rename.

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::registerFrontendCallbacks):
        * Modules/indexeddb/IDBDatabase.h:
        (IDBDatabase):
        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::registerFrontendCallbacks):
        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
        (IDBDatabaseBackendImpl):
        * Modules/indexeddb/IDBDatabaseBackendInterface.h:
        (IDBDatabaseBackendInterface):
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::onSuccess):

2012-06-08  Dana Jansens  <danakj@chromium.org>

        [chromium] Skip willDraw() and didDraw() on fully occluded layers
        https://bugs.webkit.org/show_bug.cgi?id=88435

        Reviewed by Adrienne Walker.

        Current willDraw() is called on all layers with non-empty
        visibleLayerRect and non-empty scissorRect. This excludes
        layers outside the viewport, but does not exclude occluded
        layers. We add a check for occlusion to calculateRenderPasses
        in order to avoid willDraw() when it will be culled anyway.

        We prevent didDraw() from being called for occluded layers, for
        which we did not call didDraw() by holding a vector of layers
        for which we did call willDraw(). This lets us avoid storing a
        flag on the layers, or computing occlusion again in
        didDrawAllLayers.

        Unit test: CCLayerTreeHostImplTest.willDrawNotCalledOnOccludedLayer

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::CCLayerTreeHostImpl::prepareToDraw):
        (WebCore::CCLayerTreeHostImpl::didDrawAllLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (FrameData):
        (CCLayerTreeHostImpl):

2012-06-08  Antonio Gomes  <agomes@rim.com>

        EventHandler shouldn't schedule the fake mousemove event timer when scrolling on devices that don't have a mouse
        https://bugs.webkit.org/show_bug.cgi?id=88379

        Reviewed by James Robinson.

        Paraphrasing Andy Estes:
        "In <http://trac.webkit.org/changeset/119465> we stopped dispatching fake
        mousemove events when scrolling on devices that don't support mice. This event
        is dispatched on a timer, so one better would be to not even schedule the
        timer (rather than scheduling the timer but making it a no-op).

        No new tests, as no functionality has changed. We basically do not
        start a timer under a given circumstance instead of fire it, it times out,
        and we make the callback no-op when under the given circumstance.

        It is still possible though that we have the following scenario:
        - Setting::deviceSupportsMouse set as true;
        - we fire the timer;
        - before its callback gets executed (timed out) the setting gets toggled.
        So for sakeness, lets keep the check in both places.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::dispatchFakeMouseMoveEventSoon):
        (WebCore::EventHandler::fakeMouseMoveEventTimerFired):

2012-06-08  James Robinson  <jamesr@chromium.org>

        [chromium] Clean up some unnecessary LayerChromium.h includes
        https://bugs.webkit.org/show_bug.cgi?id=88599

        Reviewed by Adam Barth.

        Reworks test code slightly to use WebCore interfaces.

        * testing/Internals.cpp:
        (WebCore::Internals::setBackgroundBlurOnNode):

2012-06-08  Erik Arvidsson  <arv@chromium.org>

        [V8] Keep TextTrackList alive as long as its owner is alive
        https://bugs.webkit.org/show_bug.cgi?id=88541

        Reviewed by Adam Barth.

        Add a hidden reference from the owner to the text track list.

        Covered by existing tests.

        * Target.pri: Add V8TextTrackListCustom.cpp.
        * UseV8.cmake: Ditto.
        * WebCore.gypi: Ditto.
        * bindings/v8/V8HiddenPropertyName.h:
        (WebCore):
        * bindings/v8/custom/V8TextTrackListCustom.cpp: Copied from Source/WebCore/bindings/v8/V8HiddenPropertyName.h.
        (WebCore):
        (WebCore::toV8): When the wrapper is created add a reference to the owner of the TextTrackList to the TextTrackList.
        * html/track/TextTrackList.idl:

2012-06-08  Ian Vollick  <vollick@chromium.org>

        [chromium] Accelerated animations should use WebTransformOperations
        https://bugs.webkit.org/show_bug.cgi?id=87686

        Reviewed by James Robinson.

        CCTransformKeyframe new owns a WebTransformOperations rather than a
        TransformOperations. LayerChromium's API has been changed so that
        LayerChromium::addAnimation should take only a CCActiveAnimation.
        GraphicsLayerChromium is new responsible for translating to
        WebTransformOperations and creating CCActiveAnimations. Tests that use
        the public API (that is, they call addAnimation with KeyframeValueList
        and Animation arguments) have been moved to GraphicsLayerChromiumTest.

         Unit tests:
            GraphicsLayerChromiumTest.createOpacityAnimation
            GraphicsLayerChromiumTest.createTransformAnimation
            GraphicsLayerChromiumTest.createTransformAnimationWithBigRotation
            GraphicsLayerChromiumTest.createTransformAnimationWithSingularMatrix
            GraphicsLayerChromiumTest.createReversedAnimation
            GraphicsLayerChromiumTest.createAlternatingAnimation
            GraphicsLayerChromiumTest.createReversedAlternatingAnimation

        * WebCore.gypi:
        * platform/graphics/chromium/AnimationTranslationUtil.cpp: Added.
        (WebCore):
        (WebCore::toWebTransformOperations):
        (WebCore::appendKeyframe):
        (WebCore::CCKeyframedTransformAnimationCurve):
        (WebCore::createActiveAnimation):
        * platform/graphics/chromium/AnimationTranslationUtil.h: Added.
        (WebCore):
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::addAnimation):
        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::addAnimation):
        * platform/graphics/chromium/LayerChromium.h:
        (WebCore):
        (WebCore::LayerChromium::bounds):
        (LayerChromium):
        * platform/graphics/chromium/LinkHighlight.cpp:
        (WebCore::LinkHighlight::LinkHighlight):
        * platform/graphics/chromium/cc/CCAnimationCurve.h:
        (CCTransformAnimationCurve):
        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp:
        (WebCore::CCTransformKeyframe::create):
        (WebCore::CCTransformKeyframe::CCTransformKeyframe):
        (WebCore::CCTransformKeyframe::value):
        (WebCore::CCTransformKeyframe::clone):
        (WebCore::CCKeyframedTransformAnimationCurve::getValue):
        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h:
        (CCTransformKeyframe):
        (CCKeyframedTransformAnimationCurve):
        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
        (WebCore::CCLayerAnimationController::removeAnimation):
        (WebCore):
        (WebCore::CCLayerAnimationController::addAnimation):
        (WebCore::CCLayerAnimationController::getActiveAnimation):
        (WebCore::CCLayerAnimationController::pushNewAnimationsToImplThread):
        (WebCore::CCLayerAnimationController::replaceImplThreadAnimations):
        (WebCore::CCLayerAnimationController::tickAnimations):
        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
        (CCLayerAnimationControllerClient):
        (CCLayerAnimationController):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore::CCLayerImpl::bounds):

2012-06-08  No'am Rosenthal  <noam.rosenthal@nokia.com>

        [Texmap] Accelerated versions of drop-shadow and blur filters
        https://bugs.webkit.org/show_bug.cgi?id=87695

        Reviewed by Kenneth Rohde Christiansen.

        Added shaders for blur and drop-shadow effects.
        The shaders use sampling of multiple coordinates and averaging them with normal-
        distribution to create a fast gaussian blur effect.

        Covered by existing tests in css3/filters.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::drawFiltered):
            Call the prepare function explicitly, with a size argument that's used to calculate
            some of the uniform values.

        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::intermediateSurfaceRect):
            The outsets of the effect have to be considered when calculating the intermediate rect.
            Otherwise the resulting image is scaled instead of outsetted.

        (WebCore::applyFilters):
        * platform/graphics/texmap/TextureMapperShaderManager.cpp:
        (WebCore::StandardFilterProgram::StandardFilterProgram):
            Added the new shaders.

        (WebCore::StandardFilterProgram::prepare):
        (WebCore::TextureMapperShaderManager::getShaderForFilter):
        * platform/graphics/texmap/TextureMapperShaderManager.h:
        (StandardFilterProgram):

2012-06-08  Dan Bernstein  <mitz@apple.com>

        Tried to fix the build after r119844.

        * bindings/js/GCController.cpp:
        (WebCore::GCController::discardAllCompiledCode):

2012-06-08  Mike West  <mkwst@chromium.org>

        Add COMPILE_ASSERT to StyledElement to ensure it doesn't accidentally grow larger.
        https://bugs.webkit.org/show_bug.cgi?id=88627

        Reviewed by Adam Barth.

        No change in user-facing behavior.

        * dom/StyledElement.cpp:
        (WebCore):

2012-06-08  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Fix several compiler warnings and errors.
        https://bugs.webkit.org/show_bug.cgi?id=88660

        Reviewed by Pavel Feldman.

        Fixed several compiler warnings and errors.
        Removed isEmpty method from Object.prototype and made it static method on Object.

        * inspector/InjectedScriptExterns.js:
        * inspector/front-end/FileSystemModel.js:
        (WebInspector.FileSystemModel.prototype._detachFrame):
        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshot.prototype._buildDominatorTree):
        * inspector/front-end/utilities.js:
        (Object.isEmpty):

2012-06-08  Max Feil  <mfeil@rim.com>

        [BlackBerry] Fix assertion failure introduced by bug 87551
        https://bugs.webkit.org/show_bug.cgi?id=88659

        Reviewed by Antonio Gomes.

        The determineRenderSlider() convenience function added in bug
        87551 made an assumption that wasn't always true. This didn't
        cause a functional error but it caused an assertion failure,
        which indicates a problem with the code. PR164142.

        No new tests because this case is already covered by ASSERT's.

        * platform/blackberry/RenderThemeBlackBerry.cpp:
        (WebCore::determineRenderSlider):

2012-06-08  Ion Rosca  <rosca@adobe.com>

        Some overlay scrollbar API calls in ScrollAnimatorMac can lead to an assertion in RenderBox::mapAbsoluteToLocalPoint
        https://bugs.webkit.org/show_bug.cgi?id=74111

        Reviewed by Simon Fraser.

        Added zero-delay timer for AppKit scroll notification that can be called during layout.
        Manual test: ManualTests/scrollbar-crash-on-hide-scrolled-area.html
        This assertion does not fire when running layout tests. It can be easly reproduced using a debug build by loading the manual test page.

        * platform/mac/ScrollAnimatorMac.h:
        (ScrollAnimatorMac):
        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::ScrollAnimatorMac::ScrollAnimatorMac):
        (WebCore::ScrollAnimatorMac::notifyContentAreaScrolled):
        (WebCore::ScrollAnimatorMac::sendContentAreaScrolledSoon):
        (WebCore):
        (WebCore::ScrollAnimatorMac::sendContentAreaScrolledTimerFired):

2012-06-08  Renata Hodovan  <reni@webkit.org>

        Adding few already supported features to the FeatureSet in DOMImplementation
        https://bugs.webkit.org/show_bug.cgi?id=86482

        Text, Filter and View features are already implemented but they
        are not added to the SVG11 feature set. This is corrected in this patch.

        Reviewed by Nikolas Zimmermann.

        No new testcase is needed because we already have one what checks the svg features via
        DOMImplementation (svg/custom/svg-features.html).

        * dom/DOMImplementation.cpp:
        (WebCore::isSVG11Feature):

2012-06-08  Stephen Chenney  <schenney@chromium.org>

        WebCore::ImageBuffer.cpp has broken color table code
        https://bugs.webkit.org/show_bug.cgi?id=80321

        Reviewed by Dirk Schulze.

        The code in ImageBuffer::transformColorSpace had two problems that are
        fixed by this patch.

        First, it was using member variables for data
        that is static constant. This is incredibly wasteful, as every
        ImageBuffer that is created (and we make a lot of them) gets its own
        copy of the LUT and the table is initialized again and again. The
        patch replaces this with a static local, with lazy evaluation, in
        the method that uses the tables.

        Second, the code for filling the table was mapping 255 to 254, thus
        reducing the intensity and alpha of every image it pushed through a
        color transform.

        Test: svg/filters/color-space-conversion.svg

        * platform/graphics/ImageBuffer.cpp:
        (WebCore::ImageBuffer::transformColorSpace):
        * platform/graphics/ImageBuffer.h:
        (ImageBuffer):

2012-06-08  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Better labels positioning on the memory pie chart
        https://bugs.webkit.org/show_bug.cgi?id=88652

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.NativeMemoryPieChart.prototype._paint.paintPercentAndLabel):
        (WebInspector.NativeMemoryPieChart.prototype._paint):

2012-06-08  Bryan McQuade  <bmcquade@google.com>

        Web Inspector: Annotate timeline records with a frame identifier
        https://bugs.webkit.org/show_bug.cgi?id=86406

        Reviewed by Vsevolod Vlasov.

        Tests: Updated existing layout tests.

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::frameForScriptExecutionContext):
        (WebCore):
        (WebCore::InspectorInstrumentation::didScheduleResourceRequestImpl):
        (WebCore::InspectorInstrumentation::didInstallTimerImpl):
        (WebCore::InspectorInstrumentation::didRemoveTimerImpl):
        (WebCore::InspectorInstrumentation::willCallFunctionImpl):
        (WebCore::InspectorInstrumentation::willChangeXHRReadyStateImpl):
        (WebCore::InspectorInstrumentation::willDispatchEventImpl):
        (WebCore::InspectorInstrumentation::willDispatchEventOnWindowImpl):
        (WebCore::InspectorInstrumentation::willEvaluateScriptImpl):
        (WebCore::InspectorInstrumentation::willFireTimerImpl):
        (WebCore::InspectorInstrumentation::willLayoutImpl):
        (WebCore::InspectorInstrumentation::willLoadXHRImpl):
        (WebCore::InspectorInstrumentation::willPaintImpl):
        (WebCore::InspectorInstrumentation::willRecalculateStyleImpl):
        (WebCore::InspectorInstrumentation::willSendRequestImpl):
        (WebCore::InspectorInstrumentation::willReceiveResourceDataImpl):
        (WebCore::InspectorInstrumentation::willReceiveResourceResponseImpl):
        (WebCore::InspectorInstrumentation::didFinishLoadingImpl):
        (WebCore::InspectorInstrumentation::didFailLoadingImpl):
        (WebCore::InspectorInstrumentation::domContentLoadedEventFiredImpl):
        (WebCore::InspectorInstrumentation::loadEventFiredImpl):
        (WebCore::InspectorInstrumentation::willWriteHTMLImpl):
        (WebCore::InspectorInstrumentation::didRequestAnimationFrameImpl):
        (WebCore::InspectorInstrumentation::didCancelAnimationFrameImpl):
        (WebCore::InspectorInstrumentation::willFireAnimationFrameImpl):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        (WebCore::InspectorInstrumentation::didScheduleResourceRequest):
        (WebCore::InspectorInstrumentation::didInstallTimer):
        (WebCore::InspectorInstrumentation::didRemoveTimer):
        (WebCore::InspectorInstrumentation::willCallFunction):
        (WebCore::InspectorInstrumentation::willChangeXHRReadyState):
        (WebCore::InspectorInstrumentation::willDispatchEvent):
        (WebCore::InspectorInstrumentation::willEvaluateScript):
        (WebCore::InspectorInstrumentation::willFireTimer):
        (WebCore::InspectorInstrumentation::willLayout):
        (WebCore::InspectorInstrumentation::willLoadXHR):
        (WebCore::InspectorInstrumentation::willPaint):
        (WebCore::InspectorInstrumentation::willRecalculateStyle):
        (WebCore::InspectorInstrumentation::willReceiveResourceData):
        (WebCore::InspectorInstrumentation::willReceiveResourceResponse):
        (WebCore::InspectorInstrumentation::willWriteHTML):
        (WebCore::InspectorInstrumentation::didRequestAnimationFrame):
        (WebCore::InspectorInstrumentation::didCancelAnimationFrame):
        (WebCore::InspectorInstrumentation::willFireAnimationFrame):
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::pushGCEventRecords):
        (WebCore::InspectorTimelineAgent::didBeginFrame):
        (WebCore::InspectorTimelineAgent::willCallFunction):
        (WebCore::InspectorTimelineAgent::willDispatchEvent):
        (WebCore::InspectorTimelineAgent::willLayout):
        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
        (WebCore::InspectorTimelineAgent::willPaint):
        (WebCore::InspectorTimelineAgent::willComposite):
        (WebCore::InspectorTimelineAgent::willWriteHTML):
        (WebCore::InspectorTimelineAgent::didInstallTimer):
        (WebCore::InspectorTimelineAgent::didRemoveTimer):
        (WebCore::InspectorTimelineAgent::willFireTimer):
        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
        (WebCore::InspectorTimelineAgent::willLoadXHR):
        (WebCore::InspectorTimelineAgent::willEvaluateScript):
        (WebCore::InspectorTimelineAgent::didScheduleResourceRequest):
        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
        (WebCore::InspectorTimelineAgent::willReceiveResourceData):
        (WebCore::InspectorTimelineAgent::willReceiveResourceResponse):
        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
        (WebCore::InspectorTimelineAgent::didTimeStamp):
        (WebCore::InspectorTimelineAgent::didMarkDOMContentEvent):
        (WebCore::InspectorTimelineAgent::didMarkLoadEvent):
        (WebCore::InspectorTimelineAgent::didRequestAnimationFrame):
        (WebCore::InspectorTimelineAgent::didCancelAnimationFrame):
        (WebCore::InspectorTimelineAgent::willFireAnimationFrame):
        (WebCore::InspectorTimelineAgent::addRecordToTimeline):
        (WebCore::InspectorTimelineAgent::innerAddRecordToTimeline):
        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
        (WebCore::InspectorTimelineAgent::appendRecord):
        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
        (WebCore::InspectorTimelineAgent::pushCancelableRecord):
        (WebCore::InspectorTimelineAgent::commitCancelableRecords):
        * inspector/InspectorTimelineAgent.h:
        (WebCore):
        (WebCore::InspectorTimelineAgent::create):
        (InspectorTimelineAgent):
        (WebCore::InspectorTimelineAgent::TimelineRecordEntry::TimelineRecordEntry):
        (TimelineRecordEntry):
        * inspector/WorkerInspectorController.cpp:
        (WebCore::WorkerInspectorController::WorkerInspectorController):
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.isEventDivider):
        (WebInspector.TimelinePresentationModel.Record):

2012-06-08  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119821.
        http://trac.webkit.org/changeset/119821
        https://bugs.webkit.org/show_bug.cgi?id=88648

        Seems to have regression on Mac (Requested by kinuko on
        #webkit).

        * fileapi/File.cpp:
        (WebCore::File::File):
        (WebCore::File::lastModifiedDate):
        (WebCore::File::lastModifiedDateForBinding):
        (WebCore):
        (WebCore::File::captureSnapshot):
        * fileapi/File.h:
        (File):
        * fileapi/File.idl:
        * platform/FileMetadata.h:
        (WebCore::FileMetadata::FileMetadata):
        * platform/FileSystem.h:
        * platform/chromium/support/WebHTTPBody.cpp:
        (WebKit::WebHTTPBody::elementAt):
        * platform/network/BlobData.cpp:
        (WebCore):
        * platform/network/BlobData.h:
        (BlobDataItem):
        (WebCore::BlobDataItem::BlobDataItem):
        * platform/network/FormData.cpp:
        (WebCore::FormData::appendFile):
        * platform/network/cf/FormDataStreamCFNet.cpp:
        (WebCore::advanceCurrentStream):
        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::blobIsOutOfDate):

2012-06-08  Kinuko Yasuda  <kinuko@chromium.org>

        Unreviewed, removing duplicated entries in gyp.

        * WebCore.gypi:

2012-06-08  Arko Saha  <arko@motorola.com>

        Microdata: An element with an empty itemprop='' should not get listed in the .properties list.
        https://bugs.webkit.org/show_bug.cgi?id=88235

        Reviewed by Ryosuke Niwa.

        As per the specification change http://html5.org/r/6854, an element should be listed in .properties
        if the elelement has an attribute itemprop specified and the element has one or more property names.

        Test: fast/dom/MicroData/element-with-empty-itemprop.html

        * html/HTMLPropertiesCollection.cpp:
        (WebCore::HTMLPropertiesCollection::itemAfter):

2012-06-07  Kinuko Yasuda  <kinuko@chromium.org>

        File::lastModifiedDate should use NaN or separate boolean flag for null Date value
        https://bugs.webkit.org/show_bug.cgi?id=87826

        Reviewed by Kent Tamura.

        Test: http/tests/local/fileapi/file-last-modified-after-delete.html

        * fileapi/File.cpp:
        (WebCore::File::File):
        (WebCore::File::captureSnapshot):
        (WebCore::File::lastModifiedDate):
        (WebCore::File::lastModifiedDateForBinding): Removed.
        * fileapi/File.h:
        (File):
        * fileapi/File.idl:
        * platform/FileMetadata.h:
        (WebCore::FileMetadata::FileMetadata):
        * platform/FileSystem.h:
        * platform/chromium/support/WebHTTPBody.cpp:
        (WebKit::WebHTTPBody::elementAt):
        * platform/network/BlobData.h:
        (WebCore::BlobDataItem::doNotCheckFileChange): Removed.
        * platform/network/BlobData.cpp:
        * platform/network/cf/FormDataStreamCFNet.cpp:
        (WebCore::advanceCurrentStream):
        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::blobIsOutOfDate):

2012-06-08  Kent Tamura  <tkent@chromium.org>

        Move form-related functions of Document to FormController
        https://bugs.webkit.org/show_bug.cgi?id=88497

        Reviewed by Hajime Morita.

        A lot of files depend on Document.h. We had to build many files when we
        touched form-related features in Document.h or
        CheckedRadioButtons.h. This patch reduces such pain.

        No new tests. Just a refactoring.

        * CMakeLists.txt: Add FormController.cpp and/or FormController.h.
        * GNUmakefile.list.am: ditto.
        * Target.pri: ditto.
        * WebCore.gypi: ditto.
        * WebCore.vcproj/WebCore.vcproj: ditto.
        * WebCore.xcodeproj/project.pbxproj: ditto.

        * dom/Document.cpp: Removed form-releated features except the followings.
        (WebCore::Document::formController): Accessor for a FormController.
        (WebCore::Document::formElementsState):
        Just returns FormController::formElementsState().
        We don't create new FormController.
        (WebCore::Document::setStateForNewFormElements):
        Just returns FormController::setStateForNewFormElements().
        We don't create new FormController if the specified vector is empty.
        * dom/Document.h:
        Moved form-related functions to FormController.

        * html/FormController.cpp: Added. Moved from Document.cpp.
        * html/FormController.h: Added. Moved from Document.h

        * html/FormAssociatedElement.cpp: Use Document::formController().
        (WebCore::FormAssociatedElement::didMoveToNewDocument):
        (WebCore::FormAssociatedElement::insertedInto):
        (WebCore::FormAssociatedElement::removedFrom):
        (WebCore::FormAssociatedElement::formAttributeChanged):
        * html/HTMLFormControlElementWithState.cpp: Use Document::formController().
        (WebCore::HTMLFormControlElementWithState::HTMLFormControlElementWithState):
        (WebCore::HTMLFormControlElementWithState::~HTMLFormControlElementWithState):
        (WebCore::HTMLFormControlElementWithState::didMoveToNewDocument):
        (WebCore::HTMLFormControlElementWithState::finishParsingChildren):
        * html/HTMLFormElement.cpp: Use Document::formController().
        (WebCore::HTMLFormElement::didNotifyDescendantInsertions):
        (WebCore::HTMLFormElement::removedFrom):
        * html/HTMLInputElement.cpp: Use Document::formController().
        (WebCore::HTMLInputElement::~HTMLInputElement):
        (WebCore::HTMLInputElement::didMoveToNewDocument):
        (WebCore::HTMLInputElement::checkedRadioButtons):
        * html/HTMLInputElement.h:
        Declare CheckedRadioButtons. It was provided by Document.h.
        * html/parser/HTMLConstructionSite.h:
        Declare HTMLFormElement. It was provided by Document.h

2012-06-08  Taiju Tsuiki  <tzik@chromium.org>

        Add FileSystem item to storage tree.
        https://bugs.webkit.org/show_bug.cgi?id=72691

        Reviewed by Vsevolod Vlasov.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/FileSystemModel.js: Added.
        * inspector/front-end/Images/fileSystem.png: Added.
        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.FileSystemListTreeElement):
        (WebInspector.FileSystemListTreeElement.prototype.onexpand):
        (WebInspector.FileSystemListTreeElement.prototype.onattach):
        (WebInspector.FileSystemListTreeElement.prototype._handleContextMenuEvent):
        (WebInspector.FileSystemListTreeElement.prototype._fileSystemAdded):
        (WebInspector.FileSystemListTreeElement.prototype._fileSystemRemoved):
        (WebInspector.FileSystemListTreeElement.prototype._fileSystemTreeElementByName):
        (WebInspector.FileSystemListTreeElement.prototype._refreshFileSystem):
        (WebInspector.FileSystemTreeElement):
        (WebInspector.FileSystemTreeElement.prototype.get fileSystemName):
        (WebInspector.FileSystemTreeElement.prototype.get itemURL):
        * inspector/front-end/Settings.js:
        (WebInspector.ExperimentsSettings):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:
        * inspector/front-end/resourcesPanel.css:
        (.file-system-storage-tree-item .icon):
        * inspector/front-end/utilities.js:

2012-06-08  Kentaro Hara  <haraken@chromium.org>

        REGRESSION r119802: Remove unnecessary ASSERT(!m_deletionHasBegun) from Document.h
        https://bugs.webkit.org/show_bug.cgi?id=88528

        Reviewed by Ryosuke Niwa.

        m_deletionHasBegun should become true just before 'delete this'.

        No tests. No change in behavior.

        * dom/Document.h:
        (WebCore::Document::guardRef):
        (WebCore::Document::guardDeref):

2012-06-08  Adam Barth  <abarth@webkit.org>

        HTTP 204 No Content responses shouldn't trigger MIME type warnings in the web inspector
        https://bugs.webkit.org/show_bug.cgi?id=88603

        Reviewed by Pavel Feldman.

        A 204 response doesn't have an entity body, so its MIME type is kind of
        meaningless.  We shouldn't spam the console with a warning about MIME
        types.

        * inspector/front-end/NetworkManager.js:
        (WebInspector.NetworkDispatcher.prototype._mimeTypeIsConsistentWithType):

2012-06-08  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Drop StepRange::NumberWithDecimalPlacesOrMissing
        https://bugs.webkit.org/show_bug.cgi?id=88621

        Reviewed by Kent Tamura.

        This patch changes NumberWithDecimalPlacesOrMissing to NumberWithDecimalPlaces.
        We use NaN as indication of having value or not.

        No new tests, because this patch doesn't change behavior.

        * html/DateInputType.cpp:
        (WebCore::DateInputType::createStepRange): Replace NumberWithDecimalPlacesOrMissing to NumberWithDecimalPlaces.
        * html/DateTimeInputType.cpp:
        (WebCore::DateTimeInputType::createStepRange): ditto.
        * html/DateTimeLocalInputType.cpp:
        (WebCore::DateTimeLocalInputType::createStepRange): ditto.
        * html/MonthInputType.cpp:
        (WebCore::MonthInputType::createStepRange): ditto.
        * html/NumberInputType.cpp:
        (WebCore::NumberInputType::createStepRange): ditto.
        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::createStepRange): ditto.
        * html/StepRange.cpp:
        (WebCore::StepRange::StepRange): Checks value is finite or not.
        (WebCore::StepRange::parseStep): Replace NumberWithDecimalPlacesOrMissing to NumberWithDecimalPlaces.
        * html/StepRange.h:
        (StepRange): Removed NumberWithDecimalPlacesOrMissing.
        * html/TimeInputType.cpp:
        (WebCore::TimeInputType::createStepRange):  NumberWithDecimalPlacesOrMissing to NumberWithDecimalPlaces.
        * html/WeekInputType.cpp:
        (WebCore::WeekInputType::createStepRange): ditto.

2012-06-08  Kentaro Hara  <haraken@chromium.org>

        Unreviewed. Fixed a comment, pointed out by ap@.

        * platform/TreeShared.h:
        (WebCore):

2012-06-08  Noel Gordon  <noel.gordon@gmail.com>

        [chromium] WEBP image blue and red color channels reversed on Android
        https://bugs.webkit.org/show_bug.cgi?id=88613

        Reviewed by Kent Tamura.

        No new tests. Covered by test fast/images/webp-image-decoding.html though I'm
        not sure where/how the Androids run their layout tests.

        * platform/image-decoders/webp/WEBPImageDecoder.cpp:
        (outputMode): Detect little-endian Skia with a blue pixel shift (aka Android)
        which seems to be the way for them per bug 75861.

2012-06-08  Ryosuke Niwa  <rniwa@webkit.org>

        Remove the assertion that has been moved to TreeScope after r119802.

        * dom/Document.cpp:
        (WebCore::Document::removedLastRef):

2012-06-07  Kentaro Hara  <haraken@chromium.org>

        Reduce Node object size from 72 byte to 64 byte
        https://bugs.webkit.org/show_bug.cgi?id=88528

        Reviewed by Ryosuke Niwa.

        This patch removes all virtual methods from TreeShared.h,
        by which we can remove a virtual method table pointer (8 byte
        in a 64bit architechture) from each Node object. Consequently,
        this patch reduces the Node object size from 72 byte to 64 byte.

        e.g. The HTML spec (http://www.whatwg.org/specs/web-apps/current-work/)
        contains 325640 Node objects. Thus this patch saves 325640 * 8 byte = 2.6 MB.

        e.g. sizeof(Element) is reduced from 104 byte to 96 byte.

        - In multiple inheritance, a virtual method table pointer is allocated
        for each base class that has virtual methods. For example, for
        'class A : public B, C {};' where B and C have virtual methods,
        two virtual method table pointers are allocated for each A object.
        In this patch, A = Node, B = EventTarget, and C = TreeShared.
        By removing the virtual methods from TreeShared, we can save the virtual
        method table pointer for TreeShared. 8 byte saving.

        - Node and SVGElementInstance are the only classes that inherit TreeShared.

        - This patch removes virtual TreeShared::removeLastRef() and implements
        virtual Node::removeLastRef() and virtual SVGElementInstance::removeLastRef().
        Node::removeLastRef() calls 'delete this' for 'this' of type Node*,
        and SVGElementInstance::removeLastRef() calls 'delete this' for 'this' of type
        SVGElementInstance*.

        - This patch removes the virtual destructor of TreeShared. This removal is safe
        because (1) no one calls 'delete this' for 'this' of type TreeShared*,
        and (2) both Node and SVGElementInstance have virtual destructor.

        No change in behavior. Confirm no regression in existing tests.

        * dom/ContainerNode.cpp:
        (WebCore::callRemovedLastRef):
        (WebCore):
        * dom/Node.h:
        (WebCore::Node::removedLastRef):
        * platform/TreeShared.h:
        (WebCore):
        (TreeShared):
        (WebCore::TreeShared::deref):
        * svg/SVGElementInstance.cpp:
        (WebCore::callRemovedLastRef):
        (WebCore):
        * svg/SVGElementInstance.h:
        (WebCore::SVGElementInstance::removedLastRef):

        * WebCore.order: Added a symbol for callRemovedLastRef().
        * WebCore.exp.in: Ditto.

2012-06-07  Takashi Sakamoto  <tasak@google.com>

        ShadowRoot needs resetStyleInheritance
        https://bugs.webkit.org/show_bug.cgi?id=84048

        Added resetStyleInheritance API to ShadowRoot. The spec URL is
        http://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#shadow-root-attributes
        To implement the API, modified StyleResolver to use empty style
        instead of parent style if resetStyleInheritance is true,
        and a node and its parent node are placed in different shadow trees.

        Reviewed by Hajime Morita.

        Test: fast/dom/shadow/shadow-root-resetStyleInheritance.html
              fast/dom/shadow/shadow-root-resetStyleInheritance-expected.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::initForStyleResolve):
        Set m_parentStyle to NULL when resetStyleInheritance.
        (WebCore::StyleResolver::documentSettings):
        Added a new method to obtain current document's settings.
        (WebCore::StyleResolver::initializeFontStyle):
        Initialize m_style by using document settings. Its code was move
        from the code initializing font style in applyProperty.
        (WebCore::StyleResolver::styleForElement):
        Initialize font style if m_parentStyle is NULL. The old code just
        used style() and don't touch font style. The new code uses the above
        initializeFontStyle.
        (WebCore::StyleResolver::applyProperty):
        Moved a code for initializing font style as "initial" to
        a new method: initializeFontStyle and modified to use the method.
        Modified to use documentSettings().
        (WebCore::StyleResolver::checkForGenericFamilyChange):
        Modified to use documentSettings().
        * css/StyleResolver.h:
        (WebCore::StyleResolver::documentSettings):
        (WebCore::StyleResolver::initializeFontStyle):
        Added two new methods to class StyleResolver.
        * dom/NodeRenderingContext.cpp:
        (WebCore::NodeRenderingContext::NodeRenderingContext):
        Modified to calculate m_resetStyleInheritance in its constructor.
        * dom/NodeRenderingContext.h:
        (WebCore::NodeRenderingContext::resetStyleInheritance):
        Implemented a new method, just returning m_resetStyleInheritance.
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::setResetStyleInheritance):
        Modified to force to recalculate children's styles if
        resetStyleInheritance is changed.
        * dom/ShadowRoot.h:
        (ShadowRoot):
        Added resetStyleInheritance getter and setter.
        * dom/ShadowRoot.idl:
        Added an attribute, resetStyleInheritance.
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::resetStyleInheritance):
        * dom/TreeScope.h:
        (TreeScope):
        Added resetStyleInheritance's default getter.
        The getter will be overrided by class ShadowRoot's getter.

2012-06-07  Victor Carbune  <victor@rosedu.org>

        addTextTrack should set track mode to HIDDEN
        https://bugs.webkit.org/show_bug.cgi?id=88317

        Reviewed by Eric Carlson.

        Updated existing test.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::addTextTrack): Set the default parameters
        for the newly created TextTrack.
        * html/track/TextTrack.cpp:
        (WebCore::TextTrack::TextTrack):

2012-06-07  Li Yin  <li.yin@intel.com>

        FileAPI: Blob should support ArrayBufferView instead of ArrayBuffer for Constructor Parameters
        https://bugs.webkit.org/show_bug.cgi?id=88294

        Reviewed by Jian Li.

        From Spec: http://dev.w3.org/2006/webapi/FileAPI/#dfn-Blob
        Currently we add the support for ArrayBufferView, while still keeping ArrayBuffer for
        backward compatibility. We will remove it in the near future.

        Test: fast/files/blob-constructor.html

        * bindings/js/JSBlobCustom.cpp:
        (WebCore::JSBlobConstructor::constructJSBlob):
        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::V8Blob::constructorCallback):
        * fileapi/WebKitBlobBuilder.cpp:
        (WebCore::WebKitBlobBuilder::append):
        (WebCore):
        * fileapi/WebKitBlobBuilder.h:
        (WebCore):
        (WebKitBlobBuilder):
        * fileapi/WebKitBlobBuilder.idl: Add support for ArrayBufferView in append method

2012-06-07  MORITA Hajime  <morrita@google.com>

        A style in an older shadow subtree causes assert when composing with <shadow>
        https://bugs.webkit.org/show_bug.cgi?id=88299

        Reviewed by Dimitri Glazkov.

        InsertionPoint::attach() assumes its distributed content not being attach()-ed.
        But this assumption can break. This change added a guard for that.
        This can happen for shadow boundaries in general. But ShadowRoot already handles that case.

        Test: fast/dom/shadow/insertion-point-shadow-crash.html

        * html/shadow/InsertionPoint.cpp:
        (WebCore::InsertionPoint::attach):

2012-06-07  Max Feil  <mfeil@rim.com>

        [BlackBerry] Show correct fullscreen button image (media controls)
        https://bugs.webkit.org/show_bug.cgi?id=88563

        Reviewed by Antonio Gomes.

        PR159306: Show "exit" fullscreen button image instead of "enter"
        fullscreen button image when in fullscreen mode (HTML5 media
        controls).

        I am not providing a test due to the simplicity of this patch
        and the relative difficulty and maintainability issues associated
        with testing how an image is rendered.

        * platform/blackberry/RenderThemeBlackBerry.cpp:
        (WebCore::RenderThemeBlackBerry::paintMediaFullscreenButton):

2012-06-07  Noel Gordon  <noel.gordon@gmail.com>

        [chromium] Use WEBPImportPictureRGBX|BGRX to import picture data
        https://bugs.webkit.org/show_bug.cgi?id=88218

        Reviewed by Kent Tamura.

        Stop using the RGBA and RGBA variants of the picture import routines (since
        these will import alpha channel data in a future libwebp). Use the RGBX and
        BGRX variants to import picture data for encoding to make it clear that the
        alpha channel is (and must be) ignored.

        Test: fast/canvas/canvas-toDataURL-webp.html

        * platform/image-encoders/skia/WEBPImageEncoder.cpp:
        (WebCore::rgbPictureImport):
        (WebCore::importPictureBGRX): Use WEBPImportPictureBGRX for picture imports
        that must ignore the alpha channel. Change the template parameter to be the
        premultiplied alpha state of the input image data.
        (WebCore::importPictureRGBX): Use WEBPImportPictureRGBX, ditto.
        (WebCore::encodePixels): Invert the sense of the template parameter to make
        it now indicate the premultiplied alpha state of the input image data.

2012-06-07  Takashi Sakamoto  <tasak@google.com>

        Improve the performance of pushScope in StyleResolver
        https://bugs.webkit.org/show_bug.cgi?id=88222

        Reviewed by Hajime Morita.

        As setupScopeStack always sets m_scopeStackParent to be NULL,
        m_scopeStack is never reused. m_scopeStackParent should be the last
        element of m_scopeStack.

        No new tests, because fast/css/style-scoped/ uses pushScope,
        popScope and setupScopeStack and checks whether there exists
        any crash bug or not. And this patch doesn't change any behavior
        of scoped author syltes.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::setupScopeStack):
        Modified to set m_scopeSackParent to be the last element of
        m_scopeStack.
        (WebCore::StyleResolver::popScope):
        Modified to remove the last element if m_scopeStack is not empty and
        the last element of m_scopeStack has the same scope as the scoping
        element given by the argument.

2012-06-07  Mark Pilgrim  <pilgrim@chromium.org>

        [Chromium] Move didStartWorkerRunLoop to Platform.h
        https://bugs.webkit.org/show_bug.cgi?id=88562

        Reviewed by Adam Barth.

        Part of a refactoring series. See tracking bug 82948.

        * WebCore.gyp/WebCore.gyp:
        * bindings/v8/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::~WorkerScriptController):
        * platform/chromium/PlatformSupport.h:
        (WebCore):
        * workers/WorkerThread.cpp:
        (WebCore::WorkerThread::workerThread):

2012-06-07  Mike West  <mkwst@chromium.org>

        Dropping m_startingLineNumber property from StyledElement.
        https://bugs.webkit.org/show_bug.cgi?id=86848

        Reviewed by Adam Barth.

        We can have the same effect by moving the line-number calculation
        directly into StyledElement::styleAttributeChanged. This means that
        subsequent changes to the style attribute (via script) won't generate
        error messages with line numbers, but that's an acceptable tradeoff.

        Behavior is covered by existing CSP tests.

        * dom/StyledElement.cpp:
        (WebCore::StyledElement::StyledElement):
        (WebCore::StyledElement::styleAttributeChanged):
        * dom/StyledElement.h:
        (WebCore::StyledElement::destroyInlineStyle):

2012-06-07  Peter Beverloo  <peter@chromium.org>

        Initialize m_document in AXObjectCache's constructor for !HAVE(ACCESSIBILITY) builds
        https://bugs.webkit.org/show_bug.cgi?id=88527

        Reviewed by Adam Barth.

        Initialize the m_document member with the passed on document in the stubbed
        AXObjectCache constructor. No behavioral changes.

        * accessibility/AXObjectCache.h:
        (WebCore::AXObjectCache::AXObjectCache):

2012-06-05  James Robinson  <jamesr@chromium.org>

        [chromium] Move deferral-related logic out of Canvas2DLayerChromium
        https://bugs.webkit.org/show_bug.cgi?id=86050

        Reviewed by Stephen White.

        This removes Canvas2DLayerChromium and puts the deferral and double-buffering related logic in a new class,
        Canvas2DLayerBridge, that uses TextureLayerChromium for compositing.  The bridge is responsible for managing the
        front texture when double buffering is active, inserting the correct makeContextCurrent() and flush() calls on
        the GraphicsContext3D and SkCanvas when appropriate, and owning the lifetime of the layer.

        * WebCore.gypi:
        * platform/graphics/chromium/Canvas2DLayerBridge.cpp: Added.
        (WebCore):
        (AcceleratedDeviceContext):
        (WebCore::AcceleratedDeviceContext::AcceleratedDeviceContext):
        (WebCore::AcceleratedDeviceContext::prepareForDraw):
        (WebCore::Canvas2DLayerBridge::Canvas2DLayerBridge):
        (WebCore::Canvas2DLayerBridge::~Canvas2DLayerBridge):
        (WebCore::Canvas2DLayerBridge::skCanvas):
        (WebCore::Canvas2DLayerBridge::prepareTexture):
        (WebCore::Canvas2DLayerBridge::context):
        (WebCore::Canvas2DLayerBridge::layer):
        (WebCore::Canvas2DLayerBridge::contextAcquired):
        * platform/graphics/chromium/Canvas2DLayerBridge.h: Added.
        (WebCore):
        (Canvas2DLayerBridge):
        (WebCore::Canvas2DLayerBridge::create):
        * platform/graphics/chromium/Canvas2DLayerChromium.cpp: Removed.
        * platform/graphics/chromium/Canvas2DLayerChromium.h: Removed.
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        * platform/graphics/chromium/ImageBufferDataSkia.h:
        (WebCore):
        (ImageBufferData):
        * platform/graphics/chromium/TextureLayerChromium.cpp:
        (WebCore::TextureLayerChromium::willModifyTexture):
            willModifyTexture() is called whenever the texture currently owned by the TextureLayerChromium will be
            modified by a system out of the compositor's control. It makes sure that the compositor does not attempt to
            draw with the potentially-modified texture until the next commit. For canvas, this is used when threading is
            enabled and a non-deferrable drawing command is invoked from JS.
        (WebCore):
        * platform/graphics/chromium/TextureLayerChromium.h:
        (TextureLayerChromium):
        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:
        (WebCore::CCTextureUpdater::hasMoreUpdates):
        (WebCore::CCTextureUpdater::update):
        (WebCore::CCTextureUpdater::clear):
        * platform/graphics/chromium/cc/CCTextureUpdater.h:
        (CCTextureUpdater):
        * platform/graphics/skia/ImageBufferSkia.cpp:
        (WebCore::createAcceleratedCanvas):
        (WebCore::ImageBuffer::~ImageBuffer):
        (WebCore::ImageBuffer::context):
        (WebCore::ImageBuffer::platformLayer):

2012-06-07  Patrick Gansterer  <paroga@webkit.org>

        Remove HAVE(PATH_BASED_BORDER_RADIUS_DRAWING)
        https://bugs.webkit.org/show_bug.cgi?id=87931

        Reviewed by Beth Dakin.

        r62035 added HAVE(PATH_BASED_BORDER_RADIUS_DRAWING) until all ports implement
        GraphicsContext::clipConvexPolygon(). All major ports define HAVE_PATH_BASED_BORDER_RADIUS_DRAWING in the
        meantime and the alternative path has unnecessary maintainace costs and even don't compile at the moment.

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::drawBoxSideFromPath):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::paintFocusRing):
        * rendering/RenderObject.h:
        (RenderObject):

2012-06-06  Vincent Scheib  <scheib@chromium.org>

        Add new Pointer Lock spec events webkitpointerlockchange and webkitpointerlockerror
        https://bugs.webkit.org/show_bug.cgi?id=88377

        Reviewed by Dimitri Glazkov.

        Part of a series of refactoring changes to update pointer lock API to
        the fullscreen locking style. https://bugs.webkit.org/show_bug.cgi?id=84402

        New change and error events added. Follow up patches will remove
        the previous callbacks and pointerlocklost event. Tests updated
        to include the new events, and a new test added specifically for
        the new events, pointerlockchange-pointerlockerror-events.html.

        Test: pointer-lock/pointerlockchange-pointerlockerror-events.html

        * dom/Document.h:
        (Document):
        * dom/Document.idl:
        * dom/EventNames.h:
        (WebCore):
        * page/PointerLockController.cpp:
        (WebCore::PointerLockController::requestPointerLock):
        (WebCore::PointerLockController::didAcquirePointerLock):
        (WebCore::PointerLockController::didNotAcquirePointerLock):
        (WebCore::PointerLockController::didLosePointerLock):
        (WebCore::PointerLockController::enqueueEvent):
        (WebCore):
        * page/PointerLockController.h:
        (PointerLockController):

2012-06-07  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119744.
        http://trac.webkit.org/changeset/119744
        https://bugs.webkit.org/show_bug.cgi?id=88584

        Fails assertions in debug builds (Requested by jamesr_ on
        #webkit).

        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
        (WebCore::CCIOSurfaceLayerImpl::~CCIOSurfaceLayerImpl):
        (WebCore::CCIOSurfaceLayerImpl::willDraw):

2012-06-07  Julien Chaffraix  <jchaffraix@webkit.org>

        Cache RenderLayer::isRootLayer for better performance
        https://bugs.webkit.org/show_bug.cgi?id=88570

        Reviewed by Ojan Vafai.

        Caching covered by existing tests.

        RenderLayer::isRootLayer()'s answer will be the same during the RenderLayer's
        lifetime as a RenderLayer is tied to a RenderBoxModelObject. This change caches
        isRootLayer value in the constructor.

        On http://dglazkov.github.com/performance-tests/biggrid.html with a 100,000 rows
        by 100 columns table, it saves about 10% on the paint time during scrolling on
        my machine (going from 50ms to 45ms). It would expect all code paths to see some
        improvement as checking renderer()->isRenderView() was pretty common.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::RenderLayer):
        Added code to cache the result of renderer()->isRenderView() here.

        (WebCore::RenderLayer::stackingContext):
        (WebCore::isPositionedContainer):
        (WebCore::isFixedPositionedContainer):
        (WebCore::RenderLayer::enclosingTransformedAncestor):
        (WebCore::RenderLayer::clippingRootForPainting):
        (WebCore::shouldSuppressPaintingLayer):
        (WebCore::RenderLayer::hitTest):
        (WebCore::RenderLayer::intersectsDamageRect):
        * rendering/RenderLayer.h:
        (WebCore::RenderLayer::isStackingContext):
        Updated all the call sites to use isRootLayer() instead of renderer()->isRenderView()
        as it is faster.

        (WebCore::RenderLayer::isRootLayer):
        Added our caching here. Also made m_canSkipRepaintRectsUpdateOnScroll to follow
        m_isRootLayer example.

2012-06-07  Takashi Sakamoto  <tasak@google.com>

        Incorrect border rendering when border radius is above 2px.
        https://bugs.webkit.org/show_bug.cgi?id=88046

        Fixing findInnerVertex's logic to decide which is the better line
        to find an inner vertex, x=center point's x of a rendering box or
        y=center point's y of a rendering box.

        Reviewed by Simon Fraser.

        Test: fast/borders/border-radius-valid-border-clipping.html

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::findInnerVertex):

2012-06-07  Edaena Salinas Jasso  <edaena@apple.com>

        Should fire error event for empty 404 script
        https://bugs.webkit.org/show_bug.cgi?id=50589
        
        Reviewed by Brady Eidson.

        Tests: 
        http/tests/loading/fire-error-event-empty-404-script.html
        http/tests/loading/fire-error-script-no-content-type.html

        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::didReceiveResponse): We should check for http status 
        codes here to stop depending on the response being non-empty.
        (WebCore::SubresourceLoader::didReceiveData): Moved the http status check but
        avoid messing with multipart responses.
        (WebCore::SubresourceLoader::checkForHTTPStatusCodeError): Renamed from 
        errorLoadingResource for clarity.

        * loader/SubresourceLoader.h:
        * loader/cf/SubresourceLoaderCF.cpp:
        (WebCore::SubresourceLoader::didReceiveDataArray):
        Updated for errorLoadingResource renaming.

2012-06-07  Konrad Piascik  <kpiascik@rim.com>

        [BlackBerry] Update PlayBook's User Agent String for Web Inspector
        https://bugs.webkit.org/show_bug.cgi?id=88543

        Reviewed by Antonio Gomes.

        We expect users to upgrade their devices so developers only need the latest UA String.

        No tests needed.

        * inspector/front-end/SettingsScreen.js:
        (WebInspector.SettingsScreen.prototype._createUserAgentSelectRowElement.get const):

2012-06-07  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Remove obsolete FIXME comment about a layer sorting bug.
        https://bugs.webkit.org/show_bug.cgi?id=88546

        Reviewed by James Robinson.

        No tests needed, only comment changed. The comment referred to a
        potential bug that actually will not occur. The W3C spec on CSS 3d
        transforms indicates that layers that do not share the same "3d
        rendering context" do not sort together, and our existing code
        sorts this way already.

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::subtreeShouldRenderToSeparateSurface):

2012-06-07  Adam Barth  <abarth@webkit.org>

        Settings::defaultDeviceScaleFactor is redundant with Page::deviceScaleFactor
        https://bugs.webkit.org/show_bug.cgi?id=88375

        Reviewed by James Robinson.

        This patch removes Settings::defaultDeviceScaleFactor because it is
        redundant with Page::deviceScaleFactor now that we no longer support
        target-densitydpi.  Page::deviceScaleFactor is the canonical place to
        store the device scale factor.

        * WebCore.exp.in:
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        (WebCore):
        * page/Settings.h:
        (Settings):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::setDeviceScaleFactor):

2012-06-07  Alec Flett  <alecflett@chromium.org>

        IndexedDB: Error codes, phase one
        https://bugs.webkit.org/show_bug.cgi?id=88459

        Reviewed by Tony Chang.

        This phase gets rid of the now-deprecated NOT_ALLOWED_ERR and
        NON_TRANSIENT_ERR from earlier versions of the spec, and
        normalizes the place where TypeError should be thrown so that it's
        easier to update when the bindings change.

        No new tests: existing tests cover these changes and have been updated.

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::advance):
        (WebCore::IDBCursor::continueFunction):
        (WebCore::IDBCursor::stringToDirection):
        (WebCore::IDBCursor::directionToString):
        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
        (WebCore::IDBCursorBackendImpl::update):
        (WebCore::IDBCursorBackendImpl::deleteFunction):
        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::createObjectStore):
        (WebCore::IDBDatabase::deleteObjectStore):
        (WebCore::IDBDatabase::setVersion):
        (WebCore::IDBDatabase::transaction):
        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
        (WebCore::IDBDatabaseBackendImpl::deleteObjectStore):
        (WebCore::IDBDatabaseBackendImpl::setVersion):
        * Modules/indexeddb/IDBDatabaseException.cpp:
        (WebCore):
        * Modules/indexeddb/IDBDatabaseException.h:
        * Modules/indexeddb/IDBDatabaseException.idl:
        * Modules/indexeddb/IDBFactory.cpp:
        (WebCore::IDBFactory::open):
        (WebCore::IDBFactory::deleteDatabase):
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::index):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::createIndex):
        (WebCore::IDBObjectStoreBackendImpl::deleteIndex):
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::result):
        (WebCore::IDBRequest::errorCode):
        (WebCore::IDBRequest::webkitErrorMessage):
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::objectStore):
        (WebCore::IDBTransaction::stringToMode):
        (WebCore::IDBTransaction::modeToString):
        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
        (WebCore::IDBTransactionBackendImpl::objectStore):

2012-06-07  Dana Jansens  <danakj@chromium.org>

        [chromium] Free texture from CCIOSurfaceLayerImpl when it is destroyed
        https://bugs.webkit.org/show_bug.cgi?id=88371

        Reviewed by James Robinson.

        Unit test: CCLayerTreeHostImplTest.layersFreeTextures

        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
        (WebCore::CCIOSurfaceLayerImpl::~CCIOSurfaceLayerImpl):
        (WebCore::CCIOSurfaceLayerImpl::willDraw):

2012-06-07  Peter Beverloo  <peter@chromium.org>

        Buildfix for ENABLE_OVERFLOW_SCROLLING=0 (though defined)
        https://bugs.webkit.org/show_bug.cgi?id=88564

        Reviewed by Adam Barth.

        Where ENABLE(X) mandates that X both has to be defined and evaluates to
        true as a lone preprocessor statement, there were two places in the CSS
        property and value input files where only was checked whether is has
        been defined. This also goes against other #ifdefs in those files.

        * css/CSSPropertyNames.in:
        * css/CSSValueKeywords.in:

2012-06-07  Ami Fischman  <fischman@chromium.org>

        Plumb CORS attribute information from HTMLMediaElement to media players so it can be used
        https://bugs.webkit.org/show_bug.cgi?id=88349

        Reviewed by Adam Barth.

        Test: http/tests/security/video-cross-origin-readback.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerCORSMode):
        (WebCore):
        * html/HTMLMediaElement.h:
        (HTMLMediaElement):
        * html/canvas/CanvasRenderingContext.cpp:
        (WebCore::CanvasRenderingContext::wouldTaintOrigin):
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::didPassCORSAccessCheck):
        (WebCore):
        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayerClient::mediaPlayerCORSMode):
        (MediaPlayer):
        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::didPassCORSAccessCheck):
        (MediaPlayerPrivateInterface):

2012-06-07  Mark Hahnenberg  <mhahnenberg@apple.com>

        Worker tear-down can re-enter JSC during GC finalization
        https://bugs.webkit.org/show_bug.cgi?id=88449

        Reviewed by Geoffrey Garen.

        No new tests. 

        This is the first of two patches to fix this issue with Workers.

        * workers/AbstractWorker.cpp:
        (WebCore::AbstractWorker::~AbstractWorker): We don't need to call onDestroyWorker() here, it 
        will be called elsewhere in contextDestroyed().

2012-06-07  Jer Noble  <jer.noble@apple.com>

        sometimes all slaved videos don't start playing
        https://bugs.webkit.org/show_bug.cgi?id=88553

        Reviewed by Darin Adler.

        Test: media/media-controller-time-clamp.html

        Some PlatformClock classes will occasionally return times < 0 and will
        always return times slightly > duration() when playback has ended.  Clamp
        the value of currentTime() to the specified [0..duration] range.

        * html/MediaController.cpp:
        (MediaController::currentTime):

2012-06-07  Simon Fraser  <simon.fraser@apple.com>

        Optimize FrameView::scrollXForFixedPosition() / scrollYForFixedPosition()
        https://bugs.webkit.org/show_bug.cgi?id=88475

        Reviewed by Sam Weinig.
        
        FrameView's scrollXForFixedPosition() and scrollYForFixedPosition()
        methods were often called together, but they do duplicate work,
        including calling into platform widget code which might be slow.
        
        Fix by converting scrollOffsetForFixedPosition() from being a wrapper
        that just calls scrollXForFixedPosition() and scrollYForFixedPosition()
        to the method that does all the work, calling just once into platform
        widget code.
        
        Changed callers to use scrollOffsetForFixedPosition() rather than make
        two separate method calls.
        
        Added ScrollView::layoutSize() and visibleSize() methods for
        convenience.
        
        Removed FrameView::scrollXForFixedPosition and FrameView::scrollYForFixedPosition
        to avoid inefficient callers in future.

        No new tests; refactoring only.

        * page/FrameView.cpp:
        (WebCore::fixedPositionScrollOffset):
        (WebCore::FrameView::scrollOffsetForFixedPosition):
        * page/FrameView.h: Removed scrollXForFixedPosition and scrollYForFixedPosition.
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::layoutSize):
        * platform/ScrollView.h:
        (WebCore::ScrollView::visibleSize):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::backgroundClipRect):
        * rendering/RenderLayer.h:
        (WebCore::ClipRect::move):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::requiresCompositingForPosition):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::computeRectForRepaint):

2012-06-07  Raymes Khoury  <raymes@chromium.org>

        Incorrect rect-based hit-test result for culled-inline elements
        https://bugs.webkit.org/show_bug.cgi?id=85849

        Reviewed by Levi Weintraub.

        Modified code which blindly adds culled inlines to rect-based hit-test
        results so that it only does so if the child node does not fully cover
        the hit-test region.

        Test: fast/dom/nodesFromRect-culled-inline.html

        * rendering/HitTestResult.cpp:
        (WebCore::HitTestResult::addNodeToRectBasedTestResult):

2012-06-07  Daniel Erat  <derat@chromium.org>

        Make Skia backend honor requests for subpixel-positioned text.
        https://bugs.webkit.org/show_bug.cgi?id=88263

        Reviewed by Tony Chang.

        Add subpixel positioning field to FontRenderStyle and rename
        subpixel rendering field.

        Pass setting to SkPaint in FontPlatformDataHarfBuzz and remove
        round() call when computing glyph widths in SimpleFontDataSkia.

        Test: platform/chromium-linux/fast/text/chromium-linux-text-subpixel-positioning.html

        * platform/graphics/blackberry/skia/PlatformSupport.cpp:
        (WebCore::setFontRenderStyleDefaults):
        (WebCore::PlatformSupport::getRenderStyleForStrike):
        * platform/graphics/chromium/FontRenderStyle.h:
        (WebCore::FontRenderStyle::FontRenderStyle):
        (WebCore::FontRenderStyle::operator==):
        (FontRenderStyle):
        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp:
        (WebCore):
        (WebCore::FontPlatformData::setSubpixelRendering):
        (WebCore::FontPlatformData::setSubpixelPositioning):
        (WebCore::FontPlatformData::setupPaint):
        (WebCore::FontPlatformData::querySystemForRenderStyle):
        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h:
        (FontPlatformData):
        * platform/graphics/skia/SimpleFontDataSkia.cpp:
        (WebCore::SimpleFontData::platformWidthForGlyph):

2012-06-06  Dana Jansens  <danakj@chromium.org>

        [chromium] In each composited frame, didDraw() should only be called on layers for which willDraw() was called
        https://bugs.webkit.org/show_bug.cgi?id=88469

        Reviewed by James Robinson.

        Unit test: CCLayerTreeHostImplTest.didDrawNotCalledOnScissoredLayer

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::shouldDrawLayer):
        (WebCore):
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::CCLayerTreeHostImpl::didDrawAllLayers):

2012-06-07  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: sorting of object fields is broken in heap profiler
        https://bugs.webkit.org/show_bug.cgi?id=88532

        A recent change to heap profiler has replaced getters with functions.
        Function calls were missing in couple places after that change.

        Reviewed by Vsevolod Vlasov.

        Tests: inspector/profiler/heap-snapshot-summary-sorting-fields.html
               inspector/profiler/heap-snapshot-summary-sorting-instances.html

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotEdgesProvider.prototype.sort.compareNodeField):

2012-06-07  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Consider Ctrl+Shift+key as valid zoom change combinations
        https://bugs.webkit.org/show_bug.cgi?id=88520

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/inspector.js:
        (WebInspector.documentKeyDown):

2012-06-07  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] Allow WebPageCompositor to blend a transparent web page
        https://bugs.webkit.org/show_bug.cgi?id=88233

        Reviewed by Rob Buis.

        RIM PR #159998

        Add a parameter to LayerRenderer::compositeBuffer() indicating whether
        the buffer contents are opaque, and set the GL blend mode accordingly.

        This is not currently testable using BlackBerry testing infrastructure.

        Reviewed internally by Jakob Petsovits.

        * platform/graphics/blackberry/LayerRenderer.cpp:
        (WebCore::LayerRenderer::compositeBuffer):
        * platform/graphics/blackberry/LayerRenderer.h:
        (LayerRenderer):

2012-06-07  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: reuse edge_count field of heap snapshot to store retained size
        https://bugs.webkit.org/show_bug.cgi?id=88416

        The edge_count field is unused after node first edge indexes have been built.
        Store node retained size in there instead of allocating an extra array for it.

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotNode.prototype.retainedSize):
        (WebInspector.HeapSnapshot.prototype._calculateRetainedSizes):

2012-06-07  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119694.
        http://trac.webkit.org/changeset/119694
        https://bugs.webkit.org/show_bug.cgi?id=88529

        it broke PrerenderBrowserTest.PrerenderHTML5VideoNetwork
        (Requested by loislo on #webkit).

        * html/HTMLMediaElement.cpp:
        * html/HTMLMediaElement.h:
        (HTMLMediaElement):
        * html/canvas/CanvasRenderingContext.cpp:
        (WebCore::CanvasRenderingContext::wouldTaintOrigin):
        * platform/graphics/MediaPlayer.cpp:
        * platform/graphics/MediaPlayer.h:
        (MediaPlayer):
        * platform/graphics/MediaPlayerPrivate.h:

2012-06-07  Shinya Kawanaka  <shinyak@chromium.org>

        Delete a contenteditable element having a Shadow DOM causes a crash.
        https://bugs.webkit.org/show_bug.cgi?id=86345

        Reviewed by Ryosuke Niwa.

        In VisibleSelection::validate(), m_start.downstream() or m_end.upstream() might cross
        editing boundaries. So we adjust selection after calling them again.

        Test: editing/shadow/select-contenteditable-shadowhost.html

        * editing/VisibleSelection.cpp:
        (WebCore::VisibleSelection::validate):

2012-06-07  Vivek Galatage  <vivekgalatage@gmail.com>

        No new line at the end for SVGCSSPropertyNames.in causes compilation warning
        https://bugs.webkit.org/show_bug.cgi?id=88503

        Reviewed by Ryosuke Niwa.

        Added new line at the end of the file.

        No new tests required.

        * css/SVGCSSPropertyNames.in:

2012-06-07  Csaba Osztrogonác  <ossy@webkit.org>

        [Qt][Win] Use OS(WINDOWS) instead of Q_WS_WIN in WebCore/platform/graphics/GraphicsContext.h
        https://bugs.webkit.org/show_bug.cgi?id=88305

        Reviewed by Simon Hausmann.

        * platform/graphics/GraphicsContext.h: Buildfix.
        (GraphicsContext):

2012-06-07  Shinya Kawanaka  <shinyak@chromium.org>

        Incorrect data retrieved in calls to get selection data in client->textWillBeReplaced from CharacterData::setDataAndUpdate
        https://bugs.webkit.org/show_bug.cgi?id=66120

        Reviewed by Ryosuke Niwa.

        Since FrameSelection::textWillBeReplaced was called before replacing text, updated Selection became
        temporarily invalid. The invalid selection was set to updateSelection(), so client will have
        invalid selection.

        This patch makes calling updateSelection() after updating selection.

        No new tests, it's too hard to create a correct test cases in DRT.

        * dom/CharacterData.cpp:
        (WebCore::CharacterData::setDataAndUpdate):
        * editing/FrameSelection.cpp:
        (WebCore::updatePositionAfterAdoptingTextReplacement):
        (WebCore::FrameSelection::textWasReplaced):
        * editing/FrameSelection.h:
        (FrameSelection):

2012-06-07  Li Yin  <li.yin@intel.com>

        FileAPI: If type consists of non-ASCII characters in Blob constructor, it should throw a SyntaxError.
        https://bugs.webkit.org/show_bug.cgi?id=88411

        Reviewed by Kentaro Hara.

        From spec: http://dev.w3.org/2006/webapi/FileAPI/#constructorBlob
        If type consists of any non-ASCII characters, throw a SyntaxError and
        return from this algorithm.
        This patch checks the String is ASCii or not, if not, throw SyntaxError.

        Test: fast/files/blob-constructor.html

        * bindings/js/JSBlobCustom.cpp:
        (WebCore::JSBlobConstructor::constructJSBlob):
        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::V8Blob::constructorCallback):

2012-06-07  Arpita Bahuguna  <arpitabahuguna@gmail.com>

        InsertUnorderedList and InsertOrderedList (execCommand) do not remove bullets
        https://bugs.webkit.org/show_bug.cgi?id=84597

        Reviewed by Ryosuke Niwa.

        Comparison between start and end VisiblePositions will fail when a position inside
        a paragraph is compared with one at the start of the paragraph.
        
        This fix thus converts the end VisiblePosition (which could be inside the paragraph)
        to the start of the paragraph thereby enabling a proper comparison of start and end
        positions.

        Test: editing/execCommand/remove-list-from-multi-list-items.html

        * editing/InsertListCommand.cpp:
        (WebCore::InsertListCommand::selectionHasListOfType):

2012-06-07  Li Yin  <li.yin@intel.com>

        [FileAPI] FileReader should throw an InvalidStateError exception when readyState is LOADING
        https://bugs.webkit.org/show_bug.cgi?id=88212

        Reviewed by Jian Li.

        From Spec: http://www.w3.org/TR/FileAPI/#readAsBinaryString
        FileReader should throw an InvalidStateError exception instead of NOT_ALLOWED_ERR
        when the readyState is LOADING.
        Also delete OperationNotAllowedException related code, because it is not longer needed.

        Tests: fast/files/read-file-async.html
               fast/files/workers/worker-read-file-async.html

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/DOMExceptions.in:
        * fileapi/FileReader.cpp:
        (WebCore::FileReader::readInternal): Changed it to throw INVALID_STATE_ERR.
        * fileapi/FileReader.idl: Changed it to raise DOMException for all read methods.
        * fileapi/OperationNotAllowedException.cpp: Removed.
        * fileapi/OperationNotAllowedException.h: Removed.
        * fileapi/OperationNotAllowedException.idl: Removed.

2012-06-07  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119689.
        http://trac.webkit.org/changeset/119689
        https://bugs.webkit.org/show_bug.cgi?id=88516

        it broke didDrawNotCalledOnScissoredLayer webkit_unit_test
        (Requested by loislo on #webkit).

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::CCLayerTreeHostImpl::didDrawAllLayers):

2012-06-07  Ami Fischman  <fischman@chromium.org>

        Plumb CORS attribute information from HTMLMediaElement to media players so it can be used
        https://bugs.webkit.org/show_bug.cgi?id=88349

        Reviewed by Adam Barth.

        Test: http/tests/security/video-cross-origin-readback.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerCORSMode):
        (WebCore):
        * html/HTMLMediaElement.h:
        (HTMLMediaElement):
        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayerClient::mediaPlayerCORSMode):

2012-06-07  Hironori Bono  <hbono@chromium.org>

        Use light gray for grammar markers on Windows and Linux
        https://bugs.webkit.org/show_bug.cgi?id=88398

        Reviewed by Ryosuke Niwa.

        This change changes the color of grammar markers from dark gray to light gray
        and rebaselines a couple of pixel tests affected by this change.

        No new tests because it changes the marker color of an existing test 'grammar-markers.html'.

        * platform/graphics/skia/GraphicsContextSkia.cpp: Change dark gray to light gray.

2012-06-07  Yoshifumi Inoue  <yosin@chromium.org>

        [Platform] Introduce conversion from/to Deciaml to/from double
        https://bugs.webkit.org/show_bug.cgi?id=88480

        Reviewed by Kent Tamura.

        This patch added functions for Decimal/Double conversion and isInfinity
        for reducing patch size of introducing Decimal arithmetic, bug 88383.

        Tests: WebKit/chromium/tests/DecimalTest.cpp

        * platform/Decimal.cpp:
        (WebCore::Decimal::fromDouble): Added.
        (WebCore::Decimal::toDouble): Added.
        * platform/Decimal.h:
        (WebCore::Decimal::EncodedData::isInfinity): Added for isinf()
        (WebCore::Decimal::isInfinity): Added.

2012-06-06  Xianzhu Wang  <wangxianzhu@chromium.org>

        Element.getBoundingClientRect() and Element.getClientRects() return incorrect values in frames in a scaled page
        https://bugs.webkit.org/show_bug.cgi?id=88430

        Element.getBoudingClientRect() and Element.getClientRects() should not scale back the rects
        if the element is in a frame because page scale only apply to elements in the main frame.

        Reviewed by James Robinson.

        Tests: fast/dom/Element/scale-page-bounding-client-rect-in-frame.html
               fast/dom/Element/scale-page-client-rects-in-frame.html

        * dom/Document.cpp:
        (WebCore):
        (WebCore::Document::adjustFloatQuadsForScrollAndAbsoluteZoomAndFrameScale): Extracted from Element.cpp and Range.cpp and fixed issue of pageScale in frames.
        (WebCore::Document::adjustFloatRectForScrollAndAbsoluteZoomAndFrameScale): Extracted from Element.cpp and fixed issue of pageScale in frames.
        * dom/Document.h:
        (WebCore):
        (Document):
        * dom/Element.cpp:
        (WebCore::Element::getClientRects):
        (WebCore::Element::getBoundingClientRect):
        * dom/Range.cpp:
        (WebCore):
        (WebCore::adjustFloatQuadsForScrollAndAbsoluteZoomAndPageScale): Moved into Document and fixed issue of pageScale in frames.
        (WebCore::Range::getBorderAndTextQuads):
        * rendering/RenderObject.h: Removed adjustFloatQuadForPageScale and adjustFloatRectForPageScale because they seem unrelated to RenderObject.
        (WebCore):

2012-06-06  Dana Jansens  <danakj@chromium.org>

        [chromium] In each composited frame, didDraw() should only be called on layers for which willDraw() was called
        https://bugs.webkit.org/show_bug.cgi?id=88469

        Reviewed by James Robinson.

        Unit test: CCLayerTreeHostImplTest.didDrawNotCalledOnScissoredLayer

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::shouldDrawLayer):
        (WebCore):
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::CCLayerTreeHostImpl::didDrawAllLayers):

2012-06-06  Andy Estes  <aestes@apple.com>

        Wrap uppercaseWord, lowercaseWord, and capitalizeWord with USE(APPKIT)
        https://bugs.webkit.org/show_bug.cgi?id=88504

        Reviewed by Dan Bernstein.

        uppercaseWord, lowercaseWord, and capitalizeWord are methods declared
        by NSResponder that subclasses are expected to implement. WebKit should
        only support these implementations on platforms that use AppKit.

        * WebCore.exp.in:
        * editing/Editor.cpp:
        * editing/Editor.h:
        * loader/EmptyClients.h:
        * page/ContextMenuController.cpp:
        * page/EditorClient.h:

2012-06-06  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119683.
        http://trac.webkit.org/changeset/119683
        https://bugs.webkit.org/show_bug.cgi?id=88505

        it broke webkit-unit-test
        WebLayerTreeViewThreadedTest.InstrumentationCallbacks on mac
        (Requested by loislo on #webkit).

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
        (WebCore::CCLayerTreeHost::setVisible):

2012-06-06  Robert Kroeger  <rjkroege@chromium.org>

        [Chromium] Re-enable handling of smooth scrolling on Chromium Linux/Windows
        https://bugs.webkit.org/show_bug.cgi?id=87535 by adding support for
        m_hasPreciseScrollingDelta on all Chromium platforms and adjusting ScrollAnimator
        and ScrollAnimatorNone accordingly to let m_hasPreciseScrollingDelta == true
        force exact (non-animated) scrolling.

        Reviewed by James Robinson.

        Updated WebKit unit tests to validate change.

        * platform/PlatformWheelEvent.h:
        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Adjusted #ifdefs to
        make m_hasPreciseScrollingDelta available on all Chromium platforms.
        (PlatformWheelEvent):
        * platform/ScrollAnimator.cpp:
        (WebCore::ScrollAnimator::handleWheelEvent): Default scroll type is set based on 
        m_hasPreciseScrollingDelta value.
        * platform/ScrollAnimatorNone.cpp:
        (WebCore::ScrollAnimatorNone::scroll): Scroll precisely when necessary.
        * platform/ScrollTypes.h: Added additional pixel scrolling subtype.
        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::scroll): Updated for additional pixel scroll subtype.

2012-06-06  Michal Mocny  <mmocny@google.com>

        [chromium] Stop dropping texture limits when the layer tree host becomes invisible, and initialize with 0 allocation.
        https://bugs.webkit.org/show_bug.cgi?id=87747

        Reviewed by Adrienne Walker.

        GpuMemoryManager manages texture memory allocation limits. It will send a 0 allocation when a renderer becomes
        invisible, and an appropriate allocation after a renderer is initialized.  These numbers will change
        depending on the state of memory across devices and other renderers, so we would like to remove all explicit
        management by the renderers themselves.

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
        (WebCore::CCLayerTreeHost::setVisible):

2012-06-06  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119680.
        http://trac.webkit.org/changeset/119680
        https://bugs.webkit.org/show_bug.cgi?id=88498

        It broke mac build (Requested by kinuko on #webkit).

        * fileapi/File.cpp:
        (WebCore::File::File):
        (WebCore::File::lastModifiedDate):
        (WebCore::File::lastModifiedDateForBinding):
        (WebCore):
        (WebCore::File::captureSnapshot):
        * fileapi/File.h:
        (File):
        * fileapi/File.idl:
        * platform/FileMetadata.h:
        (WebCore::FileMetadata::FileMetadata):
        * platform/FileSystem.h:
        * platform/chromium/support/WebHTTPBody.cpp:
        (WebKit::WebHTTPBody::elementAt):
        * platform/network/BlobData.cpp:
        (WebCore):

2012-06-06  Kinuko Yasuda  <kinuko@chromium.org>

        File::lastModifiedDate should use NaN or separate boolean flag for null Date value
        https://bugs.webkit.org/show_bug.cgi?id=87826

        Reviewed by Kent Tamura.

        Test: http/tests/local/fileapi/file-last-modified-after-delete.html

        * fileapi/File.cpp:
        (WebCore::File::File):
        (WebCore::File::captureSnapshot):
        (WebCore::File::lastModifiedDate):
        (WebCore::File::lastModifiedDateForBinding): Removed.
        * fileapi/File.h:
        (File):
        * fileapi/File.idl:
        * platform/FileMetadata.h:
        (WebCore::FileMetadata::FileMetadata):
        * platform/FileSystem.h:
        * platform/chromium/support/WebHTTPBody.cpp:
        (WebKit::WebHTTPBody::elementAt):
        * platform/network/BlobData.cpp:
        (WebCore):

2012-06-06  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119668.
        http://trac.webkit.org/changeset/119668
        https://bugs.webkit.org/show_bug.cgi?id=88493

        Hitting assertions in debug builds (Requested by rniwa on
        #webkit).

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::localCaretRect):
        * rendering/RenderBoxModelObject.cpp:
        * rendering/RenderBoxModelObject.h:
        (RenderBoxModelObject):
        * rendering/RenderInline.cpp:
        * rendering/RenderInline.h:
        (RenderInline):

2012-06-06  Julien Chaffraix  <jchaffraix@webkit.org>

        Cache isSelfPaintingLayer() for better performance
        https://bugs.webkit.org/show_bug.cgi?id=88464

        Reviewed by Simon Fraser.

        Covered by existing tests (repaint tests among them).

        isSelfPaintingLayer() has shown up several times on some scrolling benchmarks due
        to the function being called several time per paint phase. This change caches the
        boolean at style change time.
        
        On http://dglazkov.github.com/performance-tests/biggrid.html, this nearly speed-up
        painting by 2 (lowering the time taken to paint the newly exposed area when scrolling
        on a 10,000 * 100 table from 95ms to 50ms).

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::RenderLayer):
        Initialized m_isSelfPaintingLayer here.

        (WebCore::RenderLayer::paintLayer):
        Changed the order of the checks to get the more likely check first.

        (WebCore::RenderLayer::shouldBeSelfPaintingLayer):
        Renamed from isSelfPaintingLayer to make m_isNormalFlowOnly.

        (WebCore::RenderLayer::styleChanged):
        Added code to update our cached m_isSelfPaintingLayer.

        * rendering/RenderLayer.h:
        (WebCore::RenderLayer::isSelfPaintingLayer):
        Changed to return m_isSelfPaintingLayer.

2012-06-06  Yoshifumi Inoue  <yosin@chromium.org>

        REGRESSION(r109729) [Form] Rendering of select/optgroup/option combination is too slow.
        https://bugs.webkit.org/show_bug.cgi?id=88059

        Reviewed by Kent Tamura.

        This patch changes not to share RenderStyle object for option and
        optgroup element regardless attributes.

        When we tried to shared RenderStyle object, rendering performance was
        good but we had issue in selected option and text transform, see
        https://bugs.webkit.org/show_bug.cgi?id=88405 for details.

        No new tests. This patch doesn't change behavior but rendering performance.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::canShareStyleWithElement): Changed to always
        return false for option and optgroup.

2012-06-06  Alec Flett  <alecflett@chromium.org>

        IndexedDB: Optimize single-key get()
        https://bugs.webkit.org/show_bug.cgi?id=85288

        Reviewed by Tony Chang.

        No new tests, this is just an optimization.

        After a recent refactoring, we started creating
        an internal cursor with every call to get(). The
        most common use of get() is with a single key,
        so provide a fast-path to avoid creating the cursor.

        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
        (WebCore::IDBIndexBackendImpl::getByRangeInternal):
        * Modules/indexeddb/IDBKeyRange.h:
        (WebCore::IDBKeyRange::isOnlyKey):
        (IDBKeyRange):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::getByRangeInternal):

2012-06-06  Shezan Baig  <shezbaig.wk@gmail.com>

        Caret is not rendered in empty inline contenteditable elements
        https://bugs.webkit.org/show_bug.cgi?id=85793

        Reviewed by Ryosuke Niwa.

        Override localCaretRect in RenderInline. The implementation was almost
        identical to localCaretRect in RenderBlock for empty block elements, so
        I refactored RenderBlock::localCaretRect and moved the logic to a new
        method 'localCaretRectForEmptyElement' in RenderBoxModelObject. The
        implementation of 'localCaretRect' in RenderBlock and RenderInline both
        use this helper method in RenderBoxModelObject.

        Tests: editing/selection/caret-in-empty-inline-1.html
               editing/selection/caret-in-empty-inline-2.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::localCaretRect):
        Modified to use RenderBoxModelObject::localCaretRectForEmptyElement.
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::localCaretRectForEmptyElement):
        (WebCore):
        * rendering/RenderBoxModelObject.h:
        (RenderBoxModelObject):
        Add localCaretRectForEmptyElement helper method.
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::localCaretRect):
        (WebCore):
        * rendering/RenderInline.h:
        (RenderInline):
        Override localCaretRect using localCaretRectForEmptyElement.

2012-06-06  Alexis Menard  <alexis.menard@openbossa.org>

        Fix border-image-slice failures on http://css3test.com.
        https://bugs.webkit.org/show_bug.cgi?id=88328

        Reviewed by Tony Chang.

        The old parsing code was assuming that the fill keyword comes after the
        numbers or the percentage values. http://www.w3.org/TR/css3-background/#the-border-image-slice
        defines the property like this : [<number> | <percentage>]{1,4} && fill? where the fill
        keyword is not mandatory. But according to http://www.w3.org/TR/CSS2/about.html "&&" 
        separates two or more components, all of which must occur, in any order. So the previous
        code was wrong the fill can come first following by the percentages or the numbers. http://css3test.com
        was covering this particular case. I took the opportunity to extend our coverage 
        by adding tests on many different values the boder-image-slice property could take. I
        also did a small cleanup by removing unused functions in BorderImageSliceParseContext.

        Test: fast/css/getComputedStyle/getComputedStyle-border-image-slice.html

        * css/CSSParser.cpp:
        (WebCore::BorderImageSliceParseContext::BorderImageSliceParseContext):
        (WebCore::BorderImageSliceParseContext::commitNumber):
        (WebCore::BorderImageSliceParseContext::commitFill):

2012-06-06  Levi Weintraub  <leviw@chromium.org>

        Use enclosingIntRect instead of pixelSnappedIntRect in RenderFileUploadControl
        https://bugs.webkit.org/show_bug.cgi?id=88454

        Reviewed by Kent Tamura.

        Properly clipping the file upload control to avoid clipping out the top of the file upload button
        when the control is positioned at a sub-pixel offset that rounds up.

        Test: fast/sub-pixel/file-upload-control-at-fractional-offset.html

        * rendering/RenderFileUploadControl.cpp:
        (WebCore::RenderFileUploadControl::paintObject):

2012-06-06  Filip Pizlo  <fpizlo@apple.com>

        Global object variable accesses should not require an extra load
        https://bugs.webkit.org/show_bug.cgi?id=88385

        Reviewed by Gavin Barraclough and Geoffrey Garen.

        Updated JSDOMWindowBase.cpp to use the new symbol table API. this->symbolTableFoo(...)
        becomes symbolTableFoo(this, ...).
                
        No new tests because no change in behavior.

        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::updateDocument):

2012-06-06  James Robinson  <jamesr@chromium.org>

        [chromium] Move implementation of WebCore::GraphicsContext3D and related from WebKit/chromium/src to WebCore/platform/chromium/support
        https://bugs.webkit.org/show_bug.cgi?id=86257

        Reviewed by Kenneth Russell.

        The WebCore platform interfaces GraphicsContext3D and Extensions3DChromium are implemented in chromium
        on top of the Platform interface WebGraphicsContext3D. This moves the implementation support code from
        WebKit/chromium/src to WebCore/platform/chromium/support, which avoids having code in WebKit/ implementing WebCore
        interfaces and allows code in WebCore/platform to use this support code directly where appropriate.

        Refactor only, no new functionality or tests.

        * WebCore.gypi:
        * platform/chromium/support/Extensions3DChromium.cpp: Renamed from Source/WebKit/chromium/src/Extensions3DChromium.cpp.
        (WebCore):
        (WebCore::Extensions3DChromium::Extensions3DChromium):
        (WebCore::Extensions3DChromium::~Extensions3DChromium):
        (WebCore::Extensions3DChromium::supports):
        (WebCore::Extensions3DChromium::ensureEnabled):
        (WebCore::Extensions3DChromium::isEnabled):
        (WebCore::Extensions3DChromium::getGraphicsResetStatusARB):
        (WebCore::Extensions3DChromium::blitFramebuffer):
        (WebCore::Extensions3DChromium::renderbufferStorageMultisample):
        (WebCore::Extensions3DChromium::postSubBufferCHROMIUM):
        (WebCore::Extensions3DChromium::mapBufferSubDataCHROMIUM):
        (WebCore::Extensions3DChromium::unmapBufferSubDataCHROMIUM):
        (WebCore::Extensions3DChromium::mapTexSubImage2DCHROMIUM):
        (WebCore::Extensions3DChromium::unmapTexSubImage2DCHROMIUM):
        (WebCore::Extensions3DChromium::setVisibilityCHROMIUM):
        (WebCore::Extensions3DChromium::discardFramebufferEXT):
        (WebCore::Extensions3DChromium::ensureFramebufferCHROMIUM):
        (WebCore::Extensions3DChromium::setGpuMemoryAllocationChangedCallbackCHROMIUM):
        (WebCore::Extensions3DChromium::createVertexArrayOES):
        (WebCore::Extensions3DChromium::deleteVertexArrayOES):
        (WebCore::Extensions3DChromium::isVertexArrayOES):
        (WebCore::Extensions3DChromium::bindVertexArrayOES):
        (WebCore::Extensions3DChromium::getTranslatedShaderSourceANGLE):
        (WebCore::Extensions3DChromium::setSwapBuffersCompleteCallbackCHROMIUM):
        (WebCore::Extensions3DChromium::rateLimitOffscreenContextCHROMIUM):
        (WebCore::Extensions3DChromium::paintFramebufferToCanvas):
        (WebCore::Extensions3DChromium::texImageIOSurface2DCHROMIUM):
        (WebCore::Extensions3DChromium::texStorage2DEXT):
        (WebCore::Extensions3DChromium::createQueryEXT):
        (WebCore::Extensions3DChromium::deleteQueryEXT):
        (WebCore::Extensions3DChromium::isQueryEXT):
        (WebCore::Extensions3DChromium::beginQueryEXT):
        (WebCore::Extensions3DChromium::endQueryEXT):
        (WebCore::Extensions3DChromium::getQueryivEXT):
        (WebCore::Extensions3DChromium::getQueryObjectuivEXT):
        * platform/chromium/support/GraphicsContext3DChromium.cpp: Renamed from Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp.
        (WebCore):
        (WebCore::GraphicsContext3D::GraphicsContext3D):
        (WebCore::GraphicsContext3D::~GraphicsContext3D):
        (WebCore::GraphicsContext3D::setContextLostCallback):
        (WebCore::GraphicsContext3D::setErrorMessageCallback):
        (WebCore::GraphicsContext3D::create):
        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
        (WebCore::GraphicsContext3D::platformTexture):
        (WebCore::GraphicsContext3D::grContext):
        (WebCore::GraphicsContext3D::platformLayer):
        (WebCore::GraphicsContext3D::isGLES2Compliant):
        (WebCore::GraphicsContext3D::isResourceSafe):
        (WebCore::GraphicsContext3D::bindAttribLocation):
        (WebCore::GraphicsContext3D::bufferData):
        (WebCore::GraphicsContext3D::getActiveAttrib):
        (WebCore::GraphicsContext3D::getActiveUniform):
        (WebCore::GraphicsContext3D::getAttribLocation):
        (WebCore::GraphicsContext3D::getContextAttributes):
        (WebCore::GraphicsContext3D::getProgramInfoLog):
        (WebCore::GraphicsContext3D::getShaderInfoLog):
        (WebCore::GraphicsContext3D::getShaderSource):
        (WebCore::GraphicsContext3D::getString):
        (WebCore::GraphicsContext3D::getUniformLocation):
        (WebCore::GraphicsContext3D::shaderSource):
        (WebCore::GraphicsContext3D::texImage2D):
        (WebCore::GraphicsContext3D::texSubImage2D):
        (WebCore::GraphicsContext3D::reshape):
        (WebCore::GraphicsContext3D::markContextChanged):
        (WebCore::GraphicsContext3D::layerComposited):
        (WebCore::GraphicsContext3D::markLayerComposited):
        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):
        (WebCore::GraphicsContext3D::paintRenderingResultsToImageData):
        (WebCore::GraphicsContext3D::paintCompositedResultsToCanvas):
        (WebCore::GraphicsContext3D::getExtensions):
        (WebCore::GraphicsContext3D::getInternalFramebufferSize):
        * platform/chromium/support/GraphicsContext3DPrivate.cpp: Renamed from Source/WebKit/chromium/src/GraphicsContext3DPrivate.cpp.
        (WebCore):
        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
        (WebCore::GraphicsContext3DPrivate::~GraphicsContext3DPrivate):
        (WebCore::GraphicsContext3DPrivate::createGraphicsContextFromWebContext):
        (WebCore::GraphicsContext3DPrivate::extractWebGraphicsContext3D):
        (GrMemoryAllocationChangedCallback):
        (WebCore::GrMemoryAllocationChangedCallback::GrMemoryAllocationChangedCallback):
        (WebCore::GrMemoryAllocationChangedCallback::onGpuMemoryAllocationChanged):
        (WebCore::GraphicsContext3DPrivate::grContext):
        (WebCore::GraphicsContext3DPrivate::markContextChanged):
        (WebCore::GraphicsContext3DPrivate::layerComposited):
        (WebCore::GraphicsContext3DPrivate::markLayerComposited):
        (WebCore::GraphicsContext3DPrivate::paintFramebufferToCanvas):
        (GraphicsContext3DContextLostCallbackAdapter):
        (WebCore::GraphicsContext3DContextLostCallbackAdapter::GraphicsContext3DContextLostCallbackAdapter):
        (WebCore::GraphicsContext3DContextLostCallbackAdapter::~GraphicsContext3DContextLostCallbackAdapter):
        (WebCore::GraphicsContext3DContextLostCallbackAdapter::onContextLost):
        (WebCore::GraphicsContext3DPrivate::setContextLostCallback):
        (GraphicsContext3DErrorMessageCallbackAdapter):
        (WebCore::GraphicsContext3DErrorMessageCallbackAdapter::GraphicsContext3DErrorMessageCallbackAdapter):
        (WebCore::GraphicsContext3DErrorMessageCallbackAdapter::~GraphicsContext3DErrorMessageCallbackAdapter):
        (WebCore::GraphicsContext3DErrorMessageCallbackAdapter::onErrorMessage):
        (WebCore::GraphicsContext3DPrivate::setErrorMessageCallback):
        (WebCore::GraphicsContext3DPrivate::getExtensions):
        (WebCore::GraphicsContext3DPrivate::initializeExtensions):
        (WebCore::GraphicsContext3DPrivate::supportsExtension):
        (WebCore::GraphicsContext3DPrivate::ensureExtensionEnabled):
        (WebCore::GraphicsContext3DPrivate::isExtensionEnabled):
        (WebCore::GraphicsContext3DPrivate::isResourceSafe):
        (GraphicsContext3DMemoryAllocationChangedCallbackAdapter):
        (WebCore::GraphicsContext3DMemoryAllocationChangedCallbackAdapter::GraphicsContext3DMemoryAllocationChangedCallbackAdapter):
        (WebCore::GraphicsContext3DMemoryAllocationChangedCallbackAdapter::~GraphicsContext3DMemoryAllocationChangedCallbackAdapter):
        (WebCore::GraphicsContext3DMemoryAllocationChangedCallbackAdapter::onMemoryAllocationChanged):
        (WebCore::GraphicsContext3DPrivate::setGpuMemoryAllocationChangedCallbackCHROMIUM):
        (GraphicsContext3DSwapBuffersCompleteCallbackAdapter):
        (WebCore::GraphicsContext3DSwapBuffersCompleteCallbackAdapter::GraphicsContext3DSwapBuffersCompleteCallbackAdapter):
        (WebCore::GraphicsContext3DSwapBuffersCompleteCallbackAdapter::~GraphicsContext3DSwapBuffersCompleteCallbackAdapter):
        (WebCore::GraphicsContext3DSwapBuffersCompleteCallbackAdapter::onSwapBuffersComplete):
        (WebCore::GraphicsContext3DPrivate::setSwapBuffersCompleteCallbackCHROMIUM):
        * platform/chromium/support/GraphicsContext3DPrivate.h: Renamed from Source/WebKit/chromium/src/GraphicsContext3DPrivate.h.
        (WebKit):
        (WebCore):
        (GraphicsContext3DPrivate):
        (WebCore::GraphicsContext3DPrivate::webContext):
        (WebCore::GraphicsContext3DPrivate::preserveDrawingBuffer):

2012-06-06  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119624.
        http://trac.webkit.org/changeset/119624
        https://bugs.webkit.org/show_bug.cgi?id=88472

        Caused worker tests to become flaky (Requested by mhahnenberg
        on #webkit).

        * workers/AbstractWorker.cpp:
        (WebCore::AbstractWorker::~AbstractWorker):
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::workerObjectDestroyed):

2012-06-06  Brady Eidson  <beidson@apple.com>

        <rdar://problem/11575112> and https://bugs.webkit.org/show_bug.cgi?id=88428
        REGRESSION (r115654): Opening many non-English WebArchives shows obvious encoding issues

        Reviewed by Nate Chapin.

        Test: fast/loader/webarchive-encoding-respected.html

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::commitData): Properly set the main resource encoding from the webarchive.

2012-06-06  Mark Hahnenberg  <mhahnenberg@apple.com>

        Worker tear-down can re-enter JSC during GC finalization
        https://bugs.webkit.org/show_bug.cgi?id=88449

        Reviewed by Geoffrey Garen.

        No new tests. Current regression tests cover these changes.

        * workers/AbstractWorker.cpp: 
        (WebCore::AbstractWorker::~AbstractWorker): We don't need to call onDestroyWorker() here, it 
        will be called elsewhere in contextDestroyed().
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::workerObjectDestroyed): We make the call to terminateWorkerContext()
        and workerContextDestroyed() asynchronous to avoid entering JSC during GC finalization.

2012-06-06  Tony Chang  <tony@chromium.org>

        webkit crashes on debug builds when running IETC flexbox-ordinal-group-001.htm
        https://bugs.webkit.org/show_bug.cgi?id=85832

        Reviewed by Ojan Vafai.

        We were using a HashSet<unsigned>, which can't hold the value of 0.
        According to the spec, 0 isn't a valid value, so at CSS parse time,
        reject the value 0. This lets us pass the test, although that's kind
        of by accident.

        We could allow 0 for box-ordinal-group, but there are some perf implications
        to having allowing a value below the initial value (1 in this case).

        We still allow 0 for box-flex-group, because that's what the existing code
        does and there are tests expecting this behavior.

        No new tests, covered by ietestcenter/css3/flexbox/flexbox-ordinal-group-001.htm
        which was crashing.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue): Reject 0 for -webkit-box-ordinal-group.

2012-06-06  Ojan Vafai  <ojan@chromium.org>

        Remove some magic from the -webkit-flex shorthand parsing to match the changes in the spec
        https://bugs.webkit.org/show_bug.cgi?id=88444

        Reviewed by Tony Chang.

        -Unset positive flex defaults to 0.
        -Unset negative flex defaults to 1. No magic of doing something different if positive flex was set.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseFlex):

2012-06-06  Ryosuke Niwa  <rniwa@webkit.org>

        Revert r119440 now that I have a time to rebaseline them all!

        * platform/ScrollbarThemeComposite.cpp:
        (WebCore::ScrollbarThemeComposite::thumbLength):

2012-06-06  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Infinite recursion in IDBObjectStore.openCursor(key, legacy_constant)
        https://bugs.webkit.org/show_bug.cgi?id=88431

        Reviewed by Tony Chang.

        Function was calling itself, rather than delegating to the correct (IDBKeyRange) overload.

        Test: storage/indexeddb/legacy-constants.html

        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::openCursor):

2012-06-06  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Rename IDBFactory.getDatabaseNames() to webkitGetDatabaseNames()
        https://bugs.webkit.org/show_bug.cgi?id=86874

        Reviewed by Ojan Vafai.

        The function is non-standard, and should be prefixed.

        Test: storage/indexeddb/factory-basics.html

        * Modules/indexeddb/IDBFactory.idl:

2012-06-06  Julien Chaffraix  <jchaffraix@webkit.org>

        Add support for direction on table row group with collapsing borders
        https://bugs.webkit.org/show_bug.cgi?id=87900

        Reviewed by Ojan Vafai.

        Tests: fast/table/border-collapsing/first-cell-left-border-hidden-table-ltr-section-rtl.html
               fast/table/border-collapsing/last-cell-left-border-hidden-table-ltr-section-rtl.html
               fast/table/border-collapsing/left-border-table-ltr-section-rtl.html
               fast/table/border-collapsing/left-border-table-rtl-section-ltr.html
               fast/table/border-collapsing/left-border-table-rtl-section-rtl.html
               fast/table/border-collapsing/left-border-vertical-lr-table-ltr-section-rtl.html
               fast/table/border-collapsing/left-border-vertical-lr-table-rtl-section-ltr.html
               fast/table/border-collapsing/left-border-vertical-lr-table-rtl-section-rtl.html
               fast/table/border-collapsing/rtl-table-left-border-hidden.html
               fast/table/border-collapsing/top-border-vertical-rl-table-ltr-section-rtl.html
               fast/table/border-collapsing/top-border-vertical-rl-table-rtl-section-ltr.html
               fast/table/border-collapsing/top-border-vertical-rl-table-rtl-section-rtl.html
               fast/table/table-ltr-section-rtl.html
               fast/table/table-rtl-section-ltr.html
               fast/table/table-rtl-section-rtl.html

        This change enables proper support for direction on table row group.
        The current code would allow people to set direction on the row group but would still
        use the table's code for directionality checks (with surprising consequences).

        The main change involve swapping end / start borders in case of mixed directionality
        as those 2 are not in sync.
        
        Example: <table dir="ltr"><tbody dir="rtl"><td id="cell0"></td><td id="cell1"></td></tbody></table>

        Visually:
        Table: Start ---------------------> End
        Tbody: End <---------------------- Start
        Cell:  | #cell0        |           #cell1 |

        In this example, the end table border should be compared with the tbody's start border
        and the last cell's (in DOM order) start border.

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::tableStartBorderAdjoiningCell):
        (WebCore::RenderTable::tableEndBorderAdjoiningCell):
        Same as the other adjoining functions.

        * rendering/RenderTable.h:
        (WebCore::RenderTable::lastColumnIndex):
        Helper function to get the last column index.

        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::computeCollapsedStartBorder):
        (WebCore::RenderTableCell::computeCollapsedEndBorder):
        Updated to call the table's adjoining border helpers.

        * rendering/RenderTableCell.h:
        (WebCore::RenderTableCell::styleForCellFlow):
        Updated to use the table row group's style now that we properly support it.

        (WebCore::RenderTableCell::isFirstOrLastCellInRow):
        Debug only helper to make sure we don't call the border adjoining function
        on non-terminal cells.

        (WebCore::RenderTableCell::borderAdjoiningTableStart):
        (WebCore::RenderTableCell::borderAdjoiningTableEnd):
        * rendering/RenderTableRow.h:
        (WebCore::RenderTableRow::borderAdjoiningTableStart):
        (WebCore::RenderTableRow::borderAdjoiningTableEnd):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::firstRowCellAdjoiningTableStart):
        (WebCore::RenderTableSection::firstRowCellAdjoiningTableEnd):
        Updated the previous function to account for mixed directionality.

        (WebCore::RenderTableSection::layoutRows):
        Move some of the code to setLogicalPositionForCell to match RenderBlock.

        (WebCore::RenderTableSection::setLogicalPositionForCell):
        Switched direction checks to styleForCellFlow (this doesn't change anything as we
        were already properly flipping already but ensure better).

        * rendering/RenderTableSection.h:
        (WebCore::RenderTableSection::hasSameDirectionAsTable):
        Added this helper to know if we have a mixed direction.

        (WebCore::RenderTableSection::borderAdjoiningTableStart):
        (WebCore::RenderTableSection::borderAdjoiningTableEnd):
        Updated to account for mixed directionality.

2012-06-06  Keyar Hood  <keyar@chromium.org>

        [Chromium] imageSmoothingEnabled should apply to patterns
        https://bugs.webkit.org/show_bug.cgi?id=88103

        Reviewed by Stephen White.

        Test: fast/canvas/canvas-imageSmoothingEnabled-patterns.html

        When drawing patterns on a Canvas, the imageSmoothingEnabled flag is
        respected.
        * platform/graphics/skia/PlatformContextSkia.cpp:
        (WebCore::PlatformContextSkia::setupShader):

2012-06-06  Andrey Adaikin  <aandrey@chromium.org>

        Web Inspector: [JSC] Add WebGL instrumentation support
        https://bugs.webkit.org/show_bug.cgi?id=87975

        Reviewed by Vsevolod Vlasov.

        * bindings/js/JSInjectedScriptManager.cpp:
        (WebCore::injectAndExecuteFunction):
        (WebCore::InjectedScriptManager::createInjectedScript):
        (WebCore):
        (WebCore::InjectedScriptManager::injectWebGLScript):
        * bindings/v8/custom/V8InjectedScriptManager.cpp:
        (WebCore::InjectedScriptManager::injectWebGLScript):
        * inspector/InjectedScriptManager.cpp:
        (WebCore::InjectedScriptManager::wrapWebGLRenderingContextForInstrumentation):
        * inspector/InjectedScriptManager.h:
        (InjectedScriptManager):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        * inspector/InspectorWebGLAgent.cpp:
        (WebCore::InspectorWebGLAgent::wrapWebGLRenderingContextForInstrumentation):
        * inspector/InspectorWebGLAgent.h:
        (InspectorWebGLAgent):
        * inspector/InspectorWebGLInstrumentation.h:
        (WebCore::InspectorInstrumentation::wrapWebGLRenderingContextForInstrumentation):

2012-06-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>

        Fix a few spelling mistakes in IconDatabase logging

        Makes debugging harder if the logging is confusing.

        Reviewed by Jocelyn Turcotte.

        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::notifyPendingLoadDecisions):
        (WebCore::IconDatabase::readFromDatabase):

2012-05-25  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: [Compiler] Remove compile-front-end.sh and fix InjectedScriptSource errors.
        https://bugs.webkit.org/show_bug.cgi?id=87512

        Reviewed by Yury Semikhatsky.

        Removed compile-front-end.sh, compile-front-end.py should be used instead now.
        Made generate_protocol_externs a python module to call it from compile-front-end.py.
        Temporary copy of InjectedScriptSource.js is created and modified to
        avoid "This code lacks side effects" warning.

        * inspector/compile-front-end.py:
        * inspector/compile-front-end.sh: Removed.
        * inspector/generate-protocol-externs: Removed.
        * inspector/generate_protocol_externs.py: Added.
        (full_qualified_type_id):
        (param_type):
        (generate_protocol_externs):

2012-06-06  Zoltan Herczeg  <zherczeg@webkit.org>

        [Qt] REGRESSION(r118616): It made all tests crash in debug mode
        https://bugs.webkit.org/show_bug.cgi?id=87701

        Reviewed by Csaba Osztrogonác.

        Replace WriteBarrier<JSObject> to Weak<JSObject> by introducing a new
        QtWeakObjectReference sub class. Rewrite all affected type definitions.

        All existing test in debug mode cover this issue.

        * bridge/qt/qt_class.cpp:
        (JSC::Bindings::QtClass::fallbackObject):
        * bridge/qt/qt_instance.cpp:
        (QtRuntimeObject):
        (JSC::Bindings::QtInstance::removeUnusedMethods):
        * bridge/qt/qt_instance.h:
        (QtInstance):
        (QtWeakObjectReference):
        (JSC::Bindings::QtInstance::QtWeakObjectReference::QtWeakObjectReference):
        (JSC::Bindings::QtInstance::QtWeakObjectReference::operator=):
        (JSC::Bindings::QtInstance::QtWeakObjectReference::get):
        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::QtRuntimeMethodData::finalize):
        * bridge/qt/qt_runtime_qt4.cpp:
        (JSC::Bindings::QtRuntimeMethodData::finalize):

2012-06-06  Eugene Klyuchnikov  <eustas.bug@gmail.com>

        Web Inspector: help/settings screen does not overlay console in split screen mode
        https://bugs.webkit.org/show_bug.cgi?id=88352

        Reviewed by Pavel Feldman.

        * inspector/front-end/HelpScreen.js:
        (WebInspector.HelpScreen): Mark view as root.
        (WebInspector.HelpScreen.prototype.showModal): Change view parent.
        * inspector/front-end/helpScreen.css:
        (.help-window-outer): Add panel and status bar indent.
        (body.compact .help-window-outer): Ditto.

2012-06-06  Yoshifumi Inoue  <yosin@chromium.org>

        [Form] Changes for InputNumber type
        https://bugs.webkit.org/show_bug.cgi?id=88394

        Reviewed by Kent Tamura.

        This patch changes codes for consitency of InputNumber usage for
        reducing size of patch when we change InputNumber type alias from
        double to Decimal.

        No new tests. This patch doesn't change behavior.

        * html/BaseDateAndTimeInputType.cpp:
        (WebCore::BaseDateAndTimeInputType::serializeWithComponents): Fixed parameter type for getAllowedValueStep.
        * html/InputType.cpp:
        (WebCore::InputType::minimum): Fixed return value type to InputNumber.
        (WebCore::InputType::maximum): ditto.
        * html/MonthInputType.cpp:
        (WebCore::MonthInputType::defaultValueForStepUp): Fix return value type to InputNumber.
        (WebCore::MonthInputType::parseToNumber): ditto.
        * html/NumberInputType.cpp:
        (WebCore::NumberInputType::setValueAsDouble): Removed extra convertDoubleToInputNumber.
        * html/StepRange.cpp:
        (WebCore::StepRange::alignValueForStep): Use roundByStep for code sharing.
        (WebCore::StepRange::clampValue): ditto.
        (WebCore::StepRange::roundByStep): Added.
        * html/StepRange.h:
        (StepRange): Added a declaration of roundByStep.

2012-06-06  Michael Brüning  <michael.bruning@nokia.com>

        [Qt] Fix harmattan builds broken by r119247.
        https://bugs.webkit.org/show_bug.cgi?id=88330

        Reviewed by Jocelyn Turcotte.

        Fix Harmattan build break caused by undefined constant
        GL_TEXTURE_RECTANGLE_ARB by adding defined(GL_ARB_texture_rectangle)
        guards around TextureMapperGL::drawTextureRectangleARB.

        * platform/graphics/texmap/TextureMapperGL.cpp: Added defined(GL_ARB_texture_rectangle) guards around drawTextureRectangleARB.
        (WebCore):
        * platform/graphics/texmap/TextureMapperGL.h: Added definded(GL_ARB_texture_rectangle) guards around drawTextureRectangleARB.

2012-06-06  Shinya Kawanaka  <shinyak@chromium.org>

        PositionIterator:;setOffsetInLeafNode() is not used anywhere.
        https://bugs.webkit.org/show_bug.cgi?id=88397

        Reviewed by Ryosuke Niwa.

        It's not used anywhere. We can remove it safely.

        No new tests, no change in behavior.

        * WebCore.order:
        * dom/PositionIterator.cpp:
        * dom/PositionIterator.h:

2012-06-06  Andrey Adaikin  <aandrey@chromium.org>

        Web Inspector: [WebGL] Add WebGL instrumentation support on the backend
        https://bugs.webkit.org/show_bug.cgi?id=87960

        Adds a WebGLAgent, injects a WebGL script upon calling the getContext
        method of a HTMLCanvasElement that will wrap the WebGL rendering context
        for instrumentation purposes.

        Reviewed by Yury Semikhatsky.

        * CMakeLists.txt:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.am:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSHTMLCanvasElementCustom.cpp:
        (WebCore::JSHTMLCanvasElement::getContext):
        (WebCore::JSHTMLCanvasElement::toDataURL):
        * bindings/js/JSInjectedScriptManager.cpp:
        (WebCore):
        (WebCore::InjectedScriptManager::injectWebGLScript):
        * bindings/v8/ScriptState.cpp:
        (WebCore::ScriptState::forContext):
        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
        (WebCore::V8HTMLCanvasElement::getContextCallback):
        * bindings/v8/custom/V8InjectedScriptManager.cpp:
        (WebCore::InjectedScriptManager::createInjectedScript):
        (WebCore):
        (WebCore::InjectedScriptManager::injectWebGLScript):
        (WebCore::InjectedScriptManager::discardInjectedScript):
        (WebCore::InjectedScriptManager::injectedScriptFor):
        * inspector/CodeGeneratorInspector.py:
        * inspector/InjectedScriptManager.cpp:
        (WebCore):
        (WebCore::InjectedScriptManager::wrapWebGLRenderingContextForInstrumentation):
        (WebCore::InjectedScriptManager::injectedWebGLScriptSource):
        * inspector/InjectedScriptManager.h:
        (InjectedScriptManager):
        * inspector/InjectedWebGLScriptSource.js: Added.
        * inspector/Inspector.json:
        * inspector/InspectorAllInOne.cpp:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        * inspector/InspectorInstrumentation.h:
        (WebCore):
        (InspectorInstrumentation):
        (WebCore::InspectorInstrumentation::markResourceAsCached):
        * inspector/InspectorWebGLAgent.cpp: Added.
        (WebCore):
        (WebGLAgentState):
        (WebCore::InspectorWebGLAgent::InspectorWebGLAgent):
        (WebCore::InspectorWebGLAgent::~InspectorWebGLAgent):
        (WebCore::InspectorWebGLAgent::setFrontend):
        (WebCore::InspectorWebGLAgent::clearFrontend):
        (WebCore::InspectorWebGLAgent::restore):
        (WebCore::InspectorWebGLAgent::enable):
        (WebCore::InspectorWebGLAgent::disable):
        (WebCore::InspectorWebGLAgent::wrapWebGLRenderingContextForInstrumentation):
        * inspector/InspectorWebGLAgent.h: Added.
        (WebCore):
        (InspectorWebGLAgent):
        (WebCore::InspectorWebGLAgent::create):
        (WebCore::InspectorWebGLAgent::enabled):
        * inspector/InspectorWebGLInstrumentation.h: Added.
        (WebCore):
        (WebCore::InspectorInstrumentation::wrapWebGLRenderingContextForInstrumentation):
        * inspector/InstrumentingAgents.h:
        (WebCore):
        (WebCore::InstrumentingAgents::InstrumentingAgents):
        (InstrumentingAgents):
        (WebCore::InstrumentingAgents::inspectorWebGLAgent):
        (WebCore::InstrumentingAgents::setInspectorWebGLAgent):

2012-06-06  Joone Hur  <joone.hur@intel.com>

        [GTK] Build fix for Accelerated Compositing with OpenGL
        https://bugs.webkit.org/show_bug.cgi?id=88292

        Reviewed by Martin Robinson.

        Build fix after r119247.
        Do not include GraphicsSurface.h when not building
        with GRAPHICS_SURFACE.

        No new tests. This is only a build fix.

        * platform/graphics/texmap/TextureMapperBackingStore.cpp:
        * platform/graphics/texmap/TextureMapperBackingStore.h:
        * platform/graphics/texmap/TextureMapperGL.cpp:

2012-06-05  Joe Thomas  <joethomas@motorola.com>

        ASSERTION FAILED: ASSERT(!isPercentageIntrinsicSize) in RenderReplaced::computeIntrinsicRatioInformationForRenderBox
        https://bugs.webkit.org/show_bug.cgi?id=88197

        Reviewed by Daniel Bates.

        RenderSVGRoot extends RenderReplaced and it overrides the computeIntrinsicRatioInformation() 
        method of RenderReplaced. RenderSVGRoot::computeIntrinsicRatioInformation
        sets isPercentageIntrinsicSize to true while it handles width and height of percentage types.
        So this assertion should be fired only if intrinsicRatio is non-zero.

        Test: svg/in-html/svg-assert-failure-percentage.html

        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::computeIntrinsicRatioInformationForRenderBox):

2012-06-05  Tony Chang  <tony@chromium.org>

        Changing flexbox justify/alignment doesn't update their positioning
        https://bugs.webkit.org/show_bug.cgi?id=88366

        Reviewed by Ojan Vafai.

        Test: css3/flexbox/style-change.html

        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::diff): Since these member variables were moved
        out of StyleFlexibleBoxData, we have to compare them in RenderStyle::diff.

2012-06-05  Charles Wei  <charles.wei@torchmobile.com.cn>

        JSC implementation of SerializedScriptValue for IndexedDB
        https://bugs.webkit.org/show_bug.cgi?id=88048

        Reviewed by George Staikos.

        No new tests. All the current indexeddb test cases apply when indexeddb works for JSC.

        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::CloneSerializer::serializeNumber):
        (CloneSerializer):
        (WebCore::CloneDeserializer::toWireString):
        (CloneDeserializer):
        (WebCore::SerializedScriptValue::create):
        (WebCore::SerializedScriptValue::toWireString):
        (WebCore):
        (WebCore::SerializedScriptValue::createFromWire):
        (WebCore::SerializedScriptValue::numberValue):
        (WebCore::SerializedScriptValue::deserialize):

2012-06-05  Ojan Vafai  <ojan@chromium.org>

        Nested CSS flexbox renders incorrectly
        https://bugs.webkit.org/show_bug.cgi?id=87679

        Reviewed by Julien Chaffraix.

        If the containing block with a perpendicular writing mode has an overrideHeight,
        then its logical height should be based off that instead of its RenderStyle.

        Test: css3/flexbox/perpendicular-writing-modes-inside-flex-item.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::perpendicularContainingBlockLogicalHeight):

2012-06-05  Charles Wei  <charles.wei@torchmobile.com.cn>

        Need special-case toJS(IDBAny) for IDBCursorWithValue
        https://bugs.webkit.org/show_bug.cgi?id=87963

        Reviewed by George Staikos.

        No new tests, this is for indexedDB, which is not working for JSC binding.
        When indexedDB working for JSC, all the indexdb test cases should apply.

        * bindings/js/JSIDBAnyCustom.cpp:
        (WebCore::toJS):

2012-06-05  Michal Mocny  <mmocny@google.com>

        [chromium] Set default memory allocation limit bytes when GL_CHROMIUM_gpu_memory_manager is not supported by graphics context.
        https://bugs.webkit.org/show_bug.cgi?id=87996

        Reviewed by James Robinson.

        Soon we hope to have renderers not manage there own memory allocation limits, and rely exclusively on the
        allocation given by GpuMemoryManager.  However, when the graphics context does not support the
        GL_CHROMIUM_gpu_memory_manager extension, such as the one used by DumpRenderTree, we must default the
        memory allocation limit to some non-0 value.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::initialize):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::postSetContentsMemoryAllocationLimitBytesToMainThreadOnImplThread):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        (WebCore):
        (DebugScopedSetMainThreadFromEither):
        (WebCore::DebugScopedSetMainThreadFromEither::DebugScopedSetMainThreadFromEither):
        (WebCore::DebugScopedSetMainThreadFromEither::~DebugScopedSetMainThreadFromEither):

2012-06-05  Roland Takacs  <takacs.roland@stud.u-szeged.hu>

        [Qt] Use GraphicsContext3DOpenGLES.cpp when using OpenGL ES
        https://bugs.webkit.org/show_bug.cgi?id=78720

        Reviewed by Noam Rosenthal.

        Functions are removed from GraphicsContext3DQt that already implemented
        in GraphicsContext3DCommon. Macros that not supported at GLES have been
        changed to their appropriate pair that found in GraphicsContext3D
        (e.g. GL_FRAMEBUFFER_EXT to GraphicsContext3D::FRAMEBUFFER).
        It was needed because OpenGLES does not support these macros.
        Extensions3DQt is removed beceause it has never been used.
        Some functions have been moved fron GraphicsContext3DCommon to *OpenGL
        and *OpenGLES to provide specialization.
        The "m_depthStencilBuffer" member is added to Qt port because it uses
        "m_depthStencilBuffer" like the other platforms.

        * Target.pri:
        * platform/graphics/GraphicsContext3D.h:
        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
        (WebCore::GraphicsContext3D::depthRange):
        (WebCore):
        (WebCore::GraphicsContext3D::clearDepth):
        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
        (WebCore::GraphicsContext3D::prepareTexture):
        (WebCore::GraphicsContext3D::readRenderingResults):
        (WebCore::GraphicsContext3D::reshape):
        (WebCore::GraphicsContext3D::copyTexImage2D):
        (WebCore::GraphicsContext3D::copyTexSubImage2D):
        (WebCore::GraphicsContext3D::readPixels):
        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
        (WebCore::GraphicsContext3D::reshapeFBOs):
        (WebCore::GraphicsContext3D::depthRange):
        (WebCore):
        (WebCore::GraphicsContext3D::clearDepth):
        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        (WebCore::GraphicsContext3D::isGLES2Compliant):
        (WebCore::GraphicsContext3DPrivate::blitMultisampleFramebuffer):
        (WebCore::GraphicsContext3D::GraphicsContext3D):
        (WebCore::GraphicsContext3D::~GraphicsContext3D):
        (WebCore):

2012-06-05  Vitaly Buka  <vitalybuka@chromium.org>

        Special layout handler should be done on top frame being printed.
        https://bugs.webkit.org/show_bug.cgi?id=88201

        Reviewed by Brady Eidson.

        No new tests. Root case is already covered by tests.
        Case described in the issue can be reproduced only by direct call
        to Frame::setPrinting of subframe. Probably it's not possible with
        layout tests.

        * page/Frame.cpp:
        (WebCore::Frame::setPrinting):
        Use shouldUsePrintingLayout to choose proper version of forceLayout().
        (WebCore::Frame::shouldUsePrintingLayout):
        Checks if current frame is the top frame being printed.
        * rendering/RenderView.cpp:
        (WebCore::RenderView::shouldUsePrintingLayout): Forward to Frame.

2012-06-05  Max Feil  <mfeil@rim.com>

        [BlackBerry] Conditionally enlarge HTML5 video controls in fullscreen mode
        https://bugs.webkit.org/show_bug.cgi?id=87551

        Reviewed by Antonio Gomes.

        Changes to make media controls larger in fullscreen mode. The
        BlackBerry media controls used to be sized by a combination
        of CSS styles specified in mediaControlsBlackBerry.css and
        hard coded constants in RenderThemeBlackBerry.cpp. This patch
        moves all the dimensional sizes to a common location, i.e.
        RenderThemeBlackBerry.cpp. Having all the logic in C++ code allows
        more complex decision making for when and how much to enlarge the
        media controls. Currently the controls are enlarged by a factor
        of 2 if the document is in fullscreen mode, the video element
        is the current fullscreen element, and the deviceScaleFactor of
        the page is less than 2.0. This avoids overly large controls
        on pages which are already at least doubling the size of the
        controls via viewport meta tag device-width settings. In other
        words, if the CSS pixels are already enlarged compared to device
        pixels by a factor of at least 2 in length and width.

        In order to accomplish this, I had to add a new Element* parameter
        to RenderTheme::adjustSliderThumbSize(). This is needed so
        that fullscreen mode can be checked and the deviceScaleFactor
        retrieved. I feel that this does not have a big impact on the
        code and the other ports, for which I will simply be adding the
        additional parameter in their platform code.

        Tests:
        video-controls-enlarged-fullscreen-meta.html
        video-controls-enlarged-fullscreen-nometa.html

        * css/mediaControlsBlackBerry.css:
        (audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel):
        (audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button):
        (audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container):
        (audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display):
        (audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display):
        (audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline):
        (audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button):
        (audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button):
        (audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container):
        (audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider):
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::RenderSliderThumb::updateAppearance):
        * platform/blackberry/RenderThemeBlackBerry.cpp:
        (WebCore):
        (WebCore::determineRenderSlider):
        (WebCore::determineFullScreenMultiplier):
        (WebCore::RenderThemeBlackBerry::adjustSliderThumbSize):
        (WebCore::RenderThemeBlackBerry::adjustMediaControlStyle):
        (WebCore::RenderThemeBlackBerry::adjustSliderTrackStyle):
        (WebCore::RenderThemeBlackBerry::paintMediaSliderTrack):
        (WebCore::RenderThemeBlackBerry::paintMediaSliderThumb):
        * platform/blackberry/RenderThemeBlackBerry.h:
        (RenderThemeBlackBerry):
        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::adjustSliderThumbSize):
        * platform/efl/RenderThemeEfl.h:
        (RenderThemeEfl):
        * platform/gtk/RenderThemeGtk.h:
        * platform/gtk/RenderThemeGtk2.cpp:
        (WebCore::RenderThemeGtk::adjustSliderThumbSize):
        * platform/gtk/RenderThemeGtk3.cpp:
        (WebCore::RenderThemeGtk::adjustSliderThumbSize):
        * platform/qt/RenderThemeQt.cpp:
        (WebCore::RenderThemeQt::adjustSliderThumbSize):
        * platform/qt/RenderThemeQt.h:
        (RenderThemeQt):
        * platform/qt/RenderThemeQtMobile.cpp:
        (WebCore::RenderThemeQtMobile::adjustSliderThumbSize):
        * platform/qt/RenderThemeQtMobile.h:
        (RenderThemeQtMobile):
        * rendering/RenderThemeChromiumLinux.cpp:
        (WebCore::RenderThemeChromiumLinux::adjustSliderThumbSize):
        * rendering/RenderThemeChromiumLinux.h:
        (RenderThemeChromiumLinux):
        * rendering/RenderThemeChromiumSkia.cpp:
        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize):
        * rendering/RenderThemeChromiumSkia.h:
        (RenderThemeChromiumSkia):
        * rendering/RenderThemeChromiumWin.cpp:
        (WebCore):
        (WebCore::RenderThemeChromiumWin::adjustSliderThumbSize):
        * rendering/RenderThemeChromiumWin.h:
        (RenderThemeChromiumWin):
        * rendering/RenderThemeMac.h:
        (RenderThemeMac):
        * rendering/RenderThemeSafari.cpp:
        (WebCore::RenderThemeSafari::adjustSliderThumbSize):
        * rendering/RenderThemeSafari.h:
        (RenderThemeSafari):
        * rendering/RenderThemeWin.cpp:
        (WebCore::RenderThemeWin::adjustSliderThumbSize):
        * rendering/RenderThemeWin.h:
        (RenderThemeWin):
        * rendering/RenderThemeWinCE.cpp:
        (WebCore::RenderThemeWinCE::adjustSliderThumbSize):
        * rendering/RenderThemeWinCE.h:
        (RenderThemeWinCE):
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::adjustStyle):
        (WebCore::RenderTheme::adjustMediaControlStyle):
        (WebCore):
        (WebCore::RenderTheme::adjustSliderThumbStyle):
        (WebCore::RenderTheme::adjustSliderThumbSize):
        * rendering/RenderTheme.h:
        (RenderTheme):

2012-06-05  Stephanie Lewis  <slewis@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=88370
        Memory sampler should trigger low memory signal

        Reviewed by Geoff Garen.

        No new tests. Verify by running stress test which crashes 
        in a few minutes without the fix.

        Fix assumption in block code.  We could get in a state where timer_event_source
        had already been released before the block ran.

        * platform/mac/MemoryPressureHandlerMac.mm:
        (WebCore::MemoryPressureHandler::holdOff):

2012-06-05  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Introduce InputNumber type as an alias of double for replacing it to Decimal
        https://bugs.webkit.org/show_bug.cgi?id=88275

        Reviewed by Kent Tamura.

        This patch introduced InputNumber type as alias of double to be
        replaced to Decimal and convertDoubleToInputNumber and 
        convertToInputNumberToDouble for reducing size of patch when we
        introduce Decimal type.

        This patch added new vairables to use const variable to reduce
        copy operation when introducing Decimal type.

        In the implementation, we use InputNumber, will be Decimal, however some methods in IDL
        use double. To clarify internal usage of value and external usage, thit patch renamed
        following functions:

        - parseToDouble => parseNumber
        - setValueAsNumber => setValueAsDouble and setValueAsInputNumber
        - valueAsNumber => valueAsDouble

        This patch is a part of introducing Decimal, https://bugs.webkit.org/show_bug.cgi?id=80009

        No new tests. This patch doesn't change behavior.

        * html/BaseDateAndTimeInputType.cpp:
        (WebCore::BaseDateAndTimeInputType::valueAsDate): Replaced parseToNumber() to valueAsDouble()
        (WebCore::BaseDateAndTimeInputType::setValueAsDate): Inserted convertDoubleToInputNumber.
        (WebCore::BaseDateAndTimeInputType::valueAsDouble): Use new function parseToDouble().
        (WebCore::BaseDateAndTimeInputType::setValueAsInputNumber): Added.
        (WebCore::BaseDateAndTimeInputType::defaultValueForStepUp): Changed return type to InputNumber.
        (WebCore::BaseDateAndTimeInputType::parseToNumber): This is replacement of parseToDouble().
        (WebCore::BaseDateAndTimeInputType::parseToDouble): Added for valueAsDate and valueAsDouble.
        (WebCore::BaseDateAndTimeInputType::serialize): Changed parameter type to InputNumber.
        (WebCore::BaseDateAndTimeInputType::serializeWithComponents): Replace double to InputNumber for getAllowdStep.
        * html/BaseDateAndTimeInputType.h:
        (BaseDateAndTimeInputType):
        * html/DateInputType.cpp:
        (WebCore::DateInputType::createStepRange): Replaced double to InputNumber.
        * html/DateInputType.h:
        (DateInputType):
        * html/DateTimeInputType.cpp:
        (WebCore::DateTimeInputType::defaultValueForStepUp): Changed return type to InputNumber.
        (WebCore::DateTimeInputType::createStepRange): Replaced double to InputNumber.
        * html/DateTimeInputType.h:
        (DateTimeInputType):
        * html/DateTimeLocalInputType.cpp:
        (WebCore::DateTimeLocalInputType::createStepRange): Replaced double to InputNumber.
        * html/DateTimeLocalInputType.h:
        (DateTimeLocalInputType):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::getAllowedValueStep): Changed parameter type to InputNumber.
        (WebCore::HTMLInputElement::valueAsNumber): Use InputType::valueAsDouble.
        (WebCore::HTMLInputElement::setValueAsNumber): Use InputType::valueAsDouble.
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/InputType.cpp:
        (WebCore::InputType::valueAsDouble): Replacement of valueAsNumber.
        (WebCore::InputType::setValueAsDouble): Replacement of valueAsNumber.
        (WebCore::InputType::setValueAsInputNumber): Replacement of valueAsNumber.
        (WebCore::InputType::rangeUnderflow): Replaced double to InputNumber.
        (WebCore::InputType::rangeOverflow): Replaced double to InputNumber.
        (WebCore::InputType::defaultValueForStepUp): Changed return type to InputNumber.
        (WebCore::InputType::isInRange): Replaced double to InputNumber.
        (WebCore::InputType::isOutOfRange): Replaced double to InputNumber.
        (WebCore::InputType::stepMismatch): Replaced double to InputNumber.
        (WebCore::InputType::validationMessage): Replaced double to InputNumber.
        (WebCore::InputType::parseToNumber): Replacement of parseToDouble.
        (WebCore::InputType::parseToNumberOrNaN): Added for reducing number of std::numeric_limits<double>::quiet_NaN().
        (WebCore::InputType::parseToNumberWithDecimalPlaces): Replaced double to InputNumber.
        (WebCore::InputType::serialize): Changed parameter type to InputNumber.
        (WebCore::InputType::applyStep): Replaced double to InputNumber.
        (WebCore::InputType::getAllowedValueStep): Changed parameter type to InputNumber.
        (WebCore::InputType::stepUpFromRenderer): Replaced double to InputNumber.
        * html/InputType.h:
        (InputType):
        * html/MonthInputType.cpp:
        (WebCore::MonthInputType::defaultValueForStepUp): Changed return type to InputNumber.
        (WebCore::MonthInputType::createStepRange): Replaced double to InputNumber.
        (WebCore::MonthInputType::parseToNumber): Replacement of parseToDouble.
        * html/MonthInputType.h:
        (MonthInputType):
        * html/NumberInputType.cpp:
        (WebCore::NumberInputType::valueAsDouble): Replacement of valueAsNumber. Changed to use parseToDoubleForNumberType.
        (WebCore::NumberInputType::setValueAsDouble):  Replacement of setValueAsNumber.  Changed to use serializeForNumberType.
        (WebCore::NumberInputType::setValueAsInputNumber): Replacement of setValueAsNumber.
        (WebCore::NumberInputType::createStepRange): Replaced double to InputNumber.
        (WebCore::NumberInputType::parseToNumber): Replacement of parseToDouble.
        (WebCore::NumberInputType::parseToNumberWithDecimalPlaces): Replaced double to InputNumber.
        (WebCore::NumberInputType::serialize):
        * html/NumberInputType.h:
        (NumberInputType):
        * html/RangeInputType.cpp:
        (WebCore::ensureMaximum): Replaced double to InputNumber.
        (WebCore::RangeInputType::valueAsDouble): Replacement of valueAsNumber.
        (WebCore::RangeInputType::setValueAsInputNumber):  Replacement of setValueAsNumber.
        (WebCore::RangeInputType::createStepRange): Replaced double to InputNumber.
        (WebCore::RangeInputType::handleKeydownEvent): Replaced double to InputNumber.
        (WebCore::RangeInputType::parseToNumber): Replacement of parseToDouble.
        (WebCore::RangeInputType::serialize): Changed parameter type to InputNumber.
        (WebCore::RangeInputType::sanitizeValue): Replaced double to InputNumber.
        * html/RangeInputType.h:
        (RangeInputType):
        * html/StepRange.cpp:
        (WebCore::StepRange::StepRange): Replaced double to InputNumber.
        (WebCore::StepRange::acceptableError): Replaced double to InputNumber.
        (WebCore::StepRange::alignValueForStep): Replaced double to InputNumber.
        (WebCore):
        (WebCore::StepRange::clampValue): Replaced double to InputNumber.
        (WebCore::StepRange::stepMismatch): Replaced double to InputNumber.
        * html/StepRange.h:
        (WebCore::convertDoubleToInputNumber): Added.
        (WebCore::convertInputNumberToDouble): Added.
        (WebCore::StepRange::NumberWithDecimalPlaces::NumberWithDecimalPlaces): Replaced double to InputNumber.
        (WebCore::StepRange::StepDescription::defaultValue): Replaced double to InputNumber.
        (StepRange):
        (WebCore::StepRange::maximum): Replaced double to InputNumber.
        (WebCore::StepRange::minimum): Replaced double to InputNumber.
        (WebCore::StepRange::step): Replaced double to InputNumber.
        (WebCore::StepRange::stepBase): Replaced double to InputNumber.
        (WebCore::StepRange::defaultValue): Replaced double to InputNumber.
        (WebCore::StepRange::proportionFromValue): Replaced double to InputNumber.
        (WebCore::StepRange::valueFromProportion): Replaced double to InputNumber.
        * html/TimeInputType.cpp:
        (WebCore::TimeInputType::defaultValueForStepUp): Replaced double to InputNumber.
        (WebCore::TimeInputType::createStepRange): Replaced double to InputNumber.
        * html/TimeInputType.h:
        (TimeInputType):
        * html/WeekInputType.cpp:
        (WebCore::WeekInputType::createStepRange): Replaced double to InputNumber.
        * html/WeekInputType.h:
        (WeekInputType):
        * html/shadow/CalendarPickerElement.cpp:
        (WebCore::CalendarPickerElement::writeDocument): Replaced double to InputNumber.
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::sliderPosition): Replaced double to InputNumber.
        (WebCore::RenderSliderThumb::layout): Replaced double to InputNumber.
        (WebCore::SliderThumbElement::setPositionFromPoint): Replaced double to InputNumber.

2012-06-05  Ryosuke Niwa  <rniwa@webkit.org>

        Build fix after r119527.

        * dom/ViewportArguments.cpp:
        (WebCore::computeViewportAttributes):

2012-06-05  Martin Robinson  <mrobinson@igalia.com>

        [Cairo] [OpenGL] Enable GL_OES_standard_derivatives
        https://bugs.webkit.org/show_bug.cgi?id=87583

        Reviewed by Alejandro G. Castro.

        No new tests. This is covered by oes-standard-derivatives.html
        in the Khronos WebGL conformance tests, which may one day be part
        of the WebKit test suite.

        Activate the GL_OES_standard_derivatives on Cairo along with
        Qt and Mac.

        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
        (WebCore::Extensions3DOpenGL::ensureEnabled):
        (WebCore::Extensions3DOpenGL::isEnabled):

2012-06-05  Simon Fraser  <simon.fraser@apple.com>

        Avoid creating compositing layers for preserve-3d without transformed descendants
        https://bugs.webkit.org/show_bug.cgi?id=88115

        Reviewed by Antti Koivisto.
        
        Avoid creating compositing layers, and therefore using excess backing store,
        for elements that have -webkit-transform-style: preserve-3d, but no 3D-transformed
        descendants that would be affected by that preserve-3d.
        
        Test: compositing/layer-creation/no-compositing-for-preserve-3d.html

        * rendering/RenderLayer.h: Replace the "mustOverlap" flag with a enum
        that describes the different reasons for indirect compositing, so that
        we can use that information to decide whether to allocate backing store.
        (WebCore::RenderLayer::setIndirectCompositingReason):
        (WebCore::RenderLayer::indirectCompositingReason):
        (WebCore::RenderLayer::mustCompositeForIndirectReasons):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::RenderLayer): Initialize m_indirectCompositingReason

        * rendering/RenderLayerCompositor.h: New out param for computeCompositingRequirements()
        that is uses to indicate that a 3d-transformed descendant has been encountered.
        Rename requiresCompositingWhenDescendantsAreCompositing() to requiresCompositingForIndirectReason(),
        and return the reason as an out param.
        
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateCompositingLayers): Pass in the saw3DTransform
        param to computeCompositingRequirements().
        (WebCore::RenderLayerCompositor::computeCompositingRequirements): Return a flag
        from computeCompositingRequirements() that is set to true if we've seen descendants
        that have 3d transforms. This is later used to decide whether to composite for
        perspective or preserve-3d.
        Change the "mustOverlapCompositedLayers" code to use the new "indirect compositing"
        enum flags.
        After enumerating children, call requiresCompositingForIndirectReason() and 
        record the reason in the layer.
        (WebCore::RenderLayerCompositor::needsToBeComposited): Use mustCompositeForIndirectReasons() now.
        (WebCore::RenderLayerCompositor::requiresOwnBackingStore): Consult the indirect compositing
        reason rather than just looking for the overlap flag.
        (WebCore::RenderLayerCompositor::reasonForCompositing): Now that we have more information
        about indirect compositing reasons, the logging can be more detailed.
        (WebCore::RenderLayerCompositor::requiresCompositingForTransform): This now only looks
        for 3d transforms. We now treat perspective and perserve-3d as "indirect" reasons, because
        whether they composite depends on descendants having non-affine transforms.
        (WebCore::RenderLayerCompositor::requiresCompositingForIndirectReason): Includes the logic
        previously in requiresCompositingWhenDescendantsAreCompositing(), and now determines
        whether to composite for preserve-3d and perspective, based on whether we have transformed descendants.

2012-06-05  Levi Weintraub  <leviw@chromium.org>

        Block selection gaps painted not properly pixel snapped
        https://bugs.webkit.org/show_bug.cgi?id=88000

        Reviewed by Ryosuke Niwa.

        Fixes for selection painting in both inline line heights and block gaps. We were unintentionally
        flooring inline and block offsets in RenderBlock, but actually need to intentionally floor the
        logical left and right values in logical(Left|Right)SelectionGap to properly align our block
        selection gaps. This is to properly mirror the behavior in pixelSnappedLogicalRightOffsetForLine.

        We were also unintentionally upcasting LayoutUnits to floats in InlineTextBox's selection painting
        routine. Now we're properly rounding.

        Test: fast/sub-pixel/selection/selection-gaps-at-fractional-offsets.html

        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::paintSelection): Move paint values to integers and do proper rounding.
        * rendering/RenderBlock.cpp:
        (WebCore::blockDirectionOffset): Fix incorrect flooring in return value.
        (WebCore::inlineDirectionOffset): Ditto.
        (WebCore): Removing previous attempt to properly mirror inline box selection pixel alignment. This
        implementation rounded the final x value instead of properly rounding our block offset then flooring
        the offset that corresponds to the behavior in InlineTextBox. It also didn't properly pixel snap
        the y offset and height.
        (WebCore::RenderBlock::blockSelectionGap): Properly pixel snapping the gap rect before painting.
        (WebCore::RenderBlock::logicalLeftSelectionGap): Correctly match InlineTextBox's selection pixel
        alignment by flooring the logicalLeft and pixel snapping the subsequent rect. We do this in order
        to maintain proper render tree pixel snapping while simultaneously mirroring the flooring in the
        inline direction that occurs in InlineTextBox.cpp's alignSelectionRectToDevicePixels method.
        (WebCore::RenderBlock::logicalRightSelectionGap): Ditto with the right.

2012-06-05  Adam Barth  <abarth@webkit.org>

        Remove support for target-densitydpi in the viewport meta tag
        https://bugs.webkit.org/show_bug.cgi?id=88047

        Reviewed by Kenneth Rohde Christiansen.

        The target-densitydpi parameter was originally implemented on Android,
        but it does not appear to be widely used and introduces significant
        implementation complexity because it forces us to track three scale
        factors (defaultDeviceScaleFactor, deviceScaleFactor, and
        pageScaleFactor) rather than just two (deviceScaleFactor and
        pageScaleFactor).

        There don't appear to be many web sites that use target-densitydpi
        because it is not supported on iOS.  There are also concerns from the
        standards community about the design of the feature.  It seems our best
        course of action is to remove target-densitydpi and address these use
        cases via other mechanisms, such as responsive images and device units
        in CSS because those approaches are likely to be implemented broadly.

        * dom/ViewportArguments.cpp:
        (WebCore::computeViewportAttributes):
        (WebCore):
        (WebCore::setViewportFeature):
        (WebCore::viewportErrorMessageTemplate):
        (WebCore::viewportErrorMessageLevel):
        * dom/ViewportArguments.h:
        (WebCore::ViewportArguments::ViewportArguments):
        (ViewportArguments):
        (WebCore::ViewportArguments::operator==):

2012-06-05  Erik Arvidsson  <arv@chromium.org>

        [V8] Improve variable resolution order on window
        https://bugs.webkit.org/show_bug.cgi?id=84247

        Reviewed by Ojan Vafai.

        This changes the V8 flag to turn on es52_globals and updates the layout tests to reflect the fixed behavior.

        Test: fast/dom/Window/window-property-shadowing-onclick.html

        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::V8DOMWindowShell::initContextIfNeeded): Set the flag as we initialize V8.
        * bindings/v8/WorkerContextExecutionProxy.cpp:
        (WebCore::WorkerContextExecutionProxy::initIsolate): Ditto.

2012-06-05  Ojan Vafai  <ojan@chromium.org>

        Delete dead code from RenderBox::computeLogicalWidthInRegion
        https://bugs.webkit.org/show_bug.cgi?id=88353

        Reviewed by Tony Chang.

        No new tests obviously since this is dead code.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeLogicalWidthInRegion):

2012-06-05  Greg Billock  <gbillock@google.com>

        New constructor for WebIntent to be used for delivery
        https://bugs.webkit.org/show_bug.cgi?id=87143

        Reviewed by Darin Fisher.

        * Modules/intents/Intent.cpp:
        (WebCore::Intent::setExtras):
        (WebCore):
        * Modules/intents/Intent.h:
        (Intent):

2012-06-01  Ojan Vafai  <ojan@chromium.org>

        Change overrideSizes to be content-box instead of border-box
        https://bugs.webkit.org/show_bug.cgi?id=88116

        Reviewed by Tony Chang.

        Previously, the code used border-box everywhere except for one place
        where it used content-box when setting the override size. Conversely,
        it subtracted the borderAndPaddingSize everywhere it grabbed the override
        size except for one.

        Instead, make the override size override the content-box size.
        Converging on using the border-box size would be tricky given RenderTableCell's
        tricky management of intrinsic padding.

        There is no behavior change except in RenderBox::availableLogicalHeightUsing,
        which fixes a table test.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::setOverrideLogicalContentHeight):
        (WebCore::RenderBox::setOverrideLogicalContentWidth):
        (WebCore::RenderBox::overrideLogicalContentWidth):
        (WebCore::RenderBox::overrideLogicalContentHeight):
        (WebCore::RenderBox::computeLogicalWidthInRegion):
        (WebCore::RenderBox::computeLogicalHeight):
        (WebCore::RenderBox::computePercentageLogicalHeight):
        (WebCore::RenderBox::availableLogicalHeightUsing):
        We were incorrectly subtracting the borderAndPaddingLogicalWidth instead
        of the borderAndPaddingLogicalHeight.

        * rendering/RenderBox.h:
        (RenderBox):
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox):
        (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox):
        (WebCore::RenderDeprecatedFlexibleBox::applyLineClamp):
        (WebCore::RenderDeprecatedFlexibleBox::allowedChildFlex):
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::computeAvailableFreeSpace):
        (WebCore::RenderFlexibleBox::setLogicalOverrideSize):
        (WebCore::RenderFlexibleBox::applyStretchAlignmentToChild):
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::setOverrideHeightFromRowHeight):

2012-06-05  Andy Estes  <aestes@apple.com>

        REGRESSION (r118197): PluginStrategy should be used even if ENABLE(NETSCAPE_PLUGIN_API) is false
        https://bugs.webkit.org/show_bug.cgi?id=88296

        Reviewed by Dan Bernstein.

        refresh() and initPlugins() should call into PluginStrategy even if
        ENABLE(NETSCAPE_PLUGIN_API) is false. Some ports support non-Netscape
        plug-ins, so PluginStrategy should be consulted even if Netscape
        plug-ins specifically are disabled.

        Ports that support platform strategies but not Netscape plug-ins should
        handle this inside their PluginStrategy rather than modifying generic
        plug-in code.

        * plugins/PluginData.cpp:
        (WebCore::PluginData::refresh):
        (WebCore::PluginData::initPlugins):

2012-06-05  Douglas Stockwell  <dstockwell@chromium.org>

        Crash when modifying fixed-position elements in a detached frame
        https://bugs.webkit.org/show_bug.cgi?id=88288

        Reviewed by James Robinson.

        Test: fast/block/positioning/fixed-position-detached-frame.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-06-05  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: render timeline paint category dark green
        https://bugs.webkit.org/show_bug.cgi?id=88333

        Reviewed by Pavel Feldman.

        - Added a new, dark-green color for timeline events.

        * WebCore.gypi: Added timelineBarDarkGreen.png
        * inspector/front-end/Images/timelineBarDarkGreen.png: Added.
        * inspector/front-end/Images/timelineCheckmarks.png: Added a dark-green checkbox.
        * inspector/front-end/Images/timelineDots.png: Added a dark-green dot.
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.categories):
        * inspector/front-end/WebKit.qrc: Added timelineBarDarkGreen.png.
        * inspector/front-end/timelinePanel.css:
        (.timeline-category-statusbar-item.timeline-category-painting .timeline-category-checkbox):
        (.timeline-category-painting .timeline-graph-bar):
        (.popover .timeline-painting):
        (.timeline-category-painting .timeline-tree-icon):

2012-06-05  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: serialize edge counts instead of indexes in heap snapshot
        https://bugs.webkit.org/show_bug.cgi?id=88324

        The serialized node structure currently holds an index
        of its first containment edge in the edges array.
        The index can be quite big (up to 7 digits for large snapshots).
        The patch changes the serialization format to pass
        node containment edge count instead. For most nodes the count
        is just a single digit number.
        This reduces serialized snapshot size and therefore its transfer time.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotNode.prototype._edgeIndexesStart):
        (WebInspector.HeapSnapshotNode.prototype._edgeIndexesEnd):
        (WebInspector.HeapSnapshotNode.prototype._ordinal):
        (WebInspector.HeapSnapshotNodeIterator):
        (WebInspector.HeapSnapshot.prototype._init):
        (WebInspector.HeapSnapshot.prototype._buildEdgeIndexes):
        (WebInspector.HeapSnapshot.prototype._buildRetainers):
        (WebInspector.HeapSnapshot.prototype._bfs):
        (WebInspector.HeapSnapshot.prototype._buildAggregates):
        (WebInspector.HeapSnapshot.prototype._buildPostOrderIndex):
        (WebInspector.HeapSnapshot.prototype._buildDominatorTree):
        (WebInspector.HeapSnapshot.prototype._markPageOwnedNodes):
        (WebInspector.HeapSnapshot.prototype._markQueriableHeapObjects):

2012-06-05  Arpita Bahuguna  <arpitabahuguna@gmail.com>

        CSS 2.1 failure: border-conflict-element-021a
        https://bugs.webkit.org/show_bug.cgi?id=86885

        Reviewed by Julien Chaffraix.

        When two adjacent table row groups (thead, tbody, tfoot) have the same border-width
        and the same border-style in a 'border-collapse: collapse' table the color of the border
        from the top-most table row wins.

        Tests: fast/table/border-collapsing/adjacent-row-groups-multi.html
               fast/table/border-collapsing/adjacent-row-groups.html

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::paintObject):
        Currently each row group is sent for paint from top (firstChild) to bottom thereby causing
        the borders of the bottom-most row group (which is painted last) to overlap over the
        previous row-group. This breaks the precedence for collapsed borders between adjacent cells.

        This fix thus reverses the order in which the row-groups/sections are passed for painting.
        Additional change has been done to iterate over the RenderTableSections directly.

        (WebCore):
        (WebCore::RenderTable::bottomSection):
        * rendering/RenderTable.h:
        New function has been added to obtain the last section of the table.

        (RenderTable):
        * rendering/RenderTableSection.h:
        (RenderTableSection):
        RenderTableSection's paint() method has now been made public so as to make it accessible
        from RenderTable.

2012-06-05  Csaba Osztrogonác  <ossy@webkit.org>

        [Qt][Win] Fix IDL dependency generation
        https://bugs.webkit.org/show_bug.cgi?id=88304

        Reviewed by Tor Arne Vestbø.

        * DerivedSources.pri:

2012-06-05  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119467, r119471, and r119476.
        http://trac.webkit.org/changeset/119467
        http://trac.webkit.org/changeset/119471
        http://trac.webkit.org/changeset/119476
        https://bugs.webkit.org/show_bug.cgi?id=88332

        it broke chromium-mac static initializers test.\ (Requested by
        loislo on #webkit).

        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * platform/graphics/FontPlatformData.h:
        (FontPlatformData):
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        (WebCore::FontPlatformData::platformDataInit):
        (WebCore::FontPlatformData::platformDataAssign):
        * platform/graphics/harfbuzz/ng/HarfBuzzFace.cpp: Removed.
        * platform/graphics/harfbuzz/ng/HarfBuzzFace.h: Removed.
        * platform/graphics/harfbuzz/ng/HarfBuzzFaceCoreText.cpp: Removed.
        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp: Removed.
        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.h: Removed.
        * platform/graphics/mac/FontComplexTextMac.cpp:
        (WebCore::Font::selectionRectForComplexText):
        (WebCore::Font::drawComplexText):
        (WebCore::Font::floatWidthForComplexText):
        (WebCore::Font::offsetForPositionForComplexText):

2012-06-05  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: SHIFT key as helper to color adjustment in color picker
        https://bugs.webkit.org/show_bug.cgi?id=88319

        Reviewed by Pavel Feldman.

        With Shift depressed, the dragger in the color picker will snap to the horizontal
        or vertical axis while dragging, depending on which axis offset is greater.

        * inspector/front-end/Spectrum.js:
        (WebInspector.Spectrum.colorDragStart):
        (WebInspector.Spectrum.colorDrag):
        (WebInspector.Spectrum.draggable.move):
        (WebInspector.Spectrum.draggable.start):

2012-06-05  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: aggregate all events before first frame into a fake frame
        https://bugs.webkit.org/show_bug.cgi?id=88229

        - in Timeline's frame mode, start aggregating events by frame even before we get first frame marker.

        * inspector/front-end/TimelineFrameController.js:
        (WebInspector.TimelineFrameController.prototype._addRecord):
        (WebInspector.TimelineFrameController.prototype._flushFrame):
        (WebInspector.TimelineFrameController.prototype._createFrame):

2012-06-05  Charles Wei  <charles.wei@torchmobile.com.cn>

        JSC:need to implement Dictionary::getWithUndefinedOrNullCheck for IDB
        https://bugs.webkit.org/show_bug.cgi?id=88283

        Reviewed by Kentaro Hara.

        No new tests, idb not working for JSC yet.

        * bindings/js/Dictionary.cpp:
        (WebCore::Dictionary::getWithUndefinedOrNullCheck):
        * bindings/js/Dictionary.h:
        (Dictionary):
        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::getWithUndefinedOrNullCheck):
        (WebCore):
        * bindings/js/JSDictionary.h:
        (JSDictionary):

2012-06-05  Dongwoo Im  <dw.im@samsung.com>

        Add 'isProtocolHandlerRegistered' and 'unregisterProtocolHandler'.
        https://bugs.webkit.org/show_bug.cgi?id=73176

        Reviewed by Adam Barth.

        Two more APIs are added in Custom Scheme Handler specification.
        http://dev.w3.org/html5/spec/Overview.html#custom-handlers
        One is 'isProtocolHandlerRegistered' to query whether the specific URL
        is registered or not.
        The other is 'unregisterProtocolHandler' to remove the registered URL.

        Test: fast/dom/unregister-protocol-handler.html

        * Configurations/FeatureDefines.xcconfig: Add a macro 'ENABLE_CUSTOM_SCHEME_HANDLER'.
        * loader/EmptyClients.h: Add prototypes.
        (EmptyChromeClient):
        (WebCore::EmptyChromeClient::isProtocolHandlerRegistered):
        (WebCore::EmptyChromeClient::unregisterProtocolHandler):
        * page/ChromeClient.h:
        (ChromeClient):
        * page/NavigatorRegisterProtocolHandler.cpp:
        (WebCore):
        (WebCore::customHandlersStateString):
        (WebCore::NavigatorRegisterProtocolHandler::isProtocolHandlerRegistered): Query if the handler is registered.
        (WebCore::NavigatorRegisterProtocolHandler::unregisterProtocolHandler): Unregister the registered handler.
        * page/NavigatorRegisterProtocolHandler.h:
        (NavigatorRegisterProtocolHandler):
        * page/NavigatorRegisterProtocolHandler.idl:

2012-06-04  Kinuko Yasuda  <kinuko@chromium.org>

        Chromium tests: "Add support for the Blob constructor" [r115582] regressed blob layout tests
        https://bugs.webkit.org/show_bug.cgi?id=85174

        Reviewed by Kentaro Hara.

        This fixes a crash problem which could happen when the constructor is
        given an array which contains String-type item(s).

        There're still some Text mismatches between v8 results and
        JSC results, most of them are v8 not throwing exception
        when it is given an object whose toString() method throws
        exception.  (The issue will be addresse in a separate patch.)

        Test: fast/files/blob-constructor.html

        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::V8Blob::constructorCallback):

2012-06-05  Kentaro Hara  <haraken@chromium.org>

        Remove unnecessary constructor of SelectorQueryCache
        https://bugs.webkit.org/show_bug.cgi?id=87942

        Reviewed by Ryosuke Niwa.

        Per the comment from darin@ (https://bugs.webkit.org/show_bug.cgi?id=87942#c27),
        this patch removes an inline constructor that has no arguments.
        To have the compiler generate the constructor,
        this patch also removes WTF_MAKE_NONCOPYABLE().

        No tests. No change in behavior.

        * dom/SelectorQuery.h:
        (SelectorQueryCache):

2012-06-05  Kentaro Hara  <haraken@chromium.org>

        Remove unused methods from SelectorQuery.h
        https://bugs.webkit.org/show_bug.cgi?id=88289

        Reviewed by Antti Koivisto.

        This patch removes SelectorDataList::size() and
        SelectorDataList::SelectorDataList().
        SelectorDataList::size() is not used by anybody.
        SelectorDataList::SelectorDataList() can be auto-generated
        by a compiler.

        No tests. No change in behavior.

        * dom/SelectorQuery.cpp:
        * dom/SelectorQuery.h:
        (SelectorDataList):

2012-06-05  Kent Tamura  <tkent@chromium.org>

        Build fix for r119470.

        * loader/EmptyClients.cpp: Add #include "IntentRequest.h".

2012-06-05  Kent Tamura  <tkent@chromium.org>

        Remove unused function: Document::formElements
        https://bugs.webkit.org/show_bug.cgi?id=88272

        Reviewed by Kentaro Hara.

        No new tests. No behavior change.

        * dom/Document.h:
        (Document): remove formElements(). It was used for radio group
        validation, but the current code doesn't use it any more.

2012-06-05  Kenichi Ishibashi  <bashi@chromium.org>

        Unreviewed build fix on Chromium mac

        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        (WebCore::isAATFont):

2012-06-05  Kent Tamura  <tkent@chromium.org>

        Move some function definitions in EmptyClients.h to EmptyClients.cpp
        https://bugs.webkit.org/show_bug.cgi?id=88285

        Reviewed by Ryosuke Niwa.

        If we have definitions of functions with RefPtr<> in EmptyClients.h like

            virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>) { }

        and a source file includes EmptyClient.h, the source file needs to
        include FileChooser.h though the source file doesn't use FileChooser
        class explicitly because the definition of runOpenPanel() needs to call
        FileChooser::deref().
        To avoid this, we had better move such functions to EmptyClients.cpp.

        No new tests. No behavior changes.

        * loader/EmptyClients.cpp: Move such functions from EmptyClients.h to
        here, and move EmptyPopupMenu and EmptySearchPopupMenu too because
        they're used only by EmptyChromeClient.
        (WebCore):
        (EmptyPopupMenu):
        (WebCore::EmptyPopupMenu::show):
        (WebCore::EmptyPopupMenu::hide):
        (WebCore::EmptyPopupMenu::updateFromElement):
        (WebCore::EmptyPopupMenu::disconnectClient):
        (EmptySearchPopupMenu):
        (WebCore::EmptySearchPopupMenu::popupMenu):
        (WebCore::EmptySearchPopupMenu::saveRecentSearches):
        (WebCore::EmptySearchPopupMenu::loadRecentSearches):
        (WebCore::EmptySearchPopupMenu::enabled):
        (WebCore::EmptyChromeClient::createPopupMenu):
        (WebCore::EmptyChromeClient::createSearchPopupMenu):
        (WebCore::EmptyChromeClient::createColorChooser):
        (WebCore::EmptyChromeClient::runOpenPanel):
        (WebCore::EmptyFrameLoaderClient::dispatchDecidePolicyForNewWindowAction):
        (WebCore::EmptyFrameLoaderClient::dispatchDecidePolicyForNavigationAction):
        (WebCore::EmptyFrameLoaderClient::dispatchWillSendSubmitEvent):
        (WebCore::EmptyFrameLoaderClient::dispatchWillSubmitForm):
        (WebCore::EmptyFrameLoaderClient::createDocumentLoader):
        (WebCore::EmptyFrameLoaderClient::createFrame):
        (WebCore::EmptyFrameLoaderClient::createPlugin):
        (WebCore::EmptyFrameLoaderClient::createJavaAppletWidget):
        (WebCore::EmptyFrameLoaderClient::createMediaPlayerProxyPlugin):
        (WebCore::EmptyFrameLoaderClient::createNetworkingContext):
        (WebCore::EmptyFrameLoaderClient::dispatchIntent):
        (WebCore::EmptyTextCheckerClient::requestCheckingOfString):
        (WebCore::EmptyEditorClient::registerUndoStep):
        (WebCore::EmptyEditorClient::registerRedoStep):
        (WebCore::EmptyContextMenuClient::customizeMenu):
        * loader/EmptyClients.h: Move such function definitions to
        EmptyClient.cpp, and append OVERRIDE.
        (EmptyChromeClient):
        (EmptyFrameLoaderClient):
        (EmptyTextCheckerClient):
        (EmptyEditorClient):
        (EmptyContextMenuClient):
        * svg/graphics/SVGImage.cpp: Remove unnecessary #includes.

2012-06-05  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: "-webkit"-prefixed properties are considered inherited in the Computed Style pane
        https://bugs.webkit.org/show_bug.cgi?id=88257

        Reviewed by Pavel Feldman.

        Canonical names for properties should be used when checking if they are inherited (since only canonical names
        are put into the usedProperties set).

        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.ComputedStylePropertiesSection.prototype._isPropertyInherited):

2012-06-05  Kenichi Ishibashi  <bashi@chromium.org>

        [Chromium] Implement font shaping with font-feature-settings on Mac
        https://bugs.webkit.org/show_bug.cgi?id=69826

        Reviewed by Tony Chang.

        Add HarfBuzz-ng text shaper.
        Chromium mac port uses it as secondary text shaper to support OpenType features.
        HarfBuzz-ng is only used when -webkit-font-feature-settings is specified and
        corresponding font is not an AAT font.

        No new tests. css3/font-feature-settings-rendering.html should pass on Chromium mac port.

        * WebCore.gyp/WebCore.gyp: Added harfbuzz-ng dependencies.
        * WebCore.gypi: Added harfbuzz-ng files.
        * platform/graphics/FontPlatformData.h:
        (FontPlatformData): Added m_harfbuzzFace.
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        (WebCore::FontPlatformData::platformDataInit): Copy m_harfbuzzFace.
        (WebCore::FontPlatformData::platformDataAssign): Ditto.
        (WebCore):
        (WebCore::isAATFont):
        (WebCore::FontPlatformData::harfbuzzFace):
        * platform/graphics/harfbuzz/ng/HarfBuzzFace.cpp: Added.
        (WebCore):
        (WebCore::harfbuzzFaceCache):
        (WebCore::HarfBuzzFace::HarfBuzzFace):
        (WebCore::HarfBuzzFace::~HarfBuzzFace):
        * platform/graphics/harfbuzz/ng/HarfBuzzFace.h: Added.
        (WebCore):
        (HarfBuzzFace):
        (WebCore::HarfBuzzFace::create):
        * platform/graphics/harfbuzz/ng/HarfBuzzFaceCoreText.cpp: Added.
        (WebCore):
        (WebCore::floatToHarfBuzzPosition):
        (WebCore::getGlyph):
        (WebCore::getGlyphHorizontalAdvance):
        (WebCore::getGlyphHorizontalOrigin):
        (WebCore::getGlyphExtents):
        (WebCore::harfbuzzCoreTextGetFontFuncs):
        (WebCore::releaseTableData):
        (WebCore::harfbuzzCoreTextGetTable):
        (WebCore::HarfBuzzFace::createFace):
        (WebCore::HarfBuzzFace::createFont):
        (WebCore::HarfBuzzShaper::createGlyphBufferAdvance):
        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp: Added.
        (WebCore):
        (WebCore::harfbuzzPositionToFloat):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::HarfBuzzRun):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::setGlyphAndPositions):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::characterIndexForXPosition):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::xPositionForOffset):
        (WebCore::HarfBuzzShaper::HarfBuzzShaper):
        (WebCore::HarfBuzzShaper::~HarfBuzzShaper):
        (WebCore::HarfBuzzShaper::setFontFeatures):
        (WebCore::HarfBuzzShaper::shape):
        (WebCore::HarfBuzzShaper::setupHarfBuzzRun):
        (WebCore::HarfBuzzShaper::shapeHarfBuzzRun):
        (WebCore::HarfBuzzShaper::setGlyphPositionsForHarfBuzzRun):
        (WebCore::HarfBuzzShaper::offsetForPosition):
        (WebCore::HarfBuzzShaper::selectionRect):
        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.h: Added.
        (WebCore):
        (HarfBuzzShaper):
        (WebCore::HarfBuzzShaper::totalWidth):
        (HarfBuzzRun):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::create):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::setWidth):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::numCharacters):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::numGlyphs):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::width):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::rtl):
        * platform/graphics/mac/FontComplexTextMac.cpp:
        (WebCore):
        (WebCore::preferHarfBuzz): Added.
        (WebCore::Font::selectionRectForComplexText): Use HarfBuzzShaper if font-feature-settings exists.
        (WebCore::Font::drawComplexText): Ditto.
        (WebCore::Font::floatWidthForComplexText): Ditto.
        (WebCore::Font::offsetForPositionForComplexText): Ditto.

2012-06-05  Li Yin  <li.yin@intel.com>

        IETC: FileList.item(-1) should return null instead of raising
        https://bugs.webkit.org/show_bug.cgi?id=77899

        Reviewed by Kentaro Hara.

        IETC: http://samples.msdn.microsoft.com/ietestcenter/fileapi/filelist.htm
        Accroding to http://es5.github.com/#x9.6
        When the index is negative, it should not raise exception.
        Firefox and IE returns null when there is not indexth File object.

        Test: fast/files/file-list-test.html

        * fileapi/FileList.idl:

2012-06-05  Adam Barth  <abarth@webkit.org>

        EventHandler shouldn't dispatch fake mousemove events when scrolling on devices that don't have a mouse
        https://bugs.webkit.org/show_bug.cgi?id=88270

        Reviewed by James Robinson.

        This patch adds a setting analogous to deviceSupportsTouch to determine
        whether the device supports mouse. We then don't dispatch fake mouse
        events on devices that don't have a mouse in the first place.

        Test: fast/events/touch/scroll-without-mouse-lacks-mousemove-events.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::fakeMouseMoveEventTimerFired):
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (WebCore::Settings::setDeviceSupportsMouse):
        (WebCore::Settings::deviceSupportsMouse):
        (Settings):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::InternalSettings):
        (WebCore::InternalSettings::restoreTo):
        (WebCore::InternalSettings::setDeviceSupportsMouse):
        (WebCore):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-06-04  Simon Fraser  <simon.fraser@apple.com>

        Leaking ClipRects
        https://bugs.webkit.org/show_bug.cgi?id=88282

        Reviewed by Dan Bernstein.

        In r118562 I made the ClipRectsCache use RefPtr<ClipRects>. However, ClipRects
        was initialized with m_refCnt=0, not 1 as adoptRef() and friends expect. Also,
        there was a manual ref() in RenderLayer::updateClipRects() which this patch removes.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::updateClipRects):
        * rendering/RenderLayer.h:
        (WebCore::ClipRects::ClipRects):

2012-06-04  Emil A Eklund  <eae@chromium.org> and Levi Weintraub  <leviw@chromium.org>

        Add missing FractionalLayoutUnit += operator and move LineWidth to use all floats
        https://bugs.webkit.org/show_bug.cgi?id=88259

        Reviewed by Ryosuke Niwa.

        Fix two rounding bugs in LineLayout and RenderBlock that caused inlines
        and floats to wrap incorrectly.

        Tests: fast/sub-pixel/float-containing-block-with-margin.html
               fast/sub-pixel/float-with-right-margin-zoom.html
               fast/sub-pixel/inline-block-with-padding.html

        * platform/FractionalLayoutUnit.h:
        (WebCore::operator+=):
        Add missing float version of += operator thus avoiding a silent cast to
        int loosing precision.
        
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::LineWidth::computeAvailableWidthFromLeftAndRight):
        (WebCore::LineWidth::updateAvailableWidth):
        Change LineWidth left/right to floating point and instead of rounding the
        left and right edge separately.
        
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::resolveFlexibleLengths):
        Use explicit cast to avoid compiler ambiguity warning.

2012-06-04  Tony Chang  <tony@chromium.org>

        CSS property 'order' should be a number rather than an int
        https://bugs.webkit.org/show_bug.cgi?id=88111

        Reviewed by Ojan Vafai.

        This changed in the spec:
        http://dev.w3.org/csswg/css3-flexbox/#order

        I also fixed the compile with CSS3_FLEXBOX disabled.

        No new tests, covered by existing tests.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore):
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        * css/CSSProperty.cpp: Parse as float, remove clamping for HashMap<int>.
        (WebCore::CSSProperty::isInheritedProperty):
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * rendering/RenderFlexibleBox.cpp: Remove traits for HashMap<int>.
        (RenderFlexibleBox::OrderIterator):
        * rendering/RenderFlexibleBox.h:
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleRareNonInheritedData.h:
        (StyleRareNonInheritedData):

2012-06-04  Hugo Parente Lima  <hugo.lima@openbossa.org>

        Turn LEGACY_VIEWPORT_ADAPTION USE flag into an ENABLE flag.
        https://bugs.webkit.org/show_bug.cgi?id=88243

        Reviewed by Adam Barth.

        No new tests needed, this just rename a compiler flag.

        * dom/Document.cpp:
        (WebCore::Document::setDocType):
        * dom/ViewportArguments.h:
        * html/HTMLMetaElement.cpp:
        (WebCore::HTMLMetaElement::process):

2012-06-04  Dana Jansens  <danakj@chromium.org>

        [chromium] Remove redundant setNeedsCommit when prepareToDraw fails
        https://bugs.webkit.org/show_bug.cgi?id=88246

        Reviewed by James Robinson.

        When prepareToDraw fails it explicitly calls setNeedsCommit, but the
        scheduler already takes care of this for it. When a frame is not
        successfully drawn, the scheduler state machine sets the needsCommit
        bit itself.

        This behaviour is covered by CCSchedulerStateMachineTest.TestFailedDrawSetsNeedsCommitAndDoesNotDrawAgain

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::prepareToDraw):

2012-06-04  Takashi Toyoshima  <toyoshim@chromium.org>

        [WebSocket] Send requires super linear time against data size
        https://bugs.webkit.org/show_bug.cgi?id=87383

        Reviewed by Kent Tamura.

        WebSocket send operation requires super linear time to send data
        against data size. This is because removing sent data in Vector<char>
        always requires data copy.
        Introduced wtf/StreamBuffer realizes O(n) buffer operations.
        This patch is only for optimization. No new tests are needed.

        * platform/network/SocketStreamHandleBase.cpp:
        (WebCore::SocketStreamHandleBase::sendPendingData):
        * platform/network/SocketStreamHandleBase.h:
        (SocketStreamHandleBase):

2012-06-04  Tim Horton  <timothy_horton@apple.com>

        Mock scrollbars differ by 1px in DRT vs. WKTR
        https://bugs.webkit.org/show_bug.cgi?id=80879

        Rubber-stamped by Ryosuke Niwa.

        Disable r119431 except for Apple Mac port.

        * platform/ScrollbarThemeComposite.cpp:
        (WebCore::ScrollbarThemeComposite::thumbLength):

2012-06-04  Jeffrey Pfau  <jpfau@apple.com>

        Document cleanup can get confused if parser still exists
        https://bugs.webkit.org/show_bug.cgi?id=88250

        Reviewed by Geoffrey Garen.

        No new tests; no behavior changes.

        * dom/Document.cpp:
        (WebCore::Document::removedLastRef): Detach parser earlier

2012-06-04  Andrew Lo  <anlo@rim.com>

        [BlackBerry] Split AnimationFrameRateController into its own file
        https://bugs.webkit.org/show_bug.cgi?id=88242

        Reviewed by Antonio Gomes.

        Include new header file to reflect re-organization of platform animation
        header files.

        * platform/graphics/DisplayRefreshMonitor.h:

2012-06-04  Dana Jansens  <danakj@chromium.org>

        [chromium] Allow CCLayerImpl to find its layer tree host, and use this for CCVideoLayerImpl instead of always-null pointer.
        https://bugs.webkit.org/show_bug.cgi?id=88252

        Reviewed by James Robinson.

        CCVideoLayerImpl has a pointer to its CCLayerTreeHostImpl which is never
        set to be non-null currently. Instead of making this a special case, we
        move the CCLayerTreeHostImpl* up to the CCLayerImpl base class, and set
        the pointer on every layer during commit via the TreeSynchronizer's walk
        through the layer tree.

        Unit tests: Tested by TreeSynchronizer tests.

        * platform/graphics/chromium/TreeSynchronizer.cpp:
        (WebCore::TreeSynchronizer::synchronizeTrees):
        (WebCore::TreeSynchronizer::synchronizeTreeRecursive):
        * platform/graphics/chromium/TreeSynchronizer.h:
        (WebCore):
        (TreeSynchronizer):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore):
        (WebCore::CCLayerImpl::layerTreeHostImpl):
        (WebCore::CCLayerImpl::setLayerTreeHostImpl):
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::CCVideoLayerImpl):
        (WebCore::CCVideoLayerImpl::setNeedsRedraw):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:

2012-06-04  Tim Horton  <timothy_horton@apple.com>

        Mock scrollbars differ by 1px in DRT vs. WKTR
        https://bugs.webkit.org/show_bug.cgi?id=80879

        Reviewed by Simon Fraser.

        Round the length of the scrollbar thumb instead of truncating it.

        No new tests, fixes a mismatch between pixel results from DRT and WKTR.
        Change is covered by all existing tests with scrollbars run with low tolerance.

        * platform/ScrollbarThemeComposite.cpp:
        (WebCore::ScrollbarThemeComposite::thumbLength):

2012-06-04  Anders Carlsson  <andersca@apple.com>

        Fix an unused result warning when building with clang.

        * platform/cf/BinaryPropertyList.cpp:
        (WebCore::BinaryPropertyListWriter::writePropertyList):

2012-06-04  Ami Fischman  <fischman@chromium.org>

        Don't crash when re-parenting a removed HTMLMediaElement
        https://bugs.webkit.org/show_bug.cgi?id=88058

        Reviewed by Eric Carlson.

        Test: media/media-reparent.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::userCancelledLoad): Clear the pending load flags because any pending load has been cancelled.

2012-06-04  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119421 and r119425.
        http://trac.webkit.org/changeset/119421
        http://trac.webkit.org/changeset/119425
        https://bugs.webkit.org/show_bug.cgi?id=88256

        not reliable, let's have a do-over (Requested by kling on
        #webkit).

        * dom/Element.cpp:
        (WebCore::Element::detachAttribute):
        (WebCore::Element::removeAttribute):
        (WebCore::Element::attributes):
        (WebCore::Element::setAttributeInternal):
        (WebCore::Element::parserSetAttributes):
        (WebCore::Element::hasEquivalentAttributes):
        (WebCore::Element::createAttributeData):
        (WebCore):
        (WebCore::Element::setAttributeNode):
        (WebCore::Element::removeAttributeNode):
        (WebCore::Element::getAttributeNode):
        (WebCore::Element::getAttributeNodeNS):
        (WebCore::Element::hasAttribute):
        (WebCore::Element::hasAttributeNS):
        (WebCore::Element::normalizeAttributes):
        (WebCore::Element::cloneAttributesFromElement):
        * dom/Element.h:
        (WebCore::Element::attributeData):
        (Element):
        (WebCore::Element::ensureAttributeData):
        (WebCore::Element::updatedAttributeData):
        (WebCore::Element::ensureUpdatedAttributeData):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::attrIfExists):
        (WebCore::ElementAttributeData::ensureAttr):
        (WebCore::ElementAttributeData::setAttr):
        (WebCore::ElementAttributeData::removeAttr):
        (WebCore::ElementAttributeData::setClass):
        (WebCore):
        (WebCore::ElementAttributeData::ensureInlineStyle):
        (WebCore::ElementAttributeData::ensureMutableInlineStyle):
        (WebCore::ElementAttributeData::destroyInlineStyle):
        (WebCore::ElementAttributeData::addAttribute):
        (WebCore::ElementAttributeData::removeAttribute):
        (WebCore::ElementAttributeData::isEquivalent):
        (WebCore::ElementAttributeData::detachAttrObjectsFromElement):
        (WebCore::ElementAttributeData::getAttributeItemIndexSlowCase):
        (WebCore::ElementAttributeData::cloneDataFrom):
        (WebCore::ElementAttributeData::clearAttributes):
        (WebCore::ElementAttributeData::replaceAttribute):
        (WebCore::ElementAttributeData::getAttributeNode):
        * dom/ElementAttributeData.h:
        (WebCore::ElementAttributeData::create):
        (ElementAttributeData):
        (WebCore::ElementAttributeData::setIdForStyleResolution):
        (WebCore::ElementAttributeData::setAttributeStyle):
        (WebCore::ElementAttributeData::length):
        (WebCore::ElementAttributeData::isEmpty):
        (WebCore::ElementAttributeData::attributeItem):
        (WebCore::ElementAttributeData::getAttributeItem):
        (WebCore::ElementAttributeData::ElementAttributeData):
        (WebCore::ElementAttributeData::attributeVector):
        (WebCore::ElementAttributeData::clonedAttributeVector):
        (WebCore::ElementAttributeData::getAttributeItemIndex):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::style):
        (WebCore::StyledElement::classAttributeChanged):
        (WebCore::StyledElement::removeInlineStyleProperty):
        (WebCore::StyledElement::addSubresourceAttributeURLs):
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::createHTMLElementFromSavedElement):
        * xml/parser/XMLDocumentParserQt.cpp:
        (WebCore::XMLDocumentParser::XMLDocumentParser):

2012-06-04  Andreas Kling  <kling@webkit.org>

        Unreviewed build fixes for cr-android and Qt.

        * dom/ElementAttributeData.h:
        (WebCore::ElementAttributeData::setClass):
        Change ElementAttributeData::setClass() to take an AtomicString instead of a String.
        The only call site has an AtomicString anyway.
        * xml/parser/XMLDocumentParserQt.cpp:
        (WebCore::XMLDocumentParser::XMLDocumentParser): Add missing const.

2012-06-04  Sadrul Habib Chowdhury  <sadrul@chromium.org>

        [chromium] Fix software rendering for device-scale-factor > 1
        https://bugs.webkit.org/show_bug.cgi?id=88136

        Reviewed by Darin Fisher.

        Test: fast/hidpi/device-scale-factor-paint.html

        * WebCore.exp.in:
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::setDeviceScaleFactor):
        (WebCore):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-06-04  Andreas Kling  <kling@webkit.org>

        Make ElementAttributeData a variable-sized object to reduce memory use.
        <http://webkit.org/b/88240>

        Reviewed by Antti Koivisto.

        Take advantage of the fact that we know at ElementAttributeData construction time how many attributes
        it needs to accomodate and allocate exactly as much space as needed instead of using a Vector.
        For elements that never have their attribute list mutated (the vast majority), this saves a lot of
        memory and removes the indirection to Vector<Attribute>'s heap-allocated storage.

        Introduced a mutability flag to ElementAttributeData and sprinkled assertions all over to make sure
        that nothing tries to mutate an element with a raw attribute array.

        When an Element's attribute(s) are mutated, we reconstruct the ElementAttributeData, this time using
        a Vector as backing instead. This is triggered when calling Element::mutableAttributeData().

        This reduces memory consumption by 3.2MB when viewing the full HTML5 spec at <http://whatwg.org/c/>.
        This is a 35% reduction in DOM attribute memory use.

        Furthermore, that page ends up promoting 27% of the elements to mutable attribute storage due to dynamic
        adding of "class" attributes. For more static pages, savings are even greater.

        * dom/Element.cpp:
        (WebCore::Element::detachAttribute):
        (WebCore::Element::removeAttribute):
        (WebCore::Element::attributes):
        (WebCore::Element::setAttributeInternal):
        (WebCore::Element::parserSetAttributes):
        (WebCore::Element::hasEquivalentAttributes):
        (WebCore::Element::setAttributeNode):
        (WebCore::Element::removeAttributeNode):
        (WebCore::Element::getAttributeNode):
        (WebCore::Element::getAttributeNodeNS):
        (WebCore::Element::hasAttribute):
        (WebCore::Element::hasAttributeNS):
        (WebCore::Element::normalizeAttributes):
        (WebCore::Element::cloneAttributesFromElement):
        (WebCore::Element::createMutableAttributeData):
        * dom/Element.h:
        (WebCore::Element::attributeData):
        (Element):
        (WebCore::Element::updatedAttributeData):
        (WebCore::Element::ensureAttributeData):
        (WebCore::Element::ensureUpdatedAttributeData):
        (WebCore::Element::mutableAttributeData):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::createImmutable):
        (WebCore::ElementAttributeData::ElementAttributeData):
        (WebCore::ElementAttributeData::~ElementAttributeData):
        (WebCore::ElementAttributeData::attrIfExists):
        (WebCore::ElementAttributeData::ensureAttr):
        (WebCore::ElementAttributeData::setAttr):
        (WebCore::ElementAttributeData::removeAttr):
        (WebCore::ElementAttributeData::ensureInlineStyle):
        (WebCore::ElementAttributeData::ensureMutableInlineStyle):
        (WebCore::ElementAttributeData::destroyInlineStyle):
        (WebCore::ElementAttributeData::addAttribute):
        (WebCore::ElementAttributeData::removeAttribute):
        (WebCore::ElementAttributeData::isEquivalent):
        (WebCore::ElementAttributeData::detachAttrObjectsFromElement):
        (WebCore::ElementAttributeData::getAttributeItemIndexSlowCase):
        (WebCore::ElementAttributeData::cloneDataFrom):
        (WebCore::ElementAttributeData::clearAttributes):
        (WebCore::ElementAttributeData::replaceAttribute):
        (WebCore::ElementAttributeData::getAttributeNode):
        * dom/ElementAttributeData.h:
        (ElementAttributeData):
        (WebCore::ElementAttributeData::setClass):
        (WebCore::ElementAttributeData::setIdForStyleResolution):
        (WebCore::ElementAttributeData::inlineStyle):
        (WebCore::ElementAttributeData::setAttributeStyle):
        (WebCore::ElementAttributeData::isMutable):
        (WebCore::ElementAttributeData::makeMutable):
        (WebCore::ElementAttributeData::length):
        (WebCore::ElementAttributeData::isEmpty):
        (WebCore::ElementAttributeData::array):
        (WebCore::ElementAttributeData::attributeItem):
        (WebCore::ElementAttributeData::getAttributeItem):
        (WebCore::ElementAttributeData::getAttributeItemIndex):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::style):
        (WebCore::StyledElement::classAttributeChanged):
        (WebCore::StyledElement::removeInlineStyleProperty):
        (WebCore::StyledElement::addSubresourceAttributeURLs):
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::createHTMLElementFromSavedElement):
        * xml/parser/XMLDocumentParserQt.cpp:
        (WebCore::XMLDocumentParser::XMLDocumentParser):

2012-06-04  Sadrul Habib Chowdhury  <sadrul@chromium.org>

        [chromium] Combobox options and autofill options should not be scaled for device-scale factor
        https://bugs.webkit.org/show_bug.cgi?id=87921

        Reviewed by Darin Fisher.

        Chrome takes care of scaling the combobox/autofill lists in the browser side. So it is not
        necessary to scale here. This change reverts parts of changes in r111539.

        Manually tested with different scale factors.

        * platform/chromium/PopupListBox.cpp:
        (WebCore::PopupListBox::paint):
        (WebCore::PopupListBox::paintRow):
        (WebCore::PopupListBox::getRowHeight):
        * platform/chromium/PopupListBox.h:
        (PopupContainerSettings):
        * platform/chromium/PopupMenuChromium.cpp:
        (WebCore::PopupMenuChromium::show):
        * rendering/RenderMenuList.cpp:
        (WebCore::RenderMenuList::showPopup):

2012-06-04  Dana Jansens  <danakj@chromium.org>

        [chromium] Make LayerRendererChromium use RenderPasses instead of RenderSurfaces
        https://bugs.webkit.org/show_bug.cgi?id=88132

        Reviewed by Adrienne Walker.

        This patch is partly renaming, partly moving data into CCRenderPass
        and CCRenderPassDrawQuad. LayerRendererChromium should accept as input
        a set of RenderPasses and this should be sufficient for drawing. It
        should have no notion of RenderSurfaces at all.

        First, what isn't done: RenderSurfaces still hold the textures
        where RenderPasses are drawn to/from, so that these textures can
        persist across frames. This will be addressed separately.

        Otherwise, this completely removes the concept of RenderSurface from
        LayerRenderChromium and the CCDrawQuad, replacing it with RenderPass.
        The "renderSurfaceTextureManager" is renamed to the "implTextureManager"
        and like-wise for the TextureAllocator, as these are not used
        exclusively for render surfaces (passes), and a texture manager for
        render passes that does not require a RenderSurface* will be the focus
        of future changes.

        Covered by existing tests.

        * WebCore.gypi:
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::LayerRendererChromium):
        (WebCore::LayerRendererChromium::setVisible):
        (WebCore::LayerRendererChromium::releaseRenderPassTextures):
        (WebCore::LayerRendererChromium::viewportChanged):
        (WebCore::LayerRendererChromium::clearRenderPass):
        (WebCore::LayerRendererChromium::beginDrawingFrame):
        (WebCore::LayerRendererChromium::drawRenderPass):
        (WebCore::LayerRendererChromium::drawQuad):
        (WebCore::LayerRendererChromium::drawBackgroundFilters):
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
        (WebCore::LayerRendererChromium::copyPlaneToTexture):
        (WebCore::LayerRendererChromium::drawHeadsUpDisplay):
        (WebCore::LayerRendererChromium::finishDrawingFrame):
        (WebCore::LayerRendererChromium::copyTextureToFramebuffer):
        (WebCore::LayerRendererChromium::getFramebufferTexture):
        (WebCore::LayerRendererChromium::isCurrentRenderPass):
        (WebCore::LayerRendererChromium::useRenderPass):
        (WebCore::LayerRendererChromium::useManagedTexture):
        (WebCore::LayerRendererChromium::bindFramebufferToTexture):
        (WebCore::LayerRendererChromium::setScissorToRect):
        (WebCore::LayerRendererChromium::setDrawFramebufferRect):
        (WebCore::LayerRendererChromium::initializeSharedObjects):
        (WebCore::LayerRendererChromium::renderPassProgram):
        (WebCore::LayerRendererChromium::renderPassProgramAA):
        (WebCore::LayerRendererChromium::renderPassMaskProgram):
        (WebCore::LayerRendererChromium::renderPassMaskProgramAA):
        (WebCore::LayerRendererChromium::cleanupSharedObjects):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (WebCore):
        (LayerRendererChromium):
        * platform/graphics/chromium/cc/CCDrawQuad.cpp:
        (WebCore::CCDrawQuad::toRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCDrawQuad.h:
        (WebCore):
        (CCDrawQuad):
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
        (WebCore::CCHeadsUpDisplay::draw):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::CCLayerTreeHostImpl::drawLayers):
        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::CCRenderPass):
        (WebCore::CCRenderPass::appendQuadsForRenderSurfaceLayer):
        * platform/graphics/chromium/cc/CCRenderPass.h:
        (CCRenderPass):
        (WebCore::CCRenderPass::framebufferOutputRect):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceDrawQuad.cpp.
        (WebCore):
        (WebCore::CCRenderPassDrawQuad::create):
        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceDrawQuad.h.
        (WebCore):
        (CCRenderPassDrawQuad):
        (WebCore::CCRenderPassDrawQuad::renderPass):
        (WebCore::CCRenderPassDrawQuad::isReplica):
        (WebCore::CCRenderPassDrawQuad::maskTextureId):
        (WebCore::CCRenderPassDrawQuad::filters):
        (WebCore::CCRenderPassDrawQuad::backgroundFilters):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::prepareContentsTexture):
        (WebCore::CCRenderSurface::prepareBackgroundTexture):
        (WebCore::CCRenderSurface::appendQuads):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (WebCore):
        (CCRenderSurface):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (CCRenderer):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
        (WebCore::CCScrollbarLayerImpl::willDraw):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::reserveTextures):

2012-06-04  Abhishek Arya  <inferno@chromium.org>

        Crash in multi-column layout.
        https://bugs.webkit.org/show_bug.cgi?id=88022

        Reviewed by Ojan Vafai.

        The patch addresses two problems::
        1. |this| in RenderBlock::splitBlocks can get destroyed when we
        move its children to the clone and later call updateBeforeAfterContent
        on the parent. So, we stop accessing its member variables and cache
        it in a local.
        2. Positioned objects were not getting cleared from our grand parents.
        This will happen if our immediate children got moved to a clone tree,
        however at our parent nothing was moved. So, we make sure to remove
        the positioned objects at every level while we are doing the cloning.

        Tests: fast/multicol/span/empty-anonymous-block-split-crash.html
               fast/multicol/span/positioned-objects-not-removed-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::splitBlocks):

2012-06-04  Tim Horton  <timothy_horton@apple.com>

        Mac build fails with SVG disabled
        https://bugs.webkit.org/show_bug.cgi?id=88165

        Reviewed by Dirk Schulze.

        Wrap all of SVGCSSPropertyNames in #if ENABLE(SVG),
        and mark an unused argument in collectMatchingRulesForList.

        * css/SVGCSSPropertyNames.in:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-06-04  David Kilzer  <ddkilzer@apple.com>

        BUILD FIX: Unused variable with ENABLE(CONTEXT_MENUS) off

        This broke in r118374.

        * bindings/js/JSInspectorFrontendHostCustom.cpp:
        (WebCore::JSInspectorFrontendHost::showContextMenu): Add
        UNUSED_PARAM(exec) when ENABLE(CONTEXT_MENUS) is off.

2012-06-04  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119393.
        http://trac.webkit.org/changeset/119393
        https://bugs.webkit.org/show_bug.cgi?id=88236

        Test is incorrect (duplicate content) and is causing Chromium
        failures (Requested by schenney on #webkit).

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::drawImage):

2012-06-04  Zeev Lieber  <zlieber@chromium.org>

        [chromium] Cleanup scissor rect computation/use with damage
        https://bugs.webkit.org/show_bug.cgi?id=87167

        Reviewed by Adrienne Walker.

        Performing scissorRect computation during
        calculateRenderPasses. Storing scissorRect in shared quad state
        instead of computing it during drawQuad. Added scissorRect fields
        into layers and render surfaces.

        Covered by existing layout tests. Introduced more unit tests to
        test end-to-end drawing using mock graphic context, and added more
        test cases to CCLayerTreeHostCommon to verify scissorRect computation.

        * platform/graphics/chromium/LayerChromium.h:
        (WebCore::LayerChromium::scissorRect):
        (WebCore::LayerChromium::setScissorRect):
        (LayerChromium):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::clearRenderSurface):
        (WebCore::LayerRendererChromium::drawRenderPass):
        (WebCore::LayerRendererChromium::drawQuad):
        (WebCore::LayerRendererChromium::drawRenderSurfaceQuad):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
        (WebCore::RenderSurfaceChromium::computeRootScissorRectInCurrentSurface):
        (WebCore):
        * platform/graphics/chromium/RenderSurfaceChromium.h:
        (WebCore::RenderSurfaceChromium::scissorRect):
        (WebCore::RenderSurfaceChromium::setScissorRect):
        (RenderSurfaceChromium):
        * platform/graphics/chromium/cc/CCDrawQuad.h:
        (WebCore::CCDrawQuad::scissorRect):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::createSharedQuadState):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):
        (WebCore::CCLayerImpl::scissorRect):
        (WebCore::CCLayerImpl::setScissorRect):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::updateLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore):
        (WebCore::calculateLayerScissorRect):
        (WebCore::calculateSurfaceScissorRect):
        (WebCore::calculateDrawTransformsInternal):
        (WebCore::calculateVisibleAndScissorRectsInternal):
        (WebCore::CCLayerTreeHostCommon::calculateDrawTransforms):
        (WebCore::CCLayerTreeHostCommon::calculateVisibleAndScissorRects):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.h:
        (CCLayerTreeHostCommon):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::CCLayerTreeHostImpl::drawLayers):
        (WebCore::CCLayerTreeHostImpl::swapBuffers):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::appendQuadsForRenderSurfaceLayer):
        * platform/graphics/chromium/cc/CCRenderPass.h:
        (CCRenderPass):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::createSharedQuadState):
        (WebCore::CCRenderSurface::createReplicaSharedQuadState):
        (WebCore):
        (WebCore::CCRenderSurface::computeRootScissorRectInCurrentSurface):
        (WebCore::CCRenderSurface::appendQuads):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (CCRenderSurface):
        (WebCore::CCRenderSurface::setScissorRect):
        (WebCore::CCRenderSurface::scissorRect):
        * platform/graphics/chromium/cc/CCRenderSurfaceDrawQuad.cpp:
        (WebCore::CCRenderSurfaceDrawQuad::create):
        (WebCore::CCRenderSurfaceDrawQuad::CCRenderSurfaceDrawQuad):
        * platform/graphics/chromium/cc/CCRenderSurfaceDrawQuad.h:
        (CCRenderSurfaceDrawQuad):
        * platform/graphics/chromium/cc/CCRenderer.h:
        (CCRenderer):
        * platform/graphics/chromium/cc/CCSharedQuadState.cpp:
        (WebCore::CCSharedQuadState::create):
        (WebCore::CCSharedQuadState::CCSharedQuadState):
        * platform/graphics/chromium/cc/CCSharedQuadState.h:
        (CCSharedQuadState):
        (WebCore::CCSharedQuadState::scissorRect):

2012-06-04  Kentaro Hara  <haraken@chromium.org>

        Remove SelectorQueryCacheEntry from SelectorQuery.h
        https://bugs.webkit.org/show_bug.cgi?id=88204

        Reviewed by Hajime Morita.

        As anttik@ pointed out in https://bugs.webkit.org/show_bug.cgi?id=87942#c15,
        we can remove SelectorQueryCacheEntry by having SelectorQuery hold CSSSelectorList.

        Tests: fast/dom/SelectorAPI/* No change in test results.

        * dom/SelectorQuery.cpp:
        (WebCore::SelectorQuery::SelectorQuery):
        (WebCore::SelectorQueryCache::add):
        * dom/SelectorQuery.h:
        (SelectorQuery):
        (SelectorQueryCache):

2012-06-04  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>

        [GTK] Memory leak in PasteboardHelper
        https://bugs.webkit.org/show_bug.cgi?id=88216

        Reviewed by Martin Robinson.

        Fixed a memory leak in PasteboardHelper by using adoptRef instead
        of just getting a new reference of TargetList.

        No new tests because of no behavior changes.

        * platform/gtk/PasteboardHelper.cpp:
        (WebCore::PasteboardHelper::dropAtomsForContext):

2012-06-04  Rob Buis  <rbuis@rim.com>

        Hit ASSERT when editing attribute value in Element in SVG Document
        https://bugs.webkit.org/show_bug.cgi?id=88179

        Reviewed by Pavel Feldman.

        Make sure the <span> is created as a HTML Element regardless of document in use.

        * inspector/InspectorDOMAgent.cpp:
        (WebCore):
        (WebCore::InspectorDOMAgent::setAttributesAsText):

2012-06-04  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Change function and variable names independent from "double" type
        https://bugs.webkit.org/show_bug.cgi?id=88220

        Reviewed by Kent Tamura.

        This patch is a part of introducing decimal arithmetic to input type.

        This patch renames function and variable names which contain term "double"
        to "number" to separate concept and implementation.

        No new tests. This patch doesn't change behavior.

        * html/BaseDateAndTimeInputType.cpp:
        (WebCore::BaseDateAndTimeInputType::valueAsDate): Replace parseToDouble to parseToNumber.
        (WebCore::BaseDateAndTimeInputType::valueAsNumber): ditto.
        (WebCore::BaseDateAndTimeInputType::parseToNumber): ditto.
        * html/BaseDateAndTimeInputType.h:
        (BaseDateAndTimeInputType):
        * html/DateInputType.cpp:
        (WebCore::DateInputType::createStepRange): Replace parseToDouble to parseToNumber.
        * html/DateTimeInputType.cpp:
        (WebCore::DateTimeInputType::createStepRange): Replace parseToDouble to parseToNumber.
        * html/DateTimeLocalInputType.cpp:
        (WebCore::DateTimeLocalInputType::createStepRange): Replace parseToDouble to parseToNumber.
        * html/InputType.cpp:
        (WebCore::InputType::rangeUnderflow): Replace parseToDouble to parseToNumber and doubleValue to numericValue.
        (WebCore::InputType::rangeOverflow): ditto.
        (WebCore::InputType::isInRange): ditto.
        (WebCore::InputType::isOutOfRange): ditto.
        (WebCore::InputType::stepMismatch): ditto.
        (WebCore::InputType::validationMessage): ditto.
        (WebCore::InputType::parseToNumber): ditto.
        (WebCore::InputType::parseToDoubleWithDecimalPlaces): ditto.
        (WebCore::InputType::stepUpFromRenderer): dttio.
        * html/InputType.h:
        (InputType):
        * html/MonthInputType.cpp:
        (WebCore::MonthInputType::createStepRange): Replace parseToDouble to parseToNumber.
        (WebCore::MonthInputType::parseToNumber): ditto.
        * html/MonthInputType.h:
        (MonthInputType):
        * html/NumberInputType.cpp:
        (WebCore::NumberInputType::valueAsNumber): Replace parseToDouble to parseToNumber.
        (WebCore::NumberInputType::createStepRange): ditto.
        (WebCore::NumberInputType::parseToNumber): ditto.
        * html/NumberInputType.h:
        * html/RangeInputType.cpp:
        (WebCore::ensureMaximum): Added helper function for createStepRange for avoiding cast in max() and using "const".
        (WebCore::RangeInputType::valueAsNumber): Replace parseToDouble to parseToNumber.
        (WebCore::RangeInputType::createStepRange): ditto.
        (WebCore::RangeInputType::handleKeydownEvent): ditto.
        (WebCore::RangeInputType::parseToNumber): ditto.
        (WebCore::RangeInputType::sanitizeValue): ditto.
        * html/RangeInputType.h:
        (RangeInputType):
        * html/StepRange.cpp:
        (WebCore::StepRange::parseStep): Replace DoubleWithDecimalPlaces to NumberWithDecimalPlaces.
        (WebCore::StepRange::stepMismatch): Replace parseToDouble to parseToNumber.
        * html/StepRange.h:
        (WebCore::StepRange::NumberWithDecimalPlaces): Renamed from DoubleWithDecimalPlaces.
        (WebCore::StepRange::NumberWithDecimalPlacesOrMissing): Renamed from DoubleWithDecimalPlacesOrMissing.
        * html/TimeInputType.cpp:
        (WebCore::TimeInputType::createStepRange): Replace parseToDouble to parseToNumber.
        * html/WeekInputType.cpp:
        (WebCore::WeekInputType::createStepRange): Replace parseToDouble to parseToNumber.

2012-06-04  David Kilzer  <ddkilzer@apple.com>

        BUILD FIX: FeatureDefines.xcconfig should match across projects

        * Configurations/FeatureDefines.xcconfig:
        - Add missing ENABLE_CSS_IMAGE_RESOLUTION.

2012-06-04  Justin Novosad  <junov@chromium.org>

        Canvas 2D - Source rectangles that overlap the source image boundary, not supported by drawImage
        https://bugs.webkit.org/show_bug.cgi?id=66574

        Reviewed by Stephen White.

        Test: fast/canvas/drawImage-clipped-source.html

        When the source rectangle argument to drawImage is not entirely
        contatained by the domain of the source image, the source rectangle
        is clipped, and the destination rectangle is clipped proportionately
        Old behavior was to silently fail, which did not comply with the spec.

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::normalizeAndClipRects):
        (WebCore):
        (WebCore::CanvasRenderingContext2D::drawImage):

2012-06-04  Dominik Röttsches  <dominik.rottsches@intel.com>

        [Cairo] Implementation of GraphicsContext does not save/restore ImageInterpolation correctly
        https://bugs.webkit.org/show_bug.cgi?id=87985

        Reviewed by Gustavo Noronha Silva.

        Moving image interpolation quality setting into state so that it's saved and restored.

        Covered by existing test fast/canvas/canvas-imageSmoothingEnabled.html which is now passing.

        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
        (GraphicsContextPlatformPrivate): Removing stale member that was never used.
        * platform/graphics/cairo/PlatformContextCairo.cpp:
        (WebCore::PlatformContextCairo::State::State):
        (PlatformContextCairo::State):
        (WebCore::PlatformContextCairo::PlatformContextCairo):
        (WebCore::PlatformContextCairo::drawSurfaceToContext):
        (WebCore::PlatformContextCairo::setImageInterpolationQuality):
        (WebCore):
        (WebCore::PlatformContextCairo::imageInterpolationQuality):
        * platform/graphics/cairo/PlatformContextCairo.h:
        (PlatformContextCairo): Moving implementations for image interpolation quality setter into implementation file.

2012-06-04  Philip Rogers  <pdr@google.com>

        Fix assert in non-scaling strokes in patterns
        https://bugs.webkit.org/show_bug.cgi?id=88198

        When calculating the CTM for a rect or path in a pattern we need to use
        an SVGPatternElement's local transform. Pattern did not expose the transform
        because it does not extend from from SVGStyledLocatable or SVGStyledTransformable.
        This patch exposes the pattern's transform in localCoordinateSpaceTransform.

        SVGGradientElement does not need this special handling because the children
        of a gradient element are restricted to not include shape and structural elements
        that would need to calculate a CTM.

        Before this patch the added test would assert.
        This patch is a prerequisite to a major refactoring of RenderSVGShape &
        friends, and the test will be unskipped in a followup patch.

        Reviewed by Dirk Schulze.

        Tests: svg/stroke/non-scaling-stroke-pattern-expected.svg
               svg/stroke/non-scaling-stroke-pattern.svg

        * svg/SVGPatternElement.cpp:
        (WebCore::SVGPatternElement::localCoordinateSpaceTransform):
        (WebCore):
        * svg/SVGPatternElement.h:
        (SVGPatternElement):
        * svg/SVGStyledElement.cpp:
        (WebCore::SVGStyledElement::localCoordinateSpaceTransform):

2012-06-04  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: speed up _calculateRetainedSizes function
        https://bugs.webkit.org/show_bug.cgi?id=87863

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshot.prototype._calculateRetainedSizes):

2012-06-04  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add unknown size to the memory pie-chart legend
        https://bugs.webkit.org/show_bug.cgi?id=88081

        Reviewed by Pavel Feldman.

        Added "Unknown" part size to the memory pie-chart legend.

        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.NativeMemoryProfileType.prototype.buttonClicked.didReceiveMemorySnapshot):
        (WebInspector.NativeMemoryProfileType.prototype.buttonClicked):
        (WebInspector.MemoryBlockViewProperties._initialize):
        (WebInspector.NativeMemoryPieChart.prototype._paint):

2012-06-04  Mike West  <mkwst@chromium.org>

        Adding explicit console error for duplicated CSP directives.
        https://bugs.webkit.org/show_bug.cgi?id=88193

        This patch adds an explicit error message for duplicated CSP
        directives instead of reusing the "unrecognized directive" error.

        Reviewed by Adam Barth.

        Test: http/tests/security/contentSecurityPolicy/duplicate-directive.html

        * page/ContentSecurityPolicy.cpp:
        (CSPDirectiveList):
        (WebCore::CSPDirectiveList::logDuplicateDirective):
        (WebCore):
        (WebCore::CSPDirectiveList::parseReportURI):
        (WebCore::CSPDirectiveList::setCSPDirective):
        (WebCore::CSPDirectiveList::applySandboxPolicy):
        (WebCore::CSPDirectiveList::addDirective):

2012-06-04  Yoshifumi Inoue  <yosin@chromium.org>

        REGRESSION(r117929) [Forms] input type=number thinks 0 is not a number
        https://bugs.webkit.org/show_bug.cgi?id=88208

        Reviewed by Kent Tamura.

        This patch fixes invalid handling of return value of parseToDoubleForNumberType
        in NumberInputType::isAcceptableValue to use isfinite() function for checking
        whether specified string is valid number or not. Before r117929, return value
        of parseToDoubleForNumberType was bool, but after r117929, it is double.

        Test: fast/forms/number/input-number-from-renderer.html

        * html/NumberInputType.cpp:
        (WebCore::NumberInputType::isAcceptableValue): Use isfinite()

2012-06-04  Antti Koivisto  <antti@apple.com>

        Crash in WebCore::RenderView::getRetainedWidgets
        https://bugs.webkit.org/show_bug.cgi?id=88217

        Reviewed by Kenneth Rohde Christiansen.
        
        There is no known repro, the crash has been seen on the field. It is likely that it happens with frame
        flattening enabled only.

        Null check root renderer in performPostLayoutTasks. The root can legitimely be null for several reasons and
        is mostly null checked everywhere else.

        * page/FrameView.cpp:
        (WebCore::FrameView::performPostLayoutTasks):

2012-06-04  Kentaro Hara  <haraken@chromium.org>

        Use SelectorQuery in Element::webkitMatchesSelector()
        https://bugs.webkit.org/show_bug.cgi?id=88209

        Reviewed by Antti Koivisto.

        By using SelectorQuery in Element::webkitMatchesSelector(),
        we can not only simplify the code but also improve the performance
        thanks to the cache mechanism of SelectorQuery which was implemented
        in bug 87942.

        Tests: fast/dom/SelectorAPI/*. No change in test results.

        * dom/Element.cpp:
        (WebCore::Element::webkitMatchesSelector):
        * dom/SelectorQuery.cpp:
        (WebCore::SelectorQuery::matches):
        (WebCore):
        * dom/SelectorQuery.h:
        (SelectorQuery):

2012-05-31  Kinuko Yasuda  <kinuko@chromium.org>

        [chromium] DataTransferItem.webkitGetAsEntry() should synchronously return entry
        https://bugs.webkit.org/show_bug.cgi?id=87969

        Reviewed by Tony Chang.

        Per discussion on whatwg we should make webkitGetAsEntry synchronous.
        http://lists.w3.org/Archives/Public/public-whatwg-archive/2012Apr/0079.html

        Tests: editing/pasteboard/data-transfer-items-drag-drop-entry.html
               fast/filesystem/cross-filesystem-op.html

        * Modules/filesystem/DataTransferItemFileSystem.h:
        (DataTransferItemFileSystem):
        * Modules/filesystem/DataTransferItemFileSystem.idl:
        * Modules/filesystem/chromium/DataTransferItemFileSystemChromium.cpp:
        (WebCore::DataTransferItemFileSystem::webkitGetAsEntry): Changed it to synchronously return entry.

2012-06-03  Dominic Cooney  <dominicc@chromium.org>

        EventTarget.idl should generate JS bindings
        https://bugs.webkit.org/show_bug.cgi?id=88120

        This is one step in a larger change to expose a constructor for
        EventTarget and put EventTarget on the prototype chain of DOM
        objects that are event targets, in line with DOM Core. See
        <https://bugs.webkit.org/show_bug.cgi?id=67312>

        Reviewed by Adam Barth.

        No new tests. This change does not change any functionality.

        * CMakeLists.txt: Generate JSEventTarget.
        * DerivedSources.cpp:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * Target.pri:
        * UseJSC.cmake:
        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp: JSEventTarget.cpp was renamed.
        * bindings/js/JSEventTarget.h: Removed. Generated now.
        * bindings/js/JSEventTargetCustom.cpp: Renamed from Source/WebCore/bindings/js/JSEventTarget.cpp.
        * bindings/scripts/CodeGeneratorV8.pm:
        (GetInternalFields): EventTarget is an EventTarget.
        * dom/EventTarget.idl: Defer to toJS, toEventTarget in JSEventTargetCustom.cpp.

2012-06-03  Hayato Ito  <hayato@chromium.org>

        Supports traversing nodes in an orphaned shadow subtree in ComposedShadowTreeParentWalker.
        https://bugs.webkit.org/show_bug.cgi?id=87924

        Reviewed by Dimitri Glazkov.

        Some events, such as a 'click' event, can be dispatched on nodes in an orphaned shadow subtree.
        When resolving a parent node of a shadow root which is not assigned to any shadow insertion point,
        we have to return its shadow host as a parent node.

        The related shadow DOM spec section is:
        https://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#events

        Test: fast/dom/shadow/shadow-dom-event-dispatching.html

        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::ComposedShadowTreeParentWalker::traverseParentIncludingInsertionPointAndShadowRoot):

2012-06-03  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119359.
        http://trac.webkit.org/changeset/119359
        https://bugs.webkit.org/show_bug.cgi?id=88189

        This broke platform/mac/fast/dom/wrapper-classes-objc.html.
        (Requested by dominicc on #webkit).

        * bindings/objc/PublicDOMInterfaces.h:
        * bindings/scripts/CodeGeneratorObjC.pm:
        (GetBaseClass):
        * dom/MouseEvent.h:
        (MouseEvent):
        * dom/WheelEvent.cpp:
        (WebCore::WheelEvent::WheelEvent):
        * dom/WheelEvent.h:
        (WheelEvent):
        * dom/WheelEvent.idl:

2012-06-03  Dominic Cooney  <dominicc@chromium.org>

        WheelEvent should inherit from MouseEvent
        https://bugs.webkit.org/show_bug.cgi?id=76104

        Reviewed by Kentaro Hara.

        The spec for WheelEvent is
        <http://www.w3.org/TR/DOM-Level-3-Events/#webidl-events-WheelEvent>

        Tests: fast/events/event-creation.html
               http://samples.msdn.microsoft.com/ietestcenter/dominheritance/showdominheritancetest.htm?Prototype_WheelEvent

        * bindings/objc/PublicDOMInterfaces.h: Remove redundant MouseEvent API from WheelEvent
        * bindings/scripts/CodeGeneratorObjC.pm: MouseEvents are Events
        * dom/MouseEvent.h: Expose no-arg constructor to WheelEvent
        * dom/WheelEvent.cpp:
        (WebCore::WheelEvent::WheelEvent): Call MouseEvent superconstructor
        * dom/WheelEvent.h: Extend MouseEvent
        * dom/WheelEvent.idl: "

2012-06-03  Varun Jain  <varunjain@google.com>

        [chromium] Add new gesture type (two finger tap) that triggers context menu.
        https://bugs.webkit.org/show_bug.cgi?id=88173

        Reviewed by Adam Barth.

        Test: fast/events/touch/gesture/context-menu-on-two-finger-tap.html

        * platform/PlatformEvent.h:

2012-06-02  Andy Estes  <aestes@apple.com>

        __ZNK7WebCore4Node27traverseNextAncestorSiblingEv should be exported even if ENABLE(FULLSCREEN_API) is false
        https://bugs.webkit.org/show_bug.cgi?id=88184

        Reviewed by Dan Bernstein.

        Node::traverseNextAncestorSibling() is called in several inline
        functions defined in ContainerNode.h (a private header), so its symbol
        needs to be exported regardless of whether full-screen API is enabled.

        * WebCore.exp.in:

2012-06-02  Xianzhu Wang  <wangxianzhu@chromium.org>

        SVGImageCache leaks image data
        https://bugs.webkit.org/show_bug.cgi?id=87792

        There are two functions to remove a client from a CachedImage:
        - CachedResource::removeClient()
        - CachedImage::removeClientForRenderer().
        It's easy to make error to call the former which will leak the cached
        image buffers in SVGImageCache.

        This change combined the two by adding the virtual 
        CachedResource::didRemoveClient(). CachedImage will do SVGImageCache
        cleanup in the function.

        Reviewed by Nikolas Zimmermann.

        Test: svg/as-image/svg-image-leak-cached-data.html

        * loader/cache/CachedFont.h:
        (WebCore::CachedFontClient::resourceClientType): Added 'const'.
        * loader/cache/CachedImage.cpp:
        (WebCore):
        (WebCore::CachedImage::didRemoveClient): Removes the client from SVGImageCache.
        (WebCore::CachedImage::lookupOrCreateImageForRenderer):
        * loader/cache/CachedImage.h:
        (CachedImage):
        (WebCore::CachedImageClient::resourceClientType): Added 'const'.
        * loader/cache/CachedRawResource.h:
        (WebCore::CachedRawResourceClient::resourceClientType): Added 'const'.
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::removeClient): Added invocation of didRemoveClient().
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::didRemoveClient): Added for subclasses to do additional works.
        * loader/cache/CachedResourceClient.h:
        (WebCore::CachedResourceClient::resourceClientType): Added 'const'.
        * loader/cache/CachedSVGDocument.h:
        (WebCore::CachedSVGDocumentClient::resourceClientType): Added 'const'.
        * loader/cache/CachedStyleSheetClient.h:
        (WebCore::CachedStyleSheetClient::resourceClientType): Added 'const'.
        * rendering/style/StyleCachedImage.cpp:
        (WebCore::StyleCachedImage::removeClient):
        * rendering/style/StyleCachedImageSet.cpp:
        (WebCore::StyleCachedImageSet::removeClient):
        * svg/graphics/SVGImageCache.cpp:
        (WebCore::SVGImageCache::~SVGImageCache): Added checking for leaks.
        (WebCore::SVGImageCache::removeClientFromCache):
        (WebCore::SVGImageCache::setRequestedSizeAndScales): 
        (WebCore::SVGImageCache::requestedSizeAndScales):
        (WebCore::SVGImageCache::lookupOrCreateBitmapImageForClient):
        * svg/graphics/SVGImageCache.h:
        (WebCore):
        (SVGImageCache):

2012-06-02  Ryosuke Niwa  <rniwa@webkit.org>

        Windows build fix after r119330. Unnest the class for now.

        * dom/SelectorQuery.cpp:
        (WebCore::SelectorQueryCacheEntry::SelectorQueryCacheEntry):
        (WebCore::SelectorQueryCache::add):
        * dom/SelectorQuery.h:
        (SelectorQueryCacheEntry):
        (WebCore::SelectorQueryCacheEntry::selectorQuery):
        (WebCore):
        (SelectorQueryCache):

2012-06-02  Geoffrey Garen  <ggaren@apple.com>

        DOM string cache should hash pointers, not characters
        https://bugs.webkit.org/show_bug.cgi?id=88175

        Reviewed by Phil Pizlo and Sam Weinig.

        Dromaeo DOM Core reports no change.

        http://trac.webkit.org/changeset/84934 accidentally changed from hashing
        pointers to hashing characters, due to template defaults. Let's change back.

        Hashing characters is not so good because:

        (1) It's not memory-safe with HashMap::set(). HashMap::set() replaces
        the value but not the key. Since our values own our keys, we need to
        ensure object identity between key and value, or the key can be freed
        prematurely. (This is impossible to demonstrate with our current
        eager sweep behavior, but it shows up as crashes in layout tests if you
        change to lazy sweep.)

        (2) It's slower.

        * bindings/js/DOMWrapperWorld.h:
        (WebCore): Override the default hash, which hashes based on characters.

2012-06-02  Eli Fidler  <efidler@rim.com>

        Don't crash if we ask for fonts that don't exist.
        https://bugs.webkit.org/show_bug.cgi?id=88106

        Reviewed by Dan Bernstein.

        RIM PR 161219

        If the site doesn't ask for a reasonable font and the system doesn't
        provide a good fallback, FontFallBackList::primaryFontData can be 0,
        which can cause a crash.

        * platform/graphics/skia/FontCacheSkia.cpp:
        (WebCore::FontCache::getLastResortFallbackFont):

2012-06-02  Kentaro Hara  <haraken@chromium.org>

        [Performance] Optimize querySelector() by caching SelectorQuery objects
        https://bugs.webkit.org/show_bug.cgi?id=87942

        Reviewed by Antti Koivisto.

        This patch improves performance of Node::querySelector() by 7.1x in Safari/Mac
        and by 8.5x in Chromium/Linux.

        Performance test: Parser/query-selector-first.html, Parser/query-selector-last.html

        [query-selector-first.html]
        Safari/Mac      264.97 runs/s  =>  1872.78 runs/s  (7.06x speed-up)
        Chromium/Linux  244.84 runs/s  =>  2071.60 runs/s  (8.46x speed-up)

        [query-selector-last.html]
        Safari/Mac      393.73 runs/s  =>  466.05 runs/s   (1.18x speed-up)
        Chromium/Linux  401.15 runs/s  =>  484.45 runs/s   (1.20x speed-up)

        Previously Node::querySelector() and Node::querySelectorAll() had been
        parsing CSS queries every time. This patch optimizes the performance by caching
        parsed results onto a Document.

        The cache is invalidated when any of CSS related variables is updated.
        As per the current implementation of CSSParserContext::operator==(), the CSS related
        variables are as follows:

        - baseURI
        - charset
        - mode
        - isHTMLDocument
        - isCSSCustomFilterEnabled
        - isCSSRegionsEnabled
        - needsSiteSpecificQuirks
        - enforcesCSSMIMETypeInNoQuirksMode

        Actually, we do not need to watch all of these variables:

        - The current implementation does not watch the change of charset.
        charset is always set to a null String by CSSParserContext::CSSParserContext().

        - isHTMLDocument never changes.

        - isCSSCustomFilterEnabled, isCSSRegionsEnabled, needsSiteSpecificQuirks and
        enforcesCSSMIMETypeInNoQuirksMode are not flipped in a user scenario.
        If someone changes them, it would be reasonable to expect them
        to take the effect only on subsequent document loads.
        Thus we do not need to invalidate the cache when these variables are updated.

        Consequently, the condition under which we have to invalidate the cache is
        that any of the following variables is updated:

        - baseURI
        - mode

        Tests: fast/dom/SelectorAPI/*. No change in test results.

        * dom/SelectorQuery.h: SelectorQueryCache is a cache from CSS selectors to parsed results.
        SelectorQueryCache::Entry is an entry of the cache.
        SelectorQueryCache::Entry holds a SelectorQuery object and a CSSSelectorList object.
        The reason why SelectorQueryCache::Entry needs to hold the CSSSelectorList object
        is that the CSSSelectorList object keeps the lifetime of CSSSelector objects
        in the SelectorQuery object. Since the SelectorQuery object just holds pointers
        to CSSSelector objects, the CSSSelectorList object must not be destructed
        before the SelectorQuery object is destructed.
        (WebCore):
        (SelectorDataList):
        (WebCore::SelectorQuery::SelectorQuery):
        (SelectorQuery):
        (SelectorQueryCache):
        (WebCore::SelectorQueryCache::SelectorQueryCache):
        (Entry):
        (WebCore::SelectorQueryCache::Entry::selectorQuery):
        * dom/SelectorQuery.cpp:
        (WebCore::SelectorQuery::initialize):
        (WebCore::SelectorQueryCache::Entry::Entry):
        (WebCore::SelectorQueryCache::add): Returns a cached SelectorQuery object if any.
        Otherwise, parses a given CSS selector, creates a SelectorQuery object,
        adds the SelectorQuery object to a new entry in the cache, returns the SelectorQuery
        object.
        (WebCore::SelectorQueryCache::invalidate): Clears the cache.

        * dom/Document.h:
        (WebCore):
        (Document):
        * dom/Document.cpp:
        (WebCore::Document::selectorQueryCache):
        (WebCore):
        (WebCore::Document::setCompatibilityMode): Invalidates the cache
        when m_compatibilityMode is updated.
        (WebCore::Document::updateBaseURL): Invalidates the cache
        when m_baseURL is updated.

        * dom/Node.h: Changed String to AtomicString, since the key of the cache
        should be AtomicString.
        (Node):
        * dom/Node.cpp: Optimized the code by using the cache.
        (WebCore::Node::querySelector):
        (WebCore::Node::querySelectorAll):

2012-06-02  Dan Bernstein  <mitz@apple.com>

        Reverted the last change.

        * WebCore.xcodeproj/project.pbxproj:

2012-06-02  Dan Bernstein  <mitz@apple.com>

        Stop treating Perl code as private headers.

        * WebCore.xcodeproj/project.pbxproj: Removed CodeGenerator.pm, generate-bindings.pl,
        IDLParser.pm, IDLStructure.pm, and preprocessor.pm from the Copy Headers build phase.

2012-06-02  Zeno Albisser  <zeno@webkit.org>

        Fix and enable WebGL for WebKit2 on Qt.
        https://bugs.webkit.org/show_bug.cgi?id=86214

        Make GraphicsContext3DPrivate use GraphicsSurfaces
        for WK2. The GraphicsContext3D then uses the existing
        RenderBuffer for multisample rendering.
        When WebGraphicsLayer::syncCompositingState is being
        executed, the canvas is being synced as well. This means
        that the RenderBuffer contents are being blit onto
        a GraphicsSurface, and the GraphicsSurface token is
        being sent to the UIProcess.
        The WebLayerTreeRenderer then creates a
        TextureMapperSurfaceBackingStore for the canvas and
        passes the GraphicsSurface token as an argument.
        The token can then be used to identify the GraphicsSurface
        from the UIProcess side.

        Reviewed by Noam Rosenthal.

        * platform/graphics/GraphicsContext3D.h:
        Added createGraphicsSurfaces function. This is currently only
        being used by the Qt port.

        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
        (WebCore::GraphicsContext3D::reshape):
        Calling the createGraphicsSurfaces function when the GraphicsContext3D
        is reshaped. This is currently only relevant for the Qt port.

        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        (GraphicsContext3DPrivate):
        Added m_frontBufferGraphicsSurface, m_backBufferGraphicsSurface
        and m_surfaceFlags members.
        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
        In case of WK2, create a QOpenGLContext and two GraphicsSurface
        for sharing the WebGL content with the UIProcess. One GraphicsSurface
        is being used as the front, the other one as the backbuffer.
        Creating a QOpenGLContext currently requires showing a QWindow.
        For the moment we therefore create a minimal QWindow and place
        it offscreen.
        (WebCore::GraphicsContext3DPrivate::copyToGraphicsSurface):
        This new function is called from the WebGraphicsLayer,
        to blit the multisample framebuffer and copy its contents
        onto the GraphicsSurface.
        (WebCore::GraphicsContext3DPrivate::createGraphicsSurfaces):
        Whenever the GraphicsContext3D is being reshaped,
        new GraphicsSurfaces must be created with the updated dimensions.
        (WebCore::GraphicsContext3D::createGraphicsSurfaces):

        * platform/graphics/texmap/TextureMapperPlatformLayer.h:
        Added a new virtual function copyToGraphicsSurface.
        (TextureMapperPlatformLayer):
        (WebCore::TextureMapperPlatformLayer::copyToGraphicsSurface):

2012-06-02  Tony Chang  <tony@chromium.org>

        Rename the flexbox CSS propery values from start to flex-start and end to flex-end
        https://bugs.webkit.org/show_bug.cgi?id=88152

        Reviewed by Ojan Vafai.

        The spec changed. This is to differentiate from start/end which will
        depend on writing mode direction, rather than flex direction.

        No new tests, just updated the existing values.

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator EAlignItems):
        (WebCore::CSSPrimitiveValue::operator EJustifyContent):
        (WebCore::CSSPrimitiveValue::operator EAlignContent):
        * css/CSSValueKeywords.in:
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::initialJustifyContentOffset):
        (WebCore::alignmentForChild):
        (WebCore::initialAlignContentOffset):
        (WebCore::RenderFlexibleBox::alignFlexLines):
        (WebCore::RenderFlexibleBox::alignChildren):
        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyleConstants.h:

2012-06-01  Alexandre Elias  <aelias@google.com>

        [chromium] Software compositor initialization and base classes
        https://bugs.webkit.org/show_bug.cgi?id=87920

        Reviewed by James Robinson.

        This introduces new wrapper class CCGraphicsContext and base class
        CCRenderer which will be used for software compositing support.
        If no GraphicsContext3D is available, early return for now.

        No new tests. (No-op change in 3d mode.)

        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
        (WebCore::BitmapCanvasLayerTextureUpdater::Texture::updateRect):
        (WebCore::BitmapCanvasLayerTextureUpdater::updateTextureRect):
        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h:
        (Texture):
        (BitmapCanvasLayerTextureUpdater):
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::Texture::updateRect):
        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::updateTextureRect):
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
        (Texture):
        (BitmapSkPictureCanvasLayerTextureUpdater):
        * platform/graphics/chromium/CanvasLayerTextureUpdater.h:
        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::Texture::updateRect):
        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h:
        (Texture):
        (FrameBufferSkPictureCanvasLayerTextureUpdater):
        * platform/graphics/chromium/ImageLayerChromium.cpp:
        (WebCore::ImageLayerTextureUpdater::Texture::updateRect):
        (WebCore::ImageLayerTextureUpdater::updateTextureRect):
        * platform/graphics/chromium/LayerChromium.h:
        (WebCore):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::CCRenderer::toGLMatrix):
        (WebCore):
        (WebCore::LayerRendererChromium::create):
        (WebCore::CCRenderer::CCRenderer):
        (WebCore::LayerRendererChromium::LayerRendererChromium):
        (WebCore::LayerRendererChromium::copyPlaneToTexture):
        (WebCore::LayerRendererChromium::drawHeadsUpDisplay):
        (WebCore::LayerRendererChromium::getFramebufferTexture):
        (WebCore::LayerRendererChromium::bindFramebufferToTexture):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (CCRenderer):
        (WebCore::CCRenderer::~CCRenderer):
        (WebCore::CCRenderer::ccContext):
        (WebCore::CCRenderer::settings):
        (WebCore::CCRenderer::viewportSize):
        (WebCore::CCRenderer::viewportWidth):
        (WebCore::CCRenderer::viewportHeight):
        (WebCore::CCRenderer::projectionMatrix):
        (WebCore::CCRenderer::windowMatrix):
        (WebCore::CCRenderer::sharedGeometryQuad):
        (WebCore):
        (LayerRendererChromium):
        * platform/graphics/chromium/LayerTextureSubImage.cpp:
        (WebCore::LayerTextureSubImage::upload):
        (WebCore::LayerTextureSubImage::uploadWithTexSubImage):
        (WebCore::LayerTextureSubImage::uploadWithMapTexSubImage):
        * platform/graphics/chromium/LayerTextureSubImage.h:
        (WebCore):
        (LayerTextureSubImage):
        * platform/graphics/chromium/LayerTextureUpdater.h:
        (WebCore):
        (Texture):
        * platform/graphics/chromium/ManagedTexture.cpp:
        (WebCore::ManagedTexture::bindTexture):
        (WebCore::ManagedTexture::framebufferTexture2D):
        * platform/graphics/chromium/ManagedTexture.h:
        (WebCore):
        (ManagedTexture):
        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
        * platform/graphics/chromium/TextureCopier.cpp:
        (WebCore::AcceleratedTextureCopier::copyTexture):
        * platform/graphics/chromium/TextureCopier.h:
        (TextureCopier):
        (AcceleratedTextureCopier):
        * platform/graphics/chromium/TextureUploader.h:
        (TextureUploader):
        * platform/graphics/chromium/ThrottledTextureUploader.cpp:
        (WebCore::ThrottledTextureUploader::uploadTexture):
        * platform/graphics/chromium/ThrottledTextureUploader.h:
        (ThrottledTextureUploader):
        * platform/graphics/chromium/cc/CCGraphicsContext.h: Copied from Source/WebCore/platform/graphics/chromium/CanvasLayerTextureUpdater.h.
        (WebCore):
        (CCGraphicsContext):
        (WebCore::CCGraphicsContext::create2D):
        (WebCore::CCGraphicsContext::create3D):
        (WebCore::CCGraphicsContext::context3D):
        (WebCore::CCGraphicsContext::CCGraphicsContext):
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
        (WebCore::CCHeadsUpDisplay::draw):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::willDraw):
        (WebCore::CCLayerImpl::bindContentsTexture):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore):
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::createContext):
        (WebCore::CCLayerTreeHost::context):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHostClient):
        (WebCore::CCSettings::CCSettings):
        (CCSettings):
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::context):
        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::layerRenderer):
        * platform/graphics/chromium/cc/CCProxy.h:
        (WebCore):
        (CCProxy):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
        (WebCore::CCScrollbarLayerImpl::willDraw):
        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
        (CCScrollbarLayerImpl):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::context):
        (WebCore::CCSingleThreadProxy::initializeContext):
        (WebCore::CCSingleThreadProxy::recreateContext):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        (CCSingleThreadProxy):
        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:
        (WebCore::CCTextureUpdater::update):
        * platform/graphics/chromium/cc/CCTextureUpdater.h:
        (CCTextureUpdater):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::context):
        (WebCore::CCThreadProxy::initializeContext):
        (WebCore::CCThreadProxy::recreateContext):
        (WebCore::CCThreadProxy::beginFrame):
        (WebCore::CCThreadProxy::initializeContextOnImplThread):
        (WebCore::CCThreadProxy::recreateContextOnImplThread):
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (CCThreadProxy):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::willDraw):
        (WebCore::CCVideoLayerImpl::willDrawInternal):
        (WebCore::CCVideoLayerImpl::reserveTextures):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
        (CCVideoLayerImpl):

2012-06-01  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119283, r119287, and r119291.
        http://trac.webkit.org/changeset/119283
        http://trac.webkit.org/changeset/119287
        http://trac.webkit.org/changeset/119291
        https://bugs.webkit.org/show_bug.cgi?id=88159

        Not only broke compilation in the initial commit but also
        broke LayerChromiumTest.basicCreateAndDestroy (Requested by
        rniwa on #webkit).

        * WebCore.gypi:
        * platform/graphics/chromium/AnimationTranslationUtil.cpp: Removed.
        * platform/graphics/chromium/AnimationTranslationUtil.h: Removed.
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::addAnimation):
        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::addAnimation):
        * platform/graphics/chromium/LayerChromium.h:
        (LayerChromium):
        * platform/graphics/chromium/LinkHighlight.cpp:
        (WebCore::LinkHighlight::LinkHighlight):
        * platform/graphics/chromium/cc/CCAnimationCurve.h:
        (CCTransformAnimationCurve):
        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp:
        (WebCore::CCTransformKeyframe::create):
        (WebCore::CCTransformKeyframe::CCTransformKeyframe):
        (WebCore::CCTransformKeyframe::value):
        (WebCore::CCTransformKeyframe::clone):
        (WebCore::CCKeyframedTransformAnimationCurve::getValue):
        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h:
        (CCTransformKeyframe):
        (CCKeyframedTransformAnimationCurve):
        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
        (WebCore::CCLayerAnimationController::addAnimation):
        (WebCore):
        (WebCore::CCLayerAnimationController::add):
        (WebCore::CCLayerAnimationController::pushNewAnimationsToImplThread):
        (WebCore::CCLayerAnimationController::replaceImplThreadAnimations):
        (WebCore::CCLayerAnimationController::tickAnimations):
        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
        (CCLayerAnimationControllerClient):
        (CCLayerAnimationController):
        * platform/graphics/chromium/cc/CCLayerImpl.h:

2012-06-01  Levi Weintraub  <leviw@chromium.org>

        Large number constant in TransformationMatrix::projectPoint overflows FractionalLayoutUnits with sub-pixel layout enabled
        https://bugs.webkit.org/show_bug.cgi?id=87896

        Reviewed by James Robinson.

        kLargeNumber is meant to avoid overflowing when projecting a point through a transform. Unfortunately,
        due to FractionalLayoutUnit's diminished range compared to integers, we were overflowing anyways. This
        change adjusts our large number by the same value, but adjusted for our denominator.

        This was originally missed because transforms/3d is marked as pass/fail in Chromium's test_expectations.txt
        https://bugs.webkit.org/show_bug.cgi?id=66989 tracks removing this problem.

        No new tests. Covered by transforms/3d/hit-testing/perspective-clipped.html

        * platform/graphics/transforms/TransformationMatrix.cpp:
        (WebCore::TransformationMatrix::projectPoint):

2012-06-01  Tim Horton  <timothy_horton@apple.com>

        Cleanup GeneratorGeneratedImage/Gradient changes from r117858
        https://bugs.webkit.org/show_bug.cgi?id=88063

        Reviewed by Simon Fraser.

        No new tests, code cleanup.

        * platform/graphics/Generator.h:
        (WebCore::Generator::hash): hash() should be const.
        * platform/graphics/GeneratorGeneratedImage.cpp:
        (WebCore::GeneratorGeneratedImage::drawPattern): Minor cleanup.
        * platform/graphics/Gradient.cpp:
        (WebCore::Gradient::Gradient): Rename m_hashCache to m_cachedHash.
        (WebCore::Gradient::addColorStop): Rename clearHashCache to invalidateHash.
        (WebCore::Gradient::sortStopsIfNecessary): Rename clearHashCache to invalidateHash.
        (WebCore::Gradient::setSpreadMethod): Rename clearHashCache to invalidateHash.
        (WebCore::Gradient::setGradientSpaceTransform): Rename clearHashCache to invalidateHash.
        (WebCore::Gradient::hash): Use intHash instead of the pair hasher. Add compile time size checks
        for structures being passed to StringHasher.
        * platform/graphics/Gradient.h:
        (WebCore::Gradient::setP0): Rename clearHashCache to invalidateHash.
        (WebCore::Gradient::setP1): Rename clearHashCache to invalidateHash.
        (WebCore::Gradient::setStartRadius): Rename clearHashCache to invalidateHash.
        (WebCore::Gradient::setEndRadius): Rename clearHashCache to invalidateHash.
        (WebCore::Gradient::invalidateHash):  Rename clearHashCache to invalidateHash.
        * platform/graphics/GraphicsContext.cpp:
        (WebCore::scalesMatch): Added. Determine if the scale of two AffineTransforms match.
        (WebCore::GraphicsContext::isCompatibleWithBuffer): Make use of scalesMatch to simplify the logic.

2012-06-01  Raymond Toy  <rtoy@google.com>

        Remove RefInfo class
        https://bugs.webkit.org/show_bug.cgi?id=87904

        Reviewed by Chris Rogers.

        No new tests; covered by existing tests.

        * Modules/webaudio/AudioBufferSourceNode.cpp:
        (WebCore::AudioBufferSourceNode::~AudioBufferSourceNode): Clear
        panner node.
        (WebCore::AudioBufferSourceNode::totalPitchRate):
        (WebCore::AudioBufferSourceNode::setPannerNode): Use
        RefTypeConnection counting for panner node.
        (WebCore):
        (WebCore::AudioBufferSourceNode::clearPannerNode): New function to
         clear panner node in AudioBufferSourceNode.
        (WebCore::AudioBufferSourceNode::finish): Clear panner node when done.
        * Modules/webaudio/AudioBufferSourceNode.h:
        (AudioBufferSourceNode): Add virtual finish(), m_pannerNode is not
        a RefPtr anymore.
        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::addDeferredFinishDeref): Remove unneeded RefTyp.
        (WebCore::AudioContext::handleDeferredFinishDerefs): Remove
        unneeded RefType.
        * Modules/webaudio/AudioContext.h:
        (AudioContext): Update addDeferredFinishDeref signature.
        * Modules/webaudio/AudioNode.cpp:
        (WebCore::AudioNode::deref): Update call to addDeferredFinishDeref. 
        * Modules/webaudio/AudioScheduledSourceNode.h:
        (AudioScheduledSourceNode): Make finish() virtual.

2012-06-01  Tony Chang  <tony@chromium.org>

        rename -webkit-flex-pack and -webkit-flex-line-pack to -webkit-justify-content and -webkit-align-content
        https://bugs.webkit.org/show_bug.cgi?id=88113

        Reviewed by Ojan Vafai.

        This recently changed in the spec:
        http://dev.w3.org/csswg/css3-flexbox/#justify-content-property
        http://dev.w3.org/csswg/css3-flexbox/#align-content-property

        No new tests, updated existing tests.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore):
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator EJustifyContent):
        (WebCore::CSSPrimitiveValue::operator EAlignContent):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::repositionLogicalHeightDependentFlexItems):
        (WebCore::initialJustifyContentOffset):
        (WebCore::justifyContentSpaceBetweenChildren):
        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
        (WebCore::RenderFlexibleBox::layoutColumnReverse):
        (WebCore::initialAlignContentOffset):
        (WebCore::alignContentSpaceBetweenChildren):
        (WebCore::RenderFlexibleBox::alignFlexLines):
        * rendering/RenderFlexibleBox.h:
        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyleConstants.h:
        * rendering/style/StyleFlexibleBoxData.cpp:
        (WebCore::StyleFlexibleBoxData::StyleFlexibleBoxData):
        (WebCore::StyleFlexibleBoxData::operator==):
        * rendering/style/StyleFlexibleBoxData.h:
        (StyleFlexibleBoxData):
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:
        (StyleRareNonInheritedData):

2012-06-01  Adam Barth  <abarth@webkit.org>

        Overflow scrolling doesn't need to create a stacking context is the overflow is hidden
        https://bugs.webkit.org/show_bug.cgi?id=88057

        Reviewed by James Robinson.

        This patch causes us to match the iOS implementation of this feature.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-06-01  James Robinson  <jamesr@chromium.org>

        [chromium] Unreviewed compile fix for r119283

        For the record, Dana Jensens <danakj@chromium.org> wrote this slightly faster than I did.

        * platform/graphics/chromium/LayerChromium.h:
        (WebCore::LayerChromium::bounds):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore::CCLayerImpl::bounds):

2012-06-01  Ian Vollick  <vollick@chromium.org>

        [chromium] Accelerated animations should use WebTransformOperations
        https://bugs.webkit.org/show_bug.cgi?id=87686

        Reviewed by James Robinson.

        CCTransformKeyframe new owns a WebTransformOperations rather than a
        TransformOperations. LayerChromium's API has been changed so that
        LayerChromium::addAnimation should take only a CCActiveAnimation.
        GraphicsLayerChromium is new responsible for translating to
        WebTransformOperations and creating CCActiveAnimations. Tests that use
        the public API (that is, they call addAnimation with KeyframeValueList
        and Animation arguments) have been moved to GraphicsLayerChromiumTest.

        Unit tests:
            GraphicsLayerChromiumTest.createOpacityAnimation
            GraphicsLayerChromiumTest.createTransformAnimation
            GraphicsLayerChromiumTest.createTransformAnimationWithBigRotation
            GraphicsLayerChromiumTest.createTransformAnimationWithSingularMatrix
            GraphicsLayerChromiumTest.createReversedAnimation
            GraphicsLayerChromiumTest.createAlternatingAnimation
            GraphicsLayerChromiumTest.createReversedAlternatingAnimation

        * WebCore.gypi:
        * platform/graphics/chromium/AnimationTranslationUtil.cpp: Added.
        (WebCore):
        (WebCore::toWebTransformOperations):
        (WebCore::appendKeyframe):
        (WebCore::CCKeyframedTransformAnimationCurve):
        (WebCore::createActiveAnimation):
        * platform/graphics/chromium/AnimationTranslationUtil.h: Added.
        (WebCore):
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::addAnimation):
        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::addAnimation):
        * platform/graphics/chromium/LayerChromium.h:
        (WebCore):
        (LayerChromium):
        * platform/graphics/chromium/LinkHighlight.cpp:
        (WebCore::LinkHighlight::LinkHighlight):
        * platform/graphics/chromium/cc/CCAnimationCurve.h:
        (CCTransformAnimationCurve):
        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp:
        (WebCore::CCTransformKeyframe::create):
        (WebCore::CCTransformKeyframe::CCTransformKeyframe):
        (WebCore::CCTransformKeyframe::value):
        (WebCore::CCTransformKeyframe::clone):
        (WebCore::CCKeyframedTransformAnimationCurve::getValue):
        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h:
        (CCTransformKeyframe):
        (CCKeyframedTransformAnimationCurve):
        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
        (WebCore::CCLayerAnimationController::removeAnimation):
        (WebCore):
        (WebCore::CCLayerAnimationController::addAnimation):
        (WebCore::CCLayerAnimationController::getActiveAnimation):
        (WebCore::CCLayerAnimationController::pushNewAnimationsToImplThread):
        (WebCore::CCLayerAnimationController::replaceImplThreadAnimations):
        (WebCore::CCLayerAnimationController::tickAnimations):
        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
        (CCLayerAnimationControllerClient):
        (CCLayerAnimationController):

2012-06-01  Mihai Parparita  <mihaip@chromium.org>

        Improve synchronous XHR disabling
        https://bugs.webkit.org/show_bug.cgi?id=88032

        Reviewed by Alexey Proskuryakov.

        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::setSyncXHRInDocumentsEnabled): Fix a
        copy-and-paste error
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::open): Improves the disabled message, as
        suggested in a comment after r118599 was put in the commit queue.

2012-06-01  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=87774
        REGRESSION (r105515): reflection masks are truncated at zoom levels < 1
        -and corresponding-
        <rdar://problem/11387506>

        Reviewed by Simon Fraser.

        paintNinePieceImage() expects un-zoomed results from 
        calculateImageIntrinsicDimensions(). This was previously addressed by having 
        paintNinePieceImage() divide the effective zoom out of the result from 
        calculateImageIntrinsicDimensions(). However, that results in buggy behavior for 
        generated images and images with percentage sizes. In the end it seems best to 
        just send a parameter to calculateImageIntrinsicDimensions() indicating whether 
        the caller wants the result to be scaled by the effective zoom when appropriate.

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::calculateImageIntrinsicDimensions):
        (WebCore::RenderBoxModelObject::calculateFillTileSize):
        (WebCore::RenderBoxModelObject::paintNinePieceImage):
        * rendering/RenderBoxModelObject.h:
        (RenderBoxModelObject):

2012-06-01  Julien Chaffraix  <jchaffraix@webkit.org>

        Prepare table collapsed border computation to support mixed directionality on row group
        https://bugs.webkit.org/show_bug.cgi?id=88110

        Reviewed by Ojan Vafai.

        No expected change in behavior.

        One big issue with supporting mixed directionality inside a table is that the start / end
        borders don't align between table parts anymore: the start border of a ltr table will have
        to match the end border of a rtl row group for the purpose of collapsed border computation.

        This change adds the concept of adjoining borders in the table direction so that we can safely
        hide which exact borders we pick up for the collapsed border computation.

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::calcBorderStart):
        (WebCore::RenderTable::calcBorderEnd):
        Refactored those functions to use proper naming along with the new APIs. The name 'adjoining' is
        used extensively as we cannot make any assumptions on which borders we will get.

        (WebCore::RenderTable::recalcBordersInRowDirection):
        Added a FIXME found during testing.

        * rendering/RenderTableCell.h:
        (WebCore::RenderTableCell::borderAdjoiningTableStart):
        (WebCore::RenderTableCell::borderAdjoiningTableEnd):
        * rendering/RenderTableRow.h:
        (WebCore::RenderTableRow::borderAdjoiningTableStart):
        (WebCore::RenderTableRow::borderAdjoiningTableEnd):
        * rendering/RenderTableSection.h:
        (WebCore::RenderTableSection::borderAdjoiningTableStart):
        (WebCore::RenderTableSection::borderAdjoiningTableEnd):
        Those functions are the same at the moment to match the existing code. They
        will be changed to use the proper directionality in a follow up patch.

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::firstRowCellAdjoiningTableStart):
        (WebCore::RenderTableSection::firstRowCellAdjoiningTableEnd):
        Those functions return the cells that is adjoining a table edge. Due to us flipping
        the cells at layout to match the section's direction, those functions will need to
        account for mixed direction in determining the right cell to consider.

2012-06-01  Shezan Baig  <shezbaig.wk@gmail.com>

        Indenting a paragraph that begins with a link 3 times breaks the paragraph into two paragraphs
        https://bugs.webkit.org/show_bug.cgi?id=87428

        Reviewed by Ryosuke Niwa.

        Fix the way lastNode (our insertion point) is updated whenever
        traverseNextSibling moves up to a new parent, so that the relative
        depth between the next sibling and the original start node is
        maintained in the clone. The divergence in depth broke the paragraph
        into two paragraphs because the next sibling was inserted outside the
        blockquote that was created for the indentation.

        Note that the topNode is not required anymore because it is no longer
        used anywhere.

        Tests: editing/execCommand/indent-nested-inlines-1.html
               editing/execCommand/indent-nested-inlines-2.html

        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):

2012-06-01  Joe Thomas  <joethomas@motorola.com>

        getComputedStyle for background shorthand property does not return background-origin and background-clip.
        https://bugs.webkit.org/show_bug.cgi?id=86155

        Reviewed by Tony Chang.

        Added background-origin and background-clip CSS Property values to the background shorthand CSSValueList.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getBackgroundShorthandValue):

2012-06-01  Mark Pilgrim  <pilgrim@chromium.org>

        [Chromium] Call clipboard methods directly
        https://bugs.webkit.org/show_bug.cgi?id=88038

        Reviewed by Adam Barth.

        Part of a refactoring series. See tracking bug 82948.

        * WebCore.gypi:
        * platform/Pasteboard.h:
        (Pasteboard):
        * platform/chromium/ChromiumDataObject.cpp:
        (WebCore::ChromiumDataObject::createFromPasteboard):
        * platform/chromium/ChromiumDataObjectItem.cpp:
        (WebCore::ChromiumDataObjectItem::getAsFile):
        (WebCore::ChromiumDataObjectItem::internalGetAsString):
        * platform/chromium/ClipboardUtilitiesChromium.cpp:
        (WebCore::currentPasteboardBuffer):
        * platform/chromium/ClipboardUtilitiesChromium.h:
        (WebCore):
        * platform/chromium/PasteboardChromium.cpp:
        (WebCore::Pasteboard::writeSelection):
        (WebCore::Pasteboard::writePlainText):
        (WebCore::Pasteboard::writeURL):
        (WebCore::Pasteboard::writeImage):
        (WebCore::Pasteboard::writeClipboard):
        (WebCore::Pasteboard::canSmartReplace):
        (WebCore::Pasteboard::plainText):
        (WebCore::Pasteboard::documentFragment):
        * platform/chromium/PasteboardPrivate.h: Removed.
        * platform/chromium/PlatformSupport.h:
        (WebCore):
        (PlatformSupport):

2012-06-01  Hugo Parente Lima  <hugo.lima@openbossa.org>

        Improve handling of legacy viewport meta tags
        https://bugs.webkit.org/show_bug.cgi?id=55874

        Reviewed by Adam Barth.

        We now support MobileOptimized and HandheldFriendly as well.

        We set width equal to device-width for HandheldFriendly and
        for MobileOptimized, the content value of MobileOptimized is
        ignored and the initial-scale set to 1 to fit Android behavior.

        The prioritizing is done the same way as on Windows Phone 7:

        XHTML Mobile Profile found
        HandheldFriendly
        MobileOptimized (overrides HandheldFriendly)
        Viewport (overrides all above)

        Original patch by Kenneth Rohde Christiansen.

        Tests: fast/viewport/viewport-legacy-handheldfriendly.html
               fast/viewport/viewport-legacy-mobileoptimized-2.html
               fast/viewport/viewport-legacy-mobileoptimized-3.html
               fast/viewport/viewport-legacy-mobileoptimized.html
               fast/viewport/viewport-legacy-ordering-1.html
               fast/viewport/viewport-legacy-ordering-2.html
               fast/viewport/viewport-legacy-ordering-3.html
               fast/viewport/viewport-legacy-ordering-4.html
               fast/viewport/viewport-legacy-ordering-5.html
               fast/viewport/viewport-legacy-ordering-6.html
               fast/viewport/viewport-legacy-ordering-7.html
               fast/viewport/viewport-legacy-ordering-8.html
               fast/viewport/viewport-legacy-ordering-9.html

        * dom/Document.cpp:
        (WebCore::Document::setDocType):
        (WebCore::Document::processViewport): Add an origin parameter to
        tell what is changing the viewport.
        * dom/Document.h:
        (Document):
        * dom/ViewportArguments.h:
        * html/HTMLMetaElement.cpp:
        (WebCore::HTMLMetaElement::process):

2012-06-01  Tony Chang  <tony@chromium.org>

        rename -webkit-flex-order to -webkit-order
        https://bugs.webkit.org/show_bug.cgi?id=88104

        Reviewed by Ojan Vafai.

        This recently changed in the spec:
        http://dev.w3.org/csswg/css3-flexbox/#order-property

        No new tests, just updated existing results.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore):
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::OrderIterator::OrderIterator):
        (WebCore::RenderFlexibleBox::OrderIterator::next):
        (WebCore::RenderFlexibleBox::layoutBlock):
        (WebCore::RenderFlexibleBox::repositionLogicalHeightDependentFlexItems):
        (WebCore::RenderFlexibleBox::layoutFlexItems):
        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes):
        (WebCore::RenderFlexibleBox::computeNextFlexLine):
        (WebCore::RenderFlexibleBox::packFlexLines):
        (WebCore::RenderFlexibleBox::alignChildren):
        (WebCore::RenderFlexibleBox::flipForRightToLeftColumn):
        (WebCore::RenderFlexibleBox::flipForWrapReverse):
        * rendering/RenderFlexibleBox.h:
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleFlexibleBoxData.cpp:
        (WebCore::StyleFlexibleBoxData::StyleFlexibleBoxData):
        (WebCore::StyleFlexibleBoxData::operator==):
        * rendering/style/StyleFlexibleBoxData.h:
        (StyleFlexibleBoxData):
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:
        (StyleRareNonInheritedData):

2012-06-01  Zeno Albisser  <zeno@webkit.org>

        Unreviewed build fix after r119247.

        Do not include TextureMapperGL.h when not building
        with GRAPHICS_SURFACE.

        * platform/graphics/texmap/TextureMapperBackingStore.cpp:

2012-06-01  Mario Sanchez Prada  <msanchez@igalia.com>

        [GTK] Add a new and reusable Geoclue-based geolocation provider in WebCore
        https://bugs.webkit.org/show_bug.cgi?id=87800

        Reviewed by Carlos Garcia Campos.

        Added new and reusable Geoclue-based geolocation provider to WebCore.

        * GNUmakefile.am:
        * GNUmakefile.list.am:
        * platform/geoclue/GeolocationProviderGeoclue.cpp: Added.
        (getPositionCallback):
        (positionChangedCallback):
        (GeolocationProviderGeoclue::GeolocationProviderGeoclue):
        (GeolocationProviderGeoclue::~GeolocationProviderGeoclue):
        (GeolocationProviderGeoclue::startUpdating):
        (GeolocationProviderGeoclue::stopUpdating):
        (GeolocationProviderGeoclue::setEnableHighAccuracy):
        (GeolocationProviderGeoclue::setGeoclueClient):
        (GeolocationProviderGeoclue::setGeocluePosition):
        (GeolocationProviderGeoclue::updateClientRequirements):
        (GeolocationProviderGeoclue::positionChanged):
        (GeolocationProviderGeoclue::errorOccured):
        * platform/geoclue/GeolocationProviderGeoclue.h: Added.
        (WebCore):
        (GeolocationProviderGeoclue):
        * platform/geoclue/GeolocationProviderGeoclueClient.h: Added.
        (WebCore):
        (GeolocationProviderGeoclueClient):

2012-06-01  Thiago Marcos P. Santos  <thiago.santos@intel.com>

        [Qt] Remove deprecated Q_GLOBAL_STATIC_WITH_INITIALIZER
        https://bugs.webkit.org/show_bug.cgi?id=88100

        Reviewed by Tor Arne Vestbø.

        It will be deprecated on Qt5.

        * platform/text/qt/TextBreakIteratorInternalICUQt.cpp:
        (WebCore):

2012-06-01  Zeno Albisser  <zeno@webkit.org>

        Make TextureMapper work with GraphicsSurface.
        https://bugs.webkit.org/show_bug.cgi?id=87738

        Add TextureMapperSurfaceBackingStore, a new backing store
        that allows to import textures from a GraphicsSurface.
        On Mac the GraphicsSurface is backed by an IOSurface
        which must be used with a GL_TEXTURE_RECTANGLE_ARB texture.
        Therefore it is also necessary to add new shader programs
        for directly painting these textures on screen.

        Reviewed by Noam Rosenthal.

        * platform/graphics/texmap/TextureMapperBackingStore.cpp:
        Add a new TextureMapperBackingStore implementation that can directly
        reuse textures as they are being passed from the GraphicsSurface.
        (WebCore::TextureMapperSurfaceBackingStore::setGraphicsSurface):
        (WebCore::TextureMapperSurfaceBackingStore::texture):
        (WebCore::TextureMapperSurfaceBackingStore::paintToTextureMapper):
        * platform/graphics/texmap/TextureMapperBackingStore.h:
        (GraphicsSurfaceData):
        (WebCore::GraphicsSurfaceData::setSurface):
        (WebCore::GraphicsSurfaceData::GraphicsSurfaceData):
        (TextureMapperSurfaceBackingStore):
        (WebCore::TextureMapperSurfaceBackingStore::create):
        (WebCore::TextureMapperSurfaceBackingStore::~TextureMapperSurfaceBackingStore):
        (WebCore::TextureMapperSurfaceBackingStore::TextureMapperSurfaceBackingStore):

        * platform/graphics/texmap/TextureMapperGL.cpp:
        Add a drawing function for textures of type GL_TEXTURE_RECTANGLE_ARB.
        (WebCore::TextureMapperGL::drawTextureRectangleARB):
        * platform/graphics/texmap/TextureMapperShaderManager.cpp:
        (WebCore::TextureMapperShaderManager::getShaderProgram):
        (WebCore::TextureMapperShaderProgramSimple::create):
        (WebCore::TextureMapperShaderProgramSimple::initialize):
        (WebCore::TextureMapperShaderProgramSolidColor::create):
        (WebCore::TextureMapperShaderProgramSolidColor::initialize):
        (WebCore::TextureMapperShaderProgramRectSimple::create):
        (WebCore::TextureMapperShaderProgramRectSimple::fragmentShaderSource):
        (WebCore::TextureMapperShaderProgramOpacityAndMask::create):
        (WebCore::TextureMapperShaderProgramOpacityAndMask::initialize):
        (WebCore::TextureMapperShaderProgramRectOpacityAndMask::create):
        (WebCore::TextureMapperShaderProgramRectOpacityAndMask::fragmentShaderSource):

        * platform/graphics/texmap/TextureMapperShaderManager.h:
        Add new shader programs that can be used with GL_TEXTURE_RECTANGLE_ARB textures.
        This is mainly necessary, because this type of texture uses non-normalized coordinates.
        Further move the calls to initializeProgram() from the constructor into a separate
        initialize() function, as initializeProgram() calls vertexShaderSource() (and friends)
        and we should not call virtual functions in the constructor.
        (WebCore::TextureMapperShaderProgram::initialize):
        (TextureMapperShaderProgramSimple):
        (WebCore::TextureMapperShaderProgramSimple::TextureMapperShaderProgramSimple):
        (TextureMapperShaderProgramRectSimple):
        (WebCore::TextureMapperShaderProgramRectSimple::TextureMapperShaderProgramRectSimple):
        (TextureMapperShaderProgramOpacityAndMask):
        (WebCore::TextureMapperShaderProgramOpacityAndMask::TextureMapperShaderProgramOpacityAndMask):
        (TextureMapperShaderProgramRectOpacityAndMask):
        (WebCore::TextureMapperShaderProgramRectOpacityAndMask::TextureMapperShaderProgramRectOpacityAndMask):
        (TextureMapperShaderProgramSolidColor):
        (WebCore::TextureMapperShaderProgramSolidColor::TextureMapperShaderProgramSolidColor):

2012-06-01  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] EFL port does not enable WEB_INTENTS_TAG flag
        https://bugs.webkit.org/show_bug.cgi?id=86866

        Reviewed by Adam Barth.

        Fix compilation error when WEB_INTENTS_TAG flag is enabled.
        HTMLElement::insertedInto() takes a ContainerNode* in argument, not a
        Node*.

        Test: webintents/intent-tag.html

        * CMakeLists.txt:
        * html/HTMLIntentElement.cpp:
        (WebCore::HTMLIntentElement::insertedInto):
        * html/HTMLIntentElement.h:
        (HTMLIntentElement):

2012-06-01  Dominik Röttsches  <dominik.rottsches@intel.com>

        [cairo] Pixel artifacts can be seen on reflections
        https://bugs.webkit.org/show_bug.cgi?id=85483

        Antialiased clipping in the simple rectangular clip method
        leads to edge artifacts when transformations are applied to the layer.
        Explicitly disabling antialiased clipping for this function solves this issue.
        Comparing Cairo GraphicsContext to Qt and Skia GC, it seems that these
        backends do not expect the platform context to clip antialiased in this
        case either.

        Reviewed by Martin Robinson.

        No new tests, covered by fast/css/transformed-mask.html.

        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::clip):

2012-06-01  Florin Malita  <fmalita@chromium.org>

        http://shinydemos.com/clock/ doesn't seem to work
        https://bugs.webkit.org/show_bug.cgi?id=79682

        Reviewed by Nikolas Zimmermann.

        Test: svg/repaint/text-mask-update.svg

        Currently, parent resources are not invalidated when SVGInlineText nodes
        are added or removed. Adjusting SVGResourcesCache::clientWasAddedToTree()
        and SVGResourcesCache::clientWillBeRemovedFromTree() to cover this case.

        * rendering/svg/SVGResourcesCache.cpp:
        (WebCore::SVGResourcesCache::clientWasAddedToTree):
        (WebCore::SVGResourcesCache::clientWillBeRemovedFromTree):

2012-06-01  John Mellor  <johnme@chromium.org>

        Don't set scroll position twice in HistoryController::restoreScrollPositionAndViewState
        https://bugs.webkit.org/show_bug.cgi?id=88068

        Reviewed by Adam Barth.

        In the case where pageScaleFactor changes, we were calling
        setScrollPosition with an incorrect scroll position (i.e. a scroll
        position scaled by the pageScaleFactor we hadn't yet applied), then
        fixing it by setting the pageScaleFactor and scroll position together,
        overwriting the old scroll position. It's cleaner to just set the
        pageScaleFactor and scroll position together.

        No new tests as this isn't expected to change the ultimate behavior, just clean up how it happens.

        * loader/HistoryController.cpp:
        (WebCore::HistoryController::restoreScrollPositionAndViewState):

2012-06-01  Thiago Marcos P. Santos  <thiago.santos@intel.com>

        [Qt] Remove deprecated to/fromAscii()
        https://bugs.webkit.org/show_bug.cgi?id=88086

        Reviewed by Simon Hausmann.

        Replacing to/fromAscii with to/fromLatin1 since it
        is deprecated on Qt5.

        * bridge/qt/qt_class.cpp:
        (JSC::Bindings::QtClass::fallbackObject):
        * platform/network/qt/ResourceRequestQt.cpp:
        (WebCore::ResourceRequest::toNetworkRequest):

2012-06-01  Dan Bernstein  <mitz@apple.com>

        Layout not updated after setting -webkit-line-clamp to none
        https://bugs.webkit.org/show_bug.cgi?id=88049

        Reviewed by Abhishek Arya.

        Test: fast/flexbox/line-clamp-removed-dynamically.html

        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::styleWillChange): Added. Calls clearLineClamp if
        line-clamp will change to none.
        (WebCore::RenderDeprecatedFlexibleBox::clearLineClamp): Added. Marks possibly-clamped
        children for layout and clears truncation from blocks.
        * rendering/RenderDeprecatedFlexibleBox.h:

2012-06-01  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119213.
        http://trac.webkit.org/changeset/119213
        https://bugs.webkit.org/show_bug.cgi?id=88084

        This patch broke two tests on all platform except Chromium.
        The authors are unavailable. (Requested by zherczeg on
        #webkit).

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-06-01  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119219.
        http://trac.webkit.org/changeset/119219
        https://bugs.webkit.org/show_bug.cgi?id=88088

        This patch broke two tests on GTK/Qt. The authors are
        unavailable. (Requested by kkristof on #webkit).

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::closeAndRemoveChild):
        (WebCore::FrameLoader::detachFromParent):
        * page/Frame.cpp:
        (WebCore::Frame::willDetachPage):
        * page/Frame.h:
        (Frame):
        (WebCore::Frame::detachFromPage):
        (WebCore):
        * page/Page.cpp:
        (WebCore::Page::~Page):

2012-06-01  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Add Closure compiler annotations to WorkerConsole
        https://bugs.webkit.org/show_bug.cgi?id=88073

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshotWorker.js:
        (WebInspector.WorkerConsole.prototype.log):
        (WebInspector.WorkerConsole.prototype.error):
        (WebInspector.WorkerConsole.prototype.info):

2012-06-01  MORITA Hajime  <morrita@google.com>

        Frame::willDetachPage() shouldn't be called more than once.
        https://bugs.webkit.org/show_bug.cgi?id=88056

        Reviewed by Ryosuke Niwa.

        This change moved willDetachPage() to private and calls it from
        detachFromParent().  Also, it checks m_page and call
        willDetachPage() only once, if m_page is available.

        No new tests. Covered by existing suites.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::closeAndRemoveChild):
        (WebCore::FrameLoader::detachFromParent):
        * page/Frame.cpp:
        (WebCore::Frame::detachFromPage):
        (WebCore):
        (WebCore::Frame::willDetachPage):
        * page/Frame.h:
        (Frame):
        * page/Page.cpp:
        (WebCore::Page::~Page):

2012-06-01  Pierre Rossi  <pierre.rossi@gmail.com>

        [Qt] Support drawing a pattern with a translation.
        https://bugs.webkit.org/show_bug.cgi?id=87025

        Drawing an SVG pattern that has its x or y attribute set
        works by setting a transform on the Pattern.
        We would ignore this by only taking into account the texture and
        target rect.

        Reviewed by Kenneth Rohde Christiansen.

        test: svg/W3C-SVG-1.1-SE/pservers-pattern-04-f.svg

        * platform/graphics/qt/GraphicsContextQt.cpp:
        (WebCore::drawRepeatPattern): refactored to take into account the translation set on the brush.
        (WebCore::GraphicsContext::fillRect):

2012-06-01  Yoshifumi Inoue  <yosin@chromium.org>

        REGRESSION(r109729) [Form] Rendering of select/optgroup/option combination is too slow.
        https://bugs.webkit.org/show_bug.cgi?id=88059

        Reviewed by Kent Tamura.

        This patch changes to share RenderStyle object among the "option" 
        elements to improve rendering performance and reducing memory usage
        of RenderStyle.

        No new tests. This patch doesn't change behavior but rendering performance.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::canShareStyleWithElement): Check attribute value
        mismatching for "option" element.

2012-06-01  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: [REGRESSION] Bad layout of "Override device metrics" controls in the Settings dialog
        https://bugs.webkit.org/show_bug.cgi?id=88074

        Reviewed by Yury Semikhatsky.

        The "Override device metrics" controls are placed in a table, which gets too narrow. Give it a
        "white-space: nowrap" to avoid wrapping individual cells.

        * inspector/front-end/SettingsScreen.js:
        (WebInspector.SettingsScreen.prototype._createDeviceMetricsElement):
        * inspector/front-end/elementsPanel.css:
        * inspector/front-end/inspector.css:
        (.nowrap):

2012-06-01  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>

        [EFL] Implement PlatformStrategies
        https://bugs.webkit.org/show_bug.cgi?id=86946

        Reviewed by Carlos Garcia Campos.

        * PlatformEfl.cmake: Add PlatformStrategies.cpp file to the build system.
        Also, remove PluginDataEfl.cpp because the same functionality is now
        implemented in PlatformStrategiesEfl.cpp.

2012-06-01  Adam Barth  <abarth@webkit.org>

        ASSERT(m_fontSelector->document()) is bogus and should be removed
        https://bugs.webkit.org/show_bug.cgi?id=88053

        Reviewed by Abhishek Arya.

        This ASSERT was introduced in http://trac.webkit.org/changeset/97402
        together with a branch that handled the case of the ASSERT firing.
        This ASSERT fires when running tests on Android (which runs with
        ASSERTs enabled). The ASSERT appears to be bogus, so this patch removes
        it.

        * css/CSSSegmentedFontFace.cpp:
        (WebCore::CSSSegmentedFontFace::getFontData):

2012-06-01  Yoshifumi Inoue  <yosin@chromium.org>

        [Platform][Decimal] UInt128::operator/= calls makeUInt128 with wrong argument order
        https://bugs.webkit.org/show_bug.cgi?id=88044

        Reviewed by Kent Tamura.

        This patch fixed wrong argument of makeUInt128 in UInt128::operator/= to get right
        result for decimal multiplication.

        Test: WebKit/chromium/tests/DecimalTest.cpp: Add new a new test case.

        * platform/Decimal.cpp:
        (WebCore::DecimalPrivate::UInt128::operator/=):

2012-06-01  Adam Barth  <abarth@webkit.org>

        sandbox directive in X-WebKit-CSP header unable to create a unique origin
        https://bugs.webkit.org/show_bug.cgi?id=88014

        Reviewed by Ryosuke Niwa.

        We process the HTTP headers for a response after we create a document
        object for the response. Previously, the SecurityOrigin of a document
        was determined when the document was created, which meant that the
        sandbox directive in CSP couldn't create a unique origin.

        In this patch, we transition to a unique origin when we start enforcing
        the SandboxOrigin bit. This patch is more complicated than you might
        expect because we redundantly store the SecurityOrigin object in
        DOMWindow. Removing that redundant state is
        https://bugs.webkit.org/show_bug.cgi?id=75793.

        The CSP sandbox directive is defined in
        http://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-1.0-specification.html
        by reference to
        http://www.whatwg.org/specs/web-apps/current-work/#forced-sandboxing-flag-set.
        The relation between sandbox and unique origin arises from
        http://www.whatwg.org/specs/web-apps/current-work/#origin-0.

        Test: http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-control.html
              http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header.html
              http/tests/security/contentSecurityPolicy/sandbox-in-http-header-control.html
              http/tests/security/contentSecurityPolicy/sandbox-in-http-header.html

        * dom/Document.cpp:
        (WebCore::Document::didUpdateSecurityOrigin):
        (WebCore::Document::initContentSecurityPolicy):
        * dom/Document.h:
        (Document):
        * dom/SecurityContext.cpp:
        (WebCore::SecurityContext::enforceSandboxFlags):
        (WebCore):
        (WebCore::SecurityContext::didUpdateSecurityOrigin):
        * dom/SecurityContext.h:
        (SecurityContext):

2012-05-31  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: expose MemoryCache statistics in the inspector protocol
        https://bugs.webkit.org/show_bug.cgi?id=87984

        Reviewed by Pavel Feldman.

        Added MemoryCache statistics to Memory.getProcessMemoryDistribution command
        result. Corresponding sector is added to the memory pie-chart.

        * inspector/InspectorMemoryAgent.cpp:
        (MemoryBlockName):
        (WebCore):
        (WebCore::addMemoryBlockFor):
        (WebCore::memoryCacheInfo):
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.MemoryBlockViewProperties._initialize):

2012-05-31  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add RenderArena sizes to the memory pie-chart
        https://bugs.webkit.org/show_bug.cgi?id=87971

        Reviewed by Pavel Feldman.

        Added allocated and used sizes of page render arenas to the memory
        report returned by the InspectorMemoryAgent. Total allocated size of
        the inspected page's render arenas will be displayed on the memory
        pie-chart.

        * inspector/InspectorMemoryAgent.cpp:
        (MemoryBlockName):
        (WebCore):
        (WebCore::renderTreeInfo):
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.MemoryBlockViewProperties._initialize):

2012-05-30  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: change type of injected script id from long to int
        https://bugs.webkit.org/show_bug.cgi?id=87837

        Reviewed by Pavel Feldman.

        Changed injected script id type from long to int so that we don't
        lose precision when sending the id over the protocol.

        * bindings/js/JSInjectedScriptManager.cpp:
        (WebCore::InjectedScriptManager::createInjectedScript):
        (WebCore::InjectedScriptManager::injectedScriptFor):
        * bindings/v8/custom/V8InjectedScriptManager.cpp:
        (WebCore::InjectedScriptManager::createInjectedScript):
        (WebCore::InjectedScriptManager::injectedScriptFor):
        * inspector/InjectedScriptManager.cpp:
        (WebCore::InjectedScriptManager::injectedScriptForId):
        (WebCore::InjectedScriptManager::injectedScriptIdFor):
        (WebCore::InjectedScriptManager::injectScript):
        * inspector/InjectedScriptManager.h:
        (InjectedScriptManager):
        * inspector/PageRuntimeAgent.cpp:
        (WebCore::PageRuntimeAgent::notifyContextCreated):

2012-05-29  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: draw pie-chart based on memory data received from backend
        https://bugs.webkit.org/show_bug.cgi?id=87737

        Reviewed by Pavel Feldman.

        Added pie chart for memory data received from inspector memory agent.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.NativeMemorySnapshotView):
        (WebInspector.NativeMemoryProfileType):
        (WebInspector.NativeMemoryProfileType.prototype.buttonClicked.didReceiveMemorySnapshot):
        (WebInspector.NativeMemoryProfileType.prototype.buttonClicked):
        (WebInspector.NativeMemoryProfileHeader):
        (WebInspector.MemoryBlockViewProperties):
        (WebInspector.MemoryBlockViewProperties._initialize):
        (WebInspector.MemoryBlockViewProperties._forMemoryBlock):
        (WebInspector.NativeMemoryPieChart):
        (WebInspector.NativeMemoryPieChart.prototype.onResize):
        (WebInspector.NativeMemoryPieChart.prototype._updateSize):
        (WebInspector.NativeMemoryPieChart.prototype._addBlockLabels):
        (WebInspector.NativeMemoryPieChart.prototype._paint.paintPercentAndLabel):
        (WebInspector.NativeMemoryPieChart.prototype._paint):
        (WebInspector.NativeMemoryPieChart.prototype._clear):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/nativeMemoryProfiler.css: Added.
        (.memory-pie-chart-container):
        (.memory-pie-chart):
        (.memory-blocks-list .swatch):
        (.memory-blocks-list):
        (.memory-blocks-list .item):

2012-05-31  Dominic Cooney  <dominicc@chromium.org>

        [V8] Expando properties on attribute nodes disappear
        https://bugs.webkit.org/show_bug.cgi?id=87925

        Reviewed by Adam Barth.

        Test: fast/dom/gc-attribute-node.html

        * bindings/v8/V8GCController.cpp:
        (WebCore::calculateGroupId): Group attributes like other nodes.

2012-05-31  Alexander Shalamov  <alexander.shalamov@intel.com>

        [EFL] <input type="number"> is not a spinbutton
        https://bugs.webkit.org/show_bug.cgi?id=86846

        Reviewed by Kenneth Rohde Christiansen.

        Implemented adjustInnerSpinButtonStyle and
        paintInnerSpinButton in RenderThemeEfl.

        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::applyEdjeStateFromForm):
        (WebCore::RenderThemeEfl::edjeGroupFromFormType):
        (WebCore::RenderThemeEfl::adjustInnerSpinButtonStyle):
        (WebCore):
        (WebCore::RenderThemeEfl::paintInnerSpinButton):
        * platform/efl/RenderThemeEfl.h:
        (RenderThemeEfl):

2012-05-31  Hajime Morrita  <morrita@chromium.org>

        REGRESSION(r117572): editing/spelling/spellcheck-async-remove-frame.html crashes on Mac
        https://bugs.webkit.org/show_bug.cgi?id=86859

        Reviewed by Ryosuke Niwa.

        The test tries to reach an invalid SpellChecker object. Such an access should be guarded
        beforehand.

        Asynchronous spellchecking can return results after originated
        frame is gone, which triggered an invalid access to the dead spellchecker
        object. This chagne prevents it by marking request objects from
        the spellchecker as invalid:

        - Originally TextCheckerClient API was passed a SpellCheker object.
          This change abstracted it behind TextCheckingRequest interface,
          didSucceed() and didCancel() method specifically.
        - TextCheckingRequest was turned from a plain old object into
          a refcounted abstract class, which is now subclassed by SpellCheckRequest.
        - SpellChecker now marks pending SpellCheckRequest objects as invalid
          on its destructor.

        Test: editing/spelling/spellcheck-async-remove-frame.html

        * WebCore.exp.in:
        * editing/SpellChecker.cpp:
        (WebCore::SpellCheckRequest::SpellCheckRequest):
        (WebCore::SpellCheckRequest::create):
        (WebCore::SpellCheckRequest::didSucceed):
        (WebCore):
        (WebCore::SpellCheckRequest::didCancel):
        (WebCore::SpellCheckRequest::wasRequestedBy):
        (WebCore::SpellCheckRequest::requesterDestroyed):
        (WebCore::SpellChecker::~SpellChecker):
        (WebCore::SpellChecker::requestCheckingFor):
        (WebCore::SpellChecker::invokeRequest):
        (WebCore::SpellChecker::didCheckSucceed):
        (WebCore::SpellChecker::didCheckCancel):
        * editing/SpellChecker.h:
        (WebCore):
        (SpellCheckRequest):
        (WebCore::SpellCheckRequest::isStarted):
        (SpellChecker):
        * loader/EmptyClients.h:
        (WebCore::EmptyTextCheckerClient::requestCheckingOfString):
        * platform/text/TextCheckerClient.h:
        (TextCheckerClient):
        * platform/text/TextChecking.h:
        (GrammarDetail):
        (TextCheckingResult):
        (TextCheckingRequest):
        (WebCore::TextCheckingRequest::~TextCheckingRequest):

2012-05-31  Tony Chang  <tony@chromium.org>

        initial flex value should be 1 1 auto
        https://bugs.webkit.org/show_bug.cgi?id=86526

        Reviewed by Ojan Vafai.

        Also, if -webkit-flex is used to set the positive flex to 0 and
        the negative flex is omitted, the negative flex is set to 0.

        New test cases in: flex-property-parsing.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseFlex):
        * css/StyleBuilder.cpp:
        (WebCore::ApplyPropertyFlex::applyValue):
        * rendering/style/RenderStyle.h:

2012-05-31  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119146.
        http://trac.webkit.org/changeset/119146
        https://bugs.webkit.org/show_bug.cgi?id=88035

        android breakage fixed in http://crrev.com/139945 (Requested
        by fischman on #webkit).

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):
        (WebCore::HTMLMediaElement::startProgressEventTimer):
        (WebCore::HTMLMediaElement::changeNetworkStateFromLoadingToIdle):
        (WebCore::HTMLMediaElement::progressEventTimerFired):
        (WebCore::HTMLMediaElement::startPlaybackProgressTimer):
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::NullMediaPlayerPrivate::didLoadingProgress):
        (WebCore::MediaPlayer::didLoadingProgress):
        * platform/graphics/MediaPlayer.h:
        * platform/graphics/MediaPlayerPrivate.h:
        (MediaPlayerPrivateInterface):
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation):
        (WebCore::MediaPlayerPrivateAVFoundation::didLoadingProgress):
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
        (MediaPlayerPrivateAVFoundation):
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
        (WebCore::MediaPlayerPrivate::didLoadingProgress):
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
        (MediaPlayerPrivate):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
        (WebCore::MediaPlayerPrivateGStreamer::didLoadingProgress):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
        (MediaPlayerPrivateGStreamer):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        (MediaPlayerPrivateQTKit):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::MediaPlayerPrivateQTKit):
        (WebCore::MediaPlayerPrivateQTKit::didLoadingProgress):
        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
        (WebCore::MediaPlayerPrivateQt::MediaPlayerPrivateQt):
        (WebCore::MediaPlayerPrivateQt::didLoadingProgress):
        * platform/graphics/qt/MediaPlayerPrivateQt.h:
        (MediaPlayerPrivateQt):
        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::MediaPlayerPrivateQuickTimeVisualContext):
        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::didLoadingProgress):
        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h:
        (MediaPlayerPrivateQuickTimeVisualContext):
        * platform/graphics/wince/MediaPlayerPrivateWinCE.h:
        (MediaPlayerPrivate):

2012-05-31  Tom Sepez  <tsepez@chromium.org>

        XSSAuditor bypass with leading /*///*/ comment
        https://bugs.webkit.org/show_bug.cgi?id=88002

        Reviewed by Adam Barth.

        Fixes issue in xssauditor's parsing of /*/.

        Test: http/tests/security/xssAuditor/script-tag-with-trailing-comment4.html

        * html/parser/XSSAuditor.cpp:
        (WebCore::XSSAuditor::decodedSnippetForJavaScript):

2012-05-31  Hans Muller  <hmuller@adobe.com>

        Bug: Negative SVG rect rx,ry corner radii values aren't handled correctly
        https://bugs.webkit.org/show_bug.cgi?id=87859

        Reviewed by Dirk Schulze.

        Added the rect element corner radius constraints specified in steps 2-4 of 
        http://www.w3.org/TR/SVG/shapes.html#RectElement to Path::addRoundedRect().  
        Support for steps 6 and 7 was already included.  Steps 2-4:

        2 - If neither rx nor ry are properly specified, then set both rx and ry to 0. (This will result in square corners.)
        3 - Otherwise, if a properly specified value is provided for rx, but not for ry then set both rx and ry to the value of rx.
        4 - Otherwise, if a properly specified value is provided for ry, but not for rx, then set both rx and ry to the value of ry.

        Tests: svg/custom/rect-negative-corner-radii-expected.svg
               svg/custom/rect-negative-corner-radii.svg

        * platform/graphics/Path.cpp:
        (WebCore::Path::addRoundedRect):

2012-05-31  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Migrate to WebTransformationMatrix
        https://bugs.webkit.org/show_bug.cgi?id=87788

        Reviewed by James Robinson.

        Covered by all existing layout tests and unit tests.

        This patch replaces all occurrences of WebCore::TransformationMatrix
        with WebKit::WebTransformationMatrix in the chromium compositor code.

        * platform/chromium/support/WebTransformationMatrix.cpp:
        (WebKit::WebTransformationMatrix::WebTransformationMatrix):
        (WebKit):
        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::setSublayerTransform):
        (WebCore::LayerChromium::setTransform):
        (WebCore::LayerChromium::setTransformFromAnimation):
        * platform/graphics/chromium/LayerChromium.h:
        (LayerChromium):
        (WebCore::LayerChromium::sublayerTransform):
        (WebCore::LayerChromium::drawTransform):
        (WebCore::LayerChromium::setDrawTransform):
        (WebCore::LayerChromium::screenSpaceTransform):
        (WebCore::LayerChromium::setScreenSpaceTransform):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawCheckerboardQuad):
        (WebCore::LayerRendererChromium::drawDebugBorderQuad):
        (WebCore::LayerRendererChromium::drawBackgroundFilters):
        (WebCore::LayerRendererChromium::drawRenderSurfaceQuad):
        (WebCore::LayerRendererChromium::drawSolidColorQuad):
        (WebCore::LayerRendererChromium::drawTileQuad):
        (WebCore::LayerRendererChromium::drawHeadsUpDisplay):
        (WebCore::LayerRendererChromium::toGLMatrix):
        (WebCore::LayerRendererChromium::drawTexturedQuad):
        (WebCore::LayerRendererChromium::copyTextureToFramebuffer):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (WebCore::LayerRendererChromium::projectionMatrix):
        (WebCore::LayerRendererChromium::windowMatrix):
        (LayerRendererChromium):
        * platform/graphics/chromium/LinkHighlight.cpp:
        (WebCore::LinkHighlight::LinkHighlight):
        * platform/graphics/chromium/RenderSurfaceChromium.h:
        (WebCore::RenderSurfaceChromium::drawTransform):
        (WebCore::RenderSurfaceChromium::setDrawTransform):
        (WebCore::RenderSurfaceChromium::originTransform):
        (WebCore::RenderSurfaceChromium::setOriginTransform):
        (WebCore::RenderSurfaceChromium::screenSpaceTransform):
        (WebCore::RenderSurfaceChromium::setScreenSpaceTransform):
        (WebCore::RenderSurfaceChromium::replicaDrawTransform):
        (WebCore::RenderSurfaceChromium::setReplicaDrawTransform):
        (WebCore::RenderSurfaceChromium::replicaOriginTransform):
        (WebCore::RenderSurfaceChromium::setReplicaOriginTransform):
        (WebCore::RenderSurfaceChromium::replicaScreenSpaceTransform):
        (WebCore::RenderSurfaceChromium::setReplicaScreenSpaceTransform):
        (RenderSurfaceChromium):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::updateTiles):
        * platform/graphics/chromium/cc/CCAnimationCurve.h:
        (WebCore):
        (CCTransformAnimationCurve):
        * platform/graphics/chromium/cc/CCDamageTracker.cpp:
        (WebCore::CCDamageTracker::extendDamageForLayer):
        (WebCore::CCDamageTracker::extendDamageForRenderSurface):
        * platform/graphics/chromium/cc/CCDrawQuad.h:
        (WebCore::CCDrawQuad::quadTransform):
        (WebCore::CCDrawQuad::layerTransform):
        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp:
        (WebCore::CCTransformKeyframe::clone):
        (WebCore::CCKeyframedTransformAnimationCurve::getValue):
        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h:
        (CCKeyframedTransformAnimationCurve):
        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
        (WebCore::CCLayerAnimationController::tickAnimations):
        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
        (WebKit):
        (WebCore):
        (CCLayerAnimationControllerClient):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::quadTransform):
        (WebCore::CCLayerImpl::setTransformFromAnimation):
        (WebCore::CCLayerImpl::setSublayerTransform):
        (WebCore::CCLayerImpl::setTransform):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):
        (WebCore::CCLayerImpl::sublayerTransform):
        (WebCore::CCLayerImpl::drawTransform):
        (WebCore::CCLayerImpl::setDrawTransform):
        (WebCore::CCLayerImpl::screenSpaceTransform):
        (WebCore::CCLayerImpl::setScreenSpaceTransform):
        * platform/graphics/chromium/cc/CCLayerSorter.cpp:
        (WebCore::CCLayerSorter::LayerShape::LayerShape):
        (WebCore::CCLayerSorter::createGraphNodes):
        * platform/graphics/chromium/cc/CCLayerSorter.h:
        (WebKit):
        (LayerShape):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::updateLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::CCLayerTreeHostCommon::calculateVisibleRect):
        (WebCore::isSurfaceBackFaceVisible):
        (WebCore::calculateVisibleLayerRect):
        (WebCore::isScaleOrTranslation):
        (WebCore::calculateDrawTransformsAndVisibilityInternal):
        (WebCore::CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.h:
        (CCLayerTreeHostCommon):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::damageInSurfaceSpace):
        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCMathUtil.cpp:
        (WebCore::projectPoint):
        (WebCore::mapPoint):
        (WebCore::CCMathUtil::mapClippedRect):
        (WebCore::CCMathUtil::projectClippedRect):
        (WebCore::CCMathUtil::mapClippedQuad):
        (WebCore::CCMathUtil::mapQuad):
        (WebCore::CCMathUtil::projectQuad):
        * platform/graphics/chromium/cc/CCMathUtil.h:
        (WebKit):
        (WebCore):
        (CCMathUtil):
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::transformSurfaceOpaqueRegion):
        (WebCore::reduceOcclusionBelowSurface):
        (WebCore::contentToScreenSpaceTransform):
        (WebCore::contentToTargetSurfaceTransform):
        (WebCore::addOcclusionBehindLayer):
        (WebCore::::markOccludedBehindLayer):
        (WebCore::testContentRectOccluded):
        (WebCore::computeUnoccludedContentRect):
        (WebCore::::unoccludedContributingSurfaceContentRect):
        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
        * platform/graphics/chromium/cc/CCOverdrawMetrics.cpp:
        (WebCore::CCOverdrawMetrics::didUpload):
        (WebCore::CCOverdrawMetrics::didCullForDrawing):
        (WebCore::CCOverdrawMetrics::didDraw):
        * platform/graphics/chromium/cc/CCOverdrawMetrics.h:
        (WebKit):
        (CCOverdrawMetrics):
        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::appendQuadsToFillScreen):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (WebCore::CCRenderSurface::setDrawTransform):
        (WebCore::CCRenderSurface::drawTransform):
        (WebCore::CCRenderSurface::setOriginTransform):
        (WebCore::CCRenderSurface::originTransform):
        (WebCore::CCRenderSurface::setScreenSpaceTransform):
        (WebCore::CCRenderSurface::screenSpaceTransform):
        (WebCore::CCRenderSurface::setReplicaDrawTransform):
        (WebCore::CCRenderSurface::replicaDrawTransform):
        (WebCore::CCRenderSurface::setReplicaOriginTransform):
        (WebCore::CCRenderSurface::replicaOriginTransform):
        (WebCore::CCRenderSurface::setReplicaScreenSpaceTransform):
        (WebCore::CCRenderSurface::replicaScreenSpaceTransform):
        (CCRenderSurface):
        * platform/graphics/chromium/cc/CCSharedQuadState.cpp:
        (WebCore::CCSharedQuadState::create):
        (WebCore::CCSharedQuadState::CCSharedQuadState):
        * platform/graphics/chromium/cc/CCSharedQuadState.h:
        (CCSharedQuadState):
        (WebCore::CCSharedQuadState::quadTransform):
        (WebCore::CCSharedQuadState::layerTransform):
        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp:
        (WebCore::CCSolidColorLayerImpl::quadTransform):
        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.h:
        (CCSolidColorLayerImpl):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
        (WebCore::CCTiledLayerImpl::quadTransform):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
        (CCTiledLayerImpl):

2012-05-31  Ian Vollick  <vollick@chromium.org>

        [chromium] Single thread proxy should not tick animations unless the layer renderer has been initialized
        https://bugs.webkit.org/show_bug.cgi?id=87873

        Reviewed by James Robinson.

        When the layer renderer fails to initialize, be sure to stop the animation timer.

        Unit test: CCLayerTreeHostTestInitializeLayerRendererFailsAfterAddAnimation.runSingleThread

        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::initializeLayerRenderer):
        (WebCore::CCSingleThreadProxy::didAddAnimation):
        (WebCore::CCSingleThreadProxy::animationTimerDelay):
        (WebCore):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:

2012-05-31  Simon Fraser  <simon.fraser@apple.com>

        RenderLayerCompositor cleanup: make RenderGeometryMap part of the OverlapMap
        https://bugs.webkit.org/show_bug.cgi?id=88021

        Reviewed by James Robinson.
        
        We only ever use the RenderGeometryMap when we have an OverlapMap, so make
        it a member of the OverlapMap.

        No behavior change.

        * rendering/RenderLayerCompositor.cpp:
        (RenderLayerCompositor::OverlapMap):
        (WebCore::RenderLayerCompositor::OverlapMap::geometryMap):
        (WebCore::RenderLayerCompositor::updateCompositingLayers):
        (WebCore::RenderLayerCompositor::addToOverlapMap):
        (WebCore::RenderLayerCompositor::addToOverlapMapRecursive):
        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
        * rendering/RenderLayerCompositor.h:
        (WebCore):
        (RenderLayerCompositor):

2012-05-31  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to v8Boolean()
        https://bugs.webkit.org/show_bug.cgi?id=87948

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to v8Boolean().

        No tests. No change in behavior.

        * bindings/v8/SerializedScriptValue.cpp:
        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        (WebCore::V8DOMStringMap::namedPropertyDeleter):
        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
        (WebCore::V8InjectedScriptHost::isHTMLAllCollectionCallback):
        * bindings/v8/custom/V8StorageCustom.cpp:
        (WebCore::storageDeleter):
        * bindings/v8/custom/V8WebSocketCustom.cpp:
        (WebCore::V8WebSocket::sendCallback):

2012-05-31  Alec Flett  <alecflett@chromium.org>

        IndexedDB: Implement IDBTransaction.error and IDBRequest.error
        https://bugs.webkit.org/show_bug.cgi?id=87865

        Reviewed by Tony Chang.

        Added "error" attribute to IDBRequest and IDBTransaction. Update
        IDBDatabaseError to honor the IDBDatabaseException behavior
        of dealing with IDB-specific throws of DOMException codes,
        as per the spec.

        Existing tests which previously tested 'errorCode' and
        'webkitErrorMessage' have been updated to use the new attribute.

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::advance):
        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::setVersion):
        * Modules/indexeddb/IDBDatabaseError.h:
        (WebCore::IDBDatabaseError::create):
        (WebCore::IDBDatabaseError::code):
        (WebCore::IDBDatabaseError::idbCode):
        (WebCore::IDBDatabaseError::name):
        (WebCore::IDBDatabaseError::IDBDatabaseError):
        (IDBDatabaseError):
        * Modules/indexeddb/IDBDatabaseException.cpp:
        (WebCore):
        (WebCore::getErrorEntry):
        (WebCore::IDBDatabaseException::initializeDescription):
        (WebCore::IDBDatabaseException::getErrorName):
        (WebCore::IDBDatabaseException::getLegacyErrorCode):
        * Modules/indexeddb/IDBDatabaseException.h:
        (IDBDatabaseException):
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::createIndex):
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::error):
        (WebCore):
        (WebCore::IDBRequest::resetReadyState):
        (WebCore::IDBRequest::abort):
        (WebCore::IDBRequest::onError):
        (WebCore::IDBRequest::onSuccess):
        (WebCore::IDBRequest::onSuccessWithContinuation):
        (WebCore::IDBRequest::dispatchEvent):
        * Modules/indexeddb/IDBRequest.h:
        (IDBRequest):
        * Modules/indexeddb/IDBRequest.idl:
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::error):
        (WebCore):
        (WebCore::IDBTransaction::setError):
        * Modules/indexeddb/IDBTransaction.h:
        (IDBTransaction):
        * Modules/indexeddb/IDBTransaction.idl:

2012-05-31  James Robinson  <jamesr@chromium.org>

        [chromium] Assertion failures during compositor startup in lost context situations
        https://bugs.webkit.org/show_bug.cgi?id=87912

        Reviewed by Adrienne Walker.

        getShaderiv and getProgramiv may return 0 if the context is lost. We correctly recover in this case, so it's
        bogus to fail an ASSERT in debug in this case.

        Added new unit test in LayerRendererChromiumTest to cover this.

        * platform/graphics/chromium/ProgramBinding.cpp:
        (WebCore::contextLost):
        (WebCore):
        (WebCore::ProgramBindingBase::init):
        (WebCore::ProgramBindingBase::createShaderProgram):

2012-05-31  Ben Murdoch  <benm@google.com>

        Fix crash in V8Document::createTouchListCallback.
        https://bugs.webkit.org/show_bug.cgi?id=87085

        Reviewed by Abhishek Arya.

        Test: fast/events/touch/document-create-touch-list-crash.html

        * bindings/v8/custom/V8DocumentCustom.cpp:
        (WebCore::V8Document::createTouchListCallback): Verify the native type
        of the arguments passed to createTouchList are Touches before appending
        them to the TouchList. In the case of a non-Touch argument, insert
        null into the TouchList. This consolidates V8 and JSC bindings
        behaviour.
        * dom/Document.cpp: Remove dead code.
        * dom/Document.h: ditto.

2012-05-31  Simon Fraser  <simon.fraser@apple.com>

        Remove some duplicate code in RenderLayerCompositor
        https://bugs.webkit.org/show_bug.cgi?id=88009

        Reviewed by Anders Carlsson.

        RenderLayerCompositor::hasNonAffineTransform() has the same code
        as the existing RenderLayer::has3DTransform(), so just use the
        RenderLayer method and remove hasNonAffineTransform().

        No behavior change.
        
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
        * rendering/RenderLayerCompositor.h:
        (RenderLayerCompositor):

2012-05-31  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r119125.
        http://trac.webkit.org/changeset/119125
        https://bugs.webkit.org/show_bug.cgi?id=88007

        Will break android build if rolled (Requested by rafaelw_ on
        #webkit).

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):
        (WebCore::HTMLMediaElement::startProgressEventTimer):
        (WebCore::HTMLMediaElement::changeNetworkStateFromLoadingToIdle):
        (WebCore::HTMLMediaElement::progressEventTimerFired):
        (WebCore::HTMLMediaElement::startPlaybackProgressTimer):
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::NullMediaPlayerPrivate::bytesLoaded):
        (WebCore::MediaPlayer::bytesLoaded):
        * platform/graphics/MediaPlayer.h:
        * platform/graphics/MediaPlayerPrivate.h:
        (MediaPlayerPrivateInterface):
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation):
        (WebCore::MediaPlayerPrivateAVFoundation::bytesLoaded):
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
        (MediaPlayerPrivateAVFoundation):
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
        (WebCore::MediaPlayerPrivate::bytesLoaded):
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
        (MediaPlayerPrivate):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
        (WebCore::MediaPlayerPrivateGStreamer::bytesLoaded):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
        (MediaPlayerPrivateGStreamer):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        (MediaPlayerPrivateQTKit):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::MediaPlayerPrivateQTKit):
        (WebCore::MediaPlayerPrivateQTKit::bytesLoaded):
        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
        (WebCore::MediaPlayerPrivateQt::MediaPlayerPrivateQt):
        (WebCore::MediaPlayerPrivateQt::bytesLoaded):
        * platform/graphics/qt/MediaPlayerPrivateQt.h:
        (MediaPlayerPrivateQt):
        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::MediaPlayerPrivateQuickTimeVisualContext):
        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::bytesLoaded):
        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h:
        (MediaPlayerPrivateQuickTimeVisualContext):
        * platform/graphics/wince/MediaPlayerPrivateWinCE.h:
        (MediaPlayerPrivate):

2012-05-31  Andy Estes  <aestes@apple.com>

        Disentangle code that relies on USE(AUTOMATIC_TEXT_REPLACEMENT) from that which merely relies on PLATFORM(MAC)
        https://bugs.webkit.org/show_bug.cgi?id=87933

        Reviewed by Dan Bernstein.

        * editing/Editor.cpp:
        * editing/Editor.h:
        * loader/EmptyClients.h:
        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::contextMenuItemSelected):
        * page/EditorClient.h:

2012-05-31  Dana Jansens  <danakj@chromium.org>

        [chromium] Move drawing code for RenderSurfaces into LayerRendererChromium
        https://bugs.webkit.org/show_bug.cgi?id=87877

        Reviewed by James Robinson.

        We add data to CCRenderSurfaceDrawQuad so that the only use of
        CCRenderSurface directly from LayerRendererChromium is to
        reserve, release, and use the surface's textures, and to set the
        scissor rect. Each of these changes will be done independent
        of this change.

        Covered by existing tests.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::applyFilters):
        (WebCore):
        (WebCore::LayerRendererChromium::drawBackgroundFilters):
        (WebCore::LayerRendererChromium::drawRenderSurfaceQuad):
        (WebCore::LayerRendererChromium::copyTextureToFramebuffer):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::contentsTextureId):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateDrawTransformsAndVisibilityInternal):
        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
        * platform/graphics/chromium/cc/CCQuadCuller.h:
        (CCQuadCuller):
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::appendQuadsForRenderSurfaceLayer):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore):
        (WebCore::CCRenderSurface::CCRenderSurface):
        (WebCore::CCRenderSurface::prepareContentsTexture):
        (WebCore::CCRenderSurface::releaseContentsTexture):
        (WebCore::CCRenderSurface::hasValidContentsTexture):
        (WebCore::CCRenderSurface::releaseBackgroundTexture):
        (WebCore::CCRenderSurface::hasValidBackgroundTexture):
        (WebCore::CCRenderSurface::hasMask):
        (WebCore::CCRenderSurface::replicaHasMask):
        (WebCore::CCRenderSurface::appendQuads):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (WebCore):
        (CCRenderSurface):
        * platform/graphics/chromium/cc/CCRenderSurfaceDrawQuad.cpp:
        (WebCore::CCRenderSurfaceDrawQuad::create):
        (WebCore::CCRenderSurfaceDrawQuad::CCRenderSurfaceDrawQuad):
        * platform/graphics/chromium/cc/CCRenderSurfaceDrawQuad.h:
        (WebKit):
        (CCRenderSurfaceDrawQuad):
        (WebCore::CCRenderSurfaceDrawQuad::maskTextureId):
        (WebCore::CCRenderSurfaceDrawQuad::filters):
        (WebCore::CCRenderSurfaceDrawQuad::backgroundFilters):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
        (WebCore::CCTiledLayerImpl::contentsTextureId):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
        (CCTiledLayerImpl):

2012-05-31  Brady Eidson  <beidson@apple.com>

        <rdar://problem/11544454> and https://bugs.webkit.org/show_bug.cgi?id=87990
        Crashes unregistering DOMWindowProperties while releasing CachedPages

        Reviewed by Jessie Berlin.

        This patch rewrites DOMWindowProperty to always keep direct track of the DOMWindow
        it has registered with and to only ever unregister from that very same DOMWindow.

        No new tests. (While the direct cause of the crash is understood, reproducing it is not)

        * page/DOMWindowProperty.cpp:
        (WebCore::DOMWindowProperty::DOMWindowProperty):
        (WebCore::DOMWindowProperty::~DOMWindowProperty):
        (WebCore::DOMWindowProperty::disconnectFrameForPageCache):
        (WebCore::DOMWindowProperty::reconnectFrameFromPageCache):
        (WebCore::DOMWindowProperty::willDestroyGlobalObjectInCachedFrame):
        (WebCore::DOMWindowProperty::willDestroyGlobalObjectInFrame):
        (WebCore::DOMWindowProperty::willDetachGlobalObjectFromFrame):
        * page/DOMWindowProperty.h:
        (DOMWindowProperty):

2012-05-31  Tony Chang  <tony@chromium.org>

        rename flexbox CSS properties from flex-align and flex-item-align to align-items and align-self
        https://bugs.webkit.org/show_bug.cgi?id=87907

        Reviewed by Ojan Vafai.

        This was recently changed in the spec:
        http://dev.w3.org/csswg/css3-flexbox/#align-items-property

        No new tests, updated the tests to use the new naming.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore):
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator EAlignItems):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::sizesToIntrinsicLogicalWidth):
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::alignmentForChild):
        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
        (WebCore::RenderFlexibleBox::alignChildren):
        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyleConstants.h:
        * rendering/style/StyleFlexibleBoxData.cpp:
        (WebCore::StyleFlexibleBoxData::StyleFlexibleBoxData):
        (WebCore::StyleFlexibleBoxData::operator==):
        * rendering/style/StyleFlexibleBoxData.h:
        (StyleFlexibleBoxData): Move member variables to StyleRareNonInheritedData
        because these values will eventually apply to more than just flexbox.
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:
        (StyleRareNonInheritedData):

2012-05-31  Ami Fischman  <fischman@chromium.org>

        Replace WebMediaPlayer::bytesLoaded() with an explicit didLoadingProgress()
        https://bugs.webkit.org/show_bug.cgi?id=86113

        Reviewed by Eric Carlson.

        No new functionality, so no new tests.  Loading progress is already tested by existing layouttests.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):
        (WebCore::HTMLMediaElement::startProgressEventTimer):
        (WebCore::HTMLMediaElement::changeNetworkStateFromLoadingToIdle):
        (WebCore::HTMLMediaElement::progressEventTimerFired):
        (WebCore::HTMLMediaElement::startPlaybackProgressTimer):
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::NullMediaPlayerPrivate::didLoadingProgress):
        (WebCore::MediaPlayer::didLoadingProgress):
        * platform/graphics/MediaPlayer.h:
        * platform/graphics/MediaPlayerPrivate.h:
        (MediaPlayerPrivateInterface):
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation):
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
        (MediaPlayerPrivateAVFoundation):
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
        (WebCore::MediaPlayerPrivate::didLoadingProgress):
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
        (MediaPlayerPrivate):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
        (WebCore::MediaPlayerPrivateGStreamer::didLoadingProgress):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
        (MediaPlayerPrivateGStreamer):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        (MediaPlayerPrivateQTKit):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::MediaPlayerPrivateQTKit):
        (WebCore::MediaPlayerPrivateQTKit::didLoadingProgress):
        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
        (WebCore::MediaPlayerPrivateQt::MediaPlayerPrivateQt):
        (WebCore::MediaPlayerPrivateQt::didLoadingProgress):
        * platform/graphics/qt/MediaPlayerPrivateQt.h:
        (MediaPlayerPrivateQt):
        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::MediaPlayerPrivateQuickTimeVisualContext):
        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::didLoadingProgress):
        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h:
        (MediaPlayerPrivateQuickTimeVisualContext):
        * platform/graphics/wince/MediaPlayerPrivateWinCE.h:
        (MediaPlayerPrivate):

2012-05-31  Erik Arvidsson  <arv@chromium.org>

        Make DOM Exceptions Errors
        https://bugs.webkit.org/show_bug.cgi?id=85078

        Reviewed by Oliver Hunt.

        WebIDL mandates that exceptions should have Error.prototype on its prototype chain.

        For JSC we have access to the Error.prototype from the binding code.

        For V8 we set a field in the WrapperTypeInfo and when the constructor function is created we
        set the prototype as needed.

        Updated test: fast/dom/DOMException/prototype-object.html

        * ForwardingHeaders/runtime/ErrorPrototype.h: Added.
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateImplementation):
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNamedConstructorCallback):
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::JSTestException::createPrototype):
        * bindings/scripts/test/JS/JSTestException.h:
        * bindings/scripts/test/V8/V8Float64Array.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestException.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestNode.cpp:
        (WebCore):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore):
        (WebCore::V8TestObj::installPerContextProperties):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore):
        * bindings/v8/NPV8Object.cpp:
        (WebCore::npObjectTypeInfo):
        * bindings/v8/V8BindingPerContextData.cpp:
        (WebCore):
        (WebCore::V8BindingPerContextData::init):
        (WebCore::V8BindingPerContextData::createWrapperFromCacheSlowCase):
        (WebCore::V8BindingPerContextData::constructorForTypeSlowCase):
        * bindings/v8/V8BindingPerContextData.h:
        (V8BindingPerContextData):
        * bindings/v8/V8HiddenPropertyName.h:
        (WebCore):
        * bindings/v8/WrapperTypeInfo.h:
        (WebCore):
        (WrapperTypeInfo):
        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
        (WebCore):

2012-05-31  Ian Vollick  <vollick@chromium.org>

        [chromium] create WebTransformOperation interface for chromium platform
        https://bugs.webkit.org/show_bug.cgi?id=87510

        Reviewed by James Robinson.

        Unit tests:
            WebTransformOperationsTest.transformTypesAreUnique
            WebTransformOperationsTest.matchesTypesSameLength
            WebTransformOperationsTest.matchesTypesDifferentLength
            WebTransformOperationsTest.applyTranslate
            WebTransformOperationsTest.applyRotate
            WebTransformOperationsTest.applyScale
            WebTransformOperationsTest.applySkew
            WebTransformOperationsTest.applyPerspective
            WebTransformOperationsTest.applyMatrix
            WebTransformOperationsTest.applyOrder
            WebTransformOperationsTest.blendOrder
            WebTransformOperationsTest.blendProgress
            WebTransformOperationsTest.blendWhenTypesDoNotMatch

        * WebCore.gypi:
        * platform/chromium/support/WebTransformOperations.cpp: Added.
        (WebKit):
        (WebTransformOperationsPrivate):
        (WebKit::WebTransformOperations::apply):
        (WebKit::WebTransformOperations::blend):
        (WebKit::WebTransformOperations::matchesTypes):
        (WebKit::WebTransformOperations::appendTranslate):
        (WebKit::WebTransformOperations::appendRotate):
        (WebKit::WebTransformOperations::appendScale):
        (WebKit::WebTransformOperations::appendSkew):
        (WebKit::WebTransformOperations::appendPerspective):
        (WebKit::WebTransformOperations::appendMatrix):
        (WebKit::WebTransformOperations::reset):
        (WebKit::WebTransformOperations::initialize):

2012-05-31  Yury Semikhatsky  <yurys@chromium.org>

        m_totalAllocated should be intialized in RenderArena constructor
        https://bugs.webkit.org/show_bug.cgi?id=87967

        Reviewed by Ojan Vafai.

        * rendering/RenderArena.cpp:
        (WebCore::RenderArena::RenderArena): added missing initializer.

2012-05-31  Julien Chaffraix  <jchaffraix@webkit.org>

        The difference between a column and a column group renderer is badly drawn
        https://bugs.webkit.org/show_bug.cgi?id=87556

        Reviewed by Abhishek Arya.

        No expected change in behavior.

        This patch tries to draw a better line between those 3 concepts:
        - renderer is a RenderTableCol (RenderObject::isRenderTableCol).
        - renderer is a column (RenderTableCol::isTableColumn()).
        - renderer is a column group (RenderTableCol::isTableColumnGroup()).
        (most of the code that needs to know the difference manipulate a RenderTableCol
        so there was no need to move the 2 last helpers into RenderObject)

        * rendering/AutoTableLayout.cpp:
        (WebCore::AutoTableLayout::recalcColumn):
        Factored the code to use the column / column group iteration we
        set up in the rest of the code. Made the code more self-describing
        by using more RenderTableCol functions.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::addChild):
        Factored the code to use the isTableColumn() and isTableColumnGroup() to
        better underline what we check.

        * rendering/RenderObject.h:
        (WebCore::RenderObject::isRenderTableCol):
        (WebCore::RenderObject::isTablePart):
        Renamed isTableCol to isRenderTableCol to match the class as this doesn't
        imply that the renderer is actually a column.

        * html/HTMLTableColElement.cpp:
        (WebCore::HTMLTableColElement::parseAttribute):
        * rendering/AutoTableLayout.cpp:
        (WebCore::AutoTableLayout::fullRecalc):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::addChild):
        (WebCore::RenderTable::layout):
        (WebCore::RenderTable::firstColumn):
        Updated after the isRenderTableCol rename.

        * dom/Text.cpp:
        (WebCore::Text::rendererIsNeeded):
        * editing/htmlediting.cpp:
        (WebCore::isTableStructureNode):
        Ditto and renamed some variables.

        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::rendererIsNeeded):
        Ditto and added a FIXME as the logic doesn't seem very bullet proof.

        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::computeCollapsedStartBorder):
        (WebCore::RenderTableCell::computeCollapsedEndBorder):
        (WebCore::RenderTableCell::computeCollapsedBeforeBorder):
        (WebCore::RenderTableCell::computeCollapsedAfterBorder):
        Changed to use the enclosingColumnGroup* helpers.

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::paintCell):
        * rendering/RenderTableCol.cpp:
        (WebCore::RenderTableCol::isChildAllowed):
        (WebCore::RenderTableCol::canHaveChildren):
        (WebCore::RenderTableCol::enclosingColumnGroup):
        (WebCore::RenderTableCol::nextColumn):
        Updated to use the new functions.

        * rendering/RenderTableCol.h:
        (WebCore::RenderTableCol::isTableColumn):
        (WebCore::RenderTableCol::isTableColumnGroup):
        (WebCore::RenderTableCol::enclosingColumnGroupIfAdjacentBefore):
        (WebCore::RenderTableCol::enclosingColumnGroupIfAdjacentAfter):
        Added the following new helpers.

2012-05-31  Jessie Berlin  <jberlin@apple.com>

        Fix Lion build after r119073.

        * platform/Decimal.cpp:
        (WebCore::Decimal::toString):
        Do not attempt to assign a unsigned long long to an int.

2012-05-31  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] Enable CSS_IMAGE_SET flag
        https://bugs.webkit.org/show_bug.cgi?id=87727

        Reviewed by Adam Roben.

        Fix CMakeLists.txt so that CSSImageSetValue.cpp gets compiled if
        CSS_IMAGE_SET flag is enabled.

        * CMakeLists.txt:

2012-05-31  Keyar Hood  <keyar@chromium.org>

        the imageSmoothingEnabled flag needs to be in the state object
        https://bugs.webkit.org/show_bug.cgi?id=87853

        Reviewed by Darin Adler.

        Updated fast/canvas/canvas-imageSmoothingEnabled.html instead of
        adding a new test.

        The imageSmoothingEnabled flag is saved in the draw state now.
        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D):
        (WebCore::CanvasRenderingContext2D::State::State):
        (WebCore::CanvasRenderingContext2D::State::operator=):
        (WebCore::CanvasRenderingContext2D::webkitImageSmoothingEnabled):
        (WebCore::CanvasRenderingContext2D::setWebkitImageSmoothingEnabled):
        * html/canvas/CanvasRenderingContext2D.h:
        (State):

2012-05-31  Eugene Klyuchnikov  <eustas.bug@gmail.com>

        Web Inspector: Fix checkbox position on Settings screen.
        https://bugs.webkit.org/show_bug.cgi?id=87007

        Reviewed by Yury Semikhatsky.

        Checkbox seems to be improperly aligned.
        It is "shifted" up on 1px on Mac and 2px on Linux.
        Also, keyboard-shortcuts screen has "wrapped" key descriptions on Mac.

        UI changes, no new tests.

        * inspector/front-end/helpScreen.css:
        (.help-container): Fixed column width.
        (.help-block): Ditto.
        (.help-key-cell): Ditto.
        (body.platform-mac .help-container): Ditto.
        (body.platform-mac .help-block): Ditto.
        (body.platform-mac .help-key-cell): Ditto.
        (.help-content p): Ajdusted spacing between lines
        (.help-content input[type=checkbox]): Fixed alignment.
        (body.platform-mac .help-content input[type=checkbox]): Ditto.
        (.help-content input[type=radio]): Fixed alignment.
        (body.platform-mac .help-content input[type=radio]): Ditto.

2012-05-30  Andreas Kling  <kling@webkit.org>

        Have StylePropertySet constructor take array/length instead of vector.
        <http://webkit.org/b/87876>

        Reviewed by Antti Koivisto.

        Remove the StylePropertyVector typedef and have StylePropertySet constructors
        take CSSProperty*/length since we are copying the data into a tightly packed
        array anyway. This frees up the call sites to use whatever storage they please
        rather than being restricted to a vector with inlineCapacity=4.

        Change said call sites to use an arbitrary high inline capacity (256) for their
        stack-allocated temporary vectors.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::copyPropertiesInSet):
        * css/CSSParser.cpp:
        (WebCore::filterProperties):
        (WebCore::CSSParser::createStylePropertySet):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::createImmutable):
        (WebCore::StylePropertySet::StylePropertySet):
        (WebCore::StylePropertySet::removePropertiesInSet):
        (WebCore::StylePropertySet::copyPropertiesInSet):
        * css/StylePropertySet.h:
        (WebCore::StylePropertySet::create):
        (StylePropertySet):

2012-05-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>

        [Qt] Simplify QT_VERSION_CHECKS for Qt5 by introducing HAVE(QT5)
        https://bugs.webkit.org/show_bug.cgi?id=87955

        Reviewed by Simon Hausmann.

        * bridge/qt/qt_class.cpp:
        * bridge/qt/qt_instance.cpp:
        * bridge/qt/qt_runtime.h:
        * page/qt/EventHandlerQt.cpp:
        * platform/graphics/GraphicsContext3D.h:
        * platform/graphics/OpenGLShims.cpp:
        * platform/graphics/OpenGLShims.h:
        * platform/graphics/gstreamer/PlatformVideoWindowPrivate.h:
        * platform/graphics/gstreamer/PlatformVideoWindowQt.cpp:
        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        * platform/graphics/qt/SimpleFontDataQt.cpp:
        * platform/graphics/texmap/TextureMapper.h:
        * platform/graphics/texmap/TextureMapperGL.cpp:
        * platform/qt/DeviceMotionProviderQt.h:
        * platform/qt/DeviceOrientationProviderQt.h:
        * platform/qt/KURLQt.cpp:
        * platform/qt/PlatformScreenQt.cpp:
        * platform/qt/QWebPageClient.h:
        * plugins/qt/PluginPackageQt.cpp:
        * plugins/qt/PluginViewQt.cpp:

2012-05-30  Andreas Kling  <kling@webkit.org>

        Have StylePropertySet constructor take array/length instead of vector.
        <http://webkit.org/b/87876>

        Reviewed by Antti Koivisto.

        Remove the StylePropertyVector typedef and have StylePropertySet constructors
        take CSSProperty*/length since we are copying the data into a tightly packed
        array anyway. This frees up the call sites to use whatever storage they please
        rather than being restricted to a vector with inlineCapacity=4.

        Change said call sites to use an arbitrary high inline capacity (256) for their
        stack-allocated temporary vectors.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::copyPropertiesInSet):
        * css/CSSParser.cpp:
        (WebCore::filterProperties):
        (WebCore::CSSParser::createStylePropertySet):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::createImmutable):
        (WebCore::StylePropertySet::StylePropertySet):
        (WebCore::StylePropertySet::removePropertiesInSet):
        (WebCore::StylePropertySet::copyPropertiesInSet):
        * css/StylePropertySet.h:
        (WebCore::StylePropertySet::create):
        (StylePropertySet):

2012-05-31  Mike West  <mkwst@chromium.org>

        Fixing compilation with SVG disabled.
        https://bugs.webkit.org/show_bug.cgi?id=87944

        This patch adds the missing enumeration value
        'CSSPropertyWebkitBoxDecorationBreak' into switch statements to make
        clang happy.

        Reviewed by Alexis Menard.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-05-31  Yoshifumi Inoue  <yosin@chromium.org>

        [Platform] Implementation of Decimal(int32_t) isn't portable.
        https://bugs.webkit.org/show_bug.cgi?id=87941

        Reviewed by Kent Tamura.

        This patch changes negation of integer to make unsigned integer
        in portable way.

        No new tests. This patch doesn't change behavior.

        * platform/Decimal.cpp:
        (WebCore::Decimal::Decimal): Use uint64_t(-int64_t(i32)) instead of uint64_t(-i32) 

2012-05-31  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        [CMAKE][EFL] Remove unneeded include path
        https://bugs.webkit.org/show_bug.cgi?id=87927

        Reviewed by Kenneth Rohde Christiansen.

        Though *wtf* directory was moved to Source/WTF, PlatformEfl.cmake is still including the previous
        path. In addition, files on EFL port are using "<wtf/gobject/XXX>" directly in #include line.
        So, EFL port doesn't need to include ${JAVASCRIPTCORE_DIR}/wtf/gobject path anymore.

        * PlatformEfl.cmake: Remove '${JAVASCRIPTCORE_DIR}/wtf/gobject' path from include path list.

2012-05-31  Yoshifumi Inoue  <yosin@chromium.org>

        [Platform] Introduce Decimal class for Number/Range input type.
        https://bugs.webkit.org/show_bug.cgi?id=87360

        Reviewed by Kent Tamura.

        This patch added new class Decimal for decimal arithmatic in two
        files: platform/Decimal.cpp and Decimal.h with unit test.

        Test: WebKit/chromium/tests/DecimalTest.cpp

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/Decimal.cpp: Added.
        (WebCore):
        (DecimalPrivate):
        (SpecialValueHandler):
        (WebCore::DecimalPrivate::SpecialValueHandler::SpecialValueHandler):
        (WebCore::DecimalPrivate::SpecialValueHandler::handle):
        (WebCore::DecimalPrivate::SpecialValueHandler::value):
        (UInt128):
        (WebCore::DecimalPrivate::UInt128::UInt128):
        (WebCore::DecimalPrivate::UInt128::high):
        (WebCore::DecimalPrivate::UInt128::low):
        (WebCore::DecimalPrivate::UInt128::multiply):
        (WebCore::DecimalPrivate::UInt128::highUInt32):
        (WebCore::DecimalPrivate::UInt128::lowUInt32):
        (WebCore::DecimalPrivate::UInt128::isZero):
        (WebCore::DecimalPrivate::UInt128::makeUInt64):
        (WebCore::DecimalPrivate::UInt128::operator/=):
        (WebCore::DecimalPrivate::UInt128::multiplyHigh):
        (WebCore::DecimalPrivate::countDigits):
        (WebCore::DecimalPrivate::scaleDown):
        (WebCore::DecimalPrivate::scaleUp):
        (WebCore::Decimal::EncodedData::EncodedData):
        (WebCore::Decimal::EncodedData::operator==):
        (WebCore::Decimal::Decimal):
        (WebCore::Decimal::operator=):
        (WebCore::Decimal::operator+=):
        (WebCore::Decimal::operator-=):
        (WebCore::Decimal::operator*=):
        (WebCore::Decimal::operator/=):
        (WebCore::Decimal::operator-):
        (WebCore::Decimal::operator+):
        (WebCore::Decimal::operator*):
        (WebCore::Decimal::operator/):
        (WebCore::Decimal::operator==):
        (WebCore::Decimal::operator!=):
        (WebCore::Decimal::operator<):
        (WebCore::Decimal::operator<=):
        (WebCore::Decimal::operator>):
        (WebCore::Decimal::operator>=):
        (WebCore::Decimal::abs):
        (WebCore::Decimal::alignOperands):
        (WebCore::Decimal::ceiling):
        (WebCore::Decimal::compareTo):
        (WebCore::Decimal::floor):
        (WebCore::Decimal::fromString):
        (WebCore::Decimal::infinity):
        (WebCore::Decimal::nan):
        (WebCore::Decimal::remainder):
        (WebCore::Decimal::round):
        (WebCore::Decimal::toString):
        (WebCore::Decimal::zero):
        * platform/Decimal.h: Added.
        (WebCore):
        (DecimalPrivate):
        (Decimal):
        (EncodedData):
        (WebCore::Decimal::EncodedData::operator!=):
        (WebCore::Decimal::EncodedData::coefficient):
        (WebCore::Decimal::EncodedData::exponent):
        (WebCore::Decimal::EncodedData::isFinite):
        (WebCore::Decimal::EncodedData::isNaN):
        (WebCore::Decimal::EncodedData::isSpecial):
        (WebCore::Decimal::EncodedData::isZero):
        (WebCore::Decimal::EncodedData::sign):
        (WebCore::Decimal::EncodedData::setSign):
        (WebCore::Decimal::EncodedData::formatClass):
        (WebCore::Decimal::isFinite):
        (WebCore::Decimal::isNaN):
        (WebCore::Decimal::isNegative):
        (WebCore::Decimal::isPositive):
        (WebCore::Decimal::isSpecial):
        (WebCore::Decimal::isZero):
        (WebCore::Decimal::value):
        (AlignedOperands):
        (WebCore::Decimal::invertSign):
        (WebCore::Decimal::exponent):
        (WebCore::Decimal::sign):

2012-05-31  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to v8String() in custom bindings
        https://bugs.webkit.org/show_bug.cgi?id=87825

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to v8String() in custom bindings.

        No tests. No change in behavior.

        * bindings/v8/custom/V8ArrayBufferViewCustom.cpp:
        (WebCore::installFastSet):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore):
        (WebCore::setWebGLArrayHelper):
        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
        (WebCore::V8CSSStyleDeclaration::namedPropertyEnumerator):
        (WebCore::V8CSSStyleDeclaration::namedPropertyGetter):
        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
        (WebCore::toV8Object):
        * bindings/v8/custom/V8ClipboardCustom.cpp:
        (WebCore::V8Clipboard::typesAccessorGetter):
        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        (WebCore::V8DOMStringMap::namedPropertyGetter):
        (WebCore::V8DOMStringMap::namedPropertyEnumerator):
        * bindings/v8/custom/V8FileReaderCustom.cpp:
        (WebCore::V8FileReader::resultAccessorGetter):
        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
        (WebCore::V8HTMLCanvasElement::toDataURLCallback):
        * bindings/v8/custom/V8HTMLElementCustom.cpp:
        (WebCore::toV8Object):
        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
        (WebCore::V8HTMLInputElement::selectionDirectionAccessorGetter):
        * bindings/v8/custom/V8IDBAnyCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8IDBKeyCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
        (WebCore::V8InjectedScriptHost::databaseIdCallback):
        (WebCore::V8InjectedScriptHost::storageIdCallback):
        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
        (WebCore::V8InspectorFrontendHost::platformCallback):
        * bindings/v8/custom/V8JavaScriptCallFrameCustom.cpp:
        (WebCore::V8JavaScriptCallFrame::typeAccessorGetter):
        * bindings/v8/custom/V8LocationCustom.cpp:
        (WebCore::V8Location::toStringCallback):
        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
        (WebCore::V8SQLResultSetRowList::itemCallback):
        * bindings/v8/custom/V8StorageCustom.cpp:
        (WebCore::V8Storage::namedPropertyEnumerator):
        (WebCore::storageGetter):
        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
        (WebCore::V8XMLHttpRequest::responseTextAccessorGetter):
        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
        (WebCore::V8XSLTProcessor::getParameterCallback):

2012-05-31  Hayato Ito  <hayato@chromium.org>

        ComposedShadowTreeWalker should support traversing nodes in an orphaned shadow subtree.
        https://bugs.webkit.org/show_bug.cgi?id=87493

        Reviewed by Dimitri Glazkov.

        ComposedShadowTreeWalker assumed that a visited shadow root is
        always assigned to a shadow insertion point since it only
        traverses nodes which are rendered.  But there is an exceptional
        use case such as an event dispatching. Some events, such as a
        'click' event, may happen in an orphaned shadow subtree.  In such
        cases, traversal might start with a node in an orphaned shadow
        subtree.  So ComposedShadowTreeWalker can not assume that visited
        shadow root is always assigned to a shadow insertion point.

        This patch only fixes ComposedShadowTreeWalker.
        ComposedShadowTreeParentWalker will be fixed in another patch with
        an event dispatching test.

        Test: fast/dom/shadow/composed-shadow-tree-walker.html

        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::ComposedShadowTreeWalker::traverseParentBackToYoungerShadowRootOrHost):


2012-05-30  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add MemoryUsageSupport::processMemorySizesInBytes
        https://bugs.webkit.org/show_bug.cgi?id=87830

        Reviewed by James Robinson.

        Added a method for getting process memory usage in bytes. It is
        used in the inspector memory instrumentation to get process total
        memory usage.

        * inspector/InspectorMemoryAgent.cpp:
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
        * platform/MemoryUsageSupport.cpp:
        (WebCore::MemoryUsageSupport::processMemorySizesInBytes):
        (WebCore):
        * platform/MemoryUsageSupport.h:
        (MemoryUsageSupport): provided embedders with a way to report WebKit process
        memory usage.
        * platform/chromium/MemoryUsageSupportChromium.cpp:
        (WebCore::MemoryUsageSupport::processMemorySizesInBytes):
        (WebCore):

2012-05-31  Kent Tamura  <tkent@chromium.org>

        Unreviewed, rolling out r119062 and r119064.
        http://trac.webkit.org/changeset/119062
        http://trac.webkit.org/changeset/119064
        https://bugs.webkit.org/show_bug.cgi?id=87360

        Broke build on Lion, SnowLoepard, Chromium Windows, and
        Chromium Linux 32

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/Decimal.cpp: Removed.
        * platform/Decimal.h: Removed.

2012-05-31  Shane Stephens  <shanestephens@google.com>

        text-decoration should not be propagated through absolutely positioned elements to <a> tags
        https://bugs.webkit.org/show_bug.cgi?id=86517

        Reviewed by Darin Adler.

        Test: fast/css/text-decoration-in-second-order-descendants.html

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::getTextDecorationColors):
        Remove fix from 18611 as it doesn't work on second order descendants.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::adjustRenderStyle):
        Add floating and positioned checks when deciding whether to avoid propagating text decoration. Move all checks into new method to improve readability.
        (WebCore::doesNotInheritTextDecoration): Added

2012-05-30  Yoshifumi Inoue  <yosin@chromium.org>

        Build fix for Linon/SnowLeopard after r119062

        * platform/Decimal.cpp:
        (WebCore::Decimal::Decimal):

2012-05-30  Yoshifumi Inoue  <yosin@chromium.org>

        [Platform] Introduce Decimal class for Number/Range input type.
        https://bugs.webkit.org/show_bug.cgi?id=87360

        Reviewed by Kent Tamura.

        This patch added new class Decimal for decimal arithmatic in two
        files: platform/Decimal.cpp and Decimal.h with unit test.

        Test: WebKit/chromium/tests/DecimalTest.cpp

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/Decimal.cpp: Added.
        (WebCore):
        (DecimalPrivate):
        (SpecialValueHandler):
        (WebCore::DecimalPrivate::SpecialValueHandler::SpecialValueHandler):
        (WebCore::DecimalPrivate::SpecialValueHandler::handle):
        (WebCore::DecimalPrivate::SpecialValueHandler::value):
        (UInt128):
        (WebCore::DecimalPrivate::UInt128::UInt128):
        (WebCore::DecimalPrivate::UInt128::high):
        (WebCore::DecimalPrivate::UInt128::low):
        (WebCore::DecimalPrivate::UInt128::multiply):
        (WebCore::DecimalPrivate::UInt128::highUInt32):
        (WebCore::DecimalPrivate::UInt128::lowUInt32):
        (WebCore::DecimalPrivate::UInt128::isZero):
        (WebCore::DecimalPrivate::UInt128::makeUInt64):
        (WebCore::DecimalPrivate::UInt128::operator/=):
        (WebCore::DecimalPrivate::UInt128::multiplyHigh):
        (WebCore::DecimalPrivate::countDigits):
        (WebCore::DecimalPrivate::scaleDown):
        (WebCore::DecimalPrivate::scaleUp):
        (WebCore::Decimal::EncodedData::EncodedData):
        (WebCore::Decimal::EncodedData::operator==):
        (WebCore::Decimal::Decimal):
        (WebCore::Decimal::operator=):
        (WebCore::Decimal::operator+=):
        (WebCore::Decimal::operator-=):
        (WebCore::Decimal::operator*=):
        (WebCore::Decimal::operator/=):
        (WebCore::Decimal::operator-):
        (WebCore::Decimal::operator+):
        (WebCore::Decimal::operator*):
        (WebCore::Decimal::operator/):
        (WebCore::Decimal::operator==):
        (WebCore::Decimal::operator!=):
        (WebCore::Decimal::operator<):
        (WebCore::Decimal::operator<=):
        (WebCore::Decimal::operator>):
        (WebCore::Decimal::operator>=):
        (WebCore::Decimal::abs):
        (WebCore::Decimal::alignOperands):
        (WebCore::Decimal::ceiling):
        (WebCore::Decimal::compareTo):
        (WebCore::Decimal::floor):
        (WebCore::Decimal::fromString):
        (WebCore::Decimal::infinity):
        (WebCore::Decimal::nan):
        (WebCore::Decimal::remainder):
        (WebCore::Decimal::round):
        (WebCore::Decimal::toString):
        (WebCore::Decimal::zero):
        * platform/Decimal.h: Added.
        (WebCore):
        (DecimalPrivate):
        (Decimal):
        (EncodedData):
        (WebCore::Decimal::EncodedData::operator!=):
        (WebCore::Decimal::EncodedData::coefficient):
        (WebCore::Decimal::EncodedData::exponent):
        (WebCore::Decimal::EncodedData::isFinite):
        (WebCore::Decimal::EncodedData::isNaN):
        (WebCore::Decimal::EncodedData::isSpecial):
        (WebCore::Decimal::EncodedData::isZero):
        (WebCore::Decimal::EncodedData::sign):
        (WebCore::Decimal::EncodedData::setSign):
        (WebCore::Decimal::EncodedData::formatClass):
        (WebCore::Decimal::isFinite):
        (WebCore::Decimal::isNaN):
        (WebCore::Decimal::isNegative):
        (WebCore::Decimal::isPositive):
        (WebCore::Decimal::isSpecial):
        (WebCore::Decimal::isZero):
        (WebCore::Decimal::value):
        (AlignedOperands):
        (WebCore::Decimal::invertSign):
        (WebCore::Decimal::exponent):
        (WebCore::Decimal::sign):

2012-05-30  Patrick Gansterer  <paroga@webkit.org>

        Build fix for WinCE after r116723.

        * platform/graphics/wince/FontWinCE.cpp:
        (WebCore::TextRunComponent::TextRunComponent):

2012-05-30  Kentaro Hara  <haraken@chromium.org>

        Implement CSSParser::determineNameInNamespace() as a helper function for CSSGrammar.y
        https://bugs.webkit.org/show_bug.cgi?id=87799

        Reviewed by Darin Adler.

        As pointed out by darin@ in https://bugs.webkit.org/show_bug.cgi?id=87627#c12,
        we should avoid repeating the following code in CSSGrammar.y:

            if (p->m_styleSheet)
                $$->setTag(QualifiedName(namespacePrefix, $2, p->m_styleSheet->determineNamespace(namespacePrefix)));
            else
                $$->setTag(QualifiedName(namespacePrefix, $2, p->m_defaultNamespace));

        This patch implements CSSParser::determineNameInNamespace() as a helper function
        and replaces the above code.

        Tests: fast/dom/SelectorAPI/*. No change in test results.

        * css/CSSGrammar.y:
        * css/CSSParser.cpp:
        (WebCore::CSSParser::determineNameInNamespace):
        (WebCore):
        * css/CSSParser.h:

2012-05-30  Patrick Gansterer  <paroga@webkit.org>

        Build fix for WinCE after r117697.

        * page/wince/FrameWinCE.cpp:
        (WebCore::computePageRectsForFrame):

2012-05-30  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Fix min/max bounds error in CCMathUtil.cpp
        https://bugs.webkit.org/show_bug.cgi?id=87915

        Reviewed by James Robinson.

        Two unit tests added to CCMathUtilTest:
            CCMathUtilTest.verifyEnclosingClippedRectUsesCorrectInitialBounds
            CCMathUtilTest.verifyEnclosingRectOfVerticesUsesCorrectInitialBounds

        While computing bounds, the initial values for xmax and ymax are
        intended to be set to -float_max. It turns out that
        std::numeric_limits<float>::min() actually returns the smallest
        positive value close to zero, which is not what was intended. This
        patch fixes the code to use -float_max instead, which is the
        intended value.

        * platform/graphics/chromium/cc/CCMathUtil.cpp:
        (WebCore::CCMathUtil::mapClippedRect):
        (WebCore::CCMathUtil::projectClippedRect):
        (WebCore::CCMathUtil::computeEnclosingRectOfVertices):
        (WebCore::CCMathUtil::computeEnclosingClippedRect):
        (WebCore):
        * platform/graphics/chromium/cc/CCMathUtil.h:
        (WebCore::HomogeneousCoordinate::HomogeneousCoordinate):
        (HomogeneousCoordinate):
        (WebCore::HomogeneousCoordinate::shouldBeClipped):
        (WebCore::HomogeneousCoordinate::cartesianPoint2d):
        (WebCore):
        (CCMathUtil):

2012-05-30  Patrick Gansterer  <paroga@webkit.org>

        Build fix for WinCE after r118568.

        * platform/text/wince/TextBreakIteratorWinCE.cpp:
        (WebCore::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator):

2012-05-30  Abhishek Arya  <inferno@chromium.org>

        Crash in ContainerNode::parserAddChild.
        https://bugs.webkit.org/show_bug.cgi?id=87903

        Reviewed by Ryosuke Niwa.

        Call the ChildNodeInsertionNotifier.notify call at the end since
        it can destroy |this| and some of the local pointers like |last|.
        This also matches the order of calls - childrenChanged precedes
        ChildNodeInsertionNotifier.notify in updateTreeAfterInsertion and
        ContainerNode::parserInsertBefore.

        Also remove a FIXME since we use ChildNodeInsertionNotifier.notify
        instead of ChildNodeInsertionNotifier.notifyInsertedIntoDocument
        (as recommended in the FIXME).

        Test: fast/dom/child-insertion-notify-crash.html

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::parserAddChild):

2012-05-30  Rick Byers  <rbyers@chromium.org>

        [chromium] Implement pointer and hover CSS media features
        https://bugs.webkit.org/show_bug.cgi?id=87403

        Reviewed by Adam Barth.

        Add initial support for the pointer and hover media features as defined
        here:
        http://dev.w3.org/csswg/css4-mediaqueries/#pointer
        http://dev.w3.org/csswg/css4-mediaqueries/#hover

        For now this only supports the case where we know a touch screen is
        available (currently known only for the chromium port on certain
        platforms).  All other cases continue to behave exactly as if the media
        feature isn't supported.

        Tests: fast/media/mq-pointer.html

        * css/CSSValueKeywords.in:
        * css/MediaFeatureNames.h:
        (MediaFeatureNames):
        * css/MediaQueryEvaluator.cpp:
        (WebCore::getLeastCapablePrimaryPointerDeviceType):
        (WebCore):
        (WebCore::hoverMediaFeatureEval):
        (WebCore::pointerMediaFeatureEval):

        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::InternalSettings):
        (WebCore::InternalSettings::restoreTo):
        (WebCore::InternalSettings::setDeviceSupportsTouch):
        (WebCore):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-05-30  Julien Chaffraix  <jchaffraix@webkit.org>

        Add an helper function to get the style for a cell's flow computation
        https://bugs.webkit.org/show_bug.cgi?id=87902

        Reviewed by Ojan Vafai.

        No expected change in behavior.

        This change introduces styleForCellFlow that unify which function we use
        to determine a cell's direction and writing mode.

        This unification will make it easier to support direction on table row
        group (section in WebKit land).

        * rendering/RenderTableCell.h:
        (WebCore::RenderTableCell::styleForCellFlow):
        Added the new function along with a comment as to its purpose.

        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
        (WebCore::RenderTableCell::computeCollapsedStartBorder):
        (WebCore::RenderTableCell::computeCollapsedEndBorder):
        (WebCore::RenderTableCell::computeCollapsedBeforeBorder):
        (WebCore::RenderTableCell::computeCollapsedAfterBorder):
        (WebCore::RenderTableCell::borderHalfLeft):
        (WebCore::RenderTableCell::borderHalfRight):
        (WebCore::RenderTableCell::borderHalfTop):
        (WebCore::RenderTableCell::borderHalfBottom):
        (WebCore::RenderTableCell::borderHalfStart):
        (WebCore::RenderTableCell::borderHalfEnd):
        (WebCore::RenderTableCell::borderHalfBefore):
        (WebCore::RenderTableCell::borderHalfAfter):
        (WebCore::RenderTableCell::paintCollapsedBorders):
        Mostly mechanical replacement.

        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::cachedCollapsedLeftBorder):
        (WebCore::RenderTableCell::cachedCollapsedRightBorder):
        (WebCore::RenderTableCell::cachedCollapsedTopBorder):
        (WebCore::RenderTableCell::cachedCollapsedBottomBorder):
        Made the argument 'const' now.

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::layoutRows):
        Added a FIXME to unify with the rest.

2012-05-30  Christophe Dumez  <christophe.dumez@intel.com>

        [JSC] SerializedScriptValue.create() succeeds even if MessagePort object cannot be found in transferred ports
        https://bugs.webkit.org/show_bug.cgi?id=87118

        Reviewed by Adam Barth.

        Make SerializedScriptValue.create() throw an exception if one of the
        MessagePort objects cannot be found in the transferred ports. This
        matches the behavior of the V8 implementation.

        Test: webintents/web-intents-obj-constructor.html

        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::CloneSerializer::dumpIfTerminal):

2012-05-30  Mark Pilgrim  <pilgrim@chromium.org>

        [Chromium] Call fileUtilities methods directly
        https://bugs.webkit.org/show_bug.cgi?id=87852

        Reviewed by Adam Barth.

        Part of a refactoring series. See tracking bug 82948.

        * platform/chromium/DragDataChromium.cpp:
        (WebCore::DragData::asURL):
        * platform/chromium/FileSystemChromium.cpp:
        (WebCore::deleteFile):
        (WebCore::deleteEmptyDirectory):
        (WebCore::getFileSize):
        (WebCore::getFileModificationTime):
        (WebCore::getFileMetadata):
        (WebCore::directoryName):
        (WebCore::pathByAppendingComponent):
        (WebCore::makeAllDirectories):
        (WebCore::openFile):
        (WebCore::closeFile):
        (WebCore::seekFile):
        (WebCore::truncateFile):
        (WebCore::readFromFile):
        (WebCore::writeToFile):
        * platform/chromium/PlatformSupport.h:
        (PlatformSupport):

2012-05-30  Kent Tamura  <tkent@chromium.org>

        Form controls in <fieldset disabled> should not be focusable.
        https://bugs.webkit.org/show_bug.cgi?id=87380

        Reviewed by Darin Adler.

        Test: fast/forms/fieldset/focus-in-fieldset-disabled.html

        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::supportsFocus):
        Refer to disabled() instead of m_disabled to take account of wrapping
        fieldset elements.

2012-05-30  Robin Dunn  <robin@alldunn.com>

        [wx] Implement HTML clipboard support.
        https://bugs.webkit.org/show_bug.cgi?id=87883

        Reviewed by Kevin Ollivier.

        * platform/wx/ClipboardWx.cpp:
        (WebCore::ClipboardWx::writeRange):
        * platform/wx/PasteboardWx.cpp:
        (WebCore::Pasteboard::writeSelection):
        (WebCore::Pasteboard::documentFragment):

2012-05-30  Garrett Casto  <gcasto@chromium.org>

        TextFieldDecorationElement should respect style attribute
        https://bugs.webkit.org/show_bug.cgi?id=87762

        Reviewed by Kent Tamura.

        * html/shadow/TextFieldDecorationElement.cpp: Use style set on the
        Element when creating rendering style.
        (WebCore::TextFieldDecorationElement::customStyleForRenderer):

2012-05-30  Ojan Vafai  <ojan@chromium.org>

        Avoid second layout for flex-direction:row, flex-basis:auto flex items
        https://bugs.webkit.org/show_bug.cgi?id=87901

        Reviewed by Tony Chang.

        No new tests. This is strictly a performance optimization and has no other
        web visible changes.

        Also, add FIXMEs for other cases where we could avoid doing layouts. 

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes):
        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
        (WebCore::RenderFlexibleBox::applyStretchAlignmentToChild):

2012-05-30  Zhenyao Mo  <zmo@google.com>

        WebKit incorrectly clears the alpha channel on readPixels, even for Framebuffers
        https://bugs.webkit.org/show_bug.cgi?id=87310

        Reviewed by Kenneth Russell.

        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore):
        (WebCore::WebGLRenderingContext::getParameter): set DEPTH_BITS/STENCIL_BITS to 0 if related channels are not requested.
        (WebCore::WebGLRenderingContext::readPixels): don't do the alpha value fix if the current bound is not the internal drawing buffer.

2012-05-30  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118986.
        http://trac.webkit.org/changeset/118986
        https://bugs.webkit.org/show_bug.cgi?id=87914

        Caused several IndexedDB browser_test failures on Chromium
        canary builders (Requested by rafaelw_ on #webkit).

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::advance):
        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::setVersion):
        * Modules/indexeddb/IDBDatabaseError.h:
        (WebCore::IDBDatabaseError::create):
        (IDBDatabaseError):
        (WebCore::IDBDatabaseError::createWithoutOffset):
        (WebCore::IDBDatabaseError::code):
        (WebCore::IDBDatabaseError::setCode):
        (WebCore::IDBDatabaseError::setMessage):
        (WebCore::IDBDatabaseError::IDBDatabaseError):
        * Modules/indexeddb/IDBDatabaseException.cpp:
        (WebCore):
        (WebCore::IDBDatabaseException::initializeDescription):
        * Modules/indexeddb/IDBDatabaseException.h:
        (IDBDatabaseException):
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::createIndex):
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::resetReadyState):
        (WebCore::IDBRequest::abort):
        (WebCore::IDBRequest::onError):
        (WebCore::IDBRequest::onSuccess):
        (WebCore::IDBRequest::onSuccessWithContinuation):
        (WebCore::IDBRequest::dispatchEvent):
        * Modules/indexeddb/IDBRequest.h:
        (IDBRequest):
        * Modules/indexeddb/IDBRequest.idl:
        * Modules/indexeddb/IDBTransaction.cpp:
        * Modules/indexeddb/IDBTransaction.h:
        (IDBTransaction):
        * Modules/indexeddb/IDBTransaction.idl:

2012-05-30  Dominic Mazzoni  <dmazzoni@chromium.org>

        [Chromium] AX: WebAccessibilityObject should check if an AccessibilityObject is detached
        https://bugs.webkit.org/show_bug.cgi?id=87778

        Reviewed by Adam Barth.

        Chromium was never actually using AccessibilityObjectWrapper, so
        this change deletes it. Instead, it's replaced with a simple bool
        that keeps track of whether an AccessibilityObject was detached or
        not. WebKit/chromium/public/WebAccessibilityObject can then use this
        to determine if an object is still valid.

        Test: accessibility/accessibility-object-detached.html

        * WebCore.gypi:
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::AccessibilityObject):
        (WebCore::AccessibilityObject::detach):
        (WebCore::AccessibilityObject::isDetached):
        (WebCore):
        * accessibility/AccessibilityObject.h:
        (AccessibilityObject):
        * accessibility/chromium/AXObjectCacheChromium.cpp:
        (WebCore):
        (WebCore::AXObjectCache::detachWrapper):
        (WebCore::AXObjectCache::attachWrapper):
        * accessibility/chromium/AccessibilityObjectWrapper.h: Removed.

2012-05-30  Shawn Singh  <shawnsingh@chromium.org>

        Simplify TransformationMatrix rotation code to improve precision
        https://bugs.webkit.org/show_bug.cgi?id=86666

        Reviewed by Adrienne Walker.

        Change covered by existing layout tests;
        Additional unit tests added.

        The original rotation code for WebCore::TransformationMatrix was
        using indirect trig identities to compute basic rotation
        matrices. As far as I can imagine, this is unnecessary, and brief
        informal experiments showed that we can gain a few extra bits of
        precision by avoiding that indirection.

        Indeed, precision improved such that it revealed a mistake on one
        of the unit tests, where the test was actually degenerate so that
        the layer was aligned with a viewport boundary. When it was
        imprecise, it didnt appear to be aligned. Putting an additional
        translation on that test fixes it so it is no longer a degenerate
        test.

        This patch also revealed a few chinks in the unit testing armor of
        this code, an error that should have been caught in unit tests was
        luckily caught by SVG layout tests. This chink is fixed by adding
        2 extra unit tests.

        * platform/graphics/transforms/TransformationMatrix.cpp:
        (WebCore::TransformationMatrix::rotate3d):

2012-05-30  Alec Flett  <alecflett@chromium.org>

        IndexedDB: Remove old get/getKey implementations
        https://bugs.webkit.org/show_bug.cgi?id=87879

        Reviewed by Ojan Vafai.

        Removal of dead code, was scaffolding for a complicated
        Chromium landing.

        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
        (WebCore::IDBIndexBackendImpl::getInternal):
        (WebCore::IDBIndexBackendImpl::getKeyInternal):
        (WebCore::IDBIndexBackendImpl::get):
        (WebCore::IDBIndexBackendImpl::getKey):
        * Modules/indexeddb/IDBIndexBackendImpl.h:
        (IDBIndexBackendImpl):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::get):
        (WebCore::IDBObjectStoreBackendImpl::getInternal):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
        (IDBObjectStoreBackendImpl):

2012-05-30  Joe Mason  <jmason@rim.com>

        [BlackBerry] Fix assertion fail on redirect due to multiple jobs per handle
        https://bugs.webkit.org/show_bug.cgi?id=87579

        Reviewed by George Staikos.

        RIM PR #158892:

        When we start a redirect, we now call cancelJob instead of just deleting it immediately to make sure
        that all cleanup is performed. However, we also reassign the ResourceHandle to the new job, and
        since cancelJob is asynchronous it is now assigned to two jobs simultaneously.

        Work around this by only returning handles that have not been cancelled from findJobForHandle.
        Cancelled jobs still technically exist in the jobs list, but they're invisible to callers. This is
        safe because there is literally nothing that can be done with a cancelled job - it is supposed to
        merely consume any notifications that are already in progress and then kill itself off - so no
        callers of findJobForHandle are expecting a cancelled job. (All existing callers call methods on the
        returned job which are no-ops for cancelled jobs, so there is no behaviour change.)

        No new tests because there is no behaviour change (fixes a regression).

        * platform/network/blackberry/NetworkManager.cpp:
        (WebCore::NetworkManager::findJobForHandle):

2012-05-30  Kentaro Hara  <haraken@chromium.org>

        [V8][Performance] Optimize DOM attribute getters that return an empty string
        https://bugs.webkit.org/show_bug.cgi?id=87820

        Reviewed by Adam Barth.

        This patch optimizes the performance of DOM attribute getters that return an
        empty string by 65.8% (e.g. div.id, div.className, div.title, div.lang ...etc)

        Performance test: Bindings/undefined-id-getter.html

        [Without the patch]
        RESULT Bindings: undefined-id-getter= 441.984669644 runs/s
        median= 445.544554455 runs/s, stdev= 11.8406070959 runs/s, min= 405.063291139 runs/s, max= 447.204968944 runs/s

        [With the patch]
        RESULT Bindings: undefined-id-getter= 738.840460474 runs/s
        median= 738.786279683 runs/s, stdev= 2.00249797161 runs/s, min= 733.944954128 runs/s, max= 741.721854305 runs/s

        - This patch passes Isolate to v8::String::Empty(), which removes Isolate
        look-up inside v8::String::Empty().

        - This patch inlines V8Binding::getElementStringAttr() and
        V8Binding::setElementStringAttr().

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrGetter):
        (GenerateNormalAttrSetter):
        * bindings/v8/V8Binding.cpp:
        (WebCore::StringCache::v8ExternalStringSlow):
        * bindings/v8/V8Binding.h:
        (WebCore::StringCache::v8ExternalString):
        (StringCache):
        (WebCore::v8ExternalString):
        (WebCore):

2012-05-30  Kentaro Hara  <haraken@chromium.org>

        [V8] Implement V8Binding::v8BooleanWithCheck(isolate)
        https://bugs.webkit.org/show_bug.cgi?id=87814

        Reviewed by Adam Barth.

        The objective is to pass Isolate to v8::True() and v8::False().
        Similarly to v8NullWithCheck() (bug 87713), this patch implements
        V8Binding::v8BooleanWithCheck(isolate), which calls v8::True()/v8::False()
        or v8::True(isolate)/v8::False(isolate) depending on whether the
        passed isolate is null or not.

        This patch also passes Isolate to v8Boolean() in CodeGeneratorV8.pm.

        No tests. No behavior change.

        * bindings/scripts/CodeGeneratorV8.pm:
        (NativeToJSValue):
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        (WebCore::TestEventTargetV8Internal::dispatchEventCallback):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::createAttrGetter):
        (WebCore::TestObjV8Internal::reflectedBooleanAttrAttrGetter):
        (WebCore::TestObjV8Internal::reflectedCustomBooleanAttrAttrGetter):
        * bindings/v8/V8Binding.h:
        (WebCore::v8Boolean):
        (WebCore):
        (WebCore::v8BooleanWithCheck):

2012-05-30  Kentaro Hara  <haraken@chromium.org>

        [V8] Replace v8::True() and v8::False() with v8Boolean()
        https://bugs.webkit.org/show_bug.cgi?id=87812

        Reviewed by Adam Barth.

        To avoid implementing all of v8TrueWithCheck(isolate), v8FalseWithCheck(isolate)
        and v8BooleanWithCheck(isolate), we can first replace v8::True() and v8::False()
        with v8Boolean(). Then we can just implement v8BooleanWithCheck(isolate).

        No tests. No change in behavior.

        * bindings/v8/SerializedScriptValue.cpp:
        * bindings/v8/V8Binding.h:
        (WebCore::v8StringOrFalse):
        * bindings/v8/V8NPUtils.cpp:
        (WebCore::convertNPVariantToV8Object):
        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        (WebCore::V8DOMStringMap::namedPropertyDeleter):
        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
        (WebCore::V8InjectedScriptHost::isHTMLAllCollectionCallback):
        * bindings/v8/custom/V8StorageCustom.cpp:
        (WebCore::storageDeleter):

2012-05-30  Kentaro Hara  <haraken@chromium.org>

        [V8] Replace v8::Null() with v8NullWithCheck(isolate) in custom bindings where isolate can be 0
        https://bugs.webkit.org/show_bug.cgi?id=87807

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch replaces v8::Null() with v8NullWithCheck(isolate)
        in custom bindings where isolate can be 0.

        'where isolate can be 0' means all the places where we cannot
        retrieve Isolate directly from AccessorInfo or Arguments.

        No tests. No behavior change.

        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8CSSRuleCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8CSSValueCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DOMTokenListCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DataViewCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DocumentCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8EntryCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8EntrySyncCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8EventCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Float32ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Float64ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8HTMLElementCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8IDBAnyCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8IDBKeyCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ImageDataCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Int16ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Int32ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Int8ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8LocationCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8NodeCustom.cpp:
        (WebCore::toV8Slow):
        * bindings/v8/custom/V8SVGDocumentCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8SVGElementCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8SVGPathSegCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ScriptProfileCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ScriptProfileNodeCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8StyleSheetCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Uint16ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Uint32ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Uint8ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Uint8ClampedArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8WorkerContextCustom.cpp:
        (WebCore::toV8):

2012-05-30  Kentaro Hara  <haraken@chromium.org>

        [V8] Replace v8::Null() with v8::Null(isolate) or v8NullWithCheck(isolate) in non-custom bindings
        https://bugs.webkit.org/show_bug.cgi?id=87810

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        For non-custom bindings, we replace v8::Null() with v8::Null(isolate)
        where isolate cannot be 0, and replace v8::Null() with v8NullWithCheck(isolate)
        where isolate can be 0.

        This will be the final patch for passing Isolate to v8::Null().

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrGetter):
        (GenerateFunctionCallback):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::contentDocumentAttrGetter):
        (WebCore::TestObjV8Internal::getSVGDocumentCallback):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedValueAttrGetter):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedReadonlyValueAttrGetter):
        * bindings/v8/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::deserialize):
        * bindings/v8/V8DOMWrapper.cpp:
        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):

2012-05-30  Kentaro Hara  <haraken@chromium.org>

        [V8] Replace v8::Null() with v8::Null(isolate) in custom bindings where isolate shouldn't be 0
        https://bugs.webkit.org/show_bug.cgi?id=87809

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch replaces v8::Null() with v8::Null(isolate) in custom bindings
        where isolate shouldn't be 0. 'where isolate shouldn't be 0' is the place
        where isolate is retrieved directly from AccessorInfo and Arguments.

        This patch includes a couple of refactorings:

        - Makes V8DeviceMotionEvent::createAccelerationObject() and
        V8DeviceMotionEvent::createRotationRateObject() static

        - Moves V8HTMLElement::toV8Object() into the existing ENABLE(MICRODATA) flag.

        No tests. No change in behavior.

        * bindings/v8/custom/V8ClipboardCustom.cpp:
        (WebCore::V8Clipboard::typesAccessorGetter):
        * bindings/v8/custom/V8CoordinatesCustom.cpp:
        (WebCore::V8Coordinates::altitudeAccessorGetter):
        (WebCore::V8Coordinates::altitudeAccuracyAccessorGetter):
        (WebCore::V8Coordinates::headingAccessorGetter):
        (WebCore::V8Coordinates::speedAccessorGetter):
        * bindings/v8/custom/V8DeviceMotionEventCustom.cpp:
        (WebCore::V8DeviceMotionEvent::accelerationAccessorGetter):
        (WebCore::V8DeviceMotionEvent::accelerationIncludingGravityAccessorGetter):
        (WebCore::V8DeviceMotionEvent::rotationRateAccessorGetter):
        (WebCore::V8DeviceMotionEvent::intervalAccessorGetter):
        * bindings/v8/custom/V8DeviceOrientationEventCustom.cpp:
        (WebCore::V8DeviceOrientationEvent::alphaAccessorGetter):
        (WebCore::V8DeviceOrientationEvent::betaAccessorGetter):
        (WebCore::V8DeviceOrientationEvent::gammaAccessorGetter):
        (WebCore::V8DeviceOrientationEvent::absoluteAccessorGetter):
        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
        (WebCore::V8Document::locationAccessorGetter):
        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
        (WebCore::V8HTMLCanvasElement::getContextCallback):
        * bindings/v8/custom/V8HTMLElementCustom.cpp:
        (WebCore::toV8):
        (WebCore):
        (WebCore::toV8Object):
        * bindings/v8/custom/V8HistoryCustom.cpp:
        (WebCore::V8History::stateAccessorGetter):
        * bindings/v8/custom/V8MessageEventCustom.cpp:
        (WebCore::V8MessageEvent::dataAccessorGetter):
        * bindings/v8/custom/V8NodeCustom.cpp:
        (WebCore::V8Node::insertBeforeCallback):
        (WebCore::V8Node::replaceChildCallback):
        (WebCore::V8Node::removeChildCallback):
        (WebCore::V8Node::appendChildCallback):
        * bindings/v8/custom/V8PopStateEventCustom.cpp:
        (WebCore::V8PopStateEvent::stateAccessorGetter):
        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
        (WebCore::V8SQLResultSetRowList::itemCallback):
        * bindings/v8/custom/V8TrackEventCustom.cpp:
        (WebCore::V8TrackEvent::trackAccessorGetter):
        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
        (WebCore::toV8Object):
        (WebCore::V8WebGLRenderingContext::getAttachedShadersCallback):
        (WebCore::V8WebGLRenderingContext::getSupportedExtensionsCallback):

2012-05-30  Nico Weber  <thakis@chromium.org>

        Make the files attribute of HTMLInputElement writable
        https://bugs.webkit.org/show_bug.cgi?id=87154

        Reviewed by Adam Barth.

        whatwg thread:
        http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2012-May/036140.html

        * bindings/objc/PublicDOMInterfaces.h:
            Remove readonly on files property.
        * html/FileInputType.cpp:
        (FileInputType):
            Add a NULL check to setFiles().
        * html/FileInputType.h:
        (FileInputType):
            Let setFiles() overwrite the base  class's method.
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::setFiles):
            Add setFiles() implementation, delegate to input type.
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/HTMLInputElement.idl:
        * html/InputType.cpp:
        (WebCore::InputType::setFiles):
            setFiles() does nothing by default.
        * html/InputType.h:
        (InputType):
            Add a virtual setFiles() method.

2012-05-30  Joe Mason  <jmason@rim.com>

        [BlackBerry] Remove useless string->char*->string conversion in NetworkJob.
        https://bugs.webkit.org/show_bug.cgi?id=87861

        Reviewed by Antonio Gomes.

        RIM PR #152383: username is a WTF::String.  ResourceHandleInternal::m_user is a string.  Yet they're
        assigned with "username = m_user.utf8().data()".  Pointless: "username = m_user" will do.

        No new tests since there is no behaviour change.

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::sendRequestWithCredentials):

2012-05-30  Dan Bernstein  <mitz@apple.com>

        [Qt] REGRESSION(r118568): It broke fast/forms/textarea-maxlength.html on Qt 4.8
        https://bugs.webkit.org/show_bug.cgi?id=87740

        Reviewed by Darin Adler.

        * platform/text/qt/TextBreakIteratorQt.cpp:
        (WebCore::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator): Changed to use
        the return value of setUpIterator.

2012-05-30  Zeno Albisser  <zeno@webkit.org>

        GraphicsSurface: allow importing and exporting of textures directly on GPU side.
        https://bugs.webkit.org/show_bug.cgi?id=87725

        Add copyFromFramebuffer function to copy a texture from an FBO
        onto the GraphicsSurface.
        Add getTextureID function to export the texture ID.
        This allows binding/blitting the texture directly on the GPU.

        Reviewed by Noam Rosenthal.

        * platform/graphics/surfaces/GraphicsSurface.cpp:
        (WebCore::GraphicsSurface::getTextureID):
        (WebCore):
        (WebCore::GraphicsSurface::copyFromFramebuffer):
        * platform/graphics/surfaces/GraphicsSurface.h:
        (GraphicsSurface):
        * platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp:
        (WebCore::GraphicsSurface::platformGetTextureID):
        (WebCore):
        (WebCore::GraphicsSurface::platformCopyFromFramebuffer):

2012-05-30  Alec Flett  <alecflett@chromium.org>

        IndexedDB: Implement IDBTransaction.error and IDBRequest.error
        https://bugs.webkit.org/show_bug.cgi?id=87865

        Reviewed by Tony Chang.

        Added "error" attribute to IDBRequest and IDBTransaction. Update
        IDBDatabaseError to honor the IDBDatabaseException behavior
        of dealing with IDB-specific throws of DOMException codes,
        as per the spec.

        Existing tests which previously tested 'errorCode' and
        'webkitErrorMessage' have been updated to use the new attribute.

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::advance):
        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::setVersion):
        * Modules/indexeddb/IDBDatabaseError.h:
        (WebCore::IDBDatabaseError::create):
        (WebCore::IDBDatabaseError::code):
        (WebCore::IDBDatabaseError::idbCode):
        (WebCore::IDBDatabaseError::name):
        (WebCore::IDBDatabaseError::IDBDatabaseError):
        (IDBDatabaseError):
        * Modules/indexeddb/IDBDatabaseException.cpp:
        (WebCore):
        (WebCore::getErrorEntry):
        (WebCore::IDBDatabaseException::initializeDescription):
        (WebCore::IDBDatabaseException::getErrorName):
        (WebCore::IDBDatabaseException::getLegacyErrorCode):
        * Modules/indexeddb/IDBDatabaseException.h:
        (IDBDatabaseException):
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::createIndex):
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::error):
        (WebCore):
        (WebCore::IDBRequest::resetReadyState):
        (WebCore::IDBRequest::abort):
        (WebCore::IDBRequest::onError):
        (WebCore::IDBRequest::onSuccess):
        (WebCore::IDBRequest::onSuccessWithContinuation):
        (WebCore::IDBRequest::dispatchEvent):
        * Modules/indexeddb/IDBRequest.h:
        (IDBRequest):
        * Modules/indexeddb/IDBRequest.idl:
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::error):
        (WebCore):
        (WebCore::IDBTransaction::setError):
        * Modules/indexeddb/IDBTransaction.h:
        (IDBTransaction):
        * Modules/indexeddb/IDBTransaction.idl:

2012-05-30  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        [Qt] ImageDecoderQt doesn't support some decoders.
        https://bugs.webkit.org/show_bug.cgi?id=87851

        Reviewed by Kenneth Rohde Christiansen.

        If forced to decode GIF and JPEG, ImageDecoderQt show several
        artifacts. This is caused by mismatched decoded image-formats.

        Convert mismatched color spaces into ARGB color space, and perform
        manual mem-copy when the image has been decoded into a new buffer.

        This patch also add support for down-scaling in the decoder.

        * platform/graphics/qt/ImageDecoderQt.cpp:
        (WebCore::ImageDecoderQt::internalDecodeSize):
        (WebCore::ImageDecoderQt::internalHandleCurrentImage):

2012-05-30  Emil A Eklund  <eae@chromium.org>

        Floats wraps incorrectly when top edge has subpixel precision
        https://bugs.webkit.org/show_bug.cgi?id=87688

        Reviewed by Levi Weintraub.
        
        When computing the logical left and right offsets for a float we
        incorrectly floored the logical top when passing it to the float search
        adapter. This caused it to return incorrect values where the floored and
        pixel snapped values are not the same.

        Test: fast/sub-pixel/float-wrap-with-subpixel-top.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::logicalLeftOffsetForLine):
        (WebCore::RenderBlock::logicalRightOffsetForLine):

2012-05-30  Emil A Eklund  <eae@chromium.org>

        Inline blocks with margin wrap incorrectly with subpixel layout turned on
        https://bugs.webkit.org/show_bug.cgi?id=87897

        Reviewed by Levi Weintraub.

        Change WebCore::getBorderPaddingMargin and the helper function
        getBPMWidth to return a LayoutUnit rather than an int as the padding and
        margin values have subpixel precision. This fixes an issue where we would
        incorrectly wrap inline blocks with a subpixel padding or margin. 

        Test: fast/sub-pixel/inline-block-with-margin.html

        * rendering/RenderBlock.cpp:
        (WebCore::getBPMWidth):
        (WebCore::getBorderPaddingMargin):
        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):

2012-05-30  Tony Chang  <tony@chromium.org>

        rename flexbox css values from justify and distribute to space-between and space-around
        https://bugs.webkit.org/show_bug.cgi?id=87867

        Reviewed by Ojan Vafai.

        This was recently changed in the spec:
        http://dev.w3.org/csswg/css3-flexbox/#justify-content

        No new tests, updated existing tests and expectations.

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator EFlexPack):
        (WebCore::CSSPrimitiveValue::operator EFlexLinePack):
        * css/CSSValueKeywords.in:
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::initialPackingOffset):
        (WebCore::packingSpaceBetweenChildren):
        (WebCore::initialLinePackingOffset):
        (WebCore::linePackingSpaceBetweenChildren):
        * rendering/style/RenderStyleConstants.h:

2012-05-30  Kevin Ollivier  <kevino@theolliviers.com>

        [wx] Unreviewed build fix. Make sure we get the file size with the proper native type.

        * platform/wx/FileSystemWx.cpp:
        (WebCore::getFileMetadata):

2012-05-30  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118913.
        http://trac.webkit.org/changeset/118913
        https://bugs.webkit.org/show_bug.cgi?id=87891

        patch is incorrect (see comments in
        https://bugs.webkit.org/show_bug.cgi?id=87889) (Requested by
        thorton on #webkit).

        * css/CSSFontFaceSrcValue.cpp:
        (WebCore::CSSFontFaceSrcValue::addSubresourceStyleURLs):
        * css/CSSFontFaceSrcValue.h:
        (CSSFontFaceSrcValue):
        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::addSubresourceStyleURLs):
        * css/CSSPrimitiveValue.h:
        (CSSPrimitiveValue):
        * css/CSSReflectValue.cpp:
        (WebCore::CSSReflectValue::addSubresourceStyleURLs):
        * css/CSSReflectValue.h:
        (CSSReflectValue):
        * css/CSSValue.cpp:
        (WebCore::CSSValue::addSubresourceStyleURLs):
        * css/CSSValue.h:
        (CSSValue):
        * css/CSSValueList.cpp:
        (WebCore::CSSValueList::addSubresourceStyleURLs):
        * css/CSSValueList.h:
        (CSSValueList):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::addSubresourceStyleURLs):
        * css/StylePropertySet.h:
        (StylePropertySet):
        * css/StyleSheetContents.cpp:
        (WebCore::StyleSheetContents::addSubresourceStyleURLs):
        * css/StyleSheetContents.h:
        (StyleSheetContents):
        * dom/Element.h:
        * dom/Node.cpp:
        (WebCore::Node::getSubresourceURLs):
        * dom/Node.h:
        (WebCore::Node::addSubresourceAttributeURLs):
        (WebCore):
        * dom/ProcessingInstruction.cpp:
        (WebCore::ProcessingInstruction::addSubresourceAttributeURLs):
        * dom/ProcessingInstruction.h:
        (ProcessingInstruction):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::addSubresourceAttributeURLs):
        * dom/StyledElement.h:
        (StyledElement):
        * html/HTMLBodyElement.cpp:
        (WebCore::HTMLBodyElement::addSubresourceAttributeURLs):
        * html/HTMLBodyElement.h:
        (HTMLBodyElement):
        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::addSubresourceAttributeURLs):
        * html/HTMLEmbedElement.h:
        (HTMLEmbedElement):
        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::addSubresourceAttributeURLs):
        * html/HTMLImageElement.h:
        (HTMLImageElement):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::addSubresourceAttributeURLs):
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::addSubresourceAttributeURLs):
        * html/HTMLLinkElement.h:
        (HTMLLinkElement):
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::addSubresourceAttributeURLs):
        * html/HTMLObjectElement.h:
        (HTMLObjectElement):
        * html/HTMLParamElement.cpp:
        (WebCore::HTMLParamElement::addSubresourceAttributeURLs):
        * html/HTMLParamElement.h:
        (HTMLParamElement):
        * html/HTMLScriptElement.cpp:
        (WebCore::HTMLScriptElement::addSubresourceAttributeURLs):
        * html/HTMLScriptElement.h:
        (HTMLScriptElement):
        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::addSubresourceAttributeURLs):
        * html/HTMLStyleElement.h:
        (HTMLStyleElement):
        * html/HTMLTableCellElement.cpp:
        (WebCore::HTMLTableCellElement::addSubresourceAttributeURLs):
        * html/HTMLTableCellElement.h:
        (HTMLTableCellElement):
        * html/HTMLTableElement.cpp:
        (WebCore::HTMLTableElement::addSubresourceAttributeURLs):
        * html/HTMLTableElement.h:
        (HTMLTableElement):
        * svg/SVGCursorElement.cpp:
        (WebCore::SVGCursorElement::addSubresourceAttributeURLs):
        * svg/SVGCursorElement.h:
        (SVGCursorElement):
        * svg/SVGFEImageElement.cpp:
        (WebCore::SVGFEImageElement::addSubresourceAttributeURLs):
        * svg/SVGFEImageElement.h:
        (SVGFEImageElement):
        * svg/SVGImageElement.cpp:
        (WebCore::SVGImageElement::addSubresourceAttributeURLs):
        * svg/SVGImageElement.h:
        (SVGImageElement):
        * svg/SVGScriptElement.cpp:
        (WebCore::SVGScriptElement::addSubresourceAttributeURLs):
        * svg/SVGScriptElement.h:
        (SVGScriptElement):

2012-05-30  Shezan Baig  <shezbaig.wk@gmail.com>

        Rename offsetTopLeft in RenderBoxModelObject to something better
        https://bugs.webkit.org/show_bug.cgi?id=85915

        Reviewed by Darin Adler.

        Renamed offsetTopLeft in RenderBoxModelObject to
        adjustedPositionRelativeToOffsetParent, because it returns the given
        startPoint after adjusting it to be relative to the top-left corner of
        the offsetParent.  The definition of offsetParent itself is non-trivial
        and is documented within the body of RenderObject::offsetParent,
        therefore I decided to reuse this term, as-is, in the name of this
        function.

        No new tests; no functional or visible changes.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::offsetLeft):
        (WebCore::RenderBox::offsetTop):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::adjustedPositionRelativeToOffsetParent):
        (WebCore::RenderBoxModelObject::offsetLeft):
        (WebCore::RenderBoxModelObject::offsetTop):
        * rendering/RenderBoxModelObject.h:
        (RenderBoxModelObject):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::offsetLeft):
        (WebCore::RenderInline::offsetTop):

2012-05-29  Adrienne Walker  <enne@google.com>

        Transformed fixed position layers have an incorrect overlap map entry
        https://bugs.webkit.org/show_bug.cgi?id=64201

        Reviewed by Darin Adler.

        Previously, layers that both had a transform and were fixed position
        were not considered as being fixed position in RenderGeometryMap or in
        RenderBox::mapLocalToContainer (although this case is not incorrect in
        the case of painting, so an external caller likely adjusts for this).

        Tests: compositing/layer-creation/fixed-position-and-transform.html
               compositing/layer-creation/fixed-position-under-transform.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::mapLocalToContainer):
        * rendering/RenderGeometryMap.cpp:
        (WebCore::RenderGeometryMap::mapToAbsolute):

2012-05-30  Ulan Degenbaev  <ulan@chromium.org>

        [v8] Crash after redefining setter on typed array to a number
        https://bugs.webkit.org/show_bug.cgi?id=87862

        Reviewed by Kenneth Russell.

        Remove calls to typed array set() method from C++.
        Store the copying script as a hidden property of a typed array prototype.

        Test: fast/canvas/webgl/array-override-set.html

        * bindings/v8/custom/V8ArrayBufferViewCustom.cpp:
        (WebCore):
        (WebCore::getHiddenCopyMethod):
        (WebCore::installHiddenCopyMethod):
        (WebCore::copyElements):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore):
        (WebCore::constructWebGLArray):
        (WebCore::setWebGLArrayHelper):
        * bindings/v8/custom/V8ArrayBufferViewCustomScript.js:

2012-05-30  David Hyatt  <hyatt@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=87882
        
        [New Multicolumn] Rename layoutColumns to relayoutForPagination and make it
        virtual so that it can be implemented by RenderMultiColumnBlock.

        Reviewed by Anders Carlsson.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::layoutBlock):
        (WebCore::RenderBlock::relayoutForPagination):
        * rendering/RenderBlock.h:
        (RenderBlock):
        * rendering/RenderMultiColumnBlock.cpp:
        (WebCore::RenderMultiColumnBlock::relayoutForPagination):
        (WebCore):
        * rendering/RenderMultiColumnBlock.h:
        (RenderMultiColumnBlock):

2012-05-30  Daniel Drake  <dsd@laptop.org>

        Check for GTK2/GTK3 symbol mismatch earlier
        https://bugs.webkit.org/show_bug.cgi?id=87687

        Reviewed by Martin Robinson.

        No new tests. Regressions in core behavior are covered by existing
        plugin tests and the fix deals with particular aspects of the system
        environment that are difficult to test.

        Detect plugins that would mix GTK+ symbols earlier, so that the
        WebKit can skip them and choose a more appropriate plugin module.

        * plugins/gtk/PluginPackageGtk.cpp: Move this code from PluginViewGtk.
        (WebCore::moduleMixesGtkSymbols):
        (WebCore::PluginPackage::load):
        * plugins/gtk/PluginViewGtk.cpp: Move this code to PluginPackageGtk.
        (WebCore::PluginView::platformStart):

2012-05-30  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        [Qt] Support IMAGE_DECODER_DOWN_SAMPLING flag.
        https://bugs.webkit.org/show_bug.cgi?id=87840

        Based on patches by Qi Zhang and Jussi Lehto.
        Reviewed by Kenneth Rohde Christiansen.

        * platform/graphics/Image.cpp:
        (WebCore::Image::adjustSourceRectForDownSampling):
        * platform/graphics/Image.h:
        (Image):
        * platform/graphics/openvg/ImageOpenVG.cpp:
        (WebCore::BitmapImage::draw):
        * platform/graphics/qt/ImageQt.cpp:
        (WebCore::Image::drawPattern):
        (WebCore::BitmapImage::draw):

2012-05-30  Shinya Kawanaka  <shinyak@chromium.org>

        comparePositions in htmlediting should consider nested Shadow DOM.
        https://bugs.webkit.org/show_bug.cgi?id=87623

        Reviewed by Ryosuke Niwa.

        comparePositions in htmlediting.cpp didn't consider nested Shadow DOM.
        This patch makes it possible to compare the nodes in nested Shadow DOM.

        The algorithm is: we calculate the common tree scope of node A and B, and
        adjust the nodes to the treeScope, then compare them. If the adjusted nodes
        are the same, we check the shadow descendent of each node.

        Test: editing/shadow/compare-positions-in-nested-shadow.html

        * dom/TreeScope.cpp:
        (WebCore::listTreeScopes):
        (WebCore):
        (WebCore::commonTreeScope):
        * dom/TreeScope.h:
        (WebCore):
        * editing/htmlediting.cpp:
        (WebCore::comparePositions):

2012-05-30  Erik Arvidsson  <arv@chromium.org>

        [V8] Clean up V8LazyEventListener to use one less function call
        https://bugs.webkit.org/show_bug.cgi?id=87785

        Reviewed by Kentaro Hara.

        Instead of relying on 'arguments' we rely on 'this'. 'this' cannot be intercepted by a
        with-statement so it is safe to use that to bind the context objects. This allows us to
        remove one layer of function indirection in the generated code.

        Covered by existing tests.

        * bindings/v8/V8LazyEventListener.cpp:
        (WebCore::V8LazyEventListener::prepareListenerObject):

2012-05-30  Tim Horton  <timothy_horton@apple.com>

        Factor DeferrableOneShotTimer out of GraphicsContextCG/GeneratorGeneratedImage
        https://bugs.webkit.org/show_bug.cgi?id=87824

        Reviewed by Simon Fraser.

        DeferrableOneShotTimer is a timer which takes a class and method to call (as Timer does),
        and a delay. It exposes restart(), stop(), and isActive(), and none of the rest of
        the TimerBase interface. On restart(), the timer is started with the given delay,
        unless it's already running, in which case a flag is set to automatically restart
        the timer when it fires instead of calling the given method. This provides a
        low-overhead way to implement a deferrable timer.

        No new tests, refactoring.

        * platform/Timer.h:
        (DeferrableOneShotTimer):
        (WebCore::DeferrableOneShotTimer::DeferrableOneShotTimer): New class.
        (WebCore::DeferrableOneShotTimer::restart):
        (WebCore::DeferrableOneShotTimer::fired):
        * platform/graphics/GeneratorGeneratedImage.cpp:
        (WebCore::GeneratorGeneratedImage::invalidateCacheTimerFired):
        * platform/graphics/GeneratorGeneratedImage.h:
        (WebCore::GeneratorGeneratedImage::GeneratorGeneratedImage): Make use of DeferrableOneShotTimer.
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::SubimageCacheWithTimer::SubimageCacheWithTimer): Make use of DeferrableOneShotTimer.
        (WebCore::SubimageCacheWithTimer::invalidateCacheTimerFired):

2012-05-30  Xueqing Huang  <huangxueqing@baidu.com>

        eventSender.beginDragWithFiles should be implemented in Windows, which blocked drag and drop related tests.
        https://bugs.webkit.org/show_bug.cgi?id=86296

        Reviewed by Tony Chang.

        Test: This change was requirement for eventSender.beginDragWithFiles, update win/Skipped file to remove drag and drop related tests will valiate it. 

        * platform/win/DragDataWin.cpp:
        (WebCore::DragData::numberOfFiles):

2012-05-30  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>

        HashTable.h has using directives for std::pair and std::make_pair
        https://bugs.webkit.org/show_bug.cgi?id=29919

        Reviewed by Darin Adler.

        Change code to use std::pair and std::make_pair.

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::postNotification):
        * html/MediaFragmentURIParser.cpp:
        (WebCore::MediaFragmentURIParser::parseFragments):
        * html/parser/HTMLMetaCharsetParser.cpp:
        (WebCore::HTMLMetaCharsetParser::processMeta):
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::brokenImage):
        * page/PageSerializer.cpp:
        (WebCore::isCharsetSpecifyingNode):

2012-05-30  Peter Rybin  <peter.rybin@gmail.com>

        Web Inspector: disable ExactlyInt feature in InspectorTypeBuilder since it breaks release Windows 7 WK2
        https://bugs.webkit.org/show_bug.cgi?id=87857

        Reviewed by Yury Semikhatsky.

        Code generator is patched to support old style of int parameter.

        * inspector/CodeGeneratorInspector.py:
        (TypeModel.init_class):

2012-05-30  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Add trace() method to the WorkerConsole
        https://bugs.webkit.org/show_bug.cgi?id=87656

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshotProxy.js:
        (WebInspector.HeapSnapshotRealWorker.prototype._messageReceived):
        * inspector/front-end/HeapSnapshotWorker.js:
        (WebInspector.WorkerConsole.prototype.trace):

2012-05-30  Kinuko Yasuda  <kinuko@chromium.org>

        File.lastModifiedDate must return null if the modified time info is not available
        https://bugs.webkit.org/show_bug.cgi?id=87709

        Reviewed by Kentaro Hara.

        Per File API spec, File.lastModifiedDate must return null if the
        modified time info is not available.
        http://dev.w3.org/2006/webapi/FileAPI/#dfn-lastModifiedDate

        Test: http/tests/local/fileapi/file-last-modified-after-delete.html

        * fileapi/File.cpp:
        (WebCore::File::lastModifiedDateForBinding): Added.
        (WebCore):
        * fileapi/File.h:
        (File):
        * fileapi/File.idl: Added ImplementedAs=lastModifiedDateForBinding.

2012-05-30  Jochen Eisinger  <jochen@chromium.org>

        Match Firefox restrictions to window.blur and window.focus
        https://bugs.webkit.org/show_bug.cgi?id=86969

        Reviewed by Adam Barth.

        Disallow window.blur altogether, and only allow window.focus to be
        invoked from the context that created this very window.

        There's a new setting (windowFocusRestricted) that defaults to true. If
        false, the new restrictions are lifted. This can be used by ports that
        would prefer to stick with the old behavior.

        For tests, this setting is accessible in window.internals.settings

        To temporarily allow window.focus(), an object of type
        WindowFocusAllowedIndicator can be created. It is currently used to
        enable window.focus() during dispatch of the click event for
        notifications.

        Tests: fast/dom/Window/mozilla-focus-blur.html
               fast/notifications/notifications-click-event-focus.html

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * notifications/Notification.cpp:
        (WebCore::Notification::dispatchClickEvent):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::focus):
        (WebCore::DOMWindow::blur):
        * page/DOMWindow.h:
        (DOMWindow):
        * page/DOMWindow.idl:
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (Settings):
        (WebCore::Settings::setWindowFocusRestricted):
        (WebCore::Settings::windowFocusRestricted):
        * page/WindowFocusAllowedIndicator.cpp: Added.
        (WebCore):
        (WebCore::WindowFocusAllowedIndicator::windowFocusAllowed):
        (WebCore::WindowFocusAllowedIndicator::WindowFocusAllowedIndicator):
        (WebCore::WindowFocusAllowedIndicator::~WindowFocusAllowedIndicator):
        * page/WindowFocusAllowedIndicator.h: Added.
        (WebCore):
        (WindowFocusAllowedIndicator):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::InternalSettings):
        (WebCore::InternalSettings::restoreTo):
        (WebCore::InternalSettings::setWindowFocusRestricted):
        (WebCore):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-05-30  Mariusz Grzegorczyk  <mariusz.g@samsung.com>, Ryuan Choi  <ryuan.choi@samsung.com>

        [EFL][WK2] Fix WebKit2-EFL build
        https://bugs.webkit.org/show_bug.cgi?id=83693

        Reviewed by Carlos Garcia Campos.

        * CMakeLists.txt: Add GestureTapHighlighter.cpp.

2012-05-29  Antti Koivisto  <antti@apple.com>

        Rename Foo::addSubresourceStyleURLs and Node::addSubresourceAttributeURLs
        https://bugs.webkit.org/show_bug.cgi?id=87739

        Rubber-stamped by Andreas Kling.

        Rename them to collectSubresourceURLs and collectSubresourceURLsFromAttributes to match
        the naming conventions.
        
        Move collectSubresourceURLsFromAttributes from Node to Element as only elements have attributes.

        * css/CSSFontFaceSrcValue.cpp:
        (WebCore::CSSFontFaceSrcValue::collectSubresourceURLs):
        * css/CSSFontFaceSrcValue.h:
        (CSSFontFaceSrcValue):
        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::collectSubresourceURLs):
        * css/CSSPrimitiveValue.h:
        (CSSPrimitiveValue):
        * css/CSSReflectValue.cpp:
        (WebCore::CSSReflectValue::collectSubresourceURLs):
        * css/CSSReflectValue.h:
        (CSSReflectValue):
        * css/CSSValue.cpp:
        (WebCore::CSSValue::collectSubresourceURLs):
        * css/CSSValue.h:
        (CSSValue):
        * css/CSSValueList.cpp:
        (WebCore::CSSValueList::collectSubresourceURLs):
        * css/CSSValueList.h:
        (CSSValueList):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::collectSubresourceURLs):
        * css/StylePropertySet.h:
        (StylePropertySet):
        * css/StyleSheetContents.cpp:
        (WebCore::StyleSheetContents::collectSubresourceURLs):
        * css/StyleSheetContents.h:
        (StyleSheetContents):
        * dom/Element.h:
        (WebCore::Element::collectSubresourceURLsFromAttributes):
        (Element):
        * dom/Node.cpp:
        (WebCore::Node::getSubresourceURLs):
        * dom/Node.h:
        (WebCore):
        * dom/ProcessingInstruction.cpp:
        (WebCore::ProcessingInstruction::collectSubresourceURLsFromAttributes):
        * dom/ProcessingInstruction.h:
        (ProcessingInstruction):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::collectSubresourceURLsFromAttributes):
        * dom/StyledElement.h:
        (StyledElement):
        * html/HTMLBodyElement.cpp:
        (WebCore::HTMLBodyElement::collectSubresourceURLsFromAttributes):
        * html/HTMLBodyElement.h:
        (HTMLBodyElement):
        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::collectSubresourceURLsFromAttributes):
        * html/HTMLEmbedElement.h:
        (HTMLEmbedElement):
        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::collectSubresourceURLsFromAttributes):
        * html/HTMLImageElement.h:
        (HTMLImageElement):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::collectSubresourceURLsFromAttributes):
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::collectSubresourceURLsFromAttributes):
        * html/HTMLLinkElement.h:
        (HTMLLinkElement):
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::collectSubresourceURLsFromAttributes):
        * html/HTMLObjectElement.h:
        (HTMLObjectElement):
        * html/HTMLParamElement.cpp:
        (WebCore::HTMLParamElement::collectSubresourceURLsFromAttributes):
        * html/HTMLParamElement.h:
        (HTMLParamElement):
        * html/HTMLScriptElement.cpp:
        (WebCore::HTMLScriptElement::collectSubresourceURLsFromAttributes):
        * html/HTMLScriptElement.h:
        (HTMLScriptElement):
        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::collectSubresourceURLsFromAttributes):
        * html/HTMLStyleElement.h:
        (HTMLStyleElement):
        * html/HTMLTableCellElement.cpp:
        (WebCore::HTMLTableCellElement::collectSubresourceURLsFromAttributes):
        * html/HTMLTableCellElement.h:
        (HTMLTableCellElement):
        * html/HTMLTableElement.cpp:
        (WebCore::HTMLTableElement::collectSubresourceURLsFromAttributes):
        * html/HTMLTableElement.h:
        (HTMLTableElement):
        * svg/SVGCursorElement.cpp:
        (WebCore::SVGCursorElement::collectSubresourceURLsFromAttributes):
        * svg/SVGCursorElement.h:
        (SVGCursorElement):
        * svg/SVGFEImageElement.cpp:
        (WebCore::SVGFEImageElement::collectSubresourceURLsFromAttributes):
        * svg/SVGFEImageElement.h:
        (SVGFEImageElement):
        * svg/SVGImageElement.cpp:
        (WebCore::SVGImageElement::collectSubresourceURLsFromAttributes):
        * svg/SVGImageElement.h:
        (SVGImageElement):
        * svg/SVGScriptElement.cpp:
        (WebCore::SVGScriptElement::collectSubresourceURLsFromAttributes):
        * svg/SVGScriptElement.h:
        (SVGScriptElement):

2012-05-30  Eugene Klyuchnikov  <eustas.bug@gmail.com>

        Web Inspector: Fix JS compiler warning
        https://bugs.webkit.org/show_bug.cgi?id=87836

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/SettingsScreen.js: Fix method annotation.

2012-05-30  Zoltan Horvath  <zoltan@webkit.org>

        [Qt] Set WebCore imagedecoders as default and add fallback to QImageDecoder
        https://bugs.webkit.org/show_bug.cgi?id=80400

        This change modifies the default ImageDecoder for Qt-port from QImageDecoder to WebCore ImageDecoder.
        The new behavior is to use QImageDecoder only if WebCoreImageDecoder - and the platform - doesn't support 
        the requested image type.
        The WTF_USE_QT_IMAGE_DECODER macro has been removed, since it is no longer needed.

        This change adds build depedency (except Qt-MAC and Qt-WIN platform) for libpng-dev and libjpeg-dev packages, 
        because PNG and JPEG imagedecoders need not only these libraries, but their headers also. Qmake-config 
        tests for these libraries were introduced in r110045.

        Notice: with using libjpeg-turbo as a system library I measured 10% performance improvement on Methanol benchmark
        (collection of popular sites, page-loading benchmark) with this patch.

        Reviewed by Simon Hausmann.

        No new tests needed.

        * Target.pri: Move WebCore ImageDecoder files out of guards. Remove ImageFrameQt.cpp from sources.
        * WebCore.pri: Move WebCore ImageDecoder include paths out of guards.
        * platform/MIMETypeRegistry.cpp:
        (WebCore::initializeSupportedImageMIMETypes): Add WebCore supported and Qt supported MIME types.
        (WebCore::initializeSupportedImageMIMETypesForEncoding): Use Qt supported MIME types.
        * platform/graphics/ImageSource.cpp: Remove unnecessary includes.
        * platform/graphics/ImageSource.h: Remove unnecessary typedefs.
        (WebCore):
        * platform/graphics/qt/ImageDecoderQt.cpp: Remove ImageDecoder::create, since it is no longer needed.
        (WebCore::ImageDecoderQt::filenameExtension): Remove unnecessary semicolon.
        (WebCore::ImageDecoderQt::internalHandleCurrentImage): Use QImage and ImageFrame instead of QPixmap.
        (WebCore):
        (WebCore::ImageFrame::asNewNativeImage): Moved here from removed ImageFrameQt.cpp.
        * platform/image-decoders/ImageDecoder.cpp: Reorganize the includes of the header.
        (WebCore::ImageDecoder::create): Add platform macro guarded fallback case for QImageDecoder. Add guards
        for JPEG, PNG, ICO decoder for Qt-MAC and Qt-WIN platform.
        * platform/image-decoders/ImageDecoder.h: Remove Qt-specific codes.
        (WebCore::ImageFrame::getAddr): Remove Qt-specific case, since it is no longer needed.
        (ImageFrame):
        * platform/image-decoders/qt/ImageFrameQt.cpp: Removed. Dead code, other code has been moved to
        ImageDecoderQt.cpp.

2012-05-23  Kinuko Yasuda  <kinuko@chromium.org>

        REGRESSION: We should allow null modificationTime when snapshot metadata is given
        https://bugs.webkit.org/show_bug.cgi?id=86811

        Reviewed by Jian Li.

        r117432 has introduced a new File constructor which allows the caller
        to pass in a snapshot file metadata. In the change we had considered the
        given metadata is valid if "metadata.length >= 0 AND metadata.lastModifiedDate != 0",
        but we should drop the latter condition (lastModifiedDate != 0) because

        1. the value 0 is used to indicate the time information is unavailable in File, and
        2. it is valid per spec (http://dev.w3.org/2006/webapi/FileAPI/#dfn-lastModifiedDate says the UA must return null if the information is not available).

        (Note: the current js/v8 binding returns Date(0) for the time value 0,
        which is still valid as epoch time but would fail to indicate the
        unavailability of the information. In this patch I added FIXME in
        File.idl and filed a separate issue http://webkit.org/b/87709)

        No new tests as this change does not affect regular files/filesystems behavior.
        (Tests in Chrome OS port should be able to verify this)

        * fileapi/File.cpp:
        (WebCore::File::lastModifiedDate):
        (WebCore::File::size):
        (WebCore::File::captureSnapshot):
        * fileapi/File.h:
        (File):

2012-05-30  MORITA Hajime  <morrita@google.com>

        [Shadow DOM] HTMLContentElement and HTMLShadowElement constructors should be visible.
        https://bugs.webkit.org/show_bug.cgi?id=87818

        Reviewed by Kentaro Hara.

        Added them as DOMWindow properties

        Tests: fast/dom/shadow/content-element-api.html
               fast/dom/shadow/shadow-element.html

        * page/DOMWindow.idl:

2012-05-30  Mike Lawther  <mikelawther@chromium.org>

        CSS3 calc: Implement CSSOM support
        https://bugs.webkit.org/show_bug.cgi?id=84551

        Reviewed by Ryosuke Niwa.

        Adds a pretty printer for the calc expression tree. 

        Test: css3/calc/cssom.html

        * css/CSSCalculationValue.cpp:
        (WebCore::CSSCalcValue::customCssText):
        (WebCore::CSSCalcPrimitiveValue::customCssText):
        (WebCore::CSSCalcBinaryOperation::customCssText):
        (CSSCalcBinaryOperation):
        * css/CSSCalculationValue.h:
        (CSSCalcExpressionNode):

2012-05-29  Li Yin  <li.yin@intel.com>

        [FileAPI] The result attribute of FileReader shuold use null to replace empty string
        https://bugs.webkit.org/show_bug.cgi?id=87578

        Reviewed by Jian Li.

        Spec: http://www.w3.org/TR/FileAPI/#dfn-result
        If the readyState is EMPTY (no read method has been called) or an error 
        in reading the File or Blob has occurred (using any read method), then the 
        result attribute MUST return null.

        Currently, Firefox11, Opera and IE 10 follows the spec, but Webkit based
        browser doesn't.
        WebKit should change the returned value empty string into null to keep
        conformance with the spec.

        Tests: fast/files/read-file-async.html
               fast/files/workers/worker-read-file-async.html

        * fileapi/FileReader.cpp:
        (WebCore::FileReader::arrayBufferResult):
        (WebCore::FileReader::stringResult):

2012-05-29  Mark Pilgrim  <pilgrim@chromium.org>

        [Chromium] Move fileExists to Platform.h
        https://bugs.webkit.org/show_bug.cgi?id=87531

        Reviewed by Adam Barth.

        Call fileExists through fileUtilities(), not directly.

        * platform/chromium/FileSystemChromium.cpp:
        (WebCore::fileExists):

2012-05-29  Kentaro Hara  <haraken@chromium.org>

        Remove a dummy style sheet from CSSParser::parseFlowThread()
        https://bugs.webkit.org/show_bug.cgi?id=87715

        Reviewed by Darin Adler.

        r118736 changed CSSGrammar.y so that it works fine with no style sheet.
        r118736 removed a dummy style sheet from CSSParser::parserSelector().
        Now we can safely remove a dummy style sheet from parserFlowThread().

        Tests: fast/regions. No change in test results.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseFlowThread):

2012-05-29  Yoshifumi Inoue  <yosin@chromium.org>

        REGRESSION(r111497): The "option" element doesn't match CSS pseudo class :enabled
        https://bugs.webkit.org/show_bug.cgi?id=87719

        Reviewed by Kent Tamura.

        This patch added checking of "option" element for CSS pseudo class :enabled as same as
        :disabled to selector checker. Before r111497, it was done by using isFormControlElement.
        After that revision, HTMLOptionElement was no longer derived from HTMLFormControlElement.

        Test: fast/form/select/optgroup-rendering.html

        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOneSelector): Checking element is option element as same
        as PseudoDisabled in PseudoEnabled case.

2012-05-29  Hayato Ito  <hayato@chromium.org>

        Introduces ComposedShadowTreeParentWalker, extracted from ComposedShadowTreeWalker.
        https://bugs.webkit.org/show_bug.cgi?id=87004

        Reviewed by Dimitri Glazkov.

        Introduces a ComposedShadowTreeParentWalker, which is only used
        for traversing a parent node (including shadow roots and insertion
        points) and get rid of an equivalent function from
        ComposedShadowTreeWalker.

        Before this patch, there is an inconsistency inside of
        ComposedShadowTreeWalker. The Walker uses 'Policy' to decide
        whether it should visit shadow roots or not, but
        parentIncludingInsertionPointAndShadowRoot() member function
        ignores the policy.  We can not add an assertion in its
        constructor due to this inconsistency.  To resolve it, we could
        add yet another special policy, but that makes the implementation
        complex and may add some overhead in runtime.  So separate the
        functionality into another class as ComposedShadowTreeParentWalker.

        No new tests, no new functionality except for assertion.

        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::ComposedShadowTreeWalker::ComposedShadowTreeWalker):
        (WebCore::ComposedShadowTreeParentWalker::ComposedShadowTreeParentWalker):
        (WebCore):
        (WebCore::ComposedShadowTreeParentWalker::parentIncludingInsertionPointAndShadowRoot):
        (WebCore::ComposedShadowTreeParentWalker::traverseParentIncludingInsertionPointAndShadowRoot):
        * dom/ComposedShadowTreeWalker.h:
        (ComposedShadowTreeWalker):
        (WebCore::ComposedShadowTreeWalker::assertPrecondition):
        (WebCore):
        (ComposedShadowTreeParentWalker):
        (WebCore::ComposedShadowTreeParentWalker::get):
        * dom/EventDispatcher.cpp:
        (WebCore::EventRelatedTargetAdjuster::adjust):
        (WebCore::EventDispatcher::ensureEventAncestors):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::updateMouseEventTargetNode):

2012-05-29  Hayato Ito  <hayato@chromium.org>

        Add assertions to make sure that event's target and relatedTarget are accessible.
        https://bugs.webkit.org/show_bug.cgi?id=87641

        Reviewed by Dimitri Glazkov.

        No new tests. No new functionality except for assertions.

        * dom/EventContext.cpp:
        (WebCore::EventContext::EventContext):
        * dom/EventContext.h:
        (WebCore):
        (EventContext):
        (WebCore::EventContext::setRelatedTarget):
        (WebCore::EventContext::accessible):

2012-05-29  Kent Tamura  <tkent@chromium.org>

        Fix inefficient usage of traverseNextNode()
        https://bugs.webkit.org/show_bug.cgi?id=87804

        Reviewed by Ryosuke Niwa.

        foo->traverseNextNode(foo) is equivalent to foo->firstChild(), and
        firstChild() is more efficient.

        No new tests because of no behavior change.

        * html/HTMLFieldSetElement.cpp:
        (WebCore::HTMLFieldSetElement::invalidateDisabledStateUnder):
        Replace traverseNextNode() with firstChild(), and shorten a variable name.
        * svg/SVGSVGElement.cpp:
        (WebCore::SVGSVGElement::getElementById):
        Replace traverseNextNode() with firstChild().

2012-05-29  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>

        [BlackBerry] Loading media data with http authentication
        https://bugs.webkit.org/show_bug.cgi?id=84214

        Reviewed by George Staikos.

        RIM PR: 117618
        Implemented http authentication feature for media by implementing
        two interface functions in class MediaPlayerPrivate:
        onAuthenticationNeeded(): this function is triggered when MMR
        engine requires http authentication. We search the CredentialStorage
        to see if we have already stored existing credential information,
        or challenge user to provide it.
        OnAuthenticationAccepted(): this function is triggered when MMR
        engine accepts the credential information, and we need to save
        it in CredentialStorage for later use.

        Internally reviewed by Max Feil <mfeil@qnx.com>.

        Manual test case: blackberry/video-load-with-authentication.html

        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
        (WebCore::generateProtectionSpaceFromMMRAuthChallenge):
        (WebCore):
        (WebCore::MediaPlayerPrivate::onAuthenticationNeeded):
        (WebCore::MediaPlayerPrivate::onAuthenticationAccepted):
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
        (MediaPlayerPrivate):

2012-05-29  MORITA Hajime  <morrita@google.com>

        [Shadow DOM] Node distribution should be orthogonal from node attachment
        https://bugs.webkit.org/show_bug.cgi?id=87223

        Reviewed by Dimitri Glazkov.

        This chagne reorganizes Shadow DOM subtree distribution implementation.

        Originally, it was interleaved across attach() of several classes like
        InsertionPoint and ShadowRoot. Its invalidation was also mixed as a part of
        the style recalculation and detach()-es.

        This change extracts these bits of code to a set of ContentDistributor methods, which are
        facaded by two ElementShadow API. Following two API are the primary entry points:

        - ElementShadow::ensureDistribution()
        - ElementShadow::invalidateDistribution()

        The actual implementations are ContentDistributor::distribute() and
        ContentDistributor::invalidate() respectively.

        When clients need to traverse composed tree, before attach() for
        example, they should call ensureDistribution() to make sure that
        the traversal data structure ("the distribution") is ready.  When
        there is any DOM mutation which can result a composed tree
        mutation, then clients should call invalidateDistribution() to
        mark the distribution being dated.

        Here are such DOM mutations:

        - The children of any ShadowRoots are changed,
        - The children of any InsertionPoints are changed,
        - The children of any host elements are changed,
        - Any insertion point is inserted to or removed from the shadow tree,
        - @select attribute of <content> is modified and
        - New ShadowRoot is added to the shadow tree.

        Note that the validity of the distribution is tracked and
        unnecessary distribution requests are ignored.

        After the invalidation, that shadow subtrees are detached once and
        request  their  re-attachment  through  the  style  recalculation.
        Then,  on the  responding  style recalculation  and attach(),  new
        distribution will be computed.

        No new tests. Covered by existing tests.

        * dom/Element.cpp:
        (WebCore::Element::~Element):
        (WebCore::Element::childrenChanged):
        * dom/ElementShadow.cpp:
        (WebCore::ElementShadow::~ElementShadow):
        (WebCore::ElementShadow::addShadowRoot):
        (WebCore::ElementShadow::removeAllShadowRoots):
        (WebCore::ElementShadow::attach):
        (WebCore::ElementShadow::recalcStyle):
        (WebCore::ElementShadow::ensureDistribution):
        (WebCore::ElementShadow::invalidateDistribution):
        * dom/ElementShadow.h:
        (ElementShadow):
        * dom/NodeRenderingContext.cpp:
        (WebCore::NodeRenderingContext::NodeRenderingContext):
        (WebCore::NodeRendererFactory::createRendererIfNeeded):
        * dom/NodeRenderingContext.h:
        (NodeRenderingContext):
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::setApplyAuthorStyles):
        (WebCore::ShadowRoot::attach):
        (WebCore::ShadowRoot::childrenChanged):
        (WebCore):
        * dom/ShadowRoot.h:
        (ShadowRoot):
        * html/HTMLFormControlElement.cpp:
        * html/ValidationMessage.cpp:
        (WebCore::ValidationMessage::buildBubbleTree):
        * html/shadow/ContentDistributor.cpp:
        (WebCore::ContentDistributor::ContentDistributor):
        (WebCore::ContentDistributor::~ContentDistributor):
        (WebCore::ContentDistributor::findInsertionPointFor):
        (WebCore::ContentDistributor::distribute):
        (WebCore::ContentDistributor::invalidate):
        (WebCore::ContentDistributor::finishInivalidation):
        (WebCore::ContentDistributor::distributeSelectionsTo):
        (WebCore::ContentDistributor::distributeShadowChildrenTo):
        (WebCore::ContentDistributor::invalidateDistributionIn):
        * html/shadow/ContentDistributor.h:
        (WebCore::ContentDistributor::needsInvalidation):
        (ContentDistributor):
        (WebCore::ContentDistributor::needsDistribution):
        * html/shadow/HTMLContentElement.cpp:
        (WebCore::HTMLContentElement::parseAttribute):
        * html/shadow/InsertionPoint.cpp:
        (WebCore::InsertionPoint::attach):
        (WebCore::InsertionPoint::detach):
        (WebCore::InsertionPoint::nextTo):
        (WebCore::InsertionPoint::previousTo):
        (WebCore::InsertionPoint::childrenChanged):
        * html/shadow/InsertionPoint.h:
        (WebCore::InsertionPoint::setDistribution):
        (WebCore::InsertionPoint::clearDistribution):
        (InsertionPoint):

2012-05-29  Luke Macpherson  <macpherson@chromium.org>

        Implement post-landing feedback for WebKitCSSTransformValue::customCSSText().
        https://bugs.webkit.org/show_bug.cgi?id=87684

        Reviewed by Darin Adler.

        Darin provided some style suggesting on https://bugs.webkit.org/show_bug.cgi?id=87462 after it landed.
        This patch incorporates those suggestions, namely using 0 instead of empty string for UnknownTransformOperation
        and WTF_ARRAY_LENGTH instead of hard coding the array length.

        Covered by existing transform tests.

        * css/WebKitCSSTransformValue.cpp:
        (WebCore):
        (WebCore::WebKitCSSTransformValue::customCssText):

2012-05-29  Eric Seidel  <eric@webkit.org>

        Fix ENABLE_IFRAME_SEAMLESS to actually fully disable <iframe seamless>
        https://bugs.webkit.org/show_bug.cgi?id=87646

        Reviewed by Adam Barth.

        In the process of moving the seamless feature out of github and into bugs.webkit.org
        multiple versions of the shouldDisplaySeamlessly function got written
        (and moved from HTMLIFrameElement to Document), but only one of them was wrapped
        in ENABLE_IFRAME_SEAMLESS.  HTMLIFrameElement was checking mayDisplaySeamlessly
        directly (as was my original design), which got around the ENABLE_IFRAME_SEAMLESS check.
        I've fixed this oversight, and the feature is now off when we tell it to be off.

        This is covered by many existing tests.  I've verified locally that
        all tests fail when ENABLE_IFRAME_SEAMLESS is disabled instead of
        only some of them.

        * dom/SecurityContext.h:
        (SecurityContext):
        * html/HTMLIFrameElement.cpp:
        (WebCore::HTMLIFrameElement::shouldDisplaySeamlessly):

2012-05-29  Scott Graham  <scottmg@chromium.org>

        Fix warning in preprocessing Source/WebCore/dom/DOMError.idl
        https://bugs.webkit.org/show_bug.cgi?id=87763

        Reviewed by Adam Barth.

        Add newline at end of file to avoid warning:
        ../dom/DOMError.idl:35:2: warning: no newline at end of file

        * dom/DOMError.idl:

2012-05-29  Mark Pilgrim  <pilgrim@chromium.org>

        [Chromium] Move fileExists to Platform.h
        https://bugs.webkit.org/show_bug.cgi?id=87531

        Reviewed by Adam Barth.

        Part of a refactoring series. See tracking bug 82948.

        * platform/chromium/FileSystemChromium.cpp:
        (WebCore::fileExists):
        * platform/chromium/PlatformSupport.h:
        (PlatformSupport):

2012-05-29  Kentaro Hara  <haraken@chromium.org>

        [V8] Rename v8Null() to v8NullWithCheck()
        https://bugs.webkit.org/show_bug.cgi?id=87713

        Reviewed by Adam Barth.

        In IRC, cmarcelo@ pointed out that v8::Null() and v8Null()
        are confusing. This patch renames v8Null() to v8NullWithCheck().

        No tests. No behavior change.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateHeader):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestEventConstructor.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestEventTarget.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestException.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestInterface.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestNode.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestObj.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
        (WebCore::toV8):
        * bindings/v8/V8Binding.h:
        (WebCore::v8NullWithCheck):
        (WebCore::v8DateOrNull):

2012-05-29  Christophe Dumez  <christophe.dumez@intel.com>

        Some Content Security Policy console messages are missing line numbers in JSC
        https://bugs.webkit.org/show_bug.cgi?id=87558

        Reviewed by Adam Barth.

        Make ScriptController::eventHandlerPosition() behave the same way on
        JSC than V8. This means that TextPosition::minimumPosition() is
        returned if parser is null, instead of
        TextPosition::belowRangePosition(). The line numbers are now correctly
        printed in the output of Content Security Policy tests.

        Tests: http/tests/security/contentSecurityPolicy/inline-script-blocked-javascript-url.html
               http/tests/security/contentSecurityPolicy/javascript-url-blocked.html

        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::eventHandlerPosition):

2012-05-29  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] make WebTransformationMatrix object usable by non-webkit code
        https://bugs.webkit.org/show_bug.cgi?id=87315

        Reviewed by James Robinson.

        This change is covered by existing tests and by whether it
        compiles. There should be no changes in behavior.

        * platform/chromium/support/WebTransformationMatrix.cpp:
        (WebKit::WebTransformationMatrix::WebTransformationMatrix):
        (WebKit::WebTransformationMatrix::operator=):
        (WebKit::WebTransformationMatrix::operator==):
        (WebKit::WebTransformationMatrix::inverse):
        (WebKit::WebTransformationMatrix::to2dTransform):
        (WebKit::WebTransformationMatrix::multiply):
        (WebKit::WebTransformationMatrix::makeIdentity):
        (WebKit::WebTransformationMatrix::translate):
        (WebKit::WebTransformationMatrix::translate3d):
        (WebKit::WebTransformationMatrix::translateRight3d):
        (WebKit::WebTransformationMatrix::scale):
        (WebKit::WebTransformationMatrix::scaleNonUniform):
        (WebKit::WebTransformationMatrix::scale3d):
        (WebKit::WebTransformationMatrix::rotate):
        (WebKit::WebTransformationMatrix::rotate3d):
        (WebKit::WebTransformationMatrix::skewX):
        (WebKit::WebTransformationMatrix::skewY):
        (WebKit::WebTransformationMatrix::applyPerspective):
        (WebKit::WebTransformationMatrix::blend):
        (WebKit::WebTransformationMatrix::hasPerspective):
        (WebKit::WebTransformationMatrix::isInvertible):
        (WebKit::WebTransformationMatrix::isBackFaceVisible):
        (WebKit::WebTransformationMatrix::isIdentity):
        (WebKit::WebTransformationMatrix::isIdentityOrTranslation):
        (WebKit::WebTransformationMatrix::isIntegerTranslation):
        (WebKit::WebTransformationMatrix::m11):
        (WebKit::WebTransformationMatrix::setM11):
        (WebKit::WebTransformationMatrix::m12):
        (WebKit::WebTransformationMatrix::setM12):
        (WebKit::WebTransformationMatrix::m13):
        (WebKit::WebTransformationMatrix::setM13):
        (WebKit::WebTransformationMatrix::m14):
        (WebKit::WebTransformationMatrix::setM14):
        (WebKit::WebTransformationMatrix::m21):
        (WebKit::WebTransformationMatrix::setM21):
        (WebKit::WebTransformationMatrix::m22):
        (WebKit::WebTransformationMatrix::setM22):
        (WebKit::WebTransformationMatrix::m23):
        (WebKit::WebTransformationMatrix::setM23):
        (WebKit::WebTransformationMatrix::m24):
        (WebKit::WebTransformationMatrix::setM24):
        (WebKit::WebTransformationMatrix::m31):
        (WebKit::WebTransformationMatrix::setM31):
        (WebKit::WebTransformationMatrix::m32):
        (WebKit::WebTransformationMatrix::setM32):
        (WebKit::WebTransformationMatrix::m33):
        (WebKit::WebTransformationMatrix::setM33):
        (WebKit::WebTransformationMatrix::m34):
        (WebKit::WebTransformationMatrix::setM34):
        (WebKit::WebTransformationMatrix::m41):
        (WebKit::WebTransformationMatrix::setM41):
        (WebKit::WebTransformationMatrix::m42):
        (WebKit::WebTransformationMatrix::setM42):
        (WebKit::WebTransformationMatrix::m43):
        (WebKit::WebTransformationMatrix::setM43):
        (WebKit::WebTransformationMatrix::m44):
        (WebKit::WebTransformationMatrix::setM44):
        (WebKit::WebTransformationMatrix::a):
        (WebKit::WebTransformationMatrix::setA):
        (WebKit::WebTransformationMatrix::b):
        (WebKit::WebTransformationMatrix::setB):
        (WebKit::WebTransformationMatrix::c):
        (WebKit::WebTransformationMatrix::setC):
        (WebKit::WebTransformationMatrix::d):
        (WebKit::WebTransformationMatrix::setD):
        (WebKit::WebTransformationMatrix::e):
        (WebKit::WebTransformationMatrix::setE):
        (WebKit::WebTransformationMatrix::f):
        (WebKit::WebTransformationMatrix::setF):
        (WebKit::WebTransformationMatrix::toWebCoreTransform):
        (WebKit::WebTransformationMatrix::mapRect):
        (WebKit::WebTransformationMatrix::mapPoint):
        (WebKit::WebTransformationMatrix::mapQuad):
        (WebKit::WebTransformationMatrix::projectPoint):

2012-05-29  Alexis Menard  <alexis.menard@openbossa.org>

        [CSS3 Backgrounds and Borders] Implement box-decoration-break parsing.
        https://bugs.webkit.org/show_bug.cgi?id=87678

        Reviewed by Eric Seidel.

        Implement the parsing part of box-decoration-break. The specification
        is located at http://www.w3.org/TR/css3-background/#box-decoration-break.
        So far Opera implements it. This patch only implements the parsing part of
        the property. A following patch will implement the rendering part. Despite
        the rendering part missing it improves http://css3test.com by 1%.

        Test: fast/box-decoration-break/box-decoration-break-parsing.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore):
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore):
        (WebCore::CSSPrimitiveValue::operator EBoxDecorationBreak):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/CSSValueKeywords.in:
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyleConstants.h:
        * rendering/style/StyleBoxData.cpp:
        (WebCore::StyleBoxData::StyleBoxData):
        (WebCore::StyleBoxData::operator==):
        * rendering/style/StyleBoxData.h:
        (WebCore::StyleBoxData::boxDecorationBreak):
        (StyleBoxData):

2012-05-29  David Barr  <davidbarr@chromium.org>

        [text-overflow: ellipsis] WebKit should ignore the ellipsis for the purpose of dispatching mouse events
        https://bugs.webkit.org/show_bug.cgi?id=63781

        Reviewed by Eric Seidel.

        "Ellipsing only affects rendering and must not affect layout nor dispatching of pointer events."
        http://www.w3.org/TR/2012/WD-css3-ui-20120117/#text-overflow

        Test: fast/css/text-overflow-ellipsis-hit-test.html

        * rendering/EllipsisBox.cpp:
        (WebCore::EllipsisBox::nodeAtPoint): Always return false.

2012-05-29  Gavin Peters  <gavinp@chromium.org>

        [Chromium] Remove assertions on state in Prerender.cpp
        https://bugs.webkit.org/show_bug.cgi?id=87746

        Chrome was crashing in the new Prerender API on Google Web Search; this was because the DOM would stop(), setting the
        state of the Prerenders in the document to Inactive, but an asyncronous GC would later come come along and trigger the
        removedFromDocument behaviour on each element, including the <link> element launching the prerender.  This causes an
        assertion failure.

        I believe the late-deletion of the DOM, and the HTMLElement::removedFromDocument calls are legal, and it was the
        overzealous assertions in Prerender that were inappropriate.

        Reviewed by Adam Barth.

        No new automated tests, working on a Chromium browser test. Manually test by entering many prerender and non-prerendered
        queries into Google Web Search.

        * platform/chromium/Prerender.cpp:
        (WebCore::Prerender::Prerender):
        (WebCore::Prerender::add):
        (WebCore::Prerender::cancel):
        (WebCore::Prerender::abandon):
        * platform/chromium/Prerender.h:
        (Prerender):

2012-05-29  Victor Carbune  <victor@rosedu.org>

        Display cues in the controls area
        https://bugs.webkit.org/show_bug.cgi?id=87591

        Reviewed by Eric Carlson.

        Changed the behaviour to implicitly hide the volume slidebar
        if the controls are hidden (due mouse moving out of the video
        area or controls are toggled through JS).

        This seems to be the simplest fix to this issue, otherwise
        on toggling the display:none property on the controls the
        volume slidebar might appear below the video.

        Re-enabled failing tests for this functionality.

        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlPanelElement::makeTransparent): Re-enabled
        timer to set the display:none property on the controls.
        * html/shadow/MediaControlRootElement.cpp:
        (WebCore::MediaControlRootElement::hide): Added a call to hide
        the volume slider.
        (WebCore::MediaControlRootElement::makeTransparent): Same.
        * html/shadow/MediaControlRootElementChromium.cpp:
        (WebCore::MediaControlRootElementChromium::hide): Same.
        (WebCore::MediaControlRootElementChromium::makeTransparent): Same.

2012-05-29  Adrienne Walker  <enne@google.com>

        Fix transparent iframes with composited contents in WK1 on Mac
        https://bugs.webkit.org/show_bug.cgi?id=76478

        Reviewed by Simon Fraser.

        Test: compositing/iframes/repaint-after-losing-scrollbars.html

        * page/FrameView.cpp:
        (WebCore::FrameView::useSlowRepaints):

2012-05-29  David Hyatt  <hyatt@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=87787
        
        [New Multicolumn] Refactor the region and flow thread code so that it can pick up the correct column widths
        and heights when determining the logical width and height of the flow thread itself.

        This patch adds new virtual methods to RenderRegion: logicalWidthForFlowThreadContent and logicalHeightForFlowThreadContent.
        For normal regions, these methods return the contentWidth and contentHeight of the regions themselves. For column sets,
        however, these methods actually return the column widths and heights.
        
        This allows the flow thread to properly lay out according to the column width.
        
        Region invalidation is also done properly by using these new methods.
        
        In some cases the code is actually simplified, since we can get rid of some isHorizontalWritingMode() switching.
        
        With this patch the flow thread now actually lays out and paints at the right width (spilling out of the region set in a single unbroken
        column).

        Reviewed by Dan Bernstein.

        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::layout):
        (WebCore::RenderFlowThread::computeLogicalWidth):
        (WebCore::RenderFlowThread::computeLogicalHeight):
        * rendering/RenderMultiColumnBlock.cpp:
        (WebCore::RenderMultiColumnBlock::ensureColumnSets):
        * rendering/RenderMultiColumnBlock.h:
        (WebCore::RenderMultiColumnBlock::isRenderMultiColumnBlock):
        (RenderMultiColumnBlock):
        (WebCore::toRenderMultiColumnBlock):
        (WebCore):
        * rendering/RenderMultiColumnSet.cpp:
        (WebCore::RenderMultiColumnSet::computeLogicalWidth):
        (WebCore):
        (WebCore::RenderMultiColumnSet::computeLogicalHeight):
        * rendering/RenderMultiColumnSet.h:
        (WebCore::RenderMultiColumnSet::setColumnWidthAndCount):
        (RenderMultiColumnSet):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::isRenderMultiColumnBlock):
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::logicalWidthForFlowThreadContent):
        (WebCore):
        (WebCore::RenderRegion::logicalHeightForFlowThreadContent):
        (WebCore::RenderRegion::layout):
        * rendering/RenderRegion.h:
        (RenderRegion):

2012-05-29  Alec Flett  <alecflett@chromium.org>

        IndexedDB: Align codes and names for IDB-specific and DOM-specific errors/exceptions
        https://bugs.webkit.org/show_bug.cgi?id=87276

        Reviewed by Tony Chang.

        No new tests. Existing tests have been updated to use the new
        exception constant values.

        The IDB spec has evolved to DOM4-style DOMExceptions, which are
        referred to with MixedCase, string-based style names for
        exceptions rather than UNDERSCORE_CONSTANT_ERR codes. Change to
        use MixedCase error/exception names, and tease out the
        IDB-specific exception/error codes/names from the system-level
        codes. Make sure that the legacy IDB-masked exception code values
        match the DOM exception values. Make sure that
        IDBDatabaseException[exception.name] still works.

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::createObjectStore):
        (WebCore::IDBDatabase::transaction):
        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::deleteObjectStore):
        (WebCore::IDBDatabaseBackendImpl::setVersion):
        (WebCore::IDBDatabaseBackendImpl::transaction):
        * Modules/indexeddb/IDBDatabaseException.cpp:
        (IDBDatabaseExceptionNameDescription):
        (WebCore):
        (WebCore::IDBDatabaseException::initializeDescription):
        * Modules/indexeddb/IDBDatabaseException.h:
        * Modules/indexeddb/IDBDatabaseException.idl:
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::createIndex):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::index):
        (WebCore::IDBObjectStoreBackendImpl::deleteIndex):
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::abort):
        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
        (WebCore::IDBTransactionBackendImpl::objectStore):

2012-05-29  David Hyatt  <hyatt@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=87775

        [New Multicolumn] Make sure RenderMultiColumnSets have their own copy of the count, width and height of their columns. 

        Reviewed by Anders Carlsson.

        * rendering/RenderMultiColumnBlock.cpp:
        (WebCore::RenderMultiColumnBlock::RenderMultiColumnBlock):
        (WebCore::RenderMultiColumnBlock::ensureColumnSets):
        * rendering/RenderMultiColumnBlock.h:
        (WebCore::RenderMultiColumnBlock::columnWidth):
        (WebCore::RenderMultiColumnBlock::columnCount):
        (RenderMultiColumnBlock):
        * rendering/RenderMultiColumnSet.cpp:
        (WebCore::RenderMultiColumnSet::RenderMultiColumnSet):
        * rendering/RenderMultiColumnSet.h:
        (WebCore::RenderMultiColumnSet::columnCount):
        (WebCore::RenderMultiColumnSet::columnWidth):
        (WebCore::RenderMultiColumnSet::columnHeight):
        (RenderMultiColumnSet):
        (WebCore::RenderMultiColumnSet::setColumnWidthAndCount):
        (WebCore::RenderMultiColumnSet::setColumnHeight):

2012-05-29  Simon Fraser  <simon.fraser@apple.com>

        Incomplete repaint on twitter.com when replying to a tweet
        https://bugs.webkit.org/show_bug.cgi?id=87553

        Reviewed by Dean Jackson.
        
        Style changes can cause a compositing layer to change between
        requiring its own backing store or not, e.g. with the addition
        or removal of a transform.
        
        When that happens, we need to repaint the ancesetor layer that
        this layer was, or will be drawing into.
        
        Factored some code out of layerWillBeRemoved() to be able to
        also call it from setRequiresOwnBackingStore().

        New manual test, ManualTests/compositing/requires-backing-change.html.
        I was not able to get an automated pixel test to work.

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::setRequiresOwnBackingStore):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateCompositingLayers): Remove trailing whitespace.
        (WebCore::RenderLayerCompositor::repaintInCompositedAncestor):
        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
        * rendering/RenderLayerCompositor.h:

2012-05-29  David Hyatt  <hyatt@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=87771
        
        [New Multicolumn] Make sure we have one column set by default and add it to the flow thread's region list.

        Reviewed by Anders Carlsson.

        * rendering/RenderMultiColumnBlock.cpp:
        (WebCore::RenderMultiColumnBlock::ensureColumnSets):
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::RenderRegion):

2012-05-29  John Sullivan  <sullivan@apple.com>

        Update label for blacklisted plug-in
        https://bugs.webkit.org/show_bug.cgi?id=87767
        rdar://problem/11550048
        
        Reviewed by Kevin Decker.

        * English.lproj/Localizable.strings:
        Regenerated.
        
        * platform/LocalizedStrings.cpp:
        (WebCore::insecurePluginVersionText):
        Changed this string.

2012-05-29  Julien Chaffraix  <jchaffraix@webkit.org>

        REGRESSION(r111742): box-sizing: border-box doesn't work on fixed table layout
        https://bugs.webkit.org/show_bug.cgi?id=87536

        Reviewed by Tony Chang.

        Tests: fast/table/fixed-table-layout/cell-box-sizing-fixed-table-layout.html
               fast/table/fixed-table-layout/column-box-sizing-fixed-table-layout.html
               fast/table/fixed-table-layout/column-group-box-sizing-fixed-table-layout.html
               fast/table/fixed-table-layout/column-in-column-group-box-sizing-fixed-table-layout.html

        The change in r111742 completely ignored border-sizing (following the table's code lead unfortunately).
        The issue is that we would count the borders and paddings twice for the border-box case which would lead
        to the content-box including them too. From a web-author, this behavior is equivalent to ignoring box-sizing.

        * rendering/FixedTableLayout.cpp:
        (WebCore::FixedTableLayout::calcWidthArray):
        Reworked the function to properly use computeBorderBoxLogicalWidth() for correctness. This matches
        what RenderBox and the rendering code does generally. Also refactored the code to avoid the need
        for local variables and make it more readable.

2012-05-25  Ojan Vafai  <ojan@chromium.org>

        Absolute positioned elements in a relative positioned CSS3 Flexbox fail to display properly
        https://bugs.webkit.org/show_bug.cgi?id=58453

        Reviewed by Tony Chang.

        Test: css3/flexbox/align-absolute-child.html

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::prepareChildForPositionedLayout):
        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
        (WebCore::RenderFlexibleBox::adjustAlignmentForChild):
        When adjusting positioned items, adjust their static position, not their location.
        (WebCore::RenderFlexibleBox::flipForRightToLeftColumn):
        (WebCore::RenderFlexibleBox::flipForWrapReverse):
        * rendering/RenderFlexibleBox.h:

2012-05-29  Abhishek Arya  <inferno@chromium.org>

        Crash due to text fragment destruction when updating first-letter block.
        https://bugs.webkit.org/show_bug.cgi?id=87751

        Reviewed by Eric Seidel.

        Test: fast/text/text-fragment-first-letter-update-crash.html

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::setStyle):

2012-05-29  David Hyatt  <hyatt@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=87764
        
        Add implementation of checkForPaginationLogicalHeightChange to RenderMultiColumnBlock.
        
        Also stub out ensureColumnSets() and write a comment describing how it's going to work.

        Reviewed by Anders Carlsson.

        * rendering/RenderMultiColumnBlock.cpp:
        (WebCore::RenderMultiColumnBlock::RenderMultiColumnBlock):
        (WebCore::RenderMultiColumnBlock::checkForPaginationLogicalHeightChange):
        (WebCore):
        (WebCore::RenderMultiColumnBlock::ensureColumnSets):
        * rendering/RenderMultiColumnBlock.h:
        (WebCore::RenderMultiColumnBlock::columnHeight):
        (WebCore::RenderMultiColumnBlock::setColumnHeight):
        (RenderMultiColumnBlock):

2012-05-29  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118620.
        http://trac.webkit.org/changeset/118620
        https://bugs.webkit.org/show_bug.cgi?id=87760

        This patch causes regression to read an empty file/blob via
        FileReader (Requested by jianli on #webkit).

        * fileapi/FileReader.cpp:
        (WebCore::FileReader::stringResult):

2012-05-29  Andreas Kling  <kling@webkit.org>

        Make StylePropertySet a variable-sized object to reduce memory use.
        <http://webkit.org/b/87506>

        Reviewed by Antti Koivisto.

        Make immutable StylePropertySet objects variable-sized and allocate exactly
        the space needed to hold the CSSProperty objects passed at construction.
        This lets us avoid the memory overhead of Vector<CSSProperty, 4>.

        Renamed StylePropertySet::adopt* to create and createImmutable since they no
        longer adopt the incoming vector. More cleanup will follow in this area.

        This reduces memory usage across the board - the more CSS declarations,
        the bigger the benefit. As an example, we save around ~0.5MB on wsj.com.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::copyPropertiesInSet):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::createStylePropertySet):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::createImmutable):
        (WebCore::StylePropertySet::StylePropertySet):
        (WebCore::StylePropertySet::~StylePropertySet):
        (WebCore::StylePropertySet::copyPropertiesFrom):
        (WebCore::StylePropertySet::removeProperty):
        (WebCore::StylePropertySet::setProperty):
        (WebCore::StylePropertySet::parseDeclaration):
        (WebCore::StylePropertySet::addParsedProperties):
        (WebCore::StylePropertySet::asText):
        (WebCore::StylePropertySet::merge):
        (WebCore::StylePropertySet::addSubresourceStyleURLs):
        (WebCore::StylePropertySet::removePropertiesInSet):
        (WebCore::StylePropertySet::findPropertyWithId):
        (WebCore::StylePropertySet::removeEquivalentProperties):
        (WebCore::StylePropertySet::copyPropertiesInSet):
        (WebCore::StylePropertySet::averageSizeInBytes):
        (SameSizeAsStylePropertySet):
        (WebCore::StylePropertySet::append):
        * css/StylePropertySet.h:
        (WebCore::StylePropertySet::create):
        (StylePropertySet):
        (WebCore::StylePropertySet::propertyAt):
        (WebCore::StylePropertySet::propertyCount):
        (WebCore::StylePropertySet::isEmpty):
        (WebCore::StylePropertySet::array):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::updateAttributeStyle):

2012-05-29  David Hyatt  <hyatt@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=87759
        
        Pull the initial page logical height checking for columns into its own separate function. This
        will allow the derived RenderMultiColumnBlock class to do its own setup there. It also has the
        effect of cleaning up layoutBlock even for the existing code.

        Reviewed by Anders Carlsson.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::checkForPaginationLogicalHeightChange):
        (WebCore):
        (WebCore::RenderBlock::layoutBlock):
        * rendering/RenderBlock.h:
        (RenderBlock):

2012-05-29  Victor Carbune  <victor@rosedu.org>

        Update cue event dispatching for zero and negative duration cues
        https://bugs.webkit.org/show_bug.cgi?id=85143

        Reviewed by Eric Carlson.

        Updated existing test.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::updateActiveTextTrackCues): Explicitly
        treated event dispatching for zero and negative duration cues.
        (WebCore::HTMLMediaElement::textTrackAddCue): Interval tree doesn't
        handle invalid cues with intervals - negative cues need to be treated
        as zero-length cues as they are always missed cues anyway.
        (WebCore::HTMLMediaElement::textTrackRemoveCue): Same.

2012-05-29  MORITA Hajime  <morrita@google.com>

        ShadowRoot.getElementById() returns removed node.
        https://bugs.webkit.org/show_bug.cgi?id=62184

        Deregitration of m_elementsById map is done at Element::removedFrom()
        But the tree scope of the removed node is already reset from a shadow root
        to a document.

        This change lookup the old shadow root through its parent node and
        deregitrater the node against it.

        Reviewed by Dimitri Glazkov.

        Test: fast/dom/shadow/get-element-by-id-in-shadow-mutation.html

        * dom/Element.cpp:
        (WebCore::treeScopeOfParent):
        (WebCore):
        (WebCore::Element::removedFrom):
        * dom/Element.h:
        (Element):
        (WebCore::Element::updateId):
        (WebCore):

2012-05-29  Dana Jansens  <danakj@chromium.org>

        [chromium] Unoccluded area in surfaces should always be clipped to the rootScissorRect
        https://bugs.webkit.org/show_bug.cgi?id=87677

        Reviewed by Adrienne Walker.

        When a contributing surface is visited, and we have not visited another
        surface, then we know the surface is completely unoccluded. However, the
        root scissor rect should still be applied, and anything outside of it
        should be considered occluded.

        Unit test: WebKitTests::CCOcclusionTrackerTestTopmostSurfaceIsClippedToScissor

        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
        (WebCore::RenderSurfaceChromium::targetRenderSurface):
        (WebCore):
        * platform/graphics/chromium/RenderSurfaceChromium.h:
        (RenderSurfaceChromium):
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::::unoccludedContributingSurfaceContentRect):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::targetRenderSurface):
        (WebCore):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (CCRenderSurface):

2012-05-29  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>

        [BlackBerry] Refactoring http/proxy authentication to use authcallback mechanism introduced with libcurl
        https://bugs.webkit.org/show_bug.cgi?id=87706

        Reviewed by Antonio Gomes.

        Because we use authentication callback mechanism of libcurl,
        which will take care of all the authentication communication
        between UA and server, so the only thing we need to do is to
        provide credential information when authentication callback
        is triggered. By using this we don't need to process
        intermediate headers for each http authentication scheme.

        Implemented interface function notifyAuthReceived() in
        NetworkJob to handle the authentication notification from
        networking thread.
        When the authentication callback is triggered, we should
        cancel the current loading request and restart a new one with
        credential information attached which comes from
        credentialStorage or user input.

        Internally reviewed by Joe Mason <jmason@rim.com>.

        No new tests since there is no behavior change.

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::notifyAuthReceived):
        (WebCore):
        (WebCore::NetworkJob::handleNotifyHeaderReceived):
        (WebCore::NetworkJob::sendRequestWithCredentials):
        * platform/network/blackberry/NetworkJob.h:
        (NetworkJob):

2012-05-29  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>

        [BlackBerry] http authentication challenge issue when loading subresource
        https://bugs.webkit.org/show_bug.cgi?id=87660

        Reviewed by Rob Buis.

        We should try to store the credential information as soon as we
        receive http status notification which indicates that the
        authentication succeeds, instead of storing credentials when the
        main resource receives notify done which is too late for loading
        subresource.

        Internally reviewed by Joe Mason <jmason@rim.com>

        No new tests since there is no change in behavior.

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::handleNotifyStatusReceived):
        (WebCore::NetworkJob::handleNotifyClose):

2012-05-29  Alexey Proskuryakov  <ap@apple.com>

        [Mac] Move DefaultFonts.plist to C++ code
        https://bugs.webkit.org/show_bug.cgi?id=87560
        <rdar://problem/11466119>

        Reviewed by Dan Bernstein.

        * DerivedSources.make:
        * Resources/DefaultFonts.plist.in: Removed.
        * WebCore.xcodeproj/project.pbxproj:
        * page/mac/SettingsMac.mm: (WebCore::Settings::initializeDefaultFontFamilies):
        Instead of having a separate configuration file, just hardcode the settings in C++.

2012-05-29  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Retainers are missing for all objects
        https://bugs.webkit.org/show_bug.cgi?id=87655

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshotDataGrids.js:
        (WebInspector.HeapSnapshotContainmentDataGrid.prototype.setDataSource):

2012-05-29  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] Video sink doesn't respect WebKit code style
        https://bugs.webkit.org/show_bug.cgi?id=87693

        Reviewed by Alexis Menard.

        No change in behavior of the sink, this patch only adapts the code
        style to WebKit's.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
        (_WebKitVideoSinkPrivate):
        (webkitVideoSinkTimeoutCallback):
        (webkitVideoSinkRender):
        (webkitVideoSinkDispose):
        (unlockBufferMutex):
        (webkitVideoSinkUnlock):
        (webkitVideoSinkUnlockStop):
        (webkitVideoSinkStop):
        (webkitVideoSinkStart):
        (webkitVideoSinkMarshalVoidAndMiniObject):
        (webkit_video_sink_class_init):
        (webkitVideoSinkNew):
        * platform/graphics/gstreamer/VideoSinkGStreamer.h:
        (_WebKitVideoSink):
        (_WebKitVideoSinkClass):

2012-05-29  Roland Takacs  <takacs.roland@stud.u-szeged.hu>

        [Qt] Uninitialized shader compiler when GLES is used
        https://bugs.webkit.org/show_bug.cgi?id=87712

        The '#if !defined(QT_OPENGL_ES_2)' has been removed before the initialization
        of shader compiler to compile shader codes for ES-platforms as well.

        Reviewed by Noam Rosenthal.

        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        (WebCore::GraphicsContext3D::GraphicsContext3D):

2012-05-29  Taiju Tsuiki  <tzik@chromium.org>

        Add InspectorFileSystemAgent::FrontendProvider
        https://bugs.webkit.org/show_bug.cgi?id=87635

        InspectorFileSystemAgent needs weak reference to its frontend to perform
        asynchronous operation.

        Reviewed by Yury Semikhatsky.

        * inspector/InspectorFileSystemAgent.cpp:
        (InspectorFileSystemAgent::FrontendProvider):
        (WebCore):
        (WebCore::InspectorFileSystemAgent::~InspectorFileSystemAgent):
        (WebCore::InspectorFileSystemAgent::enable):
        (WebCore::InspectorFileSystemAgent::disable):
        (WebCore::InspectorFileSystemAgent::setFrontend):
        (WebCore::InspectorFileSystemAgent::clearFrontend):
        (WebCore::InspectorFileSystemAgent::restore):
        (WebCore::InspectorFileSystemAgent::InspectorFileSystemAgent):
        * inspector/InspectorFileSystemAgent.h:
        (InspectorFileSystemAgent):

2012-05-29  Yoshifumi Inoue  <yosin@chromium.org>

        REGRESSION(r109729): The optgroup element's "disabled" attribute has no effect to rendering and selection
        https://bugs.webkit.org/show_bug.cgi?id=87614

        Reviewed by Kent Tamura.

        This patch adds HTMLOptGroupElement::disabled and isEnabledFormControl
        methods which was implemented in HTMLFormControlElement at r109729 and
        updates CSS pseudo class checker to check "optgroup" element.

        Tests: fast/forms/select/optgroup-clicking.html
               fast/forms/select/optgroup-disabled.html
               fast/forms/select/optgroup-rendering.html

        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOneSelector): On disabled and enabled pseudo class checker. 
        We checked tag name "optgroup" in addition isFormControlElement.
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::canShareStyleWithElement): Checks optgroup.disabled.
        * html/HTMLOptGroupElement.cpp:
        (WebCore::HTMLOptGroupElement::disabled): Added.
        * html/HTMLOptGroupElement.h:
        (HTMLOptGroupElement): Added isEnabledFormControl.

2012-05-29  Alexander Pavlov  <apavlov@chromium.org>

        [Chromium] [Regression] SELECT popup misplaced when there is not enough vertical space
        https://bugs.webkit.org/show_bug.cgi?id=87735

        Reviewed by Kent Tamura.

        This change fixes the obsolete WebWidget Y-repositioning code for the insufficient vertical space case, not removed in r113418.

        No new tests, as popups are not testable in Chromium.

        * platform/chromium/PopupContainer.cpp:
        (WebCore::PopupContainer::layoutAndCalculateWidgetRect):

2012-05-29  Andrei Bucur  <abucur@adobe.com>

        [CSS Regions]Rename NamedFlow::overflow to NamedFlow::overset
        https://bugs.webkit.org/show_bug.cgi?id=87491

        This patch updates the CSSOM property name overflow to overset. There are no changes in functionality.
        Link to spec: http://www.w3.org/TR/2012/WD-css3-regions-20120503/

        Reviewed by Andreas Kling.

        Test: fast/regions/webkit-named-flow-overset.html

        * dom/WebKitNamedFlow.cpp:
        (WebCore::WebKitNamedFlow::overset):
        * dom/WebKitNamedFlow.h:
        (WebKitNamedFlow):
        * dom/WebKitNamedFlow.idl:
        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::RenderFlowThread):
        (WebCore::RenderFlowThread::computeOverflowStateForRegions):
        * rendering/RenderFlowThread.h:

2012-05-29  Andreas Kling  <kling@webkit.org>

        Give StylePropertySet a proper mutability flag.
        <http://webkit.org/b/87675>

        Reviewed by Antti Koivisto.

        Add a flag to StylePropertySet that determines whether it's mutable or not. Only objects
        constructed from the CSS parser (by way of StylePropertySet::adopt()) are made immutable.
        This is clean-up and prep work for implementing a more efficient storage scheme for immutable
        StylePropertySets (fixed-size array instead of vector) as the vast majority of them are
        unlikely to ever mutate during their lifetime.

        Sprinkled ASSERT(isMutable()) all over StylePropertySet to catch any attempts to modify
        an immutable object.

        Also made properties() const on StyleRule and friends, which brought some additional code
        churn along with it.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::copyPropertiesInSet):
        * css/CSSFontFaceRule.cpp:
        (WebCore::CSSFontFaceRule::style):
        (WebCore::CSSFontFaceRule::reattach):
        * css/CSSFontFaceSrcValue.cpp:
        (WebCore::CSSFontFaceSrcValue::addSubresourceStyleURLs):
        * css/CSSFontFaceSrcValue.h:
        (CSSFontFaceSrcValue):
        * css/CSSPageRule.cpp:
        (WebCore::CSSPageRule::style):
        (WebCore::CSSPageRule::reattach):
        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::addSubresourceStyleURLs):
        * css/CSSPrimitiveValue.h:
        (CSSPrimitiveValue):
        * css/CSSReflectValue.cpp:
        (WebCore::CSSReflectValue::addSubresourceStyleURLs):
        * css/CSSReflectValue.h:
        (CSSReflectValue):
        * css/CSSStyleRule.cpp:
        (WebCore::CSSStyleRule::style):
        (WebCore::CSSStyleRule::reattach):
        * css/CSSValue.cpp:
        (WebCore::CSSValue::addSubresourceStyleURLs):
        * css/CSSValue.h:
        (CSSValue):
        * css/CSSValueList.cpp:
        (WebCore::CSSValueList::addSubresourceStyleURLs):
        * css/CSSValueList.h:
        (CSSValueList):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::StylePropertySet):
        (WebCore::StylePropertySet::setCSSParserMode):
        (WebCore):
        (WebCore::StylePropertySet::copyPropertiesFrom):
        (WebCore::StylePropertySet::removeShorthandProperty):
        (WebCore::StylePropertySet::removeProperty):
        (WebCore::StylePropertySet::setProperty):
        (WebCore::StylePropertySet::parseDeclaration):
        (WebCore::StylePropertySet::addParsedProperties):
        (WebCore::StylePropertySet::addParsedProperty):
        (WebCore::StylePropertySet::merge):
        (WebCore::StylePropertySet::addSubresourceStyleURLs):
        (WebCore::StylePropertySet::removePropertiesInSet):
        (WebCore::StylePropertySet::findPropertyWithId):
        (WebCore::StylePropertySet::removeEquivalentProperties):
        (WebCore::StylePropertySet::copyPropertiesInSet):
        * css/StylePropertySet.h:
        (WebCore::StylePropertySet::adopt):
        (WebCore::StylePropertySet::adoptMutable):
        (StylePropertySet):
        (WebCore::StylePropertySet::isMutable):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::addMatchedProperties):
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleResolver.h:
        (StyleResolver):
        * css/StyleRule.cpp:
        (WebCore::StyleRule::mutableProperties):
        (WebCore):
        (WebCore::StyleRulePage::mutableProperties):
        (WebCore::StyleRuleFontFace::mutableProperties):
        * css/StyleRule.h:
        (WebCore::StyleRule::properties):
        (StyleRule):
        (WebCore::StyleRuleFontFace::properties):
        (StyleRuleFontFace):
        (WebCore::StyleRulePage::properties):
        (StyleRulePage):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::ensureInlineStyle):
        (WebCore::ElementAttributeData::updateInlineStyleAvoidingMutation):
        * editing/EditingStyle.cpp:
        (WebCore::styleFromMatchedRulesForElement):
        * svg/SVGFontFaceElement.cpp:
        (WebCore::SVGFontFaceElement::parseAttribute):
        (WebCore::SVGFontFaceElement::rebuildFontFace):
        (WebCore::SVGFontFaceElement::removedFrom):

2012-05-29  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>

        [EFL] Refactoring. Get rid of unnecessary singleCharacterString() function
        https://bugs.webkit.org/show_bug.cgi?id=87654

        Reviewed by Csaba Osztrogonác.

        Evas key events already provide key string, so no practical need for singleCharacterString() 
        evaluating the event string from keyname.
        Modified code related functionality is already covered with fast/events and fast/forms tests.

        * platform/efl/EflKeyboardUtilities.cpp:
        * platform/efl/PlatformKeyboardEventEfl.cpp:
        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):

2012-05-29  Ilya Tikhonovsky  <loislo@chromium.org>

        Unreviewed: Web Inspector: single line fix after r118742.

        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapProfileHeader.prototype.saveToFile):

2012-05-29  Kentaro Hara  <haraken@chromium.org>

        Remove m_rootNode and m_selectorChecker from SelectorQuery.h
        https://bugs.webkit.org/show_bug.cgi?id=87650

        Reviewed by Antti Koivisto.

        To avoid parsing CSS selectors every time, I am planning to cache
        SelectorQuery objects into a HashMap, which will be defined in
        Node::querySelector(). To make the size of SelectorQuery small,
        this patch removes m_rootNode and m_selectorChecker from SelectorQuery.h.

        Tests: fast/dom/SelectorAPI/*. No change in test results.

        * dom/Node.cpp:
        (WebCore::Node::querySelector):
        (WebCore::Node::querySelectorAll):
        * dom/SelectorQuery.cpp:
        (WebCore::SelectorQuery::SelectorQuery):
        (WebCore):
        (WebCore::SelectorQuery::queryAll):
        (WebCore::SelectorQuery::queryFirst):
        * dom/SelectorQuery.h:
        (SelectorQuery):

2012-05-29  Eugene Klyuchnikov  <eustas.bug@gmail.com>

        Web Inspector: Tabbed Settings Screen
        https://bugs.webkit.org/show_bug.cgi?id=87497

        Reviewed by Yury Semikhatsky.

        Combine settings screen and shortcuts screen
        to a single tabbed settings screen.
        This will make shortcuts screen more discoverable.

        * inspector/front-end/HelpScreen.js:
        (WebInspector.HelpScreen): Make titled tamplate optional.
        (WebInspector.HelpScreen.prototype._createCloseButton): Extract method.
        * inspector/front-end/SettingsScreen.js:
        (WebInspector.SettingsScreen): Split initialization and UI construction.
        (WebInspector.SettingsScreen.prototype._createSettingsTabView.appendSection):
        (WebInspector.SettingsScreen.prototype._createSettingsTabView):
        Extract GUI construction method.
        (WebInspector.SettingsScreen.prototype._getOrCreateTabbedPane):
        Make GUI construction lazy.
        (WebInspector.SettingsScreen.prototype.selectTab):
        Add method for external tab swithching.
        (WebInspector.SettingsScreen.prototype.wasShown):
        Make GUI construction lazy.
        (WebInspector.SettingsScreenTabbedPane):
        Extend class to access protected member.
        (WebInspector.SettingsController.prototype._buttonClicked):
        Change "showSettingsScreen" visibility and parameters.
        (WebInspector.SettingsController.prototype._onHideSettingsScreen):
        Preserve settings screen state.
        (WebInspector.SettingsController.prototype.showSettingsScreen):
        Change method visibility and parameters.
        * inspector/front-end/ShortcutsScreen.js:
        (WebInspector.ShortcutsScreen): Remove inheritance from HelpScreen.
        (WebInspector.ShortcutsScreen.prototype._createShortcutsTabView):
        Refactoring of GUI construction.
        (WebInspector.ShortcutsSection.prototype.renderSection):
        Ditto.
        * inspector/front-end/helpScreen.css:
        (.help-window-main ::-webkit-scrollbar): Rebind scrollbar settings.
        (.help-window-main ::-webkit-resizer): Ditto.
        (.help-window-main ::-webkit-scrollbar-thumb:vertical): Ditto.
        (.help-window-main ::-webkit-scrollbar-thumb:vertical:active): Ditto.
        (.help-window-main ::-webkit-scrollbar-track:vertical): Ditto.
        (body:not(.compact) #settings-screen .tabbed-pane): Fix container height.
        (#settings-screen .tabbed-pane-header): Ditto.
        (#settings-screen .tabbed-pane-header-tabs): Adjust spacing.
        (#settings-screen .tabbed-pane-header-tab): Adjust style.
        (#settings-screen .help-close-button): Adjust spacing.
        (#settings-screen .tabbed-pane-header-tab.selected):
        Erase line below active tab.
        (#settings-screen .tabbed-pane-content): Adjust spacing.
        (#settings-screen .help-content): Ditto.
        * inspector/front-end/inspector.js:
        (WebInspector.documentKeyDown): Use Settings screen to show shortcuts.

2012-05-29  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: REGRESSION: load heap snapshot doesn't work.
        https://bugs.webkit.org/show_bug.cgi?id=87642

        HeapSnapshotReceiver interface was introduced.
        It declares the API for HeapSnapshotLoader, HeapSnapshotLoaderProxy and HeapSnapshotSaveToFileReceiver.
        The HeapProfileHeader was refactored and tests were added.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshotLoader.js:
        (WebInspector.HeapSnapshotLoader):
        (WebInspector.HeapSnapshotLoader.prototype.startLoading):
        (WebInspector.HeapSnapshotLoader.prototype.dispose):
        (WebInspector.HeapSnapshotLoader.prototype._reset):
        (WebInspector.HeapSnapshotLoader.prototype.finishLoading):
        * inspector/front-end/HeapSnapshotProxy.js:
        (WebInspector.HeapSnapshotWorker.prototype.startCheckingForLongRunningCalls):
        (WebInspector.HeapSnapshotLoaderProxy.prototype.startLoading):
        (WebInspector.HeapSnapshotLoaderProxy.prototype.pushJSONChunk):
        (WebInspector.HeapSnapshotLoaderProxy.prototype.finishLoading):
        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapSnapshotReceiver):
        (WebInspector.HeapSnapshotReceiver.prototype.startLoading):
        (WebInspector.HeapSnapshotReceiver.prototype.pushJSONChunk):
        (WebInspector.HeapSnapshotReceiver.prototype.finishLoading):
        (WebInspector.HeapSnapshotReceiver.prototype.dispose):
        (WebInspector.HeapProfileHeader):
        (WebInspector.HeapProfileHeader.prototype.load):
        (WebInspector.HeapProfileHeader.prototype._setupWorker):
        (WebInspector.HeapProfileHeader.prototype.dispose):
        (WebInspector.HeapProfileHeader.prototype._saveStatusUpdate):
        (WebInspector.HeapProfileHeader.prototype.pushJSONChunk):
        (WebInspector.HeapProfileHeader.prototype._parsed):
        (WebInspector.HeapProfileHeader.prototype.finishHeapSnapshot):
        (WebInspector.HeapProfileHeader.prototype.saveToFile):
        (WebInspector.HeapProfileHeader.prototype.loadFromFile.onLoad):
        (WebInspector.HeapProfileHeader.prototype.loadFromFile):
        (WebInspector.HeapProfileHeader.prototype._loadNextChunk):
        (WebInspector.HeapProfileHeader.prototype._nextChunkLoaded):
        (WebInspector.HeapProfileHeader.prototype._createFileReader):
        (WebInspector.HeapSnapshotSaveToFileReceiver):
        (WebInspector.HeapSnapshotSaveToFileReceiver.prototype.startLoading):
        (WebInspector.HeapSnapshotSaveToFileReceiver.prototype.pushJSONChunk):
        (WebInspector.HeapSnapshotSaveToFileReceiver.prototype.finishLoading):
        (WebInspector.HeapSnapshotSaveToFileReceiver.prototype.dispose):
        (WebInspector.HeapSnapshotSaveToFileReceiver.prototype._startSavingSnapshot):
        (WebInspector.HeapSnapshotSaveToFileReceiver.prototype._saveStatusUpdate):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype._createFileSelectorElement.onChange):
        (WebInspector.ProfilesPanel.prototype._createFileSelectorElement):
        (WebInspector.ProfilesPanel.prototype._loadFromFile):

2012-05-29  Eric Seidel  <eric@webkit.org>

        Add HTMLIFrameElement.seamless property accessor now that seamless is enabled and works
        https://bugs.webkit.org/show_bug.cgi?id=87708

        Reviewed by Adam Barth.

        Lots of tests in fast/frames/seamless cover this property.

        * html/HTMLIFrameElement.idl:

2012-05-29  Kentaro Hara  <haraken@chromium.org>

        [Performance] Optimize querySelector() and querySelectorAll() by removing
        redundant dummy style sheet creations
        https://bugs.webkit.org/show_bug.cgi?id=87627

        Reviewed by Antti Koivisto.

        This patch improves performance of querySelector("#id") by 4.2% ~ 17.7%
        in Safari and Chromium.

        Performance tests: https://bugs.webkit.org/attachment.cgi?id=144288

        The performance test results in my desktop:

        [Safari/Mac]
        document.querySelector("#headId") :               13.60 ms =>  12.40 ms  +9.68%
        document.querySelector("#duplicatedId") :         14.80 ms =>  14.20 ms  +4.23%
        document.querySelector("#tailId") :               13.80 ms =>  12.20 ms  +13.11%
        document.querySelectorAll("#headId") :            17.80 ms =>  14.60 ms  +21.92%
        document.querySelectorAll("#duplicatedId") :     513.80 ms => 471.60 ms  +8.95%
        document.querySelectorAll("#tailId") :            19.20 ms =>  16.40 ms  +17.07%
        document.querySelector("h1") :                    14.40 ms =>  13.60 ms  +5.88%
        document.querySelector("h2") :                    14.80 ms =>  13.80 ms  +7.25%
        document.querySelector("h3") :                   312.00 ms => 306.60 ms  +1.76%
        document.querySelectorAll("h1") :                322.00 ms => 314.60 ms  +2.35%
        document.querySelectorAll("h2") :                481.00 ms => 420.60 ms  +14.36%
        document.querySelectorAll("h3") :                326.80 ms => 315.80 ms  +3.48%
        document.querySelector(".headClass") :            16.20 ms =>  15.40 ms  +5.19%
        document.querySelector(".duplicatedClass") :      17.00 ms =>  15.40 ms  +10.39%
        document.querySelector(".tailClass") :           369.60 ms => 362.60 ms  +1.93%
        document.querySelectorAll(".headClass") :        388.20 ms => 377.60 ms  +2.81%
        document.querySelectorAll(".duplicatedClass") :  605.00 ms => 581.20 ms  +4.09%
        document.querySelectorAll(".tailClass") :        401.60 ms => 391.40 ms  +2.61%

        [Chromium/Linux]
        ocument.querySelector("#headId") :                16.00 ms =>  13.60 ms  +17.65%
        document.querySelector("#duplicatedId") :         16.80 ms =>  15.40 ms  +9.09%
        document.querySelector("#tailId") :               16.00 ms =>  13.60 ms  +17.65%
        document.querySelectorAll("#headId") :            29.00 ms =>  25.00 ms  +16.00%
        document.querySelectorAll("#duplicatedId") :     561.40 ms => 505.20 ms  +11.12%
        document.querySelectorAll("#tailId") :            34.00 ms =>  26.80 ms  +26.87%
        document.querySelector("h1") :                    18.20 ms =>  15.80 ms  +15.19%
        document.querySelector("h2") :                    19.00 ms =>  16.60 ms  +14.46%
        document.querySelector("h3") :                   280.40 ms => 274.00 ms  +2.34%
        document.querySelectorAll("h1") :                300.20 ms => 365.20 ms  -17.80%
        document.querySelectorAll("h2") :                487.60 ms => 504.20 ms  -3.29%
        document.querySelectorAll("h3") :                349.40 ms => 324.00 ms  +7.84%
        document.querySelector(".headClass") :            18.40 ms =>  16.00 ms  +15.00%
        document.querySelector(".duplicatedClass") :      19.40 ms =>  16.20 ms  +19.75%
        document.querySelector(".tailClass") :           349.60 ms => 345.40 ms  +1.22%
        document.querySelectorAll(".headClass") :        382.80 ms => 378.20 ms  +1.22%
        document.querySelectorAll(".duplicatedClass") :  550.80 ms => 574.20 ms  -4.08%
        document.querySelectorAll(".tailClass") :        381.00 ms => 387.00 ms  -1.55%

        I've found that StyleSheetInternal::create() in CSSParser::parseSelector()
        is a bottleneck of querySelector() and querySelectorAll().

        void CSSParser::parseSelector(const String& string, CSSSelectorList& selectorList)
        {
            RefPtr<StyleSheetInternal> dummyStyleSheet = StyleSheetInternal::create();
            setStyleSheet(dummyStyleSheet.get());
            ...;
        }

        This patch removes a dummy style sheet. Previously the dummy style sheet
        was needed to avoid null checks of m_styleSheet in CSSGrammer.y.
        This patch fixes CSSGrammer.y so that it works fine with a null m_styleSheet.

        Tests: fast/dom/SelectorAPI/*. No change in the test results.

        * css/CSSGrammar.y:
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseSelector):

2012-05-29  Nikolas Zimmermann  <nzimmermann@rim.com>

        SVGViewSpec DOM bindings aka SVGSVGElement.currentView is unimplemented
        https://bugs.webkit.org/show_bug.cgi?id=15495

        Reviewed by Rob Buis.

        Finish SVGViewSpec implementation and expose it to the Web. Numerous smaller bugs are fixed:
        - SVGViewSpec and all of its contents should be read-only. Enforce that and test it.
          Add a new enum to SVGPropertyInfo so that each SVGAnimatedProperty knows if its content is supposed to be read-write or read-only.
        - Make the 'transform' attribute of SVGViewSpec exposable by switching to a SVGTransformListProperty - it can now be accessed from JS.
        - Assure that following XXXString methods are in sync with the corresponding SVG DOM interfaces
            readonly attribute DOMString viewBoxString;
            readonly attribute DOMString preserveAspectRatioString;
            readonly attribute DOMString transformString;
            readonly attribute DOMString viewTargetString;
        - Cleanup code in svg/properties that was intended to handle SVGViewSpec. Turns out lot of the complexity was unncessary, and can be removed.
        - Move SVGFitToViewBox to the same pattern SVGZoomAndPan uses since two days, that avoids any virtual function calls for attribute parsing.
        - Create/expose ObjectiveC/JS bindings for SVGViewSpec.
        - Enable SVGViewSpec constructor.

        Tests: svg/custom/linking-a-03-b-all-expected.svg
               svg/dom/SVGViewSpec-defaults.html
               svg/dom/SVGViewSpec.html
               svg/dom/complex-svgView-specification.html
               svg/dom/viewspec-parser.html

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * WebCore.order:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSSVGLengthCustom.cpp:
        (WebCore::JSSVGLength::setValue):
        (WebCore::JSSVGLength::convertToSpecifiedUnits):
        * bindings/objc/DOMSVG.h:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        (NativeToJSValue):
        * bindings/scripts/CodeGeneratorObjC.pm:
        (GenerateImplementation):
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrGetter):
        (GenerateNormalAttrSetter):
        (GenerateFunctionCallback):
        * bindings/v8/custom/V8SVGLengthCustom.cpp:
        (WebCore::V8SVGLength::valueAccessorSetter):
        (WebCore::V8SVGLength::convertToSpecifiedUnitsCallback):
        * page/DOMWindow.idl:
        * rendering/svg/RenderSVGResourcePattern.cpp:
        (WebCore::RenderSVGResourcePattern::buildTileImageTransform):
        * svg/SVGFitToViewBox.cpp:
        * svg/SVGFitToViewBox.h:
        (SVGFitToViewBox):
        (WebCore::SVGFitToViewBox::parseAttribute):
        * svg/SVGMarkerElement.cpp:
        (WebCore::SVGMarkerElement::orientTypePropertyInfo):
        (WebCore::SVGMarkerElement::parseAttribute):
        (WebCore::SVGMarkerElement::synchronizeOrientType):
        (WebCore::SVGMarkerElement::lookupOrCreateOrientTypeWrapper):
        * svg/SVGPathElement.cpp:
        (WebCore::SVGPathElement::dPropertyInfo):
        (WebCore::SVGPathElement::svgAttributeChanged):
        (WebCore::SVGPathElement::pathByteStream):
        (WebCore::SVGPathElement::lookupOrCreateDWrapper):
        (WebCore::SVGPathElement::synchronizeD):
        * svg/SVGPathSegWithContext.h:
        (WebCore::SVGPathSegWithContext::animatedProperty):
        * svg/SVGPatternElement.cpp:
        (WebCore::SVGPatternElement::parseAttribute):
        * svg/SVGPolyElement.cpp:
        (WebCore::SVGPolyElement::pointsPropertyInfo):
        (WebCore::SVGPolyElement::parseAttribute):
        (WebCore::SVGPolyElement::synchronizePoints):
        (WebCore::SVGPolyElement::lookupOrCreatePointsWrapper):
        * svg/SVGRect.h:
        * svg/SVGSVGElement.cpp:
        (WebCore::SVGSVGElement::~SVGSVGElement):
        (WebCore::SVGSVGElement::currentView):
        (WebCore::SVGSVGElement::parseAttribute):
        (WebCore::SVGSVGElement::currentViewBoxRect):
        (WebCore::SVGSVGElement::viewBoxToViewTransform):
        (WebCore::SVGSVGElement::setupInitialView):
        (WebCore::SVGSVGElement::inheritViewAttributes):
        * svg/SVGSVGElement.h:
        (SVGSVGElement):
        * svg/SVGSVGElement.idl:
        * svg/SVGSymbolElement.cpp:
        (WebCore::SVGSymbolElement::parseAttribute):
        * svg/SVGTests.cpp:
        (WebCore::SVGTests::requiredFeaturesPropertyInfo):
        (WebCore::SVGTests::requiredExtensionsPropertyInfo):
        (WebCore::SVGTests::systemLanguagePropertyInfo):
        (WebCore::SVGTests::synchronizeRequiredFeatures):
        (WebCore::SVGTests::synchronizeRequiredExtensions):
        (WebCore::SVGTests::synchronizeSystemLanguage):
        * svg/SVGTextContentElement.cpp:
        (WebCore::SVGTextContentElement::textLengthPropertyInfo):
        (WebCore::SVGTextContentElement::synchronizeTextLength):
        (WebCore::SVGTextContentElement::lookupOrCreateTextLengthWrapper):
        * svg/SVGViewElement.cpp:
        (WebCore::SVGViewElement::parseAttribute):
        * svg/SVGViewElement.h:
        * svg/SVGViewSpec.cpp:
        (WebCore::SVGViewSpec::viewBoxPropertyInfo):
        (WebCore::SVGViewSpec::preserveAspectRatioPropertyInfo):
        (WebCore::SVGViewSpec::transformPropertyInfo):
        (WebCore::SVGViewSpec::SVGViewSpec):
        (WebCore::SVGViewSpec::viewBoxIdentifier):
        (WebCore::SVGViewSpec::preserveAspectRatioIdentifier):
        (WebCore::SVGViewSpec::transformIdentifier):
        (WebCore::SVGViewSpec::setZoomAndPan):
        (WebCore::SVGViewSpec::setTransformString):
        (WebCore::SVGViewSpec::transformString):
        (WebCore::SVGViewSpec::viewBoxString):
        (WebCore::SVGViewSpec::preserveAspectRatioString):
        (WebCore::SVGViewSpec::viewTarget):
        (WebCore::SVGViewSpec::transform):
        (WebCore::SVGViewSpec::lookupOrCreateViewBoxWrapper):
        (WebCore::SVGViewSpec::lookupOrCreatePreserveAspectRatioWrapper):
        (WebCore::SVGViewSpec::lookupOrCreateTransformWrapper):
        (WebCore::SVGViewSpec::reset):
        (WebCore::SVGViewSpec::parseViewSpec):
        * svg/SVGViewSpec.h:
        (WebCore::SVGViewSpec::~SVGViewSpec):
        (SVGViewSpec):
        (WebCore::SVGViewSpec::create):
        (WebCore::SVGViewSpec::setViewTargetString):
        (WebCore::SVGViewSpec::setZoomAndPan):
        (WebCore::SVGViewSpec::contextElement):
        (WebCore::SVGViewSpec::resetContextElement):
        (WebCore::SVGViewSpec::transformBaseValue):
        (WebCore::SVGViewSpec::viewBoxAnimated):
        (WebCore::SVGViewSpec::viewBox):
        (WebCore::SVGViewSpec::viewBoxBaseValue):
        (WebCore::SVGViewSpec::setViewBoxBaseValue):
        (WebCore::SVGViewSpec::preserveAspectRatioAnimated):
        (WebCore::SVGViewSpec::preserveAspectRatio):
        (WebCore::SVGViewSpec::preserveAspectRatioBaseValue):
        (WebCore::SVGViewSpec::setPreserveAspectRatioBaseValue):
        * svg/SVGViewSpec.idl:
        * svg/properties/SVGAnimatedProperty.h:
        (WebCore::SVGAnimatedProperty::isReadOnly):
        (WebCore::SVGAnimatedProperty::setIsReadOnly):
        (SVGAnimatedProperty):
        (WebCore::SVGAnimatedProperty::lookupOrCreateWrapper):
        (WebCore::SVGAnimatedProperty::lookupWrapper):
        (WebCore::SVGAnimatedProperty::SVGAnimatedProperty):
        * svg/properties/SVGAnimatedPropertyMacros.h:
        (WebCore::SVGSynchronizableAnimatedProperty::synchronize):
        (SVGSynchronizableAnimatedProperty):
        * svg/properties/SVGAnimatedPropertySynchronizer.h: Removed.
        * svg/properties/SVGAttributeToPropertyMap.h:
        * svg/properties/SVGListProperty.h:
        * svg/properties/SVGListPropertyTearOff.h:
        (SVGListPropertyTearOff):
        (WebCore::SVGListPropertyTearOff::isReadOnly):
        * svg/properties/SVGPathSegListPropertyTearOff.h:
        (SVGPathSegListPropertyTearOff):
        (WebCore::SVGPathSegListPropertyTearOff::isReadOnly):
        * svg/properties/SVGProperty.h:
        (SVGProperty):
        * svg/properties/SVGPropertyInfo.h:
        (WebCore::SVGPropertyInfo::SVGPropertyInfo):
        (SVGPropertyInfo):
        * svg/properties/SVGPropertyTearOff.h:
        (WebCore::SVGPropertyTearOff::isReadOnly):
        * svg/properties/SVGStaticListPropertyTearOff.h:
        (SVGStaticListPropertyTearOff):
        (WebCore::SVGStaticListPropertyTearOff::isReadOnly):

2012-05-29  Kent Tamura  <tkent@chromium.org>

        REGRESSION (r90971): the cursor is painted “behind” the placeholder text
        https://bugs.webkit.org/show_bug.cgi?id=87155

        Reviewed by Hajime Morita.

        This regression happened only on platforms on which
        RenderTheme::shouldShowPlaceholderWhenFocused() returns true.

        Because the order of renderers for the editable node and the placeholder
        node was:
         - A renderer for the editable node
         - A renderer for the placeholder node,
        The text caret was painted, then the palceholder was painted.

        We should not use z-index in the built-in shadow nodes. So the patch
        fixes this bug by re-ordering these renderers.

        Tests: fast/forms/input-placeholder-paint-order-2.html
               fast/forms/input-placeholder-paint-order.html
               fast/forms/textarea/textarea-placeholder-paint-order-2.html
               fast/forms/textarea/textarea-placeholder-paint-order.html

        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::fixPlaceholderRenderer):
        Added. Reorder the order of renderers so that the placeholder renderer
        precedes the inner text renderer.
        * html/HTMLTextFormControlElement.h: Add fixPlaceholderRenderer() declaration.

        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::attach): Calls fixPlaceholderRenderer().
        (WebCore::HTMLTextAreaElement::updatePlaceholderText):
        ditto. Also, use innerTextElement() to improvde code readability.
        * html/HTMLTextAreaElement.h:
        (HTMLTextAreaElement): Overrides attach().

        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::updatePlaceholderText):
        Calls fixPlaceholderRenderer().
        (WebCore::TextFieldInputType::attach): ditto.
        * html/TextFieldInputType.h:
        (TextFieldInputType): Overrides attach().

2012-05-28  Kentaro Hara  <haraken@chromium.org>

        [V8] Implement V8Binding::v8Null(isolate) and use it in CodeGeneratorV8.pm
        https://bugs.webkit.org/show_bug.cgi?id=87692

        Reviewed by Adam Barth.

        Since v8::Null(isolate) crashes if we pass a NULL isolate, we are planning
        to pass Isolate to v8::Null() in the following steps:

        [1] Implement V8Bindings::v8Null(isolate). v8Null(isolate) does the NULL check.
        If isolate is NULL, v8Null(isolate) calls v8::Null(). Otherwise,
        v8Null(isolate) calls v8::Null(isolate).

        [2] In V8 bindings, we replace v8::Null() with v8::Null(isolate) for a non-optional
        'isolate' parameter. (e.g. void foo(..., Isolate* isolate) { v8::Null(); } )

        [3] In V8 bindings, we replace v8::Null() with v8Null(isolate) for an optional
        'isolate' parameter. (e.g. void foo(..., Isolate* isolate = 0) { v8::Null(); } )

        This bug fixes [1] by implementing V8Binding::v8Null(isolate). Also this patch uses
        V8Binding::v8Null(isolate) in bindings/v8/*.{h,cpp}.

        No tests. No behavior change.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateHeader):
        (NativeToJSValue):
        * bindings/scripts/test/V8/V8Float64Array.h:
        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestEventConstructor.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestEventTarget.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestException.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestInterface.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestNode.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestObj.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::valueAttrGetter):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::readonlyValueAttrGetter):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
        (WebCore::toV8):
        * bindings/v8/V8Binding.h:
        (WebCore::v8Null):
        (WebCore):
        (WebCore::v8DateOrNull):
        * bindings/v8/V8DOMWrapper.cpp:
        * bindings/v8/V8DOMWrapper.h:
        (WebCore):

2012-05-28  Kent Tamura  <tkent@chromium.org>

        Fix a crash in HTMLFormControlElement::disabled().
        https://bugs.webkit.org/show_bug.cgi?id=86534

        Reviewed by Ryosuke Niwa.

        Stop to hold pointers of fildset and legend elements. We can avoid it by
        holding ancestor's disabled state.

        The ancesotr's disabled state should be invalidated when
         - fieldset's disabled value is changed.
         - fieldset's children is updated because a legend position might be changed.
         - A form control is attached to or detached from a tree.

        No new tests. It's almost impossible to make a reliable test.

        * html/HTMLFieldSetElement.cpp:
        (WebCore::HTMLFieldSetElement::invalidateDisabledStateUnder):
        Added. Invalidate disabled state of form controls under the specified node.
        (WebCore::HTMLFieldSetElement::disabledAttributeChanged):
        Uses invalidateDisabledStateUnder().
        (WebCore::HTMLFieldSetElement::childrenChanged):
        Added new override function. We need invalidate disabled state of form
        controls under legend elements.

        * html/HTMLFieldSetElement.h:
        (HTMLFieldSetElement): Add invalidateDisabledStateUnder() and childrenChanged().

        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
        Remove initialization of the removed data members.
        Initialize m_ancestorDisabledState.
        (WebCore::HTMLFormControlElement::updateAncestorDisabledState):
        Update m_ancestorDisabledState. It should be
        AncestorDisabledStateDisabled if the control is under a disabled
        fieldset and not under the first legend child of the disabled filedset.
        (WebCore::HTMLFormControlElement::ancestorDisabledStateWasChanged):
        Invalidate m_ancestorDisabledState.
        (WebCore::HTMLFormControlElement::insertedInto): ditto.
        (WebCore::HTMLFormControlElement::removedFrom): ditto.
        (WebCore::HTMLFormControlElement::disabled):
        Calls updateAncestorDisabledState() if needed.
        (WebCore::HTMLFormControlElement::recalcWillValidate):
        Remove unnecessary check for m_legendAncestor.

        * html/HTMLFormControlElement.h:
        (HTMLFormControlElement):
        - Rename updateFieldSetAndLegendAncestor() to updateAncestorDisabledState(), and make it private.
        - Remove m_fieldSetAncestor, m_legendAncestor, and m_fieldSetAncestorValid.
        - Add m_ancestorDisabledState.

2012-05-28  Takashi Toyoshima  <toyoshim@chromium.org>

        [WebSocket] Receiving reserved close codes, 1005, 1006, and 1015 must appear as code=1006 and wasClean=false
        https://bugs.webkit.org/show_bug.cgi?id=87084

        Reviewed by Kent Tamura.

        Status codes 1005, 1006, and 1015 are forbidden to be sent in actual close frames.
        If a client received these frames, the client should handle them as broken.
        Close frames containing invalid body size are the same as these forbidden cases.
        Update close-code-and-reason tests to verify this patch.

        * Modules/websockets/WebSocket.cpp: Handle AbnormalClosure as wasClean == false
        (WebCore::WebSocket::didClose):
        * Modules/websockets/WebSocketChannel.cpp: Handle close frames' status code carefully
        (WebCore::WebSocketChannel::processFrame):
        * Modules/websockets/WebSocketChannel.h: Update on newly defined close event codes

2012-05-28  Kentaro Hara  <haraken@chromium.org>

        [V8] Avoid passing NULL to an 'isolate' parameter
        https://bugs.webkit.org/show_bug.cgi?id=87689

        Reviewed by Adam Barth.

        v8::Null(isolate) crashes if we pass a NULL isolate.
        Thus we are planning to replace v8::Null()s in a following way:

        - Implement V8Bindings::v8Null(isolate). v8Null(isolate) does the NULL check.
        If isolate is NULL, v8Null(isolate) calls v8::Null(). Otherwise,
        v8Null(isolate) calls v8::Null(isolate).

        - In V8 bindings, we replace v8::Null() with v8::Null(isolate) for a
        non-optional 'isolate' parameter.
        (e.g. void foo(..., Isolate* isolate) { v8::Null(); } )

        - In V8 bindings, we replace v8::Null() with v8Null(isolate) for an
        optional 'isolate' parameter.
        (e.g. void foo(..., Isolate* isolate = 0) { v8::Null(); } )

        However, currently we cannot do the replacement mechanically, since some code
        pass NULL to a non-optional 'isolate' parameter. In other words, currently
        "non-optional" does not guarantee that 'isolate' is not NULL.

        This patch removes all the code that passes NULL to a non-optional 'isolate'
        parameter. This will enable us to achieve the replacement mechanically.

        No tests. No behavior change.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateCallbackImplementation):
        (NativeToJSValue):
        * bindings/scripts/test/V8/V8TestCallback.cpp:
        (WebCore::V8TestCallback::callbackWithClass1Param):
        (WebCore::V8TestCallback::callbackWithClass2Param):
        (WebCore::V8TestCallback::callbackWithStringList):
        (WebCore::V8TestCallback::callbackRequiresThisToPass):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::V8TestObj::installPerContextProperties):
        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
        (WebCore::V8SQLStatementErrorCallback::handleEvent):
        * bindings/v8/custom/V8MutationCallbackCustom.cpp:
        (WebCore::V8MutationCallback::handleEvent):

2012-05-28  Kent Tamura  <tkent@chromium.org>

        Form controls in <fieldset disabled> should not be validated.
        https://bugs.webkit.org/show_bug.cgi?id=87381

        Reviewed by Hajime Morita.

        We need to use disabeld() instead of m_disabled to calculate
        willValidate property. Also, we need to update willValidate if
        necessary.

        Test: fast/forms/fieldset/validation-in-fieldset.html

        * html/HTMLFieldSetElement.cpp:
        (WebCore::HTMLFieldSetElement::disabledAttributeChanged):
         - Do not traverse this.
         - Calls ancestorDisabledStateWasChanged() instead of
          setNeedsStyleRecalc() because we'd like to do additional tasks.
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::ancestorDisabledStateWasChanged):
        Added. Just calls disabledAttributeChanged().
        (WebCore::HTMLFormControlElement::parseAttribute):
        Do not call setNeedsWillValidateCheck() whenever an attribute is updated.
        It should be called only if disabled or readonly attribute is updated.
        (WebCore::HTMLFormControlElement::disabledAttributeChanged):
        Add setNeedsWillValidateCheck(). It was moved from parseAttribute().
        (WebCore::HTMLFormControlElement::insertedInto):
        Invalidate ancestor information.
        (WebCore::HTMLFormControlElement::recalcWillValidate):
        Use disabled() instead of m_disabled. disabled() takes care of
        ancestor's disabled state.
        * html/HTMLFormControlElement.h:
        (HTMLFormControlElement):

2012-05-28  Rakesh KN  <rakesh.kn@motorola.com>

        [Forms] HTMLFieldSetElement.idl doesn't have elements attribute.
        https://bugs.webkit.org/show_bug.cgi?id=80110

        Reviewed by Kent Tamura.

        Implemented elements attribute for HTMLFieldSetElement. This is spec'ed at
        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#dom-fieldset-elements

        Tests: fast/forms/fieldset/fieldset-elements.html
               fast/forms/fieldset/fieldset-form-collection-radionode-list.html

        * dom/Node.cpp:
        (WebCore::Node::radioNodeList):
        Extended ASSERT to assert if not HTMLFieldSetElement or HTMLFormElement.
        * html/HTMLFieldSetElement.cpp:
        (WebCore::HTMLFieldSetElement::elements):
        Elements attribute implementation.
        (WebCore::HTMLFieldSetElement::refreshElementsIfNeeded):
        Update the formcontrol elements collections if dom tree got modified.
        (WebCore::HTMLFieldSetElement::associatedElements):
        FormControl elements collection accessor.
        (WebCore::HTMLFieldSetElement::length):
        Number of elements in the fieldset group.
        * html/HTMLFieldSetElement.h:
        Added elements collection member and form control collection members.
        * html/HTMLFieldSetElement.idl:
        Added elements attribute.
        * html/HTMLFormCollection.cpp:
        (WebCore::HTMLFormCollection::formControlElements):
        Added support for HTMLFieldSetElement, based on base element type gets its associated elements.
        (WebCore::HTMLFormCollection::numberOfFormControlElements): Ditto
        (WebCore::HTMLFormCollection::getNamedFormItem): Process image elements only for form element.
        (WebCore::HTMLFormCollection::updateNameCache): Ditto
        * html/RadioNodeList.cpp:
        (WebCore::RadioNodeList::RadioNodeList):
        DynamicSubTree root element is decided based on the type whether base element is form or fieldset element.
        Renamed m_formElement to m_baseElement.
        (WebCore::RadioNodeList::~RadioNodeList):
        Renamed m_formElement to m_baseElement.
        (WebCore::RadioNodeList::checkElementMatchesRadioNodeListFilter):
        Form element specific changes moved under form element check.
        * html/RadioNodeList.h:
        (WebCore::RadioNodeList::create):
        (RadioNodeList):
        Renamed m_formElement to m_baseElement.

2012-05-28  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>

        [BlackBerry] http authenticate dialog popup only once no matter authentication pass or fail
        https://bugs.webkit.org/show_bug.cgi?id=80135

        Reviewed by Rob Buis.

        RIM PR: 145660
        Fixed a regression introduced by r111810, we should cancel the new
        request when user press cancel button in http authentication challenge
        dialog, and we should also allow sending empty username and password
        with the request.
        Also removed redundant codes which checked the existence of the
        FrameLoaderClient pointer, as we've already moved authenticationChallenge()
        out of class FrameLoaderClient, it is not needed.

        Manual test added. Testing http authentication dialog relies on user interaction.

        Resubmit the patch reverted by r115104 after the digest infinite loop
        issue for BlackBerry porting get identified and fixed.

        Internally reviewed by Joe Mason <jmason@rim.com>

        * platform/blackberry/PageClientBlackBerry.h:
        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::sendRequestWithCredentials):

2012-05-28  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>

        [BlackBerry] http authentication challenge issue when loading favicon
        https://bugs.webkit.org/show_bug.cgi?id=87665

        Reviewed by Rob Buis.

        Provide the TargetType when generating a favicon loading
        request. Loading favicons is triggered after the main resource
        has been loaded and parsed, so if we cancel the authentication
        challenge when loading main resource, we should also cancel
        loading the favicon when it starts to load. If not we will
        receive another challenge after we canceled the main resource
        loading, which may confuse the user.

        Internally reviewed by Joe Mason <jmason@rim.com>

        No new tests because of no behavior changes.

        * loader/icon/IconLoader.cpp:
        (WebCore::IconLoader::startLoading):
        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::sendRequestWithCredentials):

2012-05-28  MORITA Hajime  <morrita@google.com>

        Rename FrameLoaderClient::shadowDOMAllowed() to allowShadowDOM()
        https://bugs.webkit.org/show_bug.cgi?id=87101

        Reviewed by Kentaro Hara.

        No new tests. No behavior change.

        * bindings/generic/ContextEnabledFeatures.cpp:
        (WebCore::ContextEnabledFeatures::shadowDOMEnabled):
        * loader/FrameLoaderClient.h:
        (WebCore::FrameLoaderClient::allowShadowDOM):

2012-05-28  David Barton  <dbarton@mathscribe.com>

        mathml/presentation/mo-stretch.html and mroot-pref-width.html tests fail on Mac
        https://bugs.webkit.org/show_bug.cgi?id=86786

        Reviewed by Darin Adler.

        The fix to https://bugs.webkit.org/show_bug.cgi?id=84167 changed inline-table baselines,
        including for <mtable>. We therefore have to correct <mtable>'s vertical-align CSS
        property.

        Tested by existing tests mo-stretch.html, row-alignment.xhtml, and tables.xhtml.

        * css/mathml.css:
        (mtable):

2012-05-28  Luke Macpherson  <macpherson@chromium.org>

        Make CSSParser::filteredProperties() O(n) instead of O(n^2) and improve readability.
        https://bugs.webkit.org/show_bug.cgi?id=87078

        Reviewed by Darin Adler.

        This patch implements a number of improvements to filteredProperties:
        1) Make the code more linearly readable by separating out handling of important and non-important properties.
        2) Eliminate one BitArray instance (reduces hot memory so more cache friendly).
        3) Remove O(n^2) behavior caused by scanning for and removing previously encountered definitions of each property.
        The key algorithmic change is to add properties in decreasing precedence:
        a) Iterating once per (important, !important) so that important properties are visited first.
        b) Reverse iteration of m_parsedProperties visits the properties in decreasing precedence.

        Covered by loads of existing tests - getting CSS property precedence wrong results in too many errors to list.
        In particular fast/css contains test cases for important corner cases like duplicated important properties.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::createStylePropertySet):
        * css/CSSProperty.h:
        Add vector traits so that CSSProperty can just be memset by vector without calling constructor.

2012-05-28  MORITA Hajime  <morrita@google.com>

        Can't edit <input> elements with :first-letter
        https://bugs.webkit.org/show_bug.cgi?id=87615

        Reviewed by Kent Tamura.

        A check using canHaveGeneratedChildren() should cover not only
        button and menulist, but also RenderTextControl.
        This change pulles canHaveGeneratedChildren() up
        from RenderDeprecatedFlexibleBox to RenderObject,
        and lets RenderTextControl override it.

        Test: fast/forms/input-first-letter-edit.html

        * rendering/RenderBlock.cpp:
        (WebCore):
        (WebCore::RenderBlock::styleDidChange):
        (WebCore::RenderBlock::updateFirstLetter):
        * rendering/RenderBlock.h: Removed a static function canHaveGeneratedChildren()
        (RenderBlock):
        * rendering/RenderDeprecatedFlexibleBox.h:
        * rendering/RenderObject.cpp:
        (WebCore):
        (WebCore::RenderObject::canHaveGeneratedChildren): Added.
        * rendering/RenderObject.h:
        (RenderObject):
        * rendering/RenderTextControl.h:

2012-05-28  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] Add support for layers with scale invariant size
        https://bugs.webkit.org/show_bug.cgi?id=87601

        Reviewed by Rob Buis.

        To support layers that have a "floating" appearance, i.e. don't change size
        when the web page is drawn at a different scale, we add a new layer property
        named "sizeIsScaleInvariant".

        The anchor position will still be given in document coordinates for these
        "floating" layers, so this is well suited for interface elements like selection
        handles whose size is always the same but move with the web page contents.

        PR #156812

        * platform/graphics/blackberry/LayerCompositingThread.cpp:
        (WebCore::LayerCompositingThread::setDrawTransform):
        (WebCore::LayerCompositingThread::drawTextures):
        (WebCore::LayerCompositingThread::drawMissingTextures):
        * platform/graphics/blackberry/LayerCompositingThread.h:
        (LayerCompositingThread):
        * platform/graphics/blackberry/LayerCompositingThreadClient.h:
        (LayerCompositingThreadClient):
        (WebCore::LayerCompositingThreadClient::drawMissingTextures):
        * platform/graphics/blackberry/LayerData.h:
        (WebCore::LayerData::LayerData):
        (WebCore::LayerData::sizeIsScaleInvariant):
        (LayerData):
        * platform/graphics/blackberry/LayerRenderer.cpp:
        (WebCore::LayerRenderer::LayerRenderer):
        (WebCore::LayerRenderer::compositeLayers):
        (WebCore::LayerRenderer::updateLayersRecursive):
        (WebCore::LayerRenderer::compositeLayersRecursive):
        * platform/graphics/blackberry/LayerRenderer.h:
        (LayerRenderer):
        * platform/graphics/blackberry/LayerTiler.cpp:
        (WebCore::LayerTiler::updateTextureContentsIfNeeded):
        (WebCore::LayerTiler::drawTextures):
        (WebCore::LayerTiler::drawMissingTextures):
        (WebCore::LayerTiler::drawTexturesInternal):
        * platform/graphics/blackberry/LayerTiler.h:
        (LayerTiler):
        * platform/graphics/blackberry/LayerWebKitThread.h:
        (WebCore::LayerWebKitThread::setSizeIsScaleInvariant):
        (LayerWebKitThread):

2012-05-28  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] Make it possible to manipulate layers on the compositing thread
        https://bugs.webkit.org/show_bug.cgi?id=87602

        Reviewed by Rob Buis.

        Normally, layers are manipulated on the WebKit thread, and the changes are
        synced to the compositing thread during the next accelerated compositing commit
        operation.

        However, for overlay layers the ability to manipulate layers on the compositing
        thread is necessary for adequate user interface responsiveness.

        Two mechanisms are added:
        1. For a layer with a WebKit-thread counterpart, you can temporarily override
        attributes or add animations whose output override attributes.
        2. For a layer with no WebKit-thread counterpart, you can now directly set the
        compositing thread values for attributes. If you attempt to do this for layers
        that do have a WebKit-thread counterpart, the compositing thread values will
        be overwritten at the time of the next commit, which makes the override
        mechanism more useful there.

        PR #156812

        * platform/graphics/blackberry/LayerCompositingThread.cpp:
        (WebCore::LayerCompositingThread::addSublayer):
        (WebCore):
        (WebCore::LayerCompositingThread::updateAnimations):
        (WebCore::LayerCompositingThread::removeAnimation):
        (WebCore::LayerCompositingThread::override):
        (WebCore::LayerCompositingThread::clearOverride):
        * platform/graphics/blackberry/LayerCompositingThread.h:
        (LayerOverride):
        (WebCore::LayerOverride::create):
        (WebCore::LayerOverride::setPosition):
        (WebCore::LayerOverride::setAnchorPoint):
        (WebCore::LayerOverride::setBounds):
        (WebCore::LayerOverride::setTransform):
        (WebCore::LayerOverride::setOpacity):
        (WebCore::LayerOverride::addAnimation):
        (WebCore::LayerOverride::LayerOverride):
        (WebCore):
        (LayerCompositingThread):
        (WebCore::LayerCompositingThread::setPosition):
        (WebCore::LayerCompositingThread::setAnchorPoint):
        (WebCore::LayerCompositingThread::setBounds):
        (WebCore::LayerCompositingThread::setSizeIsScaleInvariant):
        (WebCore::LayerCompositingThread::setTransform):
        (WebCore::LayerCompositingThread::setOpacity):
        (WebCore::LayerCompositingThread::setNeedsTexture):
        * platform/graphics/blackberry/LayerWebKitThread.cpp:
        (WebCore::LayerWebKitThread::LayerWebKitThread):
        (WebCore::LayerWebKitThread::commitOnCompositingThread):
        * platform/graphics/blackberry/LayerWebKitThread.h:
        (LayerWebKitThread):
        (WebCore::LayerWebKitThread::clearOverride):

2012-05-28  Rob Flack  <flackr@chromium.org>

        [chromium] Only increase size of Combo Box Options when displayed on touch screen
        https://bugs.webkit.org/show_bug.cgi?id=85921

        Reviewed by Adam Barth.

        Adds a flag to set whether the current device is a touch screen, independent of whether touch events are supported and use this for the combo box sizing.

        No new tests as this is a flag change and covered by existing tests: WebKit/chromium/tests/PopupMenuTest.cpp

        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (WebCore::Settings::setDeviceSupportsTouch):
        (WebCore::Settings::deviceSupportsTouch):
        (Settings):
        * platform/chromium/PopupListBox.cpp:
        (WebCore::PopupListBox::getRowHeight):
        * platform/chromium/PopupListBox.h:
        (PopupContainerSettings):
        * platform/chromium/PopupMenuChromium.cpp:
        (WebCore::PopupMenuChromium::show):

2012-05-28  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] Make custom compositing thread layers more flexible
        https://bugs.webkit.org/show_bug.cgi?id=87600

        Reviewed by Rob Buis.

        Introduce a LayerCompositingThreadClient that's used to fine tune the
        behaviour of custom layers. Let the LayerTiler be a
        LayerCompositingThreadClient and thus decouple it from
        LayerCompositingThread. Adjust method signatures to allow a one-to-many
        relationship between Client and Layer.

        Remove the old LayerCompositingThread::drawCustom() in favour of this new
        Client interface.

        PR #156812

        * platform/graphics/blackberry/LayerCompositingThread.cpp:
        (WebCore::LayerCompositingThread::create):
        (WebCore::LayerCompositingThread::LayerCompositingThread):
        (WebCore::LayerCompositingThread::~LayerCompositingThread):
        (WebCore::LayerCompositingThread::deleteTextures):
        (WebCore::LayerCompositingThread::drawTextures):
        (WebCore::LayerCompositingThread::hasMissingTextures):
        (WebCore::LayerCompositingThread::drawMissingTextures):
        (WebCore::LayerCompositingThread::updateTextureContentsIfNeeded):
        (WebCore::LayerCompositingThread::bindContentsTexture):
        (WebCore::LayerCompositingThread::setVisible):
        (WebCore::LayerCompositingThread::scheduleCommit):
        * platform/graphics/blackberry/LayerCompositingThread.h:
        (WebCore):
        (LayerCompositingThread):
        * platform/graphics/blackberry/LayerCompositingThreadClient.h: Added.
        (WebCore):
        (LayerCompositingThreadClient):
        (WebCore::LayerCompositingThreadClient::~LayerCompositingThreadClient):
        (WebCore::LayerCompositingThreadClient::bindContentsTexture):
        (WebCore::LayerCompositingThreadClient::hasMissingTextures):
        (WebCore::LayerCompositingThreadClient::drawMissingTextures):
        (WebCore::LayerCompositingThreadClient::scheduleCommit):
        * platform/graphics/blackberry/LayerRenderer.cpp:
        (WebCore::LayerRenderer::drawDebugBorder):
        * platform/graphics/blackberry/LayerTiler.cpp:
        (WebCore::LayerTiler::LayerTiler):
        (WebCore::LayerTiler::layerCompositingThreadDestroyed):
        (WebCore::LayerTiler::layerVisibilityChanged):
        (WebCore::LayerTiler::uploadTexturesIfNeeded):
        (WebCore::LayerTiler::deleteTextures):
        (WebCore::LayerTiler::scheduleCommit):
        (WebCore):
        (WebCore::LayerTiler::bindContentsTexture):
        * platform/graphics/blackberry/LayerTiler.h:
        (LayerTiler):
        (WebCore::LayerTiler::hasMissingTextures):
        * platform/graphics/blackberry/LayerWebKitThread.cpp:
        (WebCore::LayerWebKitThread::LayerWebKitThread):
        * platform/graphics/blackberry/LayerWebKitThread.h:
        (LayerWebKitThread):

2012-05-25  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>

        WebKitTestRunner needs to support layoutTestController.setJavaScriptProfilingEnabled
        https://bugs.webkit.org/show_bug.cgi?id=42328

        Reviewed by Eric Seidel.

        Add setJavaScriptProfilingEnabled() to window.internals.settings. No new tests, but this
        change will allow more tests to run in WebKitTestRunner and DRT for ports that weren't
        implementing this function before.
        This patch also refactors InspectorController::enableProfiler() and
        InspectorController::disableProfiler() to InspectorController::setProfilerEnabled(bool).

        * WebCore.exp.in:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::profilerEnabled):
        (WebCore::InspectorController::setProfilerEnabled):
        * inspector/InspectorController.h:
        (InspectorController):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::InternalSettings):
        (WebCore::InternalSettings::restoreTo):
        (WebCore::InternalSettings::setJavaScriptProfilingEnabled):
        (WebCore):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-05-28  Yong Li  <yoli@rim.com>

        Crash on incomplete :not().
        https://bugs.webkit.org/show_bug.cgi?id=86673

        Reviewed by Antti Koivisto.

        Add back null-checks for incomplete :not() class
        which were dropped by r81845.

        * css/CSSSelector.cpp:
        (WebCore::CSSSelector::specificityForOneSelector):
        (WebCore::CSSSelector::selectorText):
        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOneSelector):
        (WebCore::SelectorChecker::determineLinkMatchType):

2012-05-28  Leo Yang  <leo.yang@torchmobile.com.cn>

        FileWriterSync binding should have no static table
        https://bugs.webkit.org/show_bug.cgi?id=87645

        Reviewed by George Staikos.

        FileWriterSync could be used in filesystem FileWriter in worker thread, so we should add ProgressEvent in idl file.

        Covered by existing test: fast/filesystem/workers/sync-operations.html.

        * Modules/filesystem/FileWriterSync.idl:

2012-05-28  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] Add an overlay layer
        https://bugs.webkit.org/show_bug.cgi?id=87567

        Reviewed by Antonio Gomes.

        The overlay layer allows us to have compositing layers even though the
        web page is not currently using accelerated compositing.

        These layers can be used to implement tap highlight, inspector overlay
        and more.

        The WebCore changes support the overlay layer functionality in WebKit
        by making it possible to add animations from the compositing thread
        without them being instantly overwritten during the next commit.

        Also a new custom layer type is added, which allow an overlay layer to
        draw itself using raw OpenGL calls. An instance of a custom subclass of
        LayerCompositingThread must be provided when creating the
        LayerWebKitThread. Then, the custom layer can be used as the content
        layer of a GraphicsLayer, or by itself.

        Reviewed internally by Filip Spacek.

        PR #154335

        * platform/graphics/blackberry/LayerCompositingThread.cpp:
        (WebCore::LayerCompositingThread::~LayerCompositingThread):
        (WebCore::LayerCompositingThread::deleteTextures):
        (WebCore::LayerCompositingThread::drawTextures):
        (WebCore::LayerCompositingThread::drawMissingTextures):
        (WebCore::LayerCompositingThread::updateTextureContentsIfNeeded):
        (WebCore::LayerCompositingThread::setVisible):
        (WebCore::LayerCompositingThread::scheduleCommit):
        * platform/graphics/blackberry/LayerCompositingThread.h:
        (WebCore::LayerCompositingThread::addAnimation):
        (WebCore::LayerCompositingThread::setRunningAnimations):
        (WebCore::LayerCompositingThread::setSuspendedAnimations):
        (LayerCompositingThread):
        (WebCore::LayerCompositingThread::drawCustom):
        * platform/graphics/blackberry/LayerData.h:
        (LayerData):
        * platform/graphics/blackberry/LayerWebKitThread.cpp:
        (WebCore::LayerWebKitThread::LayerWebKitThread):
        (WebCore):
        (WebCore::LayerWebKitThread::~LayerWebKitThread):
        (WebCore::LayerWebKitThread::updateTextureContentsIfNeeded):
        (WebCore::LayerWebKitThread::startAnimations):
        (WebCore::LayerWebKitThread::commitOnCompositingThread):
        (WebCore::LayerWebKitThread::setNeedsDisplayInRect):
        (WebCore::LayerWebKitThread::setNeedsDisplay):
        (WebCore::LayerWebKitThread::setIsMask):
        (WebCore::LayerWebKitThread::setRunningAnimations):
        (WebCore::LayerWebKitThread::setSuspendedAnimations):
        * platform/graphics/blackberry/LayerWebKitThread.h:
        (LayerWebKitThread):

2012-05-28  Leo Yang  <leo.yang@torchmobile.com.cn>

        ProgressEvent JSC binding should have no static table
        https://bugs.webkit.org/show_bug.cgi?id=87365

        Reviewed by George Staikos.

        ProgressEvent could be used in filesystem FileWriter in worker thread, so we should add ProgressEvent in idl file.

        Covered by existing test: fast/filesystem/workers/file-writer-events.html.

        * dom/ProgressEvent.idl:

2012-05-28  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] Update WebPageCompositor::render() API
        https://bugs.webkit.org/show_bug.cgi?id=87565

        Reviewed by Rob Buis.

        The new API allows the embedder to specify the root transform and many
        OpenGL related parameters.

        Also refactor the code to allow several sets of layers to be rendered,
        and to allow interleaving the rendering of layers with rendering of
        buffers and checkerboard.

        Reviewed internally by Filip Spacek.

        PR #154334

        * platform/graphics/blackberry/LayerCompositingThread.cpp:
        (WebCore::LayerCompositingThread::drawTextures):
        (WebCore::LayerCompositingThread::drawSurface):
        * platform/graphics/blackberry/LayerRenderer.cpp:
        (WebCore::LayerRenderer::orthoMatrix):
        (WebCore::LayerRenderer::LayerRenderer):
        (WebCore::LayerRenderer::prepareFrame):
        (WebCore):
        (WebCore::LayerRenderer::setViewport):
        (WebCore::LayerRenderer::compositeLayers):
        (WebCore::LayerRenderer::compositeBuffer):
        (WebCore::LayerRenderer::drawCheckerboardPattern):
        (WebCore::LayerRenderer::drawLayersOnSurfaces):
        (WebCore::LayerRenderer::prepareFrameRecursive):
        (WebCore::LayerRenderer::updateLayersRecursive):
        (WebCore::LayerRenderer::compositeLayersRecursive):
        (WebCore::LayerRenderer::updateScissorIfNeeded):
        (WebCore::LayerRenderingResults::addHolePunchRect):
        * platform/graphics/blackberry/LayerRenderer.h:
        (LayerRenderer):

2012-05-28  Antti Koivisto  <antti@apple.com>

        REGRESSION(r96517): Attribute selector fails to match dynamically modified style attribute
        https://bugs.webkit.org/show_bug.cgi?id=87349

        Reviewed by Andreas Kling.
        
        Selector fast path does not trigger lazy style attribute generation. Since attribute selectors matching
        style attribute are rare, disallow them from the fast path rather than making it more branchy.

        Test: fast/css/dynamic-style-attribute-query.html

        * css/SelectorChecker.cpp:
        (WebCore::isFastCheckableMatch):

2012-05-28  Peter Rybin  <peter.rybin@gmail.com>

        Web Inspector: Expose function (closure) scopes in remote protocol
        https://bugs.webkit.org/show_bug.cgi?id=86861

        Reviewed by Yury Semikhatsky.

        A data transfer from V8's FunctionMirror via DebuggerScript.js via InjectedScriptHost is built.
        Scope field is added to protocol declaration similar to scopes of stack call frame.
        Test for function details is extended.
        JSC code binging got fixme for implemting the corresponding feature.

        * bindings/js/JSInjectedScriptHostCustom.cpp:
        (WebCore::JSInjectedScriptHost::functionDetails):
        * bindings/v8/DebuggerScript.js:
        * bindings/v8/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::functionScopes):
        (WebCore):
        * bindings/v8/ScriptDebugServer.h:
        (ScriptDebugServer):
        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
        (WebCore::V8InjectedScriptHost::functionDetailsCallback):
        * inspector/InjectedScriptHost.cpp:
        (WebCore):
        (WebCore::InjectedScriptHost::scriptDebugServer):
        * inspector/InjectedScriptHost.h:
        (WebCore):
        (WebCore::InjectedScriptHost::init):
        (InjectedScriptHost):
        * inspector/InjectedScriptSource.js:
        (.):
        * inspector/Inspector.json:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        * inspector/WorkerInspectorController.cpp:
        (WebCore::WorkerInspectorController::WorkerInspectorController):

2012-05-28  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] Add a constructor to create a Path from an SkPath
        https://bugs.webkit.org/show_bug.cgi?id=87566

        Reviewed by Antonio Gomes.

        Skia allows the creation of more complex paths than WebCore would
        allow. This will be used in the BlackBerry port to implement a default
        tap highlight appearance.

        Reviewed internally by Mike Lattanzio.

        PR #154329

        * platform/graphics/Path.h:
        (Path):
        * platform/graphics/skia/PathSkia.cpp:
        (WebCore):
        (WebCore::Path::Path):

2012-05-28  Alexis Menard  <alexis.menard@openbossa.org>

        Unreviewed build fix for Mac on Lion.

        * inspector/CodeGeneratorInspector.py:

2012-05-28  Keishi Hattori  <keishi@webkit.org>

        Expose value localization function of HTMLInputElement
        https://bugs.webkit.org/show_bug.cgi?id=84356

        Reviewed by Kent Tamura.

        No new tests.

        We want to localize the values that are defined in the datalist element.
        This adds HTMLInputElement::localizeValue() which will localize a given
        value.

        * html/BaseDateAndTimeInputType.cpp:
        (WebCore::BaseDateAndTimeInputType::localizeValue):
        (WebCore):
        (WebCore::BaseDateAndTimeInputType::visibleValue):
        * html/BaseDateAndTimeInputType.h:
        (BaseDateAndTimeInputType):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::localizeValue):
        (WebCore):
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/InputType.cpp:
        (WebCore::InputType::localizeValue):
        (WebCore):
        * html/InputType.h:
        (InputType):
        * html/NumberInputType.cpp:
        (WebCore::NumberInputType::localizeValue):
        (WebCore):
        (WebCore::NumberInputType::visibleValue):
        * html/NumberInputType.h:
        (NumberInputType):

2012-05-28  Yury Semikhatsky  <yurys@chromium.org>

        Unreviewed. Test fix after r118670: saved timeline data may
        not have DOM counters data and MemoryStatistics object should
        take this into account.

        * inspector/front-end/MemoryStatistics.js:
        (WebInspector.MemoryStatistics.prototype._onRecordAdded):

2012-05-28  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118580.
        http://trac.webkit.org/changeset/118580
        https://bugs.webkit.org/show_bug.cgi?id=87647

        Caused webkit_unit_tests to crash on chromium. (Requested by
        bulach on #webkit).

        * platform/graphics/chromium/ContentLayerChromium.cpp:
        (WebCore::ContentLayerPainter::create):
        (WebCore::ContentLayerPainter::paint):
        (WebCore::ContentLayerPainter::ContentLayerPainter):
        (ContentLayerPainter):
        (WebCore::ContentLayerChromium::createTextureUpdaterIfNeeded):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (UpdatableTile):
        (WebCore::UpdatableTile::UpdatableTile):
        (WebCore::TiledLayerChromium::updateTiles):
        * platform/graphics/chromium/TiledLayerChromium.h:
        (TiledLayerChromium):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::CCSettings::CCSettings):
        (CCSettings):

2012-05-28  Peter Beverloo  <peter@chromium.org>

        &AElig doesn't get rendered as U+00C6
        https://bugs.webkit.org/show_bug.cgi?id=87465

        Reviewed by Adam Barth.

        The if-statement to check whether the first entry of a certain letter
        already exists in the index used .get(). The very first alphabetical
        entry is in position "0", which evaluates to false, causing the first
        entry to be ignored. Instead, use a "x not in y" check here.

        Also update WebCore.gyp to list the create-html-entity-table script as
        an input for the action, to make sure the table will be recreated.

        Test: html5lib/resources/entities02.dat

        * WebCore.gyp/WebCore.gyp:
        * html/parser/create-html-entity-table:

2012-05-28  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: dom counters graphs vanish on switching between timeline views
        https://bugs.webkit.org/show_bug.cgi?id=87628

        Reviewed by Vsevolod Vlasov.

        MemoryStatistics object now listens to the TimelineModel events instead of being
        populated by timeline panel. This behavior mathes that of the overview pane.

        * inspector/front-end/MemoryStatistics.js:
        (WebInspector.MemoryStatistics.prototype.addTimlineEvent):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype._onTimelineEventRecorded):
        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):

2012-05-28  Marcus Bulach  <bulach@chromium.org>

        [chromium] Buildfix: remove obsolete file from gypi.
        https://bugs.webkit.org/show_bug.cgi?id=87643

        Reviewed by no-reviewer.

        Following http://trac.webkit.org/changeset/118610.
        Removes reference to platform/graphics/gstreamer/ImageGStreamerCG.mm

        * WebCore.gypi:

2012-05-28  MORITA Hajime  <morrita@google.com>

        HTMLFormControlElement::m_validationMessage shouldn't be cleared on detach()
        https://bugs.webkit.org/show_bug.cgi?id=87608

        Reviewed by Kent Tamura.

        Moved m_validationMessage clearance from detach() to removedFrom() and
        remove detach().

        No new tests. This change has no visible difference. Upcoming changes rely on this though.

        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::removedFrom):

2012-05-28  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: "Record CPU profile" button doesn't change its state after finishing profiling
        https://bugs.webkit.org/show_bug.cgi?id=87624

        Reviewed by Vsevolod Vlasov.

        Keep record button state in sync with the current profiling state.

        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype.toggleRecordButton):

2012-05-28  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118650.
        http://trac.webkit.org/changeset/118650
        https://bugs.webkit.org/show_bug.cgi?id=87639

        Patch caused massive failures throughout the builders
        (Requested by zdobersek on #webkit).

        * css/MediaQuery.cpp:
        (WebCore):
        (WebCore::MediaQuery::serialize):
        (WebCore::MediaQuery::MediaQuery):
        (WebCore::MediaQuery::cssText):
        * css/MediaQuery.h:
        (WebCore::MediaQuery::expressions):
        (WebCore::MediaQuery::mediaType):
        (MediaQuery):
        (WebCore::MediaQuery::copy):
        * css/MediaQueryEvaluator.cpp:
        (WebCore::MediaQueryEvaluator::MediaQueryEvaluator):
        (WebCore::MediaQueryEvaluator):
        (WebCore::MediaQueryEvaluator::eval):
        (WebCore::aspect_ratioMediaFeatureEval):
        (WebCore::device_aspect_ratioMediaFeatureEval):
        (WebCore::transform_3dMediaFeatureEval):
        (WebCore::view_modeMediaFeatureEval):
        (WebCore::createFunctionMap):
        * css/MediaQueryEvaluator.h:
        (WebCore):
        (MediaQueryEvaluator):
        * css/StyleResolver.cpp:
        (WebCore):
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleResolver.h:
        (MediaQueryResult):
        (WebCore::MediaQueryResult::MediaQueryResult):
        (WebCore):
        (StyleResolver):

2012-05-28  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Move allowRoundingHacks to Internals interface
        https://bugs.webkit.org/show_bug.cgi?id=87328

        Reviewed by Hajime Morita.

        Add allowRoundingHacks function, because it is able to work in the
        cross-port way by means of the Internals interface.

        In addition, a function is added in order to restore default setting values.

        No new tests, since we are improving here the infra-structure for testing
        a specific method.

        * testing/Internals.cpp:
        (WebCore::Internals::reset):
        (WebCore):
        (WebCore::Internals::resetDefaultsToConsistentValues):
        (WebCore::Internals::allowRoundingHacks):
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-05-28  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>

        [BlackBerry] http authentication crash the browser when user commit or cancel the http authentication dialog
        https://bugs.webkit.org/show_bug.cgi?id=87579

        Reviewed by George Staikos.

        In function NetworkJob::startNewJobWithRequest, We should cancel the
        NetworkJob first before we start a new NetworkJob which reuses the
        resource handle of the old one. If we only set the m_handle = 0 of the
        old NetworkJob without cancelling itself, it will still receives data
        notification from network thread and handles the received data with
        the released resource handler, which will cause the crash.

        No new tests because no behavior has changed.

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::startNewJobWithRequest):

2012-05-27  MORITA Hajime  <morrita@google.com>

        [Refactoring][ShadowDOM] Some ElementShadow methods can be inlined.
        https://bugs.webkit.org/show_bug.cgi?id=87617

        Reviewed by Kentaro Hara.

        Inlined ElementShadow::attachHost(), ElementShadow::detachHost() and
        ElementShadow::reattach()

        No new tests. No behavior change.

        * dom/Element.cpp:
        (WebCore::Element::attach):
        (WebCore::Element::detach):
        * dom/ElementShadow.cpp:
        (WebCore::ElememtnShadow::reattachHostChildrenAndShadow):
        * dom/ElementShadow.h:
        (ElementShadow):

2012-05-28  Peter Rybin  <peter.rybin@gmail.com>

        Web Inspector: CodeGeneratorInspector.py: protect typed API from C++ implicit float to int cast
        https://bugs.webkit.org/show_bug.cgi?id=87183

        Reviewed by Yury Semikhatsky.

        An intermediate C++ class is introduced that uses C++ template technique to control actual type
        of its constructor argument.
        All input parameters of type "int" now have type ExactlyInt. 
        All usage sites are fixed accordingly.

        * inspector/CodeGeneratorInspector.py:
        (TypeModel.RefPtrBased):
        (TypeModel.Enum):
        (TypeModel.ValueType):
        (TypeModel.ValueType.get_opt_output_type_):
        (TypeModel.ValueType.ValueOptional.get_command_return_pass_model):
        (TypeModel.ExactlyInt):
        (TypeModel.ExactlyInt.__init__):
        (TypeModel.ExactlyInt.get_input_param_type_text):
        (TypeModel.ExactlyInt.get_opt_output_type_):
        (TypeModel.init_class):
        (ExactlyInt):
        * inspector/InspectorAgent.cpp:
        (WebCore::InspectorAgent::enable):
        (WebCore::InspectorAgent::didCreateWorker):
        (WebCore::InspectorAgent::didDestroyWorker):
        (WebCore::InspectorAgent::evaluateForTestInFrontend):
        * inspector/InspectorApplicationCacheAgent.cpp:
        (WebCore::InspectorApplicationCacheAgent::updateApplicationCacheStatus):
        (WebCore::InspectorApplicationCacheAgent::getFramesWithManifests):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::buildObjectForNode):
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore::jsHeapInfo):
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
        * inspector/PageRuntimeAgent.cpp:
        (WebCore::PageRuntimeAgent::notifyContextCreated):

2012-05-28  Kentaro Hara  <haraken@chromium.org>

        Unreviewed. Rebaselined run-binding-tests results.

        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::JSTestActiveDOMObjectOwner::finalize):
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::JSTestCustomNamedGetterOwner::finalize):
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::JSTestEventConstructorOwner::finalize):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::JSTestEventTargetOwner::finalize):
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::JSTestExceptionOwner::finalize):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::JSTestInterfaceOwner::finalize):
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::JSTestMediaQueryListListenerOwner::finalize):
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::JSTestNamedConstructorOwner::finalize):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjOwner::finalize):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::JSTestSerializedScriptValueInterfaceOwner::finalize):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::V8TestObj::installPerContextProperties):

2012-05-28  Darin Adler  <darin@apple.com>

        StyleResolver need not allocate each MediaQueryResult on the heap
        https://bugs.webkit.org/show_bug.cgi?id=75223

        Reviewed by Daniel Bates.

        * css/MediaQuery.cpp: Removed some comments that pointed to CSS documents.
        There is no guarantee these links will be valid over time.
        (WebCore::MediaQuery::MediaQuery): Rewrote for clarity, conventional WebKit coding
        style, and simplicity.
        (WebCore::MediaQuery::copy): Moved out of line; not performance critical, and this
        allows us to cut down header dependencies.
        (WebCore::MediaQuery::cssText): Updated for change to data member name.

        * css/MediaQuery.h: Removed unneeded includes. Removed non-helpful argument name
        "exprs". Changed expressions function to return a reference instead of
        a pointer. Changed mediaType and cssText functions to return a reference. Renamed
        m_serializationCache to m_serializedQuery. Moved copy function out of header.

        * css/MediaQueryEvaluator.cpp: Renamed EvalFunc to MediaFeatureEvaluationFunction.
        Broke a FIXME into three and reworded for clarity.
        (WebCore::MediaQueryEvaluator): Updated for name changes.
        (WebCore::MediaQueryEvaluator::eval): Rewrote this for clarity and to regularize
        the logic a bit.
        (WebCore::aspect_ratioMediaFeatureEval): Got rid of a != 0 that is contrary to the
        normal WebKit style.
        (WebCore::device_aspect_ratioMediaFeatureEval): Ditto.
        (WebCore::transform_3dMediaFeatureEval): Fixed mangled #if that was here.
        (WebCore::view_modeMediaFeatureEval): Replaced UNUSED_PARAM usage with ASSERT_UNUSED.
        (WebCore::createFunctionMap): Changed this so it returns the map so we can use a
        cleaner style in the caller.
        (WebCore::MediaQueryEvaluator::eval): Updated to take a reference and improved the
        comments and coding style a bit.

        * css/MediaQueryEvaluator.h: Updated comment style. Removed unused constructor.
        Removed unneeded destructor declaration. Renamed m_expResult to m_mediaFeatureResult.

        * css/StyleResolver.cpp: Moved the MediaQueryResult class into this file
        and made it a structure rather than a class.
        (WebCore::StyleResolver::addViewportDependentMediaQueryResult): Updated to take
        a reference argument instead of a pointer and for the new vector type.
        (WebCore::StyleResolver::affectedByViewportChange): Updated for above changes.

        * css/StyleResolver.h: Removed many unneeded includes and forward declarations of
        classes, including now-unneeded include of MediaQueryExp.h. Replaced MediaQueryResult
        definition with a forward declaration. Changed addViewportDependentMediaQueryResult
        to take a reference instead of a pointer. Changed m_viewportDependentMediaQueryResults
        to be a vector of values rather than of pointers.

2012-05-27  Shinya Kawanaka  <shinyak@chromium.org>

        cut, copy or paste event won't be fired in Shadow DOM.
        https://bugs.webkit.org/show_bug.cgi?id=87352

        Reviewed by Dimitri Glazkov.

        cut, copy or paste event was not fired in Shadow DOM.
        Since event re-targeting has been implemented, it should be safe to fire them in Shadow DOM now.

        Tests: fast/dom/shadow/cppevent-in-shadow.html
               fast/dom/shadow/cppevent-input-in-shadow.html

        * editing/Editor.cpp:
        (WebCore::Editor::findEventTargetFrom):

2012-05-27  Hayato Ito  <hayato@chromium.org>

        Support multiple shadow roots in event dispatching.
        https://bugs.webkit.org/show_bug.cgi?id=87470

        Reviewed by Dimitri Glazkov.

        The current implementation does not set event's target correctly
        if an event happens on DOM tree with multiple shadow roots.  So
        this patch updates an event re-targeting algorithm so that it
        works even if it is applied to multiple shadow roots.

        Tests: fast/dom/shadow/shadow-dom-event-dispatching.html

        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::ComposedShadowTreeWalker::traverseParentIncludingInsertionPointAndShadowRoot):
        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::ensureEventAncestors):

2012-05-27  Benjamin Poulain  <benjamin@webkit.org>

        Minor code cleaning for the interface of MainResourceLoader
        https://bugs.webkit.org/show_bug.cgi?id=87607

        Reviewed by Darin Adler.

        * loader/MainResourceLoader.cpp:
        (WebCore::MainResourceLoader::MainResourceLoader):
        (WebCore::MainResourceLoader::handleSubstituteDataLoadNow):
        (WebCore::MainResourceLoader::handleSubstituteDataLoadSoon):
        * loader/MainResourceLoader.h:
        (MainResourceLoader):
        -Add the OVERRIDE keyword for the methods inherited from ResourceLoader.
        -Remove the useless declaration of handleDataLoad(ResourceRequest&), this method does not exist.
        -Rename handleDataLoadNow() to handleSubstituteDataLoadNow() and make the method private. This should
         only be used by handleSubstituteDataLoadSoon() and indirectly through the timer.

2012-05-27  Yoshifumi Inoue  <yosin@chromium.org>

        [WTF] Introduce UINT64_C to MathExtras.h
        https://bugs.webkit.org/show_bug.cgi?id=87485

        Reviewed by Kent Tamura.

        This patch introduces UINT64_C for all platforms to avoid using
        conditional compilation.

        No new tests. This patch doesn't change behavior.

        * Modules/websockets/WebSocketFrame.cpp:
        (WebCore::WebSocketFrame::parseFrame): Replace conditional compilation with UINT64_C.

2012-05-27  Luke Macpherson  <macpherson@chromium.org>

        Use StringBuilder in WebKitCSSTransformValue::customCssText() to allow code reuse with CSS Variables.
        https://bugs.webkit.org/show_bug.cgi?id=87462

        Reviewed by Dimitri Glazkov.

        Factor out strings into a const char* array, and use a StringBuilder instead of String concatenation.
        This will allow future code to re-use the array of transform names, and StringBuilder is generally faster.

        Covered by existing CSS transform tests.

        * css/WebKitCSSTransformValue.cpp:
        (WebCore):
        (WebCore::WebKitCSSTransformValue::customCssText):

2012-05-27  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] Update color for tap highlight and selection
        https://bugs.webkit.org/show_bug.cgi?id=87606

        Reviewed by Antonio Gomes.

        PR #154813

        * platform/blackberry/RenderThemeBlackBerry.cpp:
        (WebCore::RenderThemeBlackBerry::platformTapHighlightColor):
        (WebCore::RenderThemeBlackBerry::platformActiveSelectionBackgroundColor):

2012-05-27  Benjamin Poulain  <bpoulain@apple.com>

        When pages are loaded from AppCache with DeferredLoading, willSendRequest() is never called
        https://bugs.webkit.org/show_bug.cgi?id=87582

        Reviewed by Darin Adler.

        Previously, there was a shortcut when a deferred MainResourceLoader is resumed: If the data
        was coming from AppCache we could jump directly to startDataLoadTimer().

        The problem with the shortcut is willSendRequest() is never called in that particular case
        (substituteData + deferred-resume). The imbalance between willSendRequest() and didReceiveResponse()
        causes problems.

        This patch removes the shortcut so that MainResourceLoader::loadNow() is used regardless of
        the deferred loading. The method MainResourceLoader::loadNow() handle the substituteData as if the loading
        was not deferred.

        Test: http/tests/appcache/load-from-appcache-defer-resume-crash.html

        * loader/MainResourceLoader.cpp:
        (WebCore::MainResourceLoader::continueAfterNavigationPolicy):
        (WebCore::MainResourceLoader::handleSubstituteDataLoadSoon):
        Rename the method to be consistent with the attribute it uses, making the naming more explicit.
        (WebCore::MainResourceLoader::loadNow):
        (WebCore::MainResourceLoader::setDefersLoading):
        * loader/MainResourceLoader.h:
        (MainResourceLoader):

2012-05-27  David Kilzer  <ddkilzer@apple.com>

        Use xcrun to find gperf path on platforms that use Xcode
        <http://webkit.org/b/87587>

        Reviewed by Dan Bernstein.

        * WebCore.xcodeproj/project.pbxproj:
        (Generate Derived Sources): Set GPERF environment variable using
        xcrun.
        * css/makeprop.pl: Use GPERF environment variable if set, else
        "gperf".
        * css/makevalues.pl: Ditto.
        * make-hash-tools.pl: Ditto.

2012-05-27  Li Yin  <li.yin@intel.com>

        [FileAPI] FileReader should fire progress event when blob has been completely read into memory
        https://bugs.webkit.org/show_bug.cgi?id=87585

        Reviewed by Kentaro Hara.

        From Spec: http://www.w3.org/TR/FileAPI/#dfn-progress-event
        One progress event will fire when blob has been completely read into memory.
        Firefox, Opera and IE follows the spec.
        Webkit based browser doesn't do that, it only fires progress event at interval of 50ms.
        WebKit should add the behavior to make the conformance with the spec.

        Tests: fast/files/file-reader-event-listener.html

        * fileapi/FileReader.cpp:
        (WebCore::FileReader::didFinishLoading):

2012-05-26  Li Yin  <li.yin@intel.com>

        [FileAPI] The result attribute of FileReader shuold use null to replace empty string
        https://bugs.webkit.org/show_bug.cgi?id=87578

        Reviewed by Kentaro Hara.

        From Spec: http://www.w3.org/TR/FileAPI/#filedata-attr
        Before read method has been called or an error in reading has occurred,
        the result attribute should be null, not empty string.

        Currently, Firefox, Opera and IE 10 follows the spec, but Webkit based 
        browser don't.
        WebKit should change the returned value empty string into null to keep 
        conformance with the spec.

        Tests: fast/files/read-file-async.html
               fast/files/blob-slice-test.html
               fast/files/read-blob-async.html
               fast/files/workers/worker-read-blob-async.html
               fast/files/workers/worker-read-file-async.html

        * fileapi/FileReader.cpp:
        (WebCore::FileReader::stringResult):

2012-05-26  Andy Estes  <aestes@apple.com>

        Fix the build when NETSCAPE_PLUGIN_API is disabled by marking a
        parameter as unused.

        * plugins/PluginData.cpp:
        (WebCore::PluginData::initPlugins):

2012-05-26  Nate Chapin  <japhet@chromium.org>

        Cancel CachedResource loads when the last client is removed.
        https://bugs.webkit.org/show_bug.cgi?id=35377

        Reviewed by Darin Adler.

        Test: http/tests/cache/cancel-in-progress-load.html

        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::errorLoadingResource):
        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::allClientsRemoved):
        * loader/cache/CachedFont.cpp:
        (WebCore::CachedFont::allClientsRemoved):
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::allClientsRemoved):
        * loader/cache/CachedRawResource.cpp:
        (WebCore):
        * loader/cache/CachedRawResource.h:
        (WebCore::CachedRawResource::shouldIgnoreHTTPStatusCodeErrors):
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::allClientsRemoved):
        (WebCore):
        * loader/cache/CachedResource.h:
        (CachedResource):
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::allClientsRemoved):

2012-05-26  Simon Fraser  <simon.fraser@apple.com>

        fast/block/inline-children-root-linebox-crash.html asserts after r118567
        https://bugs.webkit.org/show_bug.cgi?id=87544

        Reviewed by Darin Adler.
        
        RenderInline::offsetFromContainer() set offsetDependsOnPoint to true based
        on the container's flipped writing mode. However, offsetFromContainer() would
        then overwrite that, since it only checked for columns.
        
        Fix by having RenderInline::offsetFromContainer() check for flipping on
        the container. This fixes the assertion.
        
        The new testcase exercises fixes another issue; unlike mapLocalToAbsolute(),
        RenderGeometryMap::absoluteRect() didn't pass the rect center point through
        the mapping, which resulted in a different result in some flipping cases.

        Test: compositing/geometry/flipped-blocks-inline-mapping.html

        * rendering/RenderGeometryMap.cpp:
        (WebCore::RenderGeometryMap::absoluteRect):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::offsetFromContainer):
        (WebCore::RenderInline::pushMappingToContainer):

2012-05-26  Geoffrey Garen  <ggaren@apple.com>

        WebKit should be lazy-finalization-safe (esp. the DOM) v2
        https://bugs.webkit.org/show_bug.cgi?id=87581

        Reviewed by Oliver Hunt.

        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::destroy):
        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::destroy):
        * bindings/js/JSDOMWindowShell.cpp:
        (WebCore::JSDOMWindowShell::destroy):
        * bindings/js/JSNodeCustom.cpp:
        (WebCore::JSNodeOwner::finalize):
        * bindings/js/JSWorkerContextBase.cpp:
        (WebCore::JSWorkerContextBase::destroy):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::JSTestActiveDOMObject::destroy):
        (WebCore::JSTestActiveDOMObjectOwner::finalize):
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::JSTestCustomNamedGetter::destroy):
        (WebCore::JSTestCustomNamedGetterOwner::finalize):
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::JSTestEventConstructor::destroy):
        (WebCore::JSTestEventConstructorOwner::finalize):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::JSTestEventTarget::destroy):
        (WebCore::JSTestEventTargetOwner::finalize):
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::JSTestException::destroy):
        (WebCore::JSTestExceptionOwner::finalize):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::JSTestInterface::destroy):
        (WebCore::JSTestInterfaceOwner::finalize):
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::JSTestMediaQueryListListener::destroy):
        (WebCore::JSTestMediaQueryListListenerOwner::finalize):
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::JSTestNamedConstructor::destroy):
        (WebCore::JSTestNamedConstructorOwner::finalize):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObj::destroy):
        (WebCore::JSTestObjOwner::finalize):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::JSTestSerializedScriptValueInterface::destroy):
        (WebCore::JSTestSerializedScriptValueInterfaceOwner::finalize):
        * bridge/objc/objc_runtime.mm:
        (JSC::Bindings::ObjcFallbackObjectImp::destroy):
        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::QtRuntimeMethod::destroy):
        * bridge/qt/qt_runtime_qt4.cpp:
        (JSC::Bindings::QtRuntimeMethod::destroy):
        * bridge/runtime_array.cpp:
        (JSC::RuntimeArray::destroy):
        * bridge/runtime_method.cpp:
        (JSC::RuntimeMethod::destroy):
        * bridge/runtime_object.cpp:
        (JSC::Bindings::RuntimeObject::destroy):
        * bridge/runtime_root.cpp:
        (JSC::Bindings::RootObject::finalize): Use static_cast instead of jsCast because
        jsCast does Structure-based validation, and our Structure is not guaranteed
        to be alive when we get finalized.

2012-05-26  Simon Fraser  <simon.fraser@apple.com>

        Clip rects assertion when hovering div with transform
        https://bugs.webkit.org/show_bug.cgi?id=87580

        Reviewed by Eric Seidel.
        
        Hit testing used to use temporary clip rects in composited documents,
        until r118562. Now that we cache clip rects for hit testing, we need
        to clear the cache on descendant layers when a layer gains or loses
        a transform.

        Test: fast/layers/clip-rects-assertion.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::updateTransform):

2012-05-25  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/11439771> WebProcess sends many synchronous messages to the UI process while scrolling beneath ScrollView::contentsToScreen()
        https://bugs.webkit.org/show_bug.cgi?id=87571

        Reviewed by Anders Carlsson.

        fakeMouseEventTimerFired() uses the last known mouse position for the fake mouse event, but
        calls contentsToScreen() to compute a corresponding position in screen coordinates. Avoid
        this by also recording the last known mouse position in screen coordinates, and using that
        value.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::clear): Added resetting m_currentMouseGlobalPosition.
        (WebCore::EventHandler::handleMousePressEvent): Added updating m_currentMouseGlobalPosition
        when updating m_currentMousePosition.
        (WebCore::EventHandler::handleMouseDoubleClickEvent): Ditto.
        (WebCore::EventHandler::handleMouseMoveEvent): Ditto.
        (WebCore::EventHandler::handleMouseReleaseEvent): Ditto.
        (WebCore::EventHandler::fakeMouseMoveEventTimerFired): Changed to use m_currentMouseGlobalPosition
        in the fake event instead of calling contentsToScreen().
        * page/EventHandler.h: Added m_currentMouseGlobalPosition data member.

2012-05-25  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] Remove ImageGStreamerCG implementation
        https://bugs.webkit.org/show_bug.cgi?id=87559

        The ImageGStreamerCG abstraction is being removed until I manage to
        port my gst-mac WebKit branch over to the WebKit2 mac port. No
        need to update the Xcode project because this file is not
        referenced there anyway.

        Reviewed by Martin Robinson.

        * platform/graphics/gstreamer/ImageGStreamer.h:
        (ImageGStreamer):
        * platform/graphics/gstreamer/ImageGStreamerCG.mm: Removed.

2012-05-26  Rob Buis  <rwlbuis@webkit.org>

        Bug 15799: textPath element does not re-render when referenced path changes
        https://bugs.webkit.org/show_bug.cgi?id=15799

        Reviewed by Nikolas Zimmermann.

        Support textPath updating to changes on the referenced path. To make this possible
        use the target reference functionality also used by SVGFEImageElement.

        Tests: svg/custom/textPath-change-id-expected.svg
               svg/custom/textPath-change-id-pattern-expected.svg
               svg/custom/textPath-change-id-pattern.svg
               svg/custom/textPath-change-id.svg
               svg/custom/textPath-change-id2-expected.svg
               svg/custom/textPath-change-id2-pattern-expected.svg
               svg/custom/textPath-change-id2-pattern.svg
               svg/custom/textPath-change-id2.svg
               svg/custom/textPath-change-reference-expected.svg
               svg/custom/textPath-change-reference-pattern-expected.svg
               svg/custom/textPath-change-reference-pattern.svg
               svg/custom/textPath-change-reference-using-baseval-expected.svg
               svg/custom/textPath-change-reference-using-baseval-pattern-expected.svg
               svg/custom/textPath-change-reference-using-baseval-pattern.svg
               svg/custom/textPath-change-reference-using-baseval.svg
               svg/custom/textPath-change-reference.svg
               svg/custom/textPath-change-reference2-expected.svg
               svg/custom/textPath-change-reference2-pattern-expected.svg
               svg/custom/textPath-change-reference2-pattern.svg
               svg/custom/textPath-change-reference2-using-baseval-expected.svg
               svg/custom/textPath-change-reference2-using-baseval-pattern-expected.svg
               svg/custom/textPath-change-reference2-using-baseval-pattern.svg
               svg/custom/textPath-change-reference2-using-baseval.svg
               svg/custom/textPath-change-reference2.svg
               svg/custom/textPath-insert-path-expected.svg
               svg/custom/textPath-insert-path-pattern-expected.svg
               svg/custom/textPath-insert-path-pattern.svg
               svg/custom/textPath-insert-path.svg
               svg/custom/textPath-modify-child-expected.svg
               svg/custom/textPath-modify-child-pattern-expected.svg
               svg/custom/textPath-modify-child-pattern.svg
               svg/custom/textPath-modify-child.svg
               svg/custom/textPath-path-change-expected.svg
               svg/custom/textPath-path-change-pattern-expected.svg
               svg/custom/textPath-path-change-pattern.svg
               svg/custom/textPath-path-change-using-svg-dom-expected.svg
               svg/custom/textPath-path-change-using-svg-dom-pattern-expected.svg
               svg/custom/textPath-path-change-using-svg-dom-pattern.svg
               svg/custom/textPath-path-change-using-svg-dom.svg
               svg/custom/textPath-path-change.svg
               svg/custom/textPath-path-change2-expected.svg
               svg/custom/textPath-path-change2-pattern-expected.svg
               svg/custom/textPath-path-change2-pattern.svg
               svg/custom/textPath-path-change2.svg
               svg/custom/textPath-remove-path-expected.svg
               svg/custom/textPath-remove-path-pattern-expected.svg
               svg/custom/textPath-remove-path-pattern.svg
               svg/custom/textPath-remove-path.svg
               svg/custom/textPath-set-id-expected.svg
               svg/custom/textPath-set-id.svg
               svg/custom/textPath-startoffset-expected.svg
               svg/custom/textPath-startoffset-pattern-expected.svg
               svg/custom/textPath-startoffset-pattern.svg
               svg/custom/textPath-startoffset.svg

        * svg/SVGTextPathElement.cpp:
        (WebCore::SVGTextPathElement::~SVGTextPathElement):
        (WebCore):
        (WebCore::SVGTextPathElement::clearResourceReferences):
        (WebCore::SVGTextPathElement::svgAttributeChanged):
        (WebCore::SVGTextPathElement::buildPendingResource):
        (WebCore::SVGTextPathElement::insertedInto):
        (WebCore::SVGTextPathElement::removedFrom):
        * svg/SVGTextPathElement.h:

2012-05-26  Nikolas Zimmermann  <nzimmermann@rim.com>

        Avoid updateFromElement() usage in SVG
        https://bugs.webkit.org/show_bug.cgi?id=87573

        Stop relying on updateFromElement() - instead rely on addChild/removeChild, which
        allows us to optimize the resources re-fetching. When a child is added to the tree
        we don't need to remove existing resources from the SVGResourcesCache - the renderer
        can't be in the cache yet. Similary, remove the entry from the cache earlier: as soon
        as the renderer is removed from the tree, instead of waiting for willBeDestroyed().

        No new tests, refactoring only.

        * rendering/svg/RenderSVGBlock.cpp:
        * rendering/svg/RenderSVGBlock.h:
        (RenderSVGBlock):
        * rendering/svg/RenderSVGContainer.cpp:
        (WebCore::RenderSVGContainer::addChild):
        (WebCore):
        (WebCore::RenderSVGContainer::removeChild):
        * rendering/svg/RenderSVGContainer.h:
        (RenderSVGContainer):
        * rendering/svg/RenderSVGInline.cpp:
        (WebCore::RenderSVGInline::addChild):
        (WebCore::RenderSVGInline::removeChild):
        * rendering/svg/RenderSVGInline.h:
        (RenderSVGInline):
        * rendering/svg/RenderSVGModelObject.cpp:
        * rendering/svg/RenderSVGModelObject.h:
        (RenderSVGModelObject):
        * rendering/svg/RenderSVGResourceContainer.cpp:
        (WebCore::RenderSVGResourceContainer::registerResource):
        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::addChild):
        (WebCore):
        (WebCore::RenderSVGRoot::removeChild):
        * rendering/svg/RenderSVGRoot.h:
        (RenderSVGRoot):
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::addChild):
        (WebCore::RenderSVGText::removeChild):
        * rendering/svg/SVGResourcesCache.cpp:
        (WebCore::SVGResourcesCache::clientStyleChanged):
        (WebCore::rendererCanHaveResources):
        (WebCore):
        (WebCore::SVGResourcesCache::clientWasAddedToTree):
        (WebCore::SVGResourcesCache::clientWillBeRemovedFromTree):
        * rendering/svg/SVGResourcesCache.h:
        (SVGResourcesCache):
        * svg/SVGStyledElement.cpp:
        * svg/SVGStyledElement.h:
        (SVGStyledElement):

2012-05-25  Nat Duca  <nduca@chromium.org>

        [chromium] Instrument V8 GC with TraceEvent
        https://bugs.webkit.org/show_bug.cgi?id=87530

        Reviewed by Kentaro Hara.

        We sometimes get performance issues where performance stalls can
        be attributed to badly timed GC operations, especially ones that
        happen just before a frame running. This adds tracing calls around
        GC so that we can better understand these kinds of hangs.

        * bindings/v8/V8GCController.cpp:
        (WebCore::V8GCController::gcPrologue):
        (WebCore::V8GCController::gcEpilogue):

2012-05-25  Garrett Casto  <gcasto@chromium.org>

        Allow WebTextFieldDecoratorClient to see applied decorations.
        https://bugs.webkit.org/show_bug.cgi?id=86557

        Reviewed by Kent Tamura.

        * html/shadow/TextFieldDecorationElement.cpp:
        (WebCore::TextFieldDecorationElement::fromShadowRoot): A function
        that will extract a TextFielDecorationElement from a ShadowRoot, if
        there is one.
        * html/shadow/TextFieldDecorationElement.h:
        (WebCore):
        (TextFieldDecorator):

2012-05-25  Tony Chang  <tony@chromium.org>

        implement new negative flexing algorithm
        https://bugs.webkit.org/show_bug.cgi?id=86528

        Reviewed by Ojan Vafai.

        Rather than just scale by the negative flexibility, we also take the
        flex-basis (preferred size) into consideration.  That means items with
        a larger preferred size will shrink faster.

        Test: css3/flexbox/flex-algorithm.html (new test cases added)

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::preferredMainAxisContentExtentForChild): Handle overflow.
        (WebCore::RenderFlexibleBox::layoutFlexItems):
        (WebCore::RenderFlexibleBox::computeNextFlexLine): Sum weighted negative flex.
        (WebCore::RenderFlexibleBox::freezeViolations):
        (WebCore::RenderFlexibleBox::resolveFlexibleLengths): Shrink by weighted amount.
        Also handle large values by making sure the flex values are finite.
        * rendering/RenderFlexibleBox.h:

2012-05-25  Mihai Parparita  <mihaip@chromium.org>

        Allow synchronous XHRs to be disabled in documents
        https://bugs.webkit.org/show_bug.cgi?id=87540

        Reviewed by Eric Seidel.

        Test: fast/xmlhttprequest/xmlhttprequest-sync-disabled.html

        Synchronous XMLHttpRequests are a problematic API, since they result
        in blocked UI threads. Some clients may wish to always disable them;
        give them a setting to do so (see also r103629 for other cases where
        synchronous XHRs are disabled).

        * page/Settings.cpp:
        (WebCore):
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (Settings):
        (WebCore::Settings::setSyncXHRInDocumentsEnabled):
        (WebCore::Settings::syncXHRInDocumentsEnabled):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::InternalSettings):
        (WebCore::InternalSettings::restoreTo):
        (WebCore::InternalSettings::setSyncXHRInDocumentsEnabled):
        (WebCore):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::open):

2012-05-25  Kinuko Yasuda  <kinuko@chromium.org>

        [chromium] Deprecate FileUtilities::getFileSize and getFileModifiedTime in favor of getFileMetadata
        https://bugs.webkit.org/show_bug.cgi?id=87492

        Reviewed by Adam Barth.

        No new tests: existing tests (http/tests/local/fileapi/* and fast/files/*) should pass.

        * platform/chromium/FileSystemChromium.cpp:
        (WebCore::getFileSize):
        (WebCore::getFileModificationTime):
        (WebCore::getFileMetadata):
        * platform/chromium/PlatformSupport.h:
        (PlatformSupport):

2012-05-25  Abhishek Arya  <inferno@chromium.org>

        Crash in RenderTableSection::paintCell.
        https://bugs.webkit.org/show_bug.cgi?id=87445

        Reviewed by Eric Seidel and Julien Chaffraix.

        Fix the crash by preventing table parts from being set
        as layout root. This prevents us from accessing removed
        table cells which can happen if RenderTableSection::layout
        is called directly without calling RenderTable::layout first
        (in case of cell recalc).

        Add ASSERTs to RenderTableSection::layout to prevent
        layout to happen when we are already pending cell recalc
        or our table is pending section recalc. In those cases,
        RenderTable::layout should be called first to relayout
        the entire table.

        Test: tables/table-section-overflow-clip-crash.html

        * rendering/RenderObject.cpp:
        (WebCore::objectIsRelayoutBoundary):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::layout):

2012-05-25  Philip Rogers  <pdr@google.com>

        Fix for self-closing <use> tags
        https://bugs.webkit.org/show_bug.cgi?id=87504

        Reviewed by Adam Barth.

        This change causes self-closing non-html tags to behave the same
        as tags immediately followed by the closing tag.

        Test: svg/custom/svg-self-closing-use.html

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::attachLater):
        (WebCore::HTMLConstructionSite::insertSelfClosingHTMLElement):
        (WebCore::HTMLConstructionSite::insertForeignElement):
        * html/parser/HTMLConstructionSite.h:
        (HTMLConstructionSite):

2012-05-25  Dan Bernstein  <mitz@apple.com>

        Make the ICU-based implementation of NonSharedCharacterBreakIterator work in configurations
        that do not have COMPARE_AND_SWAP enabled.

        Reviewed by Jessie Berlin.

        * platform/text/TextBreakIteratorICU.cpp:
        (WebCore::compareAndSwapNonSharedCharacterBreakIterator): Added this helper. It uses
        weakCompareAndSwap when COMPARE_AND_SWAP is enabled, and uses a mutex to do the atomic
        compare and swap otherwise.
        (WebCore::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator): Changed to use
        compareAndSwapNonSharedCharacterBreakIterator().
        (WebCore::NonSharedCharacterBreakIterator::~NonSharedCharacterBreakIterator): Ditto.

2012-05-25  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: Make sure IceCallback is valid for PeerConnection00
        https://bugs.webkit.org/show_bug.cgi?id=87480

        Reviewed by Adam Barth.

        Existing tests have been extended to cover this change.

        * Modules/mediastream/PeerConnection00.cpp:
        (WebCore::PeerConnection00::create):
        * Modules/mediastream/PeerConnection00.h:
        * Modules/mediastream/PeerConnection00.idl:

2012-05-25  Mike West  <mkwst@chromium.org>

        Inline script and style blocked by Content Security Policy should provide more detailed console errors.
        https://bugs.webkit.org/show_bug.cgi?id=86848

        Reviewed by Adam Barth.

        This change adds a URL and line number for context to each call to
        `ContentSecurityPolicy::allowInline*`, and pipes it through to the
        console message generation in `CSPDirectiveList::reportViolation`.

        Line numbers are not added for injected scripts (`document.write(...)`,
        `document.body.appendChild`, and etc.).

        Tests: http/tests/security/contentSecurityPolicy/injected-inline-script-allowed.html
               http/tests/security/contentSecurityPolicy/injected-inline-script-blocked.html
               http/tests/security/contentSecurityPolicy/injected-inline-style-allowed.html
               http/tests/security/contentSecurityPolicy/injected-inline-style-blocked.html

        * bindings/ScriptControllerBase.cpp:
        (WebCore::ScriptController::executeIfJavaScriptURL):
        * bindings/js/JSLazyEventListener.cpp:
        (WebCore::JSLazyEventListener::initializeJSFunction):
        * bindings/v8/V8LazyEventListener.cpp:
        (WebCore::V8LazyEventListener::prepareListenerObject):
        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::ScriptElement):
        (WebCore::ScriptElement::executeScript):
        * dom/ScriptElement.h:
        (ScriptElement):
        * dom/StyleElement.cpp:
        (WebCore::StyleElement::StyleElement):
        (WebCore::StyleElement::createSheet):
        * dom/StyleElement.h:
        (StyleElement):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::StyledElement):
        (WebCore):
        (WebCore::StyledElement::style):
        (WebCore::StyledElement::styleAttributeChanged):
        * dom/StyledElement.h:
        (StyledElement):
        * page/ContentSecurityPolicy.cpp:
        (CSPDirectiveList):
        (WebCore::CSPDirectiveList::reportViolation):
        (WebCore::CSPDirectiveList::checkInlineAndReportViolation):
        (WebCore::CSPDirectiveList::checkEvalAndReportViolation):
        (WebCore::CSPDirectiveList::allowJavaScriptURLs):
        (WebCore::CSPDirectiveList::allowInlineEventHandlers):
        (WebCore::CSPDirectiveList::allowInlineScript):
        (WebCore::CSPDirectiveList::allowInlineStyle):
        (WebCore::CSPDirectiveList::allowEval):
        (WebCore):
        (WebCore::isAllowedByAllWithCallStack):
        (WebCore::isAllowedByAllWithContext):
        (WebCore::ContentSecurityPolicy::allowJavaScriptURLs):
        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers):
        (WebCore::ContentSecurityPolicy::allowInlineScript):
        (WebCore::ContentSecurityPolicy::allowInlineStyle):
        * page/ContentSecurityPolicy.h:
        (WTF):

2012-05-25  Tim Horton  <timothy_horton@apple.com>

        ENABLE_CSS3_FLEXBOX is insufficient to disable all web-facing bits of the feature
        https://bugs.webkit.org/show_bug.cgi?id=87537
        <rdar://problem/11524921>

        Reviewed by Simon Fraser.

        Allow the feature flag to disable more web-facing parts of the CSS3 flexbox
        implementation (primarily fallout from hiding it from computed style).

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/CSSValueKeywords.in:
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::getPropertyValue):
        (WebCore::StylePropertySet::asText):
        * css/StylePropertyShorthand.cpp:
        (WebCore::shorthandForProperty):
        * css/StylePropertyShorthand.h:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * page/animation/CSSPropertyAnimation.cpp:
        (WebCore::CSSPropertyAnimation::ensurePropertyMap):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::createObject):
        * rendering/style/RenderStyleConstants.h:

2012-05-25  Adrienne Walker  <enne@google.com>

        [chromium] Add setting for painting debug info onto tiles
        https://bugs.webkit.org/show_bug.cgi?id=75763

        Reviewed by James Robinson.

        Add a compile-time CCSetting to paint debug information onto tiles. This
        can help to understand paint counts and layer indices. This setting is
        off by default.

        * platform/graphics/chromium/ContentLayerChromium.cpp:
        (WebCore::ContentLayerPainter::create):
        (WebCore::ContentLayerPainter::paint):
        (WebCore::ContentLayerPainter::ContentLayerPainter):
        (WebCore::ContentLayerChromium::createTextureUpdater):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::UpdatableTile::UpdatableTile):
        (WebCore::UpdatableTile::setUpdateFrame):
        (WebCore::UpdatableTile::incrementPaintCount):
        (WebCore::UpdatableTile::updateFrame):
        (WebCore::UpdatableTile::paintCount):
        (WebCore::TiledLayerChromium::TiledLayerChromium):
        (WebCore::TiledLayerChromium::prepareToUpdateTiles):
        (WebCore::TiledLayerChromium::paintDebugTileInfo):
        * platform/graphics/chromium/TiledLayerChromium.h:
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::CCSettings::CCSettings):

2012-05-25  Ami Fischman  <fischman@chromium.org>

        [chromium] Default media controls should render only the currentTime-containing buffered range
        https://bugs.webkit.org/show_bug.cgi?id=85925

        Reviewed by Eric Carlson.

        Test: http/tests/media/video-buffered-range-contains-currentTime.html

        * rendering/RenderMediaControlsChromium.cpp:
        (WebCore::paintMediaSlider):

2012-05-25  Simon Fraser  <simon.fraser@apple.com>

        Build fix: add TransformationMatrix ctor from an AffineTransform.

        * platform/graphics/transforms/TransformationMatrix.cpp:
        (WebCore::TransformationMatrix::TransformationMatrix):
        (WebCore):
        * platform/graphics/transforms/TransformationMatrix.h:
        (TransformationMatrix):

2012-05-24  Ryosuke Niwa  <rniwa@webkit.org>

        createContextualFragment and insertAdjacentHTML should throw syntax error
        https://bugs.webkit.org/show_bug.cgi?id=87454

        Reviewed by Darin Adler.

        Before this patch, createContextualFragment threw NOT_SUPPORTED_ERR and insertAdjacentHTML didn't throw any errors.
        Make them throw SYNTAX_ERR to be consistent with the spec and Firefox:
        http://html5.org/specs/dom-parsing.html#parsing
        http://www.whatwg.org/specs/web-apps/current-work/multipage/the-xhtml-syntax.html#xml-fragment-parsing-algorithm

        Also reduced the code duplication.

        Test: fast/dom/xhtml-fragment-parsing-exceptions.xhtml

        * dom/Range.cpp:
        (WebCore::Range::createContextualFragment):
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::setInnerHTML): Explicitly pass AllowScriptingContent. 
        * editing/markup.cpp:
        (WebCore::createFragmentFromMarkup):
        (WebCore::createFragmentForInnerOuterHTML): Takes ExceptionCode now.
        (WebCore::createContextualFragment): Share code with createFragmentForInnerOuterHTML
        and propagate the exception code.
        * editing/markup.h:
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::setInnerHTML): Explicitly pass AllowScriptingContent.
        (WebCore::HTMLElement::setOuterHTML): Ditto.
        (WebCore::HTMLElement::insertAdjacentHTML): Ditto; also rename ignoredEc to ignoredEC
        per Darin's comment on the bug 87339.

2012-05-25  John Knottenbelt  <jknotten@chromium.org>

        Body scrollWidth() and scrollHeight() should be page scale-invariant
        https://bugs.webkit.org/show_bug.cgi?id=87494

        RenderView::documentRect() is calculating the "scaled" document rect by applying
        the current transformation matrix to the unscaledDocumentRect() and then
        returning the rounded-out IntRect result.

        This rounding out is incorrect because it allows the scaled rectangle to
        represent an area that is not actually covered by the document.

        We fix this by applying the current transform to the document rect
        as a FloatRect and then explicitly converting to IntRect, which
        takes the floor of the resulting rectangle coordinates instead of
        rounding them out.

        This is evidenced by the document.body.scrollWidth() and
        document.body.scrollHeight() changing under page scale factor when
        they are expected to remain invariant.

        Reviewed by James Robinson.

        Test: fast/dom/window-scroll-scaling.html

        * rendering/RenderView.cpp:
        (WebCore::RenderView::documentRect):

2012-05-25  Dan Bernstein  <mitz@apple.com>

        characterBreakIterator() is not safe to use reentrantly or from multiple threads
        https://bugs.webkit.org/show_bug.cgi?id=87521

        Reviewed by Darin Adler.

        Replaced characterBreakIterator() with a NonSharedCharacterBreakIterator class, which
        obtains a unique TextBreakIterator. Replaced the global shared instance with a single-entry
        cache.

        * dom/CharacterData.cpp:
        (WebCore::CharacterData::parserAppendData): Changed to use NonSharedCharacterBreakIterator.

        * platform/graphics/StringTruncator.cpp:
        (WebCore::centerTruncateToBuffer): Ditto.
        (WebCore::rightTruncateToBuffer): Ditto.

        * platform/text/String.cpp:
        (WebCore::numGraphemeClusters): Ditto.
        (WebCore::numCharactersInGraphemeClusters): Ditto.

        * platform/text/TextBreakIterator.h: Removed the declaration of characterBreakIterator().
        (NonSharedCharacterBreakIterator): Added. An instance of this class has a character break
        iterator instance that is unique to it for the lifetime of the instance.
        (WebCore::NonSharedCharacterBreakIterator::operator TextBreakIterator*): Added.

        * platform/text/TextBreakIteratorICU.cpp:
        (WebCore::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator): Added. Tries
        to swap the m_iterator member variable with the cached instance. If that fails, initializes
        m_iterator to a new character break iterator.
        (WebCore::NonSharedCharacterBreakIterator::~NonSharedCharacterBreakIterator): Added. Tries
        to put the m_iterator member variable back in the cache. If that fails, meaning there is
        already something in the cache, destroys m_iterator.

        * platform/text/gtk/TextBreakIteratorGtk.cpp:
        (WebCore::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator): Same as in
        TextBreakIteratorICU.cpp.
        (WebCore::NonSharedCharacterBreakIterator::~NonSharedCharacterBreakIterator): Ditto.
        (WebCore::cursorMovementIterator): Moved the old implementation of characterBreakIterator()
        here.

        * platform/text/qt/TextBreakIteratorQt.cpp:
        (WebCore::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator): Same as in
        TextBreakIteratorICU.cpp.
        (WebCore::NonSharedCharacterBreakIterator::~NonSharedCharacterBreakIterator): Ditto.
        (WebCore::cursorMovementIterator): Moved the old implementation of characterBreakIterator()
        here.

        * platform/text/wince/TextBreakIteratorWinCE.cpp:
        (WebCore::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator): Same as in
        TextBreakIteratorICU.cpp.
        (WebCore::NonSharedCharacterBreakIterator::~NonSharedCharacterBreakIterator): Ditto.
        (WebCore::cursorMovementIterator): Moved the old implementation of characterBreakIterator()
        here.

2012-05-25  Simon Fraser  <simon.fraser@apple.com>

        Terrible performance on http://alliances.commandandconquer.com/ and http://www.lordofultima.com/
        https://bugs.webkit.org/show_bug.cgi?id=84410

        Reviewed by Dave Hyatt.
        
        First part of fixing O(N^2) issues when walking the RenderLayer tree
        for computeCompositingRequirements().
        
        For each layer that goes into the OverlapMap, we were computing an absolute
        layer bounds, which requires walking back to the root of the tree.
        Optimize this when possible by storing a stack of offsets as we walk
        the tree, and using this stack to do the mapping.
        
        The stack of offsets and transforms is managed by RenderGeometryMap.
        When visiting a RenderLayer, RenderLayerCompositor pushes onto
        the geometry map stack data about offsets and transforms between
        the current layer and its stacking-parent. RenderGeometryMap handles
        the case where the previous renderer pushed is between the current
        renderer and its container. RenderGeometryMap can also handle callers
        pushing renderers with multiple containers between them.
        
        RenderGeometryMap stores some flags about whether the set of mapping
        steps in the stack involve transforms, fixed position, or special non-uniform
        mappings like CSS columns. In some cases, it falls back to mapping via
        renderers.

        Once constructed, the RenderGeometryMap stack can be used to map multiple
        rects or points efficiently. Stacks consisting of simple offsets are
        collapsed to a single offset.
        
        Mappings between renderers and their containers are pushed by pushMappingToContainer()
        methods, which are similar to mapLocalToContainer() methods. Having this code
        in RenderObjects was deemed preferable to handling columns, transforms etc. all in
        RenderLayer code.

        Tested by assertions in RenderGeometryMap code that its mapping matches
        mapping via localToAbsolute() calls.
        
        RenderLayerCompositor::updateCompositingLayers() creates a RenderGeometryMap,
        and pushes and pops layer renderers as it visits them. The geometry map is used
        by RenderLayerCompositor::addToOverlapMap() when computing absolute layer bounds.
        
        Futher optimizations in RenderGeometryMap are possible, especially with stacks that
        have many offsets and a few transforms.

        Tests: compositing/geometry/composited-in-columns.html
               compositing/geometry/flipped-writing-mode.html

        * CMakeLists.txt: Add RenderGeometryMap
        * GNUmakefile.list.am: Ditt
        * Target.pri: Ditto
        * WebCore.gypi: Ditto
        * WebCore.vcproj/WebCore.vcproj: Ditto
        * WebCore.xcodeproj/project.pbxproj: Ditto
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::absoluteContentBox):
        (WebCore::RenderBox::pushMappingToContainer):
        (WebCore::RenderBox::offsetFromContainer):
        * rendering/RenderBox.h:
        * rendering/RenderGeometryMap.cpp: Added.
        (RenderGeometryMapStep):
        (WebCore::RenderGeometryMapStep::RenderGeometryMapStep):
        (WebCore::RenderGeometryMapStep::mapPoint):
        (WebCore::RenderGeometryMapStep::mapQuad):
        (WebCore::RenderGeometryMap::RenderGeometryMap):
        (WebCore::RenderGeometryMap::~RenderGeometryMap):
        (WebCore::RenderGeometryMap::absolutePoint):
        (WebCore::RenderGeometryMap::absoluteRect):
        (WebCore::RenderGeometryMap::mapToAbsolute):
        (WebCore::RenderGeometryMap::pushMappingsToAncestor):
        (WebCore::RenderGeometryMap::push):
        (WebCore::RenderGeometryMap::pushView):
        (WebCore::RenderGeometryMap::popMappingsToAncestor):
        (WebCore::RenderGeometryMap::stepInserted):
        (WebCore::RenderGeometryMap::stepRemoved):
        * rendering/RenderGeometryMap.h: Added.
        (RenderGeometryMap):
        (WebCore::RenderGeometryMap::hasNonUniformStep):
        (WebCore::RenderGeometryMap::hasTransformStep):
        (WebCore::RenderGeometryMap::hasFixedPositionStep):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::offsetFromContainer):
        (WebCore::RenderInline::pushMappingToContainer):
        * rendering/RenderInline.h:
        (RenderInline):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateCompositingLayers):
        (WebCore::RenderLayerCompositor::addToOverlapMap):
        (WebCore::RenderLayerCompositor::addToOverlapMapRecursive):
        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
        * rendering/RenderLayerCompositor.h:
        (RenderLayerCompositor):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::mapLocalToContainer):
        (WebCore::RenderObject::pushMappingToContainer):
        (WebCore::RenderObject::offsetFromContainer):
        (WebCore::RenderObject::container):
        * rendering/RenderObject.h:
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::offsetFromContainer):
        * rendering/RenderTableCell.h:
        (RenderTableCell):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::pushMappingToContainer):
        * rendering/RenderView.h:
        * rendering/svg/RenderSVGForeignObject.cpp:
        (WebCore::RenderSVGForeignObject::pushMappingToContainer):
        * rendering/svg/RenderSVGForeignObject.h:
        (RenderSVGForeignObject):
        * rendering/svg/RenderSVGInline.cpp:
        (WebCore::RenderSVGInline::pushMappingToContainer):
        * rendering/svg/RenderSVGInline.h:
        (RenderSVGInline):
        * rendering/svg/RenderSVGModelObject.cpp:
        (WebCore::RenderSVGModelObject::pushMappingToContainer):
        * rendering/svg/RenderSVGModelObject.h:
        (RenderSVGModelObject):
        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::pushMappingToContainer):
        * rendering/svg/RenderSVGRoot.h:
        (RenderSVGRoot):
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::pushMappingToContainer):
        * rendering/svg/RenderSVGText.h:
        (RenderSVGText):
        * rendering/svg/SVGRenderSupport.cpp:
        (WebCore::SVGRenderSupport::pushMappingToContainer):
        * rendering/svg/SVGRenderSupport.h:
        (SVGRenderSupport):

2012-05-25  Simon Fraser  <simon.fraser@apple.com>

        Cache absolute clip rects on RenderLayer for compositing overlap testing
        https://bugs.webkit.org/show_bug.cgi?id=87212

        Reviewed by Dave Hyatt.
        
        Enhance the cache of ClipRects on RenderLayers to store three
        different types of ClipRects, rather than just one.
        
        We need to compute clip rects relative to different layers
        for different purposes. For painting, we compute relative to
        the compositing layer which is acting as a painting root.
        For hit testing, we compute relative to the root, except
        for transformed layers. For composting overlap testing, we
        compute relative to the root ("absolute"). At other times, we do one-off
        computation which we never want to cache ("temporary clip rects").
        
        This change allows us to cache rects for hit testing, and for
        compositing overlap testing. This has huge performance benefits
        on some pages (bug 84410).
        
        This change also makes ClipRects not arena-allocated, so we
        can use RefPtr<ClipRect>.

        No testable behavior change.

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::willBeDestroyed): No need for the
        explicit clipRects teardown, since clipRects don't need a live
        RenderObject for arena-based destruction.

        * rendering/RenderLayer.cpp: Remove arena-related new and delete.
        (WebCore::RenderLayer::RenderLayer): No need to explicitly initialize m_clipRects,
        since it's an OwnPtr now.
        (WebCore::RenderLayer::~RenderLayer): No explicit clipRect teardown required.
        (WebCore::RenderLayer::clippingRootForPainting): Renamed to make its purpose
        more obvious.
        (WebCore::RenderLayer::paintLayer): Use the TemporaryClipRects type when necessary.
        (WebCore::RenderLayer::paintLayerContents): Ditto
        (WebCore::RenderLayer::hitTestLayer): No longer need to use temporary clipRects when
        hit testing since we cache clip rects for hit testing.
        (WebCore::RenderLayer::updateClipRects): Take a ClipRectsType and pass it through.
        (WebCore::RenderLayer::calculateClipRects): Ditto
        (WebCore::RenderLayer::parentClipRects): Ditto
        (WebCore::RenderLayer::backgroundClipRect): Ditto
        (WebCore::RenderLayer::calculateRects): Take ClipRectsType, which obviates temporaryClipRects.
        (WebCore::RenderLayer::childrenClipRect): Use clippingRootForPainting().
        (WebCore::RenderLayer::selfClipRect): Ditto
        (WebCore::RenderLayer::localClipRect): Ditto
        (WebCore::RenderLayer::clearClipRectsIncludingDescendants): Take a type of clip rect to clear
        (include all). Allows us to just clear painting clip rects.
        (WebCore::RenderLayer::clearClipRects):

        * rendering/RenderLayer.h:
        (WebCore::ClipRects::create): We don't use RefCounted<> in order to use a bit in
        the refCount for a flag. Add create() method.
        (WebCore::ClipRects::deref): No longer arena-allocated.
        (WebCore::ClipRectsCache::ClipRectsCache): Struct that holds a small
        array of the 3 types of clipRects (and, in debug, the layer relative
        to which they were computed).
        (WebCore::RenderLayer::clipRects):

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateCompositedBounds): Use AbsoluteClipRects; rootLayer
        is always the RenderView's layer here.
        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Use TemporaryClipRects.
        (WebCore::RenderLayerBacking::setRequiresOwnBackingStore): When this variable changes,
        we need to invalidate painting clipRects, since it affects the ancestor relative to which
        those rects are computed.

        * rendering/RenderLayerBacking.h:
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateBacking): When the composited state
        of a layer changes, we have to clear all descendant clip rects, since this
        can affect the layers relative to which clip rects are computed.
        (WebCore::RenderLayerCompositor::addToOverlapMap): Use AbsoluteClipRects.
        (WebCore::RenderLayerCompositor::computeCompositingRequirements): No need
        to call updateLayerPosition(), since that should have always happened after
        layout. That call cleared clip rects, so removing it is very beneficial.
        (WebCore::RenderLayerCompositor::clippedByAncestor): Use TemporaryClipRects.

        * rendering/RenderTreeAsText.cpp:
        (WebCore::writeLayers): Use TemporaryClipRects.

2012-05-25  Dean Jackson  <dino@apple.com>

        Unreviewed, rolling out r112155.
        http://trac.webkit.org/changeset/112155
        https://bugs.webkit.org/show_bug.cgi?id=79389
        Hitch (due to style recalc?) when starting CSS3 animation

        This caused a number of issues, including:
        https://bugs.webkit.org/show_bug.cgi?id=87146
        https://bugs.webkit.org/show_bug.cgi?id=84194
        <rdar://problem/11506629>
        <rdar://problem/11267408>
        <rdar://problem/11531859>

        * dom/Element.cpp:
        (WebCore::Element::recalcStyle):

2012-05-25  David Hyatt  <hyatt@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=87525
        
        For the new multi-column layout, create a flow thread and make sure the children get put inside it.

        Reviewed by Eric Seidel.

        * rendering/RenderMultiColumnBlock.cpp:
        (WebCore::RenderMultiColumnBlock::RenderMultiColumnBlock):
        (WebCore::RenderMultiColumnBlock::addChild):
        (WebCore):
        * rendering/RenderMultiColumnBlock.h:
        (WebCore):
        (RenderMultiColumnBlock):
        (WebCore::RenderMultiColumnBlock::flowThread):
        * rendering/RenderMultiColumnFlowThread.cpp:
        (WebCore::RenderMultiColumnFlowThread::~RenderMultiColumnFlowThread):
        (WebCore):
        * rendering/RenderMultiColumnFlowThread.h:
        (RenderMultiColumnFlowThread):
        * rendering/RenderMultiColumnSet.h:
        * rendering/RenderObject.h:
        (RenderObject):
        (WebCore::RenderObject::isRenderMultiColumnSet):

2012-05-25  Emil A Eklund  <eae@chromium.org>

        Change RenderBoxModelObject to compute relativePositionOffset as size
        https://bugs.webkit.org/show_bug.cgi?id=87447

        Reviewed by Eric Seidel.

        Compute relativePositionOffset as size instead of doing one axis at a
        time as all call sites uses the size version of the method. This avoids
        having to walk the DOM twice to accumulate the offsets.

        Also remove the relativePositionOffsetX and Y methods as they are no
        longer used.

        No new tests, covered by existing tests.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::layoutOverflowRectForPropagation):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::accumulateRelativePositionOffsets):
        (WebCore::RenderBoxModelObject::relativePositionOffset):
        * rendering/RenderBoxModelObject.h:
        (RenderBoxModelObject):

2012-05-25  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118395.
        http://trac.webkit.org/changeset/118395
        https://bugs.webkit.org/show_bug.cgi?id=87526

        Breaking sites including GMail and Yahoo mail (Requested by
        jsbell on #webkit).

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::collapseMargins):

2012-05-25  Ken Buchanan  <kenrb@chromium.org>

        Layout root not getting cleared for anonymous renderers geting destroyed
        https://bugs.webkit.org/show_bug.cgi?id=84002

        Reviewed by Abhishek Arya.

        This is a follow-up to r109406, which added a check to clear layout
        roots when they point to a renderer that is being destroyed. The
        thinking was that layout roots would never be anonymous renderers,
        but there are some cases where this is not true (in particular,
        generated content containers with overflow clips can be layout roots).

        As in r109406, this patch has no layout test. This is because any test
        that exercises this behavior is caused by an existing layout bug where
        a child is not properly getting layout (or a renderer is getting dirtied
        out of order during layout) and will fail multiple ASSERTs:
        in particular, ASSERT(!m_layoutRoot->container() || !m_layoutRoot->
        container()->needsLayout()) in FrameView::scheduleRelayoutOfSubtree(),
        and ASSERT_NOT_REACHED() in RenderObject::clearLayoutRootIfNeeded().
        We are preventing those bugs from manifesting as security issues with
        this patch.

        This also removes an ASSERT from the RenderObject destructor. This is
        redundant with the condition in RenderObject::clearLayoutRootIfNeeded()
        which is always called in RenderObject::willBeDestroyed(), so the check 
        is not needed. It had to be removed because it fails when I try to
        adjust the ASSERT condition by removing the !node()
        check, due to RenderWidget clearing its node() during destruction.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::~RenderObject):
        (WebCore::RenderObject::willBeDestroyed):

2012-05-25  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Hangup when continuously changing a css width value in Inspector
        https://bugs.webkit.org/show_bug.cgi?id=85802

        Reviewed by Vsevolod Vlasov.

        An error in the property whitespace prefix detection algorithm would append the previous line trailing whitespace,
        thereby enormously increasing the actual prefix during multiple incremental property changes.

        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyle::newLineAndWhitespaceDelimiters):

2012-05-25  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Clean up Inspector.json after r118367
        https://bugs.webkit.org/show_bug.cgi?id=87499

        Reviewed by Yury Semikhatsky.

        This cleans up the semantic inconsistencies introduced into type/field names r118367.

        No new tests, as this is a refactoring.

        * inspector/Inspector.json:
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::asInspectorStyleSheet):
        (WebCore::InspectorCSSAgent::viaInspectorStyleSheet):
        (WebCore::InspectorCSSAgent::detectOrigin):
        * inspector/InspectorCSSAgent.h:
        (InspectorCSSAgent):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyleSheet::create):
        (WebCore::InspectorStyleSheet::InspectorStyleSheet):
        (WebCore::InspectorStyleSheet::buildObjectForRule):
        (WebCore::InspectorStyleSheet::resourceStyleSheetText):
        (WebCore::InspectorStyleSheetForInlineStyle::create):
        (WebCore::InspectorStyleSheetForInlineStyle::InspectorStyleSheetForInlineStyle):
        * inspector/InspectorStyleSheet.h:
        (InspectorStyleSheet):
        (WebCore::InspectorStyleSheet::canBind):
        (InspectorStyleSheetForInlineStyle):

2012-05-25  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: speed-up HeapSnapshot._bfs method.
        https://bugs.webkit.org/show_bug.cgi?id=87502

        It had containmentEdges.length call in the loop that forced deoptimization.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshot.prototype._calculateObjectToWindowDistance):
        (WebInspector.HeapSnapshot.prototype._bfs):

2012-05-25  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Speed up edges iteration in heap profiler
        https://bugs.webkit.org/show_bug.cgi?id=87286

        Add an extra node to nodes array that points to the end of edges array.
        It allows to eliminate a check for the last node in iteration code.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotNode.prototype._edgeIndexesStart):
        (WebInspector.HeapSnapshotNode.prototype._edgeIndexesEnd):
        (WebInspector.HeapSnapshotNodeIterator):
        (WebInspector.HeapSnapshot.prototype._buildRetainers):
        (WebInspector.HeapSnapshot.prototype._bfs):
        (WebInspector.HeapSnapshot.prototype._buildAggregates):
        (WebInspector.HeapSnapshot.prototype._buildPostOrderIndex):
        (WebInspector.HeapSnapshot.prototype._buildDominatorTree):
        (WebInspector.HeapSnapshot.prototype._markQueriableHeapObjects):

2012-05-25  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: put paint and compositing timeline events in a new category of their own
        https://bugs.webkit.org/show_bug.cgi?id=86852

        Reviewed by Pavel Feldman.

        - add forth timeline category, "Painting"; make it light-purple;
        - assign paint and compositing events to Painting category;

        * WebCore.gypi: added timelineBarLightPurple.png;
        * inspector/front-end/Images/timelineBarLightPurple.png: Added.
        * inspector/front-end/Images/timelineCheckmarks.png: added light-purple icon;
        * inspector/front-end/Images/timelineDots.png: ditto.
        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineCategoryStrips.prototype.update.appendRecord): do not merge bars in same raw if these are from different categories;
        (WebInspector.TimelineCategoryStrips.prototype.update):
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.categories):
        (WebInspector.TimelinePresentationModel.recordStyle):
        * inspector/front-end/WebKit.qrc: added timelineBarLightPurple.png;
        * inspector/front-end/timelinePanel.css: added styles for painting category;
        (.timeline-category-statusbar-item.timeline-category-painting .timeline-category-checkbox):
        (.timeline-category-painting .timeline-graph-bar):
        (.popover .timeline-painting):
        (.timeline-category-scripting .timeline-tree-icon):
        (.timeline-category-rendering .timeline-tree-icon):
        (.timeline-category-painting .timeline-tree-icon):

2012-05-25  W. James MacLean  <wjmaclean@chromium.org>

        [chromium] LayerChromium should recognise existing layer active animations when the layer is added.
        https://bugs.webkit.org/show_bug.cgi?id=87166

        Reviewed by Adrienne Walker.

        Unit test added.

        LayerChromium needs to correctly recognize if a newly added layer has an existing
        active animation.

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::setLayerTreeHost):
        (WebCore::LayerChromium::notifyAnimationFinished):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHost):

2012-05-25  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: HeapSnapshot: introduce performance counter for HeapSnapshotConstructorsDataGrid._aggregatesReceived method.
        https://bugs.webkit.org/show_bug.cgi?id=87393

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshotDataGrids.js:
        (WebInspector.HeapSnapshotConstructorsDataGrid.prototype._aggregatesReceived):
        (WebInspector.HeapSnapshotConstructorsDataGrid.prototype._populateChildren):

2012-05-25  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: drop obsolete WebInspector.Uint32Array and adjust snapshot chunk size for better transfer-snapshot metric.
        https://bugs.webkit.org/show_bug.cgi?id=87490

        Originally WebInspector.Uint32Array was used for dynamic array
        reallocation because we had no information about expected arrays sizes.
        Now we have these sizes and allocates array precisely.

        Reviewed by Yury Semikhatsky.

        * bindings/v8/ScriptHeapSnapshot.cpp:
        (WebCore):
        * inspector/front-end/HeapSnapshot.js:
        * inspector/front-end/HeapSnapshotLoader.js:
        (WebInspector.HeapSnapshotLoader.prototype._parseUintArray):
        (WebInspector.HeapSnapshotLoader.prototype.pushJSONChunk):

2012-05-25  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: drop obsolete WebInspector.Uint32Array and adjust snapshot chunk size for better transfer-snapshot metric.
        https://bugs.webkit.org/show_bug.cgi?id=87490

        Originally WebInspector.Uint32Array was used for dynamic array
        reallocation because we had no information about expected arrays sizes.
        Now we have these sizes and allocates array precisely.

        Reviewed by Yury Semikhatsky.

        * bindings/v8/ScriptHeapSnapshot.cpp:
        (WebCore):
        * inspector/front-end/HeapSnapshot.js:
        * inspector/front-end/HeapSnapshotLoader.js:
        (WebInspector.HeapSnapshotLoader.prototype._parseUintArray):
        (WebInspector.HeapSnapshotLoader.prototype.pushJSONChunk):

2012-05-25  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: cmd-[ shortcut navigates page and is fr-keyboard incompatible
        https://bugs.webkit.org/show_bug.cgi?id=85312

        Reviewed by Vsevolod Vlasov.

        Suppress the handling of panel history navigation events if the corresponding keyboard activities produce
        the "keypress" event (which is the case on French keyboards, where AltGr+[ is translated into Ctrl+Alt+[ on Windows).
        The event is also told to preventDefault() to avoid browser history navigation on Mac while traversing the Inspector panel history.

        * inspector/front-end/InspectorView.js:
        (WebInspector.InspectorView):
        (WebInspector.InspectorView.prototype._keyPress):
        (WebInspector.InspectorView.prototype._keyDown):
        (WebInspector.InspectorView.prototype._keyDownInternal):
        * inspector/front-end/UIUtils.js:
        (WebInspector.isWin):

2012-05-25  Yury Semikhatsky  <yurys@google.com>

        Unreviewed. Fixed closure compiler warnings.

        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.NativeMemoryProfileType.prototype.buttonClicked):
        (WebInspector.NativeMemoryProfileHeader.prototype.createView):

2012-05-25  Lu Guanqun  <guanqun.lu@intel.com>

        [GTK] fix compilation warning in GtkInputMethodFilter.cpp
        https://bugs.webkit.org/show_bug.cgi?id=87475

        Reviewed by Martin Robinson.

        * platform/gtk/GtkInputMethodFilter.cpp:
        (WebCore::GtkInputMethodFilter::setWidget):

2012-05-25  Zalan Bujtas  <zbujtas@gmail.com>

        [Qt] Broken controls rendering when transform is applied.
        https://bugs.webkit.org/show_bug.cgi?id=87483

        Reviewed by Simon Hausmann.

        Use only the scaling transform value to determine the size of
        the control to be drawn. When other transforms present such as
        rotate or skew, ignore them, unless scaling also involved. In
        that case, calculate the scaling value out of the transformation.

        * ManualTests/qt/control_paiting_with_transforms.html: Added.

        * platform/qt/RenderThemeQtMobile.cpp:
        (WebCore::painterScale):
        (WebCore):
        (WebCore::StylePainterMobile::sizeForPainterScale):

2012-05-17  Andrey Kosyakov  <caseq@chromium.org>

        [chromium] add instrumentation for compositing
        https://bugs.webkit.org/show_bug.cgi?id=83928

        Reviewed by James Robinson.

        - plumb willCommit() and didBeginFrame() from CCSingleThreadProxy and CCThreadProxy to inspector instrumentation;
        - note for threaded case, didBeginFrame() is invoked upon unblocking of main thread;

        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHostClient):
        (WebCore::CCLayerTreeHost::didBeginFrame):
        (WebCore::CCLayerTreeHost::willCommit):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::commitAndComposite):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::beginFrame):

2012-05-25  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Drop InspectorFileSystemInstrumentation
        https://bugs.webkit.org/show_bug.cgi?id=87460

        Inspector does not need to track DOMFileSystem object now. So we can
        drop InspectorFileSystemInstrumentation.

        Reviewed by Vsevolod Vlasov.

        * GNUmakefile.list.am:
        * Modules/filesystem/DOMFileSystem.cpp:
        (WebCore::DOMFileSystem::create):
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * inspector/InspectorFileSystemAgent.cpp:
        (WebCore::InspectorFileSystemAgent::enable):
        * inspector/InspectorFileSystemAgent.h:
        (InspectorFileSystemAgent):
        * inspector/InspectorFileSystemInstrumentation.h: Removed.
        * inspector/InspectorInstrumentation.cpp:
        (WebCore):
        * inspector/InspectorInstrumentation.h:
        (WebCore):
        (InspectorInstrumentation):

2012-05-25  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: HeapProfiler: speed-up _calculateClassesRetainedSize and _buildAggregates.
        https://bugs.webkit.org/show_bug.cgi?id=87482

        Engine didn't inline node's classIndex method because the switch statement in it wasn't inlineable.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotNode.prototype.classIndex):

2012-05-24  Andreas Kling  <kling@webkit.org>

        Dodge style recalc when id attribute is overwritten with same value.
        <http://webkit.org/b/87211>

        Reviewed by Eric Seidel.

        Don't force style recalc when the id attribute is set to the same value it already had.
        ~3.5% improvement on Dromaeo's "dom-attr" locally.

        * dom/Element.cpp:
        (WebCore::Element::attributeChanged):

2012-05-24  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add profile type for native memory snapshots
        https://bugs.webkit.org/show_bug.cgi?id=87400

        Reviewed by Vsevolod Vlasov.

        Introduced new profile type and view classes for native memory snapshots.
        All the stuff is hidden behind an experimental setting.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/NativeMemorySnapshotView.js: Added.
        (WebInspector.NativeMemorySnapshotView):
        (WebInspector.NativeMemorySnapshotView.prototype.dispose):
        (WebInspector.NativeMemorySnapshotView.prototype.get statusBarItems):
        (WebInspector.NativeMemorySnapshotView.prototype.get profile):
        (WebInspector.NativeMemoryProfileType):
        (WebInspector.NativeMemoryProfileType.prototype.get buttonTooltip):
        (WebInspector.NativeMemoryProfileType.prototype.buttonClicked):
        (WebInspector.NativeMemoryProfileType.prototype.get treeItemTitle):
        (WebInspector.NativeMemoryProfileType.prototype.get description):
        (WebInspector.NativeMemoryProfileType.prototype.createTemporaryProfile):
        (WebInspector.NativeMemoryProfileType.prototype.createProfile):
        (WebInspector.NativeMemoryProfileHeader):
        (WebInspector.NativeMemoryProfileHeader.prototype.createSidebarTreeElement):
        (WebInspector.NativeMemoryProfileHeader.prototype.createView):
        * inspector/front-end/ProfilesPanel.js:
        * inspector/front-end/Settings.js:
        (WebInspector.ExperimentsSettings):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:

2012-05-25  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: make some profiler methods private
        https://bugs.webkit.org/show_bug.cgi?id=87479

        Reviewed by Vsevolod Vlasov.

        - Removed unused methods.
        - Renamed private methods so that their names start with underscore. 
        - ProfileLauncherView methods are called directly from ProfilesPanel instead
          of sending events.

        * inspector/front-end/CPUProfileView.js:
        * inspector/front-end/CSSSelectorProfileView.js:
        (WebInspector.CSSSelectorProfileType.prototype.buttonClicked):
        (WebInspector.CSSSelectorProfileType.prototype._startRecordingProfile):
        (WebInspector.CSSSelectorProfileType.prototype.createTemporaryProfile):
        * inspector/front-end/ProfileLauncherView.js:
        (WebInspector.ProfileLauncherView.prototype.profileStarted):
        (WebInspector.ProfileLauncherView.prototype.profileFinished):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfileType.prototype.createProfile):
        (WebInspector.ProfilesPanel.prototype.toggleRecordButton):
        (WebInspector.ProfilesPanel.prototype._reset):
        (WebInspector.ProfilesPanel.prototype._populateProfiles.populateCallback.var):
        (WebInspector.ProfilesPanel.prototype._populateProfiles.populateCallback):
        (WebInspector.ProfilesPanel.prototype._populateProfiles):
        (WebInspector.ProfilesPanel.prototype.setRecordingProfile):
        (WebInspector.ProfilesPanel.prototype.takeHeapSnapshot.done):
        (WebInspector.ProfilesPanel.prototype.takeHeapSnapshot):

2012-05-25  Keishi Hattori  <keishi@webkit.org>

        Bad checkValidity result on recently "enabled" form fields
        https://bugs.webkit.org/show_bug.cgi?id=85704

        Reviewed by Kent Tamura.

        Test: fast/forms/disabled-attr-checkvalidity.html

        We were tripping on the assertion m_isValid == validity()->valid()
        inside HTMLFormControlElement::isValidFormControlElement.
        m_isValid was becoming stale because setNeedsValidityCheck wasn't called
        after m_willValidate changed.

        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::willValidate): We used const_cast
        because it was too difficult to remove const. We are checking if the
        value from willValidate has changed to avoid an infinite loop.
        (WebCore::HTMLFormControlElement::setNeedsWillValidateCheck):

2012-05-24  Kinuko Yasuda  <kinuko@chromium.org>

        [chromium] DataTransferItem.webkitGetAsEntry() shouldn't be exposed without flag yet
        https://bugs.webkit.org/show_bug.cgi?id=87457

        Reviewed by Kent Tamura.

        No new tests, marking some tests SKIP as we stop exposing this by default.

        * Modules/filesystem/DataTransferItemFileSystem.idl: Removed webkitGetAsEntry

2012-05-25  Rakesh KN  <rakesh.kn@motorola.com>

        RadioNodeList does not include a object element
        https://bugs.webkit.org/show_bug.cgi?id=87371

        Reviewed by Kent Tamura.

        As per spec http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#category-listed
        Object element should also be listed in RadioNodeList object.

        Updated existing test.

        * html/RadioNodeList.cpp:
        (WebCore::RadioNodeList::checkElementMatchesRadioNodeListFilter):
        Compares if test element's name/id  and form matches that of the RadioNodeList filter.
        (WebCore::RadioNodeList::nodeMatches):
        Added support for Object element, check if object elements name/id matches the RadioNodeList filter.
        * html/RadioNodeList.h:
        (RadioNodeList): Ditto

2012-05-25  Jan Keromnes  <janx@linux.com>

        Web Inspector: Resource object has no methods getContent and setContent
        https://bugs.webkit.org/show_bug.cgi?id=87424

        This fixes the extension API so that it uses the `new Resource()`
        constructor, which adds the missing `getContent` and `setContent`
        methods to a `Resource` object.

        Reviewed by Vsevolod Vlasov.

        The tests were fixed accordingly in:
        LayoutTests/inspector/extensions/extensions-resources-expected.txt

        * inspector/front-end/ExtensionAPI.js:
        (injectedExtensionAPI.Panels.prototype.setOpenResourceHandler.else.callbackWrapper):
        (injectedExtensionAPI.Panels.prototype.setOpenResourceHandler):

2012-05-24  Tim Horton  <timothy_horton@apple.com>

        Add feature defines for web-facing parts of CSS Regions and Exclusions
        https://bugs.webkit.org/show_bug.cgi?id=87442
        <rdar://problem/10887709>

        Reviewed by Dan Bernstein.

        * Configurations/FeatureDefines.xcconfig:
        * GNUmakefile.am:
        * bindings/generic/RuntimeEnabledFeatures.cpp:
        * bindings/generic/RuntimeEnabledFeatures.h:
        (RuntimeEnabledFeatures):
        (WebCore::RuntimeEnabledFeatures::setCSSExclusionsEnabled):
        (WebCore::RuntimeEnabledFeatures::cssExclusionsEnabled):
        * bindings/js/JSCSSRuleCustom.cpp:
        (WebCore::toJS):
        * bindings/objc/DOMCSS.mm:
        (kitClass):
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::isSimpleLengthPropertyID):
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::detectAtToken):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/CSSRule.cpp:
        (WebCore::CSSRule::cssText):
        (WebCore::CSSRule::destroy):
        (WebCore::CSSRule::reattach):
        * css/CSSRule.h:
        (WebCore::CSSRule::isRegionRule):
        * css/CSSRule.idl:
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::getPropertyValue):
        (WebCore::StylePropertySet::asText):
        * css/StylePropertyShorthand.cpp:
        (WebCore::shorthandForProperty):
        * css/StylePropertyShorthand.h:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleRule.cpp:
        (WebCore::StyleRuleBase::destroy):
        (WebCore::StyleRuleBase::copy):
        (WebCore::StyleRuleBase::createCSSOMWrapper):
        * css/WebKitCSSRegionRule.cpp:
        * css/WebKitCSSRegionRule.h:
        * css/WebKitCSSRegionRule.idl:
        * dom/Document.cpp:
        * dom/Document.h:
        * dom/Document.idl:
        * page/DOMWindow.idl:
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (WebCore::Settings::setCSSRegionsEnabled):
        (WebCore::Settings::cssRegionsEnabled):

2012-05-24  Geoffrey Garen  <ggaren@apple.com>

        WebKit should be lazy-finalization-safe (esp. the DOM)
        https://bugs.webkit.org/show_bug.cgi?id=87456

        Reviewed by Filip Pizlo.

        * bindings/js/DOMWrapperWorld.cpp:
        (WebCore::JSStringOwner::finalize):
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::jsStringSlowCase):
        * bindings/js/JSDOMBinding.h:
        (WebCore::cacheWrapper):
        (WebCore::uncacheWrapper): Use the new idioms.

        (WebCore::jsString): Use get instead of find because get is simpler in
        the case of entries that are logically null.

        (WebCore::domObjectWrapperMapFor): Removed, since it was unused.

        * bindings/js/ScriptWrappable.h:
        (WebCore::ScriptWrappable::clearWrapper): Use the new idioms.

        * bridge/runtime_root.cpp:
        (JSC::Bindings::RootObject::invalidate): Check for null while iterating,
        since that's possible now.

        (JSC::Bindings::RootObject::addRuntimeObject):
        (JSC::Bindings::RootObject::removeRuntimeObject):
        (JSC::Bindings::RootObject::finalize): Use the new idioms.

        * bridge/runtime_root.h:
        (RootObject): Clarified the word "need".

2012-05-24  Kent Tamura  <tkent@chromium.org>

        PAGE_POPUP: window.setValueAndClosePopup should be moved to a
        per-context property of DOMWindow.
        https://bugs.webkit.org/show_bug.cgi?id=87086

        Reviewed by Adam Barth.

        - Introduce window.pagePagePopupController property as V8EnabledPerContext.
        - Move window.setValueAndClosePopup() to window.pagePopupController.
        So, we can remove ad-hoc ScriptController::installFunctionsForPagePopup().

        No behavior change.

        Test: fast/forms/date/no-page-popup-controller.html

        * Resources/calendarPicker.js:
        (submitValue): Use window.pagePopupController.
        (handleCancel): ditto.
        * WebCore.gypi: Add new files.
        * bindings/generic/ContextEnabledFeatures.cpp:
        (WebCore::ContextEnabledFeatures::pagePopupEnabled): Added.
        * bindings/generic/ContextEnabledFeatures.h:
        (ContextEnabledFeatures): Added.
        * bindings/v8/ScriptController.cpp: Remove installFunctionsForPagePopup().
        * bindings/v8/ScriptController.h: ditto.
        * loader/FrameLoaderClient.h:
        (WebCore::FrameLoaderClient::allowPagePopup): Added.
        * page/DOMWindowPagePopup.cpp:
        (WebCore::DOMWindowPagePopup::DOMWindowPagePopup):
        Creates a PagePopupController object for the specified PagePopupClient.
        (WebCore::DOMWindowPagePopup::~DOMWindowPagePopup):
        Empty destructor to generate the RefPtr<PagePopupController> destructor.
        (WebCore::DOMWindowPagePopup::pagePopupController):
        * page/DOMWindowPagePopup.h:
        (DOMWindowPagePopup):
         - Remove setValueAndClosePopup()
         - Add pagePopupController()
         - Change the data member from PagePopupClient to PagePopupController.
        * page/DOMWindowPagePopup.idl: Supply per-context window.pagePopupController.
        * page/PagePopupController.cpp: Added. This object is attached to window.
        * page/PagePopupController.h: ditto.
        * page/PagePopupController.idl: ditto.

2012-05-21  Kinuko Yasuda  <kinuko@chromium.org>

        Cleanup: add a file system call which captures the file metadata at once.
        https://bugs.webkit.org/show_bug.cgi?id=86995

        Reviewed by David Levin.

        Current File.slice() (webkitSlice()) implementation calls two separate platform calls,
        getFileSize() and getFileModificationTime() [both are defined in platform/FileSystem.h],
        to capture the file metadata, but we should have a single file system call to get them at once
        for two reasons: 1. save additional system call costs, and 2.  atomically obtain the file metadata.

        No new tests: existing tests (http/tests/local/fileapi/* and fast/files/*) should pass.

        * fileapi/File.cpp:
        (WebCore::File::captureSnapshot):
        * platform/FileMetadata.h:
        * platform/FileSystem.h:
        * platform/chromium/FileSystemChromium.cpp:
        (WebCore::getFileMetadata): Added.
        * platform/chromium/PlatformSupport.h:
        (PlatformSupport):
        * platform/gtk/FileSystemGtk.cpp:
        (WebCore::getFileMetadata): Added.
        * platform/posix/FileSystemPOSIX.cpp:
        (WebCore::getFileMetadata): Added.
        * platform/qt/FileSystemQt.cpp:
        (WebCore::getFileMetadata): Added.
        * platform/win/FileSystemWin.cpp:
        (WebCore::getFileSizeFromFindData):
        (WebCore::getFileModificationTimeFromFindData):
        (WebCore::getFileSize):
        (WebCore::getFileModificationTime):
        (WebCore::getFileMetadata): Added.
        * platform/wince/FileSystemWinCE.cpp:
        (WebCore::getFileSizeFromFileInfo):
        (WebCore::getFileModificationTimeFromFileInfo):
        (WebCore::getFileSize):
        (WebCore::getFileModificationTime):
        (WebCore::getFileMetadata): Added.
        * platform/wx/FileSystemWx.cpp:
        (WebCore::getFileMetadata): Added.
        (WebCore):

2012-05-24  Hironori Bono  <hbono@chromium.org>

        Enable grammar checking on Chromium when we paste text (Take 2)
        https://bugs.webkit.org/show_bug.cgi?id=74393

        Reviewed by Ryosuke Niwa.

        This change enables grammar checking on Chromium and implements a mock grammar
        checker to fix a failing test.

        Test: editing/spelling/grammar-markers.html

        * platform/graphics/skia/GraphicsContextSkia.cpp:
        (WebCore::GraphicsContext::drawLineForDocumentMarker): render grammar markers in gray on Windows and Linux or in green on Mac.

2012-05-24  Dominic Mazzoni  <dmazzoni@google.com>

        Crash in WebCore::AccessibilityTable::isDataTable
        https://bugs.webkit.org/show_bug.cgi?id=87409

        Reviewed by Abhishek Arya.

        Use Node::rendererIsEditable everywhere rather than
        Node::isContentEditable because the latter can trigger a layout
        and destroy the renderer. New test covers the change to
        AccessibilityTable.cpp, changes to AccessibilityRenderObject.cpp
        are covered by existing tests.

        Test: accessibility/contenteditable-table-check-causes-crash.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::isReadOnly):
        (WebCore::AccessibilityRenderObject::contentChanged):
        * accessibility/AccessibilityTable.cpp:
        (WebCore::AccessibilityTable::isDataTable):

2012-05-24  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms][TextArea] Too long validation message doesn't count LF as CRLF
        https://bugs.webkit.org/show_bug.cgi?id=87458

        Reviewed by Kent Tamura.

        This patch changes current number of characters in "too long" validation message
        parameter to counting newline as 2 characters (CR and LF) as submission data.

        No new tests. To have test for this change, we need to change localization
        text handling during DRT. We'll try.

        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::validationMessage): Use computeLengthForSubmission instead of numGraphmeClusters.

2012-05-24  Hayato Ito  <hayato@chromium.org>

        Fix crashes caused by a DOMCharacterDataModified event on a text node.
        https://bugs.webkit.org/show_bug.cgi?id=86953

        Reviewed by Dimitri Glazkov.

        TextNode can be released while CharacterData::setData() will dispatch a mutation event.
        So protect it.

        Mutation event itself should not be dispatched on the test case.
        This is being tracked by webkit bug https://bugs.webkit.org/show_bug.cgi?id=87372.

        Test: fast/events/dom-character-data-modified-textarea-crash.html

        * dom/CharacterData.cpp:
        (WebCore::CharacterData::setData):

2012-05-24  Philippe Normand  <pnormand@igalia.com>

        [GTK] Add --enable-css3-flexbox configure option after r118304.
        https://bugs.webkit.org/show_bug.cgi?id=87455

        Reviewed by Xan Lopez.

        * GNUmakefile.am:

2012-05-24  MORITA Hajime  <morrita@google.com>

        Scoped stylesheet should be per-document-configurable.
        https://bugs.webkit.org/show_bug.cgi?id=86985

        Reviewed by Kent Tamura.

        This change replaced RuntimeEnabledFeatures::styleScopedEnabled() callsites
        with newly introduced ContextEnabledFeatures::styleScopedEnabled().
        Clients can override the decision by implementing FrameLoaderClient::allowStyleScoped().

        No new tests. This isn't testable on DRT.

        * bindings/generic/ContextEnabledFeatures.cpp:
        (WebCore):
        (WebCore::ContextEnabledFeatures::styleScopedEnabled):
        * bindings/generic/ContextEnabledFeatures.h:
        (WebCore):
        (ContextEnabledFeatures):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::determineScope):
        * css/StyleResolver.h:
        (StyleResolver):
        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::registerWithScopingNode):
        (WebCore::HTMLStyleElement::unregisterWithScopingNode):
        * loader/FrameLoaderClient.h:
        (WebCore::FrameLoaderClient::allowStyleScoped):

2012-05-24  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118452.
        http://trac.webkit.org/changeset/118452
        https://bugs.webkit.org/show_bug.cgi?id=87446

        Causes many tests to assert on Mac, NRWT bails out (Requested
        by sundiamonde on #webkit).

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::~RenderObject):
        (WebCore::RenderObject::clearLayoutRootIfNeeded):

2012-05-24  Kevin Ollivier  <kevino@theolliviers.com>

        [wx] Unreviewed build fix. Add contextMenuItemVector stub.

        * platform/wx/ContextMenuWx.cpp:
        (WebCore):
        (WebCore::contextMenuItemVector):

2012-05-24  Raymond Toy  <rtoy@google.com>

        Use 32-byte alignment in AudioArray if using WEBAUDIO_FFMPEG
        https://bugs.webkit.org/show_bug.cgi?id=87430

        Reviewed by Chris Rogers.

        Covered by existing tests.

        * platform/audio/AudioArray.h:
        (WebCore::AudioArray::allocate):

2012-05-24  Antoine Labour  <piman@chromium.org>

        [chromium] Add a setForceRenderSurface to WebLayer for test/bench purpose
        https://bugs.webkit.org/show_bug.cgi?id=87436

        Reviewed by James Robinson.

        Tested by CCLayerTreeHostCommonTest.verifyForceRenderSurface

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::LayerChromium):
        (WebCore::LayerChromium::setForceRenderSurface):
        (WebCore):
        (WebCore::LayerChromium::pushPropertiesTo):
        * platform/graphics/chromium/LayerChromium.h:
        (WebCore::LayerChromium::forceRenderSurface):
        (LayerChromium):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore::CCLayerImpl::forceRenderSurface):
        (WebCore::CCLayerImpl::setForceRenderSurface):
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::subtreeShouldRenderToSeparateSurface):

2012-05-24  Ken Buchanan  <kenrb@chromium.org>

        Layout root not getting cleared for anonymous renderers geting destroyed
        https://bugs.webkit.org/show_bug.cgi?id=84002

        Reviewed by Abhishek Arya.

        This is a follow-up to r109406, which added a check to clear layout
        roots when they point to a renderer that is being destroyed. The
        thinking was that layout roots would never be anonymous renderers,
        but there are some cases where this is not true (in particular,
        generated content containers with overflow clips can be layout roots).

        As in r109406, this patch has no layout test. This is because any test
        that exercises this behavior is caused by an existing layout bug where
        a child is not properly getting layout (or a renderer is getting dirtied
        out of order during layout) and will fail multiple ASSERTs:
        in particular, ASSERT(!m_layoutRoot->container() || !m_layoutRoot->
        container()->needsLayout()) in FrameView::scheduleRelayoutOfSubtree(),
        and ASSERT_NOT_REACHED() in RenderObject::clearLayoutRootIfNeeded().
        We are preventing those bugs from manifesting as security issues with
        this patch.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::~RenderObject):
        (WebCore::RenderObject::willBeDestroyed):

2012-05-24  Anders Carlsson  <andersca@apple.com>

        Corrupted pages rendering when images are zoomed on Google+
        https://bugs.webkit.org/show_bug.cgi?id=87439
        <rdar://problem/11503078>

        Reviewed by Beth Dakin.

        The rect that's given to scrollContentsSlowPath is in frame view coordinates, but if we end up
        passing them to RenderLayer::setBackingNeedsRepaintInRect we need to account for the frame scale factor.

        * page/FrameView.cpp:
        (WebCore::FrameView::scrollContentsSlowPath):

2012-05-24  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION (r112399): insertHTML doesn't respect current selection range and inserts HTML to incorrect position
        https://bugs.webkit.org/show_bug.cgi?id=87195

        Reviewed by Darin Adler.

        The bug was caused by our passing insertionPos.anchorNode() to splitTreeToNode's start node even when
        the position's type was an offset in a container. Fixed the bug by passing the node after the insert position
        or the container node if the position is at the end of the container.

        Test: editing/pasteboard/paste-at-end-of-node-followed-by-inline-element.html

        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplaceSelectionCommand::doApply):

2012-05-24  Emil A Eklund  <eae@chromium.org>

        REGRESSION (115573): Incorrect rounding of margins for floats
        https://bugs.webkit.org/show_bug.cgi?id=87319

        Reviewed by Eric Seidel.

        In RenderBlock::computeInlinePreferredLogicalWidths we used a float to
        accumulate margins for floating children while the children themselves
        represent their margins as LayoutUnits. Due to lack of rounding this can
        cause the block to be too small at certain certain zoom levels, causing
        unwanted wrapping. 

        This patch changes computeInlinePreferredLogicalWidths to use a
        LayoutUnit to accumulate the margins and thus ensures that the margin
        values are rounded the same way.

        Test: fast/block/float/floats-with-margin-should-not-wrap.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):

2012-05-24  Christophe Dumez  <christophe.dumez@intel.com>

        postMessage and webkitPostMessage should behave the same way
        https://bugs.webkit.org/show_bug.cgi?id=87384

        Reviewed by Adam Barth.

        Make postMessage behave the same way as webkitPostMessage, meaning
        that it supports transfer of MessagePorts and ArrayBuffers as per
        the spec. Both V8 and JSC implementations have been updated.

        Test: fast/dom/Window/window-postmessage-args.html

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::handlePostMessage):
        (WebCore::JSDOMWindow::postMessage):
        (WebCore::JSDOMWindow::webkitPostMessage):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::handlePostMessageCallback):
        (WebCore::V8DOMWindow::postMessageCallback):
        (WebCore::V8DOMWindow::webkitPostMessageCallback):
        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
        (WebCore::handlePostMessageCallback):
        (WebCore::V8DedicatedWorkerContext::postMessageCallback):
        (WebCore::V8DedicatedWorkerContext::webkitPostMessageCallback):
        * bindings/v8/custom/V8MessagePortCustom.cpp:
        (WebCore::handlePostMessageCallback):
        (WebCore::V8MessagePort::postMessageCallback):
        (WebCore::V8MessagePort::webkitPostMessageCallback):
        * bindings/v8/custom/V8WorkerCustom.cpp:
        (WebCore::handlePostMessageCallback):
        (WebCore::V8Worker::postMessageCallback):
        (WebCore::V8Worker::webkitPostMessageCallback):

2012-05-24  Pablo Flouret  <pablof@motorola.com>

        Submit button doesn't submit the form if the form is wrapped by an anchor tag
        https://bugs.webkit.org/show_bug.cgi?id=86719

        Reviewed by Ryosuke Niwa.

        When a form's button is clicked or activated with the keyboard a
        DOMActivate event is dispatched internally and the default handler for
        it takes care of processing the form submission, but the underlying
        event that prompted it is not set as handled and so it ends up
        navigating the anchor, thereby cancelling the form submission.

        This patch sets the original click event as handled if the DOMActivate
        event was handled. This matches the rest of the browsers for form
        controls that submit a form (input type=submit, button type=submit,
        input type=image, etc), and matches IE for the rest of the controls
        (basically, IE never activates the anchor when clicking on form
        controls, Presto and Gecko mostly don't either, except in a few cases.

        Test: fast/forms/form-in-anchor-controls-activation.html

        * dom/Node.cpp:
        (WebCore::Node::dispatchDOMActivateEvent):
        (WebCore::Node::defaultEventHandler):
        * dom/Node.h:
        (Node):
        * html/HTMLButtonElement.cpp:
        (WebCore::HTMLButtonElement::defaultEventHandler):

2012-05-24  Crystal Zhang  <haizhang@rim.com>

        [BlackBerry] Implement select popup and remove old hook to air popup
        https://bugs.webkit.org/show_bug.cgi?id=87419

        Reviewed by Rob Buis.

        Add new files to make file, add css file for select popup.

        * PlatformBlackBerry.cmake:
        * Resources/blackberry/popupControlBlackBerry.css: Added.
        (html):
        (body):
        (.bottombuttonOK):
        (.bottombuttonCancel):
        (.tablebutton):

2012-05-24  Levi Weintraub  <leviw@chromium.org>

        Avoid creating InlineBoxes for floating and positioned objects in isolates.
        https://bugs.webkit.org/show_bug.cgi?id=87277

        Reviewed by Eric Seidel.

        We currently will create a placeholder run for the first object we encounter inside an isolate. Then
        in RenderBlockLineLayout's constructBidiRuns, we replace that run with the contents of the Isolate.
        We run into problems when there are no valid contents in the Isolate. We can't simply remove the
        placeholder if there's nothing to replace it with since it may be the logically last run, which we
        track but can't rebuild by the time we're handling isolates (we've already shuffled the BidiRuns around).

        With this change, we avoid creating a placeholder altogether until we hit contents in the isolate
        that would warrant a BidiRun in the first place.

        Test: fast/text/international/float-as-only-child-of-isolate-crash.html

        * rendering/InlineIterator.h:
        (WebCore::IsolateTracker::addFakeRunIfNecessary):
        * rendering/RenderBlock.h:
        (RenderBlock):
        (WebCore::RenderBlock::shouldSkipCreatingRunsForObject):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::appendRunsForObject):

2012-05-24  Ryosuke Niwa  <rniwa@webkit.org>

        There are too many poorly named functions to create a fragment from markup
        https://bugs.webkit.org/show_bug.cgi?id=87339

        Reviewed by Eric Seidel.

        Moved all functions that create a fragment from markup to markup.h/cpp.
        There should be no behavioral change.

        * dom/Range.cpp:
        (WebCore::Range::createContextualFragment):
        * dom/Range.h: Removed createDocumentFragmentForElement.
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::setInnerHTML):
        * editing/markup.cpp:
        (WebCore::createFragmentFromMarkup):
        (WebCore::createFragmentForInnerOuterHTML): Renamed from createFragmentFromSource.
        (WebCore::createFragmentForTransformToFragment): Moved from XSLTProcessor.
        (WebCore::removeElementPreservingChildren): Moved from Range.
        (WebCore::createContextualFragment): Ditto.
        * editing/markup.h:
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::setInnerHTML):
        (WebCore::HTMLElement::setOuterHTML):
        (WebCore::HTMLElement::insertAdjacentHTML):
        * inspector/DOMPatchSupport.cpp:
        (WebCore::DOMPatchSupport::patchNode): Added a FIXME since this code should be using
        one of the functions listed in markup.h
        * xml/XSLTProcessor.cpp:
        (WebCore::XSLTProcessor::transformToFragment):

2012-05-24  Jer Noble  <jer.noble@apple.com>

        MediaControlTimelineElement is adjusting time 3 times per click
        https://bugs.webkit.org/show_bug.cgi?id=58160

        Reviewed by Eric Carlson.

        No new tests; we intentionally throttle timeupdate events for the same
        movie time, so there is no way to write a layout test for this case.

        Only call setCurrentTime() on mousedown or mousemove events.

        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlTimelineElement::defaultEventHandler):

2012-05-24  John Mellor  <johnme@chromium.org>

        Font Boosting: Add compile flag and runtime setting
        https://bugs.webkit.org/show_bug.cgi?id=87394

        Reviewed by Adam Barth.

        Add ENABLE_FONT_BOOSTING compile flag and fontBoostingEnabled runtime setting.

        No functionality yet, so no new tests.

        * Configurations/FeatureDefines.xcconfig:
        * GNUmakefile.am:
        * Target.pri:
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        (WebCore::Settings::setFontBoostingEnabled):
        (WebCore):
        * page/Settings.h:
        (Settings):
        (WebCore::Settings::fontBoostingEnabled):

2012-05-24  Greg Spencer  <gspencer@chromium.org>

        MHTML files should be loadable from all schemes considered local,
        not just "file:"

        https://bugs.webkit.org/show_bug.cgi?id=86540

        Reviewed by Adam Barth.

        Existing tests should verify correct function.

        * loader/MainResourceLoader.cpp:
        (WebCore::MainResourceLoader::continueAfterContentPolicy):
        * loader/archive/mhtml/MHTMLArchive.cpp:
        (WebCore::MHTMLArchive::create):

2012-05-24  Dana Jansens  <danakj@chromium.org>

        [chromium] Remove some leftover references to LayerTilerChromium
        https://bugs.webkit.org/show_bug.cgi?id=87405

        Reviewed by James Robinson.

        * platform/graphics/chromium/LayerChromium.h:
        (LayerChromium):
        * platform/graphics/chromium/SolidColorLayerChromium.h:

2012-05-24  Jessie Berlin  <jberlin@apple.com>

        REGRESSION(r109663) All the the dom/html/level2/html/HTMLFrameElement* tests crash on Windows
        https://bugs.webkit.org/show_bug.cgi?id=87410

        Reviewed by Anders Carlsson.

        Do not pass a reference type to va_start (see r75435).

        * platform/LocalizedStrings.cpp:
        (WebCore::formatLocalizedString):

2012-05-24  Yael Aharon  <yael.aharon@nokia.com>

        [Qt] Stop using the flag FIXED_POSITION_CREATES_STACKING_CONTEXT
        https://bugs.webkit.org/show_bug.cgi?id=87392

        Reviewed by Antonio Gomes.

        Remove our dependency on a build flag and use the new setting.

        No new tests.

        * css/StyleResolver.cpp:

2012-05-24  Alexey Proskuryakov  <ap@apple.com>

        [WK2] Let the client give local files universal access on a case by case basis
        https://bugs.webkit.org/show_bug.cgi?id=87174
        <rdar://problem/11024330>

        Reviewed by Maciej Stachowiak.

        * dom/Document.cpp: (WebCore::Document::initSecurityContext): When settings->allowUniversalAccessFromFileURLs()
        is false, also try asking the client for an indulgence.

        * loader/FrameLoaderClient.h: (WebCore::FrameLoaderClient::shouldForceUniversalAccessFromLocalURL):
        Default implementation doesn't change anything.

2012-05-24  Tony Chang  <tony@chromium.org>

        improve StyleRareNonInheritedData bit packing on Windows
        https://bugs.webkit.org/show_bug.cgi?id=87322

        Reviewed by Eric Seidel.

        Accessors for m_runningAcceleratedAnimation and m_hasAspectRatio are on RenderStyle already.

        Also reorder the variables in operator== to be consistent with the constructor and header file.
        This makes it easier to add or remove values.

        No new tests, just refactoring.

        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:
        (StyleRareNonInheritedData):

2012-05-24  Robert Hogan  <robert@webkit.org>

        Negative margin block doesn't properly clear a float enclosed by a previous sibling
        https://bugs.webkit.org/show_bug.cgi?id=10900

        Reviewed by David Hyatt.

        Tests: fast/css/clear-float-sibling.html

        Parent blocks keep a list of child floats that extend out of the parent block and
        by implication overhang into the parent's siblings. But this doesn't work if the
        sibling has collapsing margins - it will not find the float in the previous block's
        list so will ignore the float and fail to clear it.

        RenderBlock:collapseMargins() needs to check if a child's collapsing margin has 
        reduced the height of the parent up past the bottom of its previous sibling's lowest float
        and add the now overhanging float to the parent's float list if appropriate.
        
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::collapseMargins):

2012-05-24  Kinuko Yasuda  <kinuko@chromium.org>

        Cleanup: introduce toFile() to reduce static cast from Blob to File
        https://bugs.webkit.org/show_bug.cgi?id=87234

        Reviewed by Eric Seidel.

        No new tests as this must have no side effect.

        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::toV8):
        * fileapi/Blob.cpp:
        (WebCore::Blob::webkitSlice):
        * fileapi/Blob.h:
        (Blob):
        * fileapi/File.h:
        (WebCore::toFile): Added.
        (WebCore):
        * fileapi/FileReader.cpp:
        (WebCore::FileReader::readAsArrayBuffer):
        (WebCore::FileReader::readAsBinaryString):
        (WebCore::FileReader::readAsText):
        (WebCore::FileReader::readAsDataURL):
        * fileapi/WebKitBlobBuilder.cpp:
        (WebCore::WebKitBlobBuilder::append):
        * platform/chromium/ClipboardChromium.cpp:
        (WebCore::ClipboardChromium::files):
        * platform/network/FormData.cpp:
        (WebCore::FormData::appendKeyValuePairItems):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::send):

2012-05-24  Darin Adler  <darin@apple.com>

        SVGElement::addEventListener has peculiar RefPtr usage
        https://bugs.webkit.org/show_bug.cgi?id=86497

        Reviewed by Andy Estes.

        * svg/SVGElement.cpp:
        (WebCore::SVGElement::addEventListener): Switch to a more-standard style of RefPtr usage,
        getting rid of some unneeded reference count churn; also removed an unneeded special case
        for zero listeners.

2012-05-24  Raphael Kubo da Costa  <rakuco@webkit.org>

        [EFL] Modify keycode conversion functions to return keycodes with location information after r118001.
        https://bugs.webkit.org/show_bug.cgi?id=87203

        Reviewed by Andreas Kling.

        Add the required changes to make
        fast/events/keydown-leftright-keys.html pass after r118001.

        * platform/efl/EflKeyboardUtilities.cpp:
        (WebCore::createWindowsKeyMap): Translate the keycodes for
        "{left,right}{Shift,Alt,Control}" into the right windows keyboard
        definitions.

2012-05-24  Claudio Saavedra  <csaavedra@igalia.com>

        [Gtk] Wrong cursor used for ne-resize
        https://bugs.webkit.org/show_bug.cgi?id=87366

        Reviewed by Eric Seidel.

        * platform/gtk/CursorGtk.cpp:
        (WebCore::Cursor::ensurePlatformCursor): Use GDK_TOP_RIGHT_CORNER
        for Cursor::NorthEastPanning.

2012-05-24  Gabor Ballabas  <gaborb@inf.u-szeged.hu>

        [Qt]  Fix Webkit1 + V8 build.
        https://bugs.webkit.org/show_bug.cgi?id=87368

        Reviewed by Eric Seidel.

        No new tests, because this is a buildfix.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateImplementation):
        * bindings/v8/npruntime_impl.h:
        * bindings/v8/npruntime_priv.h:

2012-05-24  Dana Jansens  <danakj@chromium.org>

        [chromium] Only display frames created with memory allocations meant to be displayed
        https://bugs.webkit.org/show_bug.cgi?id=85108

        Reviewed by Adrienne Walker.

        In this patch we remove the setVisible() code paths from CCProxy, and
        instead commit visiblity state along with a frame. We also commit a
        flag with a frame that indicates if the frame is one that can be drawn.

        The impl host is set to visible during commit instead of using a
        special channel through the proxy, and the scheduler allows
        commits when we are waiting to draw our first frame but blocked on
        being non-visible.

        canDraw is gated on a new flag that indicates if the frame is one meant
        for display. A frame is meant for display if the frame was generated
        with a memory allocation meant for display. At this time, any non-zero
        memory allocation is considered meant for display.

        We prevent races by not changing the memory allocation at any time
        except during a commit. So we force a commit when the memory
        allocation needs to be adjusted and we are not visible. Similarly,
        we force a commit when visibility changes so that we are able to
        commit the visibility change to the impl tree.

        In order to prevent drawing frames that are not meant for display
        with a single thread, we prevent compositing when the impl tree
        is not visible, with an early out in CCSingleThreadProxy.

        Unit tests: CCLayerTreeHostTestVisibilityAndAllocationControlDrawing

        * platform/graphics/chromium/LayerChromium.h:
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        * platform/graphics/chromium/TiledLayerChromium.h:
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
        (WebCore::CCLayerTreeHost::setNeedsCommit):
        (WebCore):
        (WebCore::CCLayerTreeHost::setNeedsForcedCommit):
        (WebCore::CCLayerTreeHost::setVisible):
        (WebCore::CCLayerTreeHost::setContentsMemoryAllocationLimitBytes):
        (WebCore::CCLayerTreeHost::scheduleComposite):
        (WebCore::CCLayerTreeHost::updateLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::canDraw):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (WebCore::CCLayerTreeHostImpl::sourceFrameCanBeDrawn):
        (WebCore::CCLayerTreeHostImpl::setSourceFrameCanBeDrawn):
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCProxy.h:
        (CCProxy):
        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
        (WebCore::CCSchedulerStateMachine::drawSuspendedUntilCommit):
        (WebCore::CCSchedulerStateMachine::scheduledToDraw):
        (WebCore::CCSchedulerStateMachine::updateState):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::doCommit):
        (WebCore::CCSingleThreadProxy::setNeedsCommit):
        (WebCore):
        (WebCore::CCSingleThreadProxy::setNeedsForcedCommit):
        (WebCore::CCSingleThreadProxy::doComposite):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::CCThreadProxy):
        (WebCore::CCThreadProxy::setNeedsForcedCommit):
        (WebCore):
        (WebCore::CCThreadProxy::setNeedsForcedCommitOnImplThread):
        (WebCore::CCThreadProxy::forceBeginFrameOnImplThread):
        (WebCore::CCThreadProxy::beginFrame):
        (WebCore::CCThreadProxy::scheduledActionCommit):
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (CCThreadProxy):

2012-05-24  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: [regression] search in formatted scripts is broken.
        https://bugs.webkit.org/show_bug.cgi?id=87377

        Reviewed by Vsevolod Vlasov.

        Using formatted content in search.

        Test: inspector/debugger/script-formatter-search.html

        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource.prototype.workingCopyCommitted):
        (WebInspector.JavaScriptSource.prototype.searchInContent.callbackWrapper):
        (WebInspector.JavaScriptSource.prototype.searchInContent):

2012-05-24  Philip Rogers  <pdr@google.com>

        Refactor SVGAnimateTransformElement to avoid expensive determineAnimatedPropertyType call
        https://bugs.webkit.org/show_bug.cgi?id=87309

        Reviewed by Nikolas Zimmermann.

        This is a simple refactor that matches the work done in
        https://bugs.webkit.org/show_bug.cgi?id=87309 to avoid an expensive call.

        No new tests, no actual effects beyond performance improvement.

        * svg/SVGAnimateElement.h:
        (SVGAnimateElement):
        * svg/SVGAnimateTransformElement.cpp:
        (WebCore::SVGAnimateTransformElement::hasValidAttributeType):

2012-05-24  Csaba Osztrogonác  <ossy@webkit.org>

        [Qt] Unreviewed trvial fixes.

        * Target.pri: Typo fix after r118226.
        * WebCore.pri: Warning fix after r117291.

2012-05-24  Antti Koivisto  <antti@apple.com>

        Move StyleRuleImport to a file of its own
        https://bugs.webkit.org/show_bug.cgi?id=87386

        Rubber-stamped by Andreas Kling.

        Move StyleRuleImport out from CSSImportRule.cpp/.h

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSImportRule.cpp:
        (WebCore):
        (WebCore::CSSImportRule::href):
        * css/CSSImportRule.h:
        (WebCore):
        (CSSImportRule):
        * css/CSSParser.cpp:
        * css/StyleRuleImport.cpp: Copied from Source/WebCore/css/CSSImportRule.cpp.
        (WebCore):
        * css/StyleRuleImport.h: Copied from Source/WebCore/css/CSSImportRule.h.
        (WebCore):
        * css/StyleSheetContents.cpp:

2012-05-24  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118352.
        http://trac.webkit.org/changeset/118352
        https://bugs.webkit.org/show_bug.cgi?id=87390

        Caused 6 editing/spelling tests crash/fail on chromium in
        debug. (Requested by vsevik on #webkit).

        * platform/graphics/skia/GraphicsContextSkia.cpp:
        (WebCore::GraphicsContext::drawLineForDocumentMarker):

2012-05-24  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Support hierarchical context menus
        https://bugs.webkit.org/show_bug.cgi?id=86847

        Reviewed by Pavel Feldman.

        This patch makes use of the WebMenuItemInfo SubMenu type to expose the capability of building submenu items
        in the Web Inspector's context menu. ContextMenuItems are also passed/stored by reference/value rather than pointer
        in order to be consistent with the PlatformMenuDescription typedef.

        * bindings/js/JSInspectorFrontendHostCustom.cpp:
        (WebCore::populateContextMenuItems): Enable submenu item population.
        (WebCore):
        (WebCore::JSInspectorFrontendHost::showContextMenu): Extract the menu population part into populateContextMenuItems().
        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
        (WebCore::populateContextMenuItems): Enable submenu item population.
        (WebCore):
        (WebCore::V8InspectorFrontendHost::showContextMenuCallback): Extract the menu population part into populateContextMenuItems().
        * inspector/InspectorFrontendHost.cpp:
        (WebCore::FrontendMenuProvider::create): Use reference instead of pointer for ContextMenuItems.
        (WebCore::FrontendMenuProvider::FrontendMenuProvider): Use reference instead of pointer for ContextMenuItems.
        (WebCore::FrontendMenuProvider::populateContextMenu): Use reference instead of pointer for ContextMenuItems.
        (WebCore::FrontendMenuProvider::contextMenuCleared):
        (FrontendMenuProvider):
        (WebCore::InspectorFrontendHost::showContextMenu): Use reference instead of pointer for ContextMenuItems.
        * inspector/InspectorFrontendHost.h:
        (InspectorFrontendHost):
        * inspector/front-end/ContextMenu.js: Support the tree-like structure of context menus.
        (WebInspector.ContextMenuItem):
        (WebInspector.ContextMenuItem.prototype.id):
        (WebInspector.ContextMenuItem.prototype.type):
        (WebInspector.ContextMenuItem.prototype._buildDescriptor):
        (WebInspector.ContextSubMenuItem):
        (WebInspector.ContextSubMenuItem.prototype.appendItem):
        (WebInspector.ContextSubMenuItem.prototype.appendSubMenuItem):
        (WebInspector.ContextSubMenuItem.prototype.appendCheckboxItem):
        (WebInspector.ContextSubMenuItem.prototype.appendSeparator):
        (WebInspector.ContextSubMenuItem.prototype._buildDescriptor):
        (WebInspector.ContextMenu):
        (WebInspector.ContextMenu.prototype.nextId):
        (WebInspector.ContextMenu.prototype.show):
        (WebInspector.ContextMenu.prototype._setHandler):
        (WebInspector.ContextMenu.prototype._buildDescriptor):
        * inspector/front-end/SoftContextMenu.js:
        (.WebInspector.SoftContextMenu): Support sub-menus.
        (.WebInspector.SoftContextMenu.prototype.show):
        (.WebInspector.SoftContextMenu.prototype._parentGlassPaneElement):
        (.WebInspector.SoftContextMenu.prototype._createMenuItem):
        (.WebInspector.SoftContextMenu.prototype._createSubMenu):
        (.WebInspector.SoftContextMenu.prototype._createSeparator):
        (.WebInspector.SoftContextMenu.prototype._menuItemMouseUp):
        (.WebInspector.SoftContextMenu.prototype._focus):
        (.WebInspector.SoftContextMenu.prototype._triggerAction):
        (.WebInspector.SoftContextMenu.prototype._showSubMenu):
        (.WebInspector.SoftContextMenu.prototype._buildMouseEventForSubMenu):
        (.WebInspector.SoftContextMenu.prototype._hideSubMenu):
        (.WebInspector.SoftContextMenu.prototype._menuItemMouseOut):
        (.WebInspector.SoftContextMenu.prototype._highlightMenuItem):
        (.WebInspector.SoftContextMenu.prototype._menuKeyDown):
        (.WebInspector.SoftContextMenu.prototype._glassPaneMouseUp):
        (.WebInspector.SoftContextMenu.prototype._discardMenu):
        (.WebInspector.SoftContextMenu.prototype._discardSubMenus):
        * inspector/front-end/inspector.css: Support for sub-menus, separator improvement.
        (.soft-context-menu-separator):
        (.soft-context-menu-separator > .separator-line):
        (.soft-context-menu-item-submenu-arrow):
        * platform/chromium/ContextMenuChromium.cpp:
        (WebCore::contextMenuItemVector): Implemented.
        (WebCore):

2012-05-24  Vivek Galatage  <vivekgalatage@gmail.com>

        Web Inspector: Breakpoints Pane should not show context menu with no breakpoints
        https://bugs.webkit.org/show_bug.cgi?id=87340

        Reviewed by Pavel Feldman.

        Removed the method _contextMenu as this would be redundant call
        because _breakpointContextMenu would take care of showing the remove
        all breakpoints option.

        * inspector/front-end/BreakpointsSidebarPane.js:
        (WebInspector.JavaScriptBreakpointsSidebarPane):
        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._breakpointContextMenu):

2012-05-24  Yury Semikhatsky  <yurys@chromium.org>

        Unreviewed. Chromium Mac build fix after r118357.
        Use full name specifier instead of "using" directive.

        * inspector/InspectorMemoryAgent.cpp:
        (WebCore::jsHeapInfo):
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):

2012-05-24  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: introduce virtual resource for inspector stylesheet.
        https://bugs.webkit.org/show_bug.cgi?id=87357

        Reviewed by Vsevolod Vlasov.

        This change introduces virtual resource that represents inspector stylesheet (that is added for styles added via inspector).
        New resource has url of form "inspector://<page url folder>/inspector-stylesheet. It enables live editing and revision
        history of the inspector stylesheet.

        Test: inspector/styles/edit-inspector-stylesheet.html

        * inspector/Inspector.json:
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::asInspectorStyleSheet):
        (WebCore::InspectorCSSAgent::bindStyleSheet):
        (WebCore::InspectorCSSAgent::viaInspectorStyleSheet):
        (WebCore::InspectorCSSAgent::detectOrigin):
        * inspector/InspectorCSSAgent.h:
        (InspectorCSSAgent):
        * inspector/InspectorDOMAgent.h:
        (InspectorDOMAgent):
        (WebCore::InspectorDOMAgent::pageAgent):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyleSheet::create):
        (WebCore::InspectorStyleSheet::InspectorStyleSheet):
        (WebCore::InspectorStyleSheet::buildObjectForStyleSheetInfo):
        (WebCore::InspectorStyleSheet::buildObjectForRule):
        (WebCore::InspectorStyleSheet::resourceStyleSheetText):
        (WebCore::InspectorStyleSheetForInlineStyle::create):
        (WebCore::InspectorStyleSheetForInlineStyle::InspectorStyleSheetForInlineStyle):
        * inspector/InspectorStyleSheet.h:
        (WebCore):
        (InspectorStyleSheet):
        (WebCore::InspectorStyleSheet::canBind):
        (InspectorStyleSheetForInlineStyle):
        * inspector/front-end/CSSStyleModel.js:
        (WebInspector.CSSStyleModel):
        (WebInspector.CSSStyleModel.prototype._undoRedoCompleted):
        (WebInspector.CSSStyleModel.prototype.getViaInspectorResourceForRule):
        (WebInspector.CSSStyleModelResourceBinding):
        (WebInspector.CSSStyleModelResourceBinding.prototype.setContent):
        (WebInspector.CSSStyleModelResourceBinding.prototype._inspectedURLChanged):
        (WebInspector.CSSStyleModelResourceBinding.prototype._loadStyleSheetHeaders):
        (WebInspector.CSSStyleModelResourceBinding.prototype._innerStyleSheetChanged):
        (WebInspector.CSSStyleModelResourceBinding.prototype._getViaInspectorResource.hadersLoaded):
        (WebInspector.CSSStyleModelResourceBinding.prototype._getViaInspectorResource):
        (WebInspector.CSSStyleModelResourceBinding.prototype._viaInspectorResource.overrideRequestContent.callbackWrapper):
        (WebInspector.CSSStyleModelResourceBinding.prototype._viaInspectorResource.overrideRequestContent):
        (WebInspector.CSSStyleModelResourceBinding.prototype._viaInspectorResource):
        (WebInspector.CSSStyleModelResourceBinding.prototype._viaInspectorResourceURL):
        * inspector/front-end/Resource.js:
        (WebInspector.Resource):
        (WebInspector.Resource.prototype.isHidden):
        * inspector/front-end/ResourceTreeModel.js:
        (WebInspector.ResourceTreeModel.prototype._onRequestUpdateDropped):
        (WebInspector.ResourceTreeModel.prototype._addFramesRecursively):
        (WebInspector.ResourceTreeFrame.prototype._navigate):
        (WebInspector.ResourceTreeFrame.prototype.addResource):
        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.FrameTreeElement.prototype.appendResource):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.InspectorStyleSource):
        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylePropertiesSection.prototype._createRuleOriginNode.callback):
        (WebInspector.StylePropertiesSection.prototype._createRuleOriginNode):
        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.successCallback):
        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted):

2012-05-24  Robin Cao  <robin.cao@torchmobile.com.cn>

        [BlackBerry] Possible deadlock in the WebGL code path
        https://bugs.webkit.org/show_bug.cgi?id=87375

        Reviewed by Rob Buis.

        Fix a deadlock happening in the WebGL code path. The mutex is locked
        but is not unlocked afterword. Also fix a possible double delete,
        the mutex m_frontBufferLock will be destroyed in the base class.

        Covered by tests in fast/canvas/webgl.

        * platform/graphics/blackberry/LayerCompositingThread.cpp:
        (WebCore::LayerCompositingThread::releaseTextureResources):
        * platform/graphics/blackberry/WebGLLayerWebKitThread.cpp:
        (WebCore::WebGLLayerWebKitThread::~WebGLLayerWebKitThread):

2012-05-24  Ian Vollick  <vollick@chromium.org>

        [chromium] Forcibly sync running animations in the waiting state when synchronized start times are needed.
        https://bugs.webkit.org/show_bug.cgi?id=87153

        Reviewed by James Robinson.

        Unit test: CCLayerAnimationControllerTest.ForceSyncWhenSynchronizedStartTimeNeeded

        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
        (WebCore::CCLayerAnimationController::replaceImplThreadAnimations):

2012-05-24  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: convert HeapSnapshotGridNode._provider into getter.
        https://bugs.webkit.org/show_bug.cgi?id=87382

        I found that we create a provider for child nodes for the each DataGrid node in advance.
        It cost us one async call to the HeapSnapshot's worker per each such the node.
        I converted the property into the getter which is initializing the provider lazily.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        * inspector/front-end/HeapSnapshotGridNodes.js:
        (WebInspector.HeapSnapshotGridNode):
        (WebInspector.HeapSnapshotGridNode.prototype.createProvider):
        (WebInspector.HeapSnapshotGridNode.prototype._provider):
        (WebInspector.HeapSnapshotGridNode.prototype.dispose):
        (WebInspector.HeapSnapshotGridNode.prototype._populate):
        (WebInspector.HeapSnapshotGridNode.prototype.expandWithoutPopulate):
        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren.serializeNextChunk):
        (WebInspector.HeapSnapshotGridNode.prototype.sort):
        (WebInspector.HeapSnapshotGenericObjectNode):
        (WebInspector.HeapSnapshotGenericObjectNode.prototype.updateHasChildren):
        (WebInspector.HeapSnapshotObjectNode):
        (WebInspector.HeapSnapshotInstanceNode):
        (WebInspector.HeapSnapshotConstructorNode):
        (WebInspector.HeapSnapshotConstructorNode.prototype.createProvider):
        (WebInspector.HeapSnapshotConstructorNode.prototype.revealNodeBySnapshotObjectId):
        (WebInspector.HeapSnapshotDiffNode):
        (WebInspector.HeapSnapshotDiffNode.prototype.createProvider):
        (WebInspector.HeapSnapshotDominatorObjectNode):
        (WebInspector.HeapSnapshotDominatorObjectNode.prototype.createProvider):
        (WebInspector.HeapSnapshotDominatorObjectNode.prototype.retrieveChildBySnapshotObjectId):

2012-05-24  Rakesh KN  <rakesh.kn@motorola.com>

        Filter for RadioNodeList should be case sensitive.
        https://bugs.webkit.org/show_bug.cgi?id=87369

        Reviewed by Kent Tamura.

        Element's id/name attribute matching criteria is case sensitive now.

        Modified existing test.

        * html/RadioNodeList.cpp:
        (WebCore::RadioNodeList::nodeMatches):
        Element matching criteria is case sensitive.

2012-05-23  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add a command to InspectorMemoryAgent for getting process memory break down
        https://bugs.webkit.org/show_bug.cgi?id=87263

        Reviewed by Pavel Feldman.

        Introduced new protocol command Memory.getProcessMemoryDistribution which returns
        memory distribution for the inspected process. Currently only JS allocated and used
        heap size is included.

        * inspector/Inspector.json:
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore::jsHeapInfo):
        (WebCore):
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
        * inspector/InspectorMemoryAgent.h:
        (InspectorMemoryAgent):
        * platform/chromium/PlatformSupport.h:
        (PlatformSupport):

2012-05-24  Nikolas Zimmermann  <nzimmermann@rim.com>

        SVGZoomAndPan constants are missing from window object
        https://bugs.webkit.org/show_bug.cgi?id=15494

        Reviewed by Rob Buis.

        Generate the SVGZoomAndPanConstructor, so that the constants defined in the IDL
        can be reached from the bindings. Provide a stub-implementation of ref/deref
        that's never used, as we don't actually use JSSVGZoomAndPan which needs this, but
        only the JSSVGZoomAndPanConstructor.

        Add a new IDL flag "SuppressToJSObject" which disables generation of toJS/toV8
        methods for classes that are only used in SVGs interfaces via multiple inheritance.
        This affects: SVGFitToViewBox, SVGTests, SVGLangSapce, SVGExternalResourcesRequired, etc.

        Unlike those classes SVGZoomAndPan defines constants, and thus needs a generated Constructor.
        That requires us to build JSSVGZoomAndPan.* (JSSVGFitToViewBox/etc. is generated, but not built!).
        Unfortunately this causes compilation problems on Windows, as it builds all sources in a single-file.
        MSVC can't decide whether it should call toJS(Node*) or toJS(SVGZoomAndPan*) for a SVGSVGElement.
        To avoid these problems stop generating toJS/toV8 completely for all SVG MI types. They were
        never used before, so there's no point in actually generating them, as it's now causing problems.

        This is a preparation towards bug 15495, which covers implementing
        SVGSVGElement.currentView and the SVGViewSpec interface.

        No new tests. The SVGZoomAndPan constructor is covered by existing tests, now that its enabled.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * WebCore.gyp/WebCore.gyp:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/scripts/CodeGeneratorJS.pm:
        (ShouldGenerateToJSDeclaration):
        (ShouldGenerateToJSImplementation):
        (GenerateHeader):
        (GenerateImplementation):
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateHeader):
        * bindings/scripts/IDLAttributes.txt:
        * gyp/WebCore.gyp:
        * page/DOMWindow.idl:
        * svg/SVGDocument.cpp:
        (WebCore::SVGDocument::zoomAndPanEnabled):
        * svg/SVGExternalResourcesRequired.idl:
        * svg/SVGFitToViewBox.idl:
        * svg/SVGLangSpace.idl:
        * svg/SVGLocatable.idl:
        * svg/SVGRenderingIntent.idl:
        * svg/SVGSVGElement.cpp:
        (WebCore::SVGSVGElement::SVGSVGElement):
        (WebCore::SVGSVGElement::parseAttribute):
        (WebCore::SVGSVGElement::viewBoxToViewTransform):
        (WebCore::SVGSVGElement::setupInitialView):
        (WebCore::SVGSVGElement::inheritViewAttributes):
        * svg/SVGSVGElement.h:
        (SVGSVGElement):
        (WebCore::SVGSVGElement::useCurrentView):
        (WebCore::SVGSVGElement::setUseCurrentView):
        (WebCore::SVGSVGElement::zoomAndPan):
        (WebCore::SVGSVGElement::setZoomAndPan):
        * svg/SVGStylable.idl:
        * svg/SVGTests.idl:
        * svg/SVGURIReference.idl:
        * svg/SVGUnitTypes.idl:
        * svg/SVGViewElement.cpp:
        (WebCore::SVGViewElement::SVGViewElement):
        (WebCore::SVGViewElement::parseAttribute):
        * svg/SVGViewElement.h:
        (SVGViewElement):
        (WebCore::SVGViewElement::zoomAndPan):
        (WebCore::SVGViewElement::setZoomAndPan):
        * svg/SVGViewSpec.cpp:
        (WebCore::SVGViewSpec::SVGViewSpec):
        (WebCore::SVGViewSpec::setTransformString):
        (WebCore::SVGViewSpec::parseViewSpec):
        * svg/SVGViewSpec.h:
        (SVGViewSpec):
        (WebCore::SVGViewSpec::transformBaseValue):
        (WebCore::SVGViewSpec::zoomAndPan):
        (WebCore::SVGViewSpec::setZoomAndPanBaseValue):
        * svg/SVGZoomAndPan.cpp:
        (WebCore::SVGZoomAndPan::isKnownAttribute):
        (WebCore::SVGZoomAndPan::addSupportedAttributes):
        (WebCore):
        (WebCore::SVGZoomAndPan::parseZoomAndPan):
        (WebCore::SVGZoomAndPan::ref):
        (WebCore::SVGZoomAndPan::deref):
        (WebCore::SVGZoomAndPan::setZoomAndPan):
        * svg/SVGZoomAndPan.h:
        (SVGZoomAndPan):
        (WebCore::SVGZoomAndPan::parseFromNumber):
        (WebCore::SVGZoomAndPan::parseAttribute):
        (WebCore::SVGZoomAndPan::zoomAndPan):
        * svg/SVGZoomAndPan.idl:

2012-05-24  Hironori Bono  <hbono@chromium.org>

        Enable grammar checking on Chromium when we paste text.
        https://bugs.webkit.org/show_bug.cgi?id=74393

        Reviewed by Hajime Morita.

        This change enables grammar checking on Chromium and implements a mock grammar
        checker to fix a failing test.

        Test: editing/spelling/grammar-markers.html

        * platform/graphics/skia/GraphicsContextSkia.cpp:
        (WebCore::GraphicsContext::drawLineForDocumentMarker): render grammar markers in gray on Windows and Linux or in green on Mac.

2012-05-17  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: add inspector instrumentation interface for compositing
        https://bugs.webkit.org/show_bug.cgi?id=83842

        Reviewed by Pavel Feldman.

        - added instrumentation methods to mark start/end of layer compositing;
        - added associated timeline record type (CompositeLayers);
        - plumbed the calls from instrumentation up to the timeline panel;
        - actual call-sites are platform-specific and will come as separate patches.

        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::willCompositeImpl):
        (WebCore):
        (WebCore::InspectorInstrumentation::didCompositeImpl):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        (WebCore::InspectorInstrumentation::willComposite):
        (WebCore):
        (WebCore::InspectorInstrumentation::didComposite):
        * inspector/InspectorTimelineAgent.cpp:
        (TimelineRecordType):
        (WebCore::InspectorTimelineAgent::willComposite):
        (WebCore):
        (WebCore::InspectorTimelineAgent::didComposite):
        * inspector/InspectorTimelineAgent.h:
        (InspectorTimelineAgent):
        * inspector/front-end/TimelineModel.js:
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.recordStyle):

2012-05-24  Ilya Tikhonovsky  <loislo@chromium.org>

        Unreviewed Web Inspector: remove obsolete isDetailedSnapshot method from HeapSnapshotView.

        * inspector/front-end/HeapSnapshotView.js:

2012-05-24  Vivek Galatage  <vivekgalatage@gmail.com>

        Web Inspector: localStorage items are not updated when the storage changes
        https://bugs.webkit.org/show_bug.cgi?id=83012

        Reviewed by Pavel Feldman.

        Renamed the inspector protocol UpdateDOMStorage to domStorageUpdated.
        Instrumented StorageEventDispatcher to send the update event to the
        front-end. Also removed the way DOM Storage Agent used to listen for
        the storage events. Added new test to verify the update notifications.

        Test: inspector/storage-panel-dom-storage-update.html

        * dom/EventListener.h:
        * inspector/Inspector.json:
        * inspector/InspectorDOMStorageAgent.cpp:
        (WebCore):
        (WebCore::InspectorDOMStorageAgent::getDOMStorageEntries):
        (WebCore::InspectorDOMStorageAgent::storageId):
        (WebCore::InspectorDOMStorageAgent::didUseDOMStorage):
        (WebCore::InspectorDOMStorageAgent::didDispatchDOMStorageEvent):
        * inspector/InspectorDOMStorageAgent.h:
        (InspectorDOMStorageAgent):
        * inspector/InspectorDOMStorageResource.cpp:
        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
        (WebCore::InspectorDOMStorageResource::isSameHostAndType):
        (WebCore::InspectorDOMStorageResource::unbind):
        * inspector/InspectorDOMStorageResource.h:
        (WebCore):
        (InspectorDOMStorageResource):
        (WebCore::InspectorDOMStorageResource::create):
        (WebCore::InspectorDOMStorageResource::id):
        (WebCore::InspectorDOMStorageResource::storageArea):
        (WebCore::InspectorDOMStorageResource::frame):
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::didDispatchDOMStorageEventImpl):
        (WebCore):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        (WebCore::InspectorInstrumentation::didUseDOMStorage):
        (WebCore):
        (WebCore::InspectorInstrumentation::didDispatchDOMStorageEvent):
        * inspector/front-end/DOMStorage.js:
        (WebInspector.DOMStorageDispatcher.prototype.domStorageUpdated):
        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.ResourcesPanel.prototype.domStorageUpdated):
        * storage/StorageEventDispatcher.cpp:
        (WebCore::StorageEventDispatcher::dispatch):

2012-05-23  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: introduce console proxy object for HeapSnapshot worker.
        https://bugs.webkit.org/show_bug.cgi?id=87346

        There is no console object in html5 workers at the moment.
        This makes me sad when I'm troubleshooting the HeapSnapshot stuff.
        I wrote a simplest proxy object which sends the log, info and error messages
        to the WebInspector window.

        Reviewed by Pavel Feldman.

        * inspector/front-end/HeapSnapshotProxy.js:
        (WebInspector.HeapSnapshotRealWorker.prototype._messageReceived):
        * inspector/front-end/HeapSnapshotWorker.js:
        (WebInspector.WorkerConsole):
        (WebInspector.WorkerConsole.prototype.log):
        (WebInspector.WorkerConsole.prototype.error):
        (WebInspector.WorkerConsole.prototype.info):
        (WebInspector.WorkerConsole.prototype._postMessage):

2012-05-24  Shinya Kawanaka  <shinyak@chromium.org>

        Elements in Shadow DOM are not resizable.
        https://bugs.webkit.org/show_bug.cgi?id=87342

        Reviewed by Ryosuke Niwa.

        In RenderLayer::resize(), shadowAncestorNode() was used but if the ancestor node is used,
        it is not possible to resize elements in Shadow DOM.

        The comments said it is necessary for textarea, however actually it is not necessary now.
        Existing test (fast/css/resize-corner-tracking) covers it.

        Test: fast/dom/shadow/resize-in-shadow-dom.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::resize):

2012-05-24  Antti Koivisto  <antti@apple.com>

        Move StyleSheetContents to a separate file
        https://bugs.webkit.org/show_bug.cgi?id=87354

        Reviewed by Eric Seidel.

        Move StyleSheetContents class to StyleSheetContents.h/cpp.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSFontFaceSrcValue.cpp:
        * css/CSSGrammar.y:
        * css/CSSImportRule.cpp:
        * css/CSSParser.cpp:
        * css/CSSPrimitiveValue.cpp:
        * css/CSSRule.cpp:
        * css/CSSStyleSheet.cpp:
        (WebCore::CSSStyleSheet::create):
        (WebCore::CSSStyleSheet::href):
        (WebCore):
        (WebCore::CSSStyleSheet::baseURL):
        (WebCore::CSSStyleSheet::isLoading):
        * css/CSSStyleSheet.h:
        (WebCore):
        (CSSStyleSheet):
        * css/StylePropertySet.cpp:
        * css/StyleResolver.cpp:
        * css/StyleSheetContents.cpp: Copied from css/CSSStyleSheet.cpp.
        (WebCore):
        * css/StyleSheetContents.h: Copied from css/CSSStyleSheet.h.
        (WebCore):
        * dom/DOMImplementation.cpp:
        (WebCore::XMLMIMETypeRegExp::XMLMIMETypeRegExp):
        * dom/Document.cpp:
        * dom/ProcessingInstruction.cpp:
        * dom/StyleElement.cpp:
        * html/HTMLLinkElement.cpp:
        * html/HTMLStyleElement.cpp:
        * inspector/InspectorStyleSheet.cpp:
        * loader/cache/CachedCSSStyleSheet.cpp:
        * page/PageSerializer.cpp:

2012-05-24  Kristóf Kosztyó  <kkristof@inf.u-szeged.hu>

        [Qt] Buildfix for the minimal build because the r118197 broke it.
        https://bugs.webkit.org/show_bug.cgi?id=87096

        Reviewed by Csaba Osztrogonác.

        * plugins/PluginData.cpp:
        (WebCore):
        (WebCore::PluginData::refresh):
        (WebCore::PluginData::initPlugins):

2012-05-23  Ilya Tikhonovsky  <loislo@chromium.org>

        Unreviewed: Web Inspector single line fix for r118162.

        * inspector/front-end/HeapSnapshotDataGrids.js:
        (WebInspector.HeapSnapshotConstructorsDataGrid.prototype._populateChildren):

2012-05-23  Lu Guanqun  <guanqun.lu@intel.com>

        sort the array 'non_wrapper_types'
        https://bugs.webkit.org/show_bug.cgi?id=87335

        Reviewed by Kentaro Hara.

        * bindings/scripts/CodeGeneratorV8.pm:

2012-05-23  Shinya Kawanaka  <shinyak@chromium.org>

        Document.elementFromPoint exposes inner element of Shadow DOM.
        https://bugs.webkit.org/show_bug.cgi?id=87235

        Reviewed by Dimitri Glazkov.

        Document::elementFromPoint didn't consider nested Shadow DOM.
        The container node should be adjusted up to document TreeScope beyond ShadowRoot TreeScope.

        Test: fast/dom/shadow/element-from-point-in-nested-shadow.html

        * dom/Document.cpp:
        (WebCore::Document::elementFromPoint):

2012-05-23  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118297.
        http://trac.webkit.org/changeset/118297
        https://bugs.webkit.org/show_bug.cgi?id=87338

        It caused several layout failures on Mac (Requested by
        sundiamonde on #webkit).

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):

2012-05-23  Shinya Kawanaka  <shinyak@chromium.org>

        Document.caretRangeFromPoint exposes inner elemnet of Shadow DOM.
        https://bugs.webkit.org/show_bug.cgi?id=87231

        Reviewed by Dimitri Glazkov.

        Document::caretRangeFromPoint didn't consider nested Shadow DOM.
        The container node should be adjusted up to document TreeScope beyond ShadowRoot TreeScope.

        Test: fast/dom/shadow/caret-range-from-point-in-nested-shadow.html

        * dom/Document.cpp:
        (WebCore::Document::caretRangeFromPoint):

2012-05-23  Julien Chaffraix  <jchaffraix@webkit.org>

        Crash in RenderTableCol::nextColumn
        https://bugs.webkit.org/show_bug.cgi?id=87314

        Reviewed by Abhishek Arya.

        Tests: fast/table/canvas-column-in-column-group.html
               fast/table/columngroup-inside-columngroup.html

        The issue comes from elements not abiding by the display property (e.g. canvas). This means
        that any renderer with display: table-column would pass the current isChildAllowed check and
        would confuse our algorithm to iterate.

        We were getting away with allowing those children as table columns or column groups don't
        paint themselves but it's better to just not allow such children in the first place.

        * rendering/RenderTableCol.cpp:
        (WebCore::RenderTableCol::isChildAllowed):
        Fixed the logic to only accept proper column renderer (RenderTableCol with display: column
        to ignore column-groups). Also removed an unneeded NULL-check.

2012-05-23  Jer Noble  <jer.noble@apple.com>

        REGRESSION: compositing/video/video-poster.html fails on Mac
        https://bugs.webkit.org/show_bug.cgi?id=87199

        Reviewed by Maciej Stachowiak.

        No new tests; fixes failing compositing/video/video-poster.html test.

        Instead of creating the video layer directly, simply allow the layer
        to be created in updateStates() by changing the definition of
        isReadyForVideoSetup() to bypass the m_isAllowedToRender check if
        the player reports a video track is present.  This causes the video layer
        to be created and for future calls to prepareForRendering() to result
        in calls to mediaPlayerRenderingModeChanged().

        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::isReadyForVideoSetup):
        (WebCore::MediaPlayerPrivateAVFoundation::metadataLoaded):

2012-05-23  Nico Weber  <thakis@chromium.org>

        [chromium/mac] Unbreak popup menus.
        https://bugs.webkit.org/show_bug.cgi?id=87325

        Reviewed by David Levin.

        http://svn.webkit.org/repository/webkit/trunk@117607 added this function, but the
        Chromium/Mac build doesn't use the file added in that change and hence didn't have
        the category method.. Adding it doesn't help, as the category calls a
        10.7-only function. Just don't use the category for chromium/mac. Fixes
        http://crbug.com/129418

        * platform/mac/WebCoreNSCellExtras.h:

2012-05-23  Ojan Vafai  <ojan@chromium.org>

        add back the ability to disable flexbox
        https://bugs.webkit.org/show_bug.cgi?id=87147

        Reviewed by Tony Chang.

        * Configurations/FeatureDefines.xcconfig:
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):

2012-05-23  Shinya Kawanaka  <shinyak@chromium.org>

        [Shadow] mousewheel event isn't fired on nodes in Shadow DOM.
        https://bugs.webkit.org/show_bug.cgi?id=87218

        Reviewed by Dimitri Glazkov.

        EventHander::handleWheelEvent re-targets an event to a shadow ancestor node,
        however it should be done by adjusting event target. So we don't need to have it.

        Tests: fast/dom/shadow/wheel-event-in-shadow-dom.html
               fast/dom/shadow/wheel-event-on-input-in-shadow-dom.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleWheelEvent):

2012-05-23  Huang Dongsung  <luxtella@company100.net>

        Remove an unused setter in CachedResource.h.
        https://bugs.webkit.org/show_bug.cgi?id=87324

        CachedResource::setInLiveDecodedResourcesList was defined in r24925, but it has
        been unused.

        Reviewed by Darin Adler.

        * loader/cache/CachedResource.h:

2012-05-23  Hayato Ito  <hayato@chromium.org>

        Adjust a target node of a mouse event correctly when a distributed text node is clicked.
        https://bugs.webkit.org/show_bug.cgi?id=86999

        Reviewed by Dimitri Glazkov.

        Make EventHandler::updateMouseEventTargetNode() be aware of shadow dom subtree
        so that an insertion point can receive an event when a distributed text node is clicked.

        Tests: fast/dom/shadow/shadow-dom-event-dispatching.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::updateMouseEventTargetNode):

2012-05-23  Shinya Kawanaka  <shinyak@chromium.org>

        [Shadow] drop event is not fired on nodes in Shadow DOM
        https://bugs.webkit.org/show_bug.cgi?id=85774

        Reviewed by Dimitri Glazkov.

        EventHander::updateDragAndDrop re-targets an event to a shadow ancestor node,
        however it should be done by adjusting event target. So we don't need to have it.

        Tests: fast/dom/shadow/drop-event-for-input-in-shadow.html
               fast/dom/shadow/drop-event-in-shadow.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::updateDragAndDrop):

2012-05-23  Emil A Eklund  <eae@chromium.org>

        REGRESSION (115573): Incorrect rounding of margins for floats
        https://bugs.webkit.org/show_bug.cgi?id=87319

        Reviewed by Eric Seidel.

        In RenderBlock::computeInlinePreferredLogicalWidths we used a float to
        accumulate margins for floating children while the children themselves
        represent their margins as LayoutUnits. Due to lack of rounding this can
        cause the block to be too small at certain certain zoom levels, causing
        unwanted wrapping. 

        This patch changes computeInlinePreferredLogicalWidths to use a
        LayoutUnit to accumulate the margins and thus ensures that the margin
        values are rounded the same way.

        Test: fast/block/float/floats-with-margin-should-not-wrap.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):

2012-05-23  Huang Dongsung  <luxtella@company100.net>

        Remove unused declarations in MemoryCache.h
        https://bugs.webkit.org/show_bug.cgi?id=87323

        It is originated from r75912.

        Reviewed by Darin Adler.

        * loader/cache/MemoryCache.h:

2012-05-23  Eric Seidel  <eric@webkit.org>

        Add seamless layout code (and pass most of the remaining seamless tests)
        https://bugs.webkit.org/show_bug.cgi?id=86608

        Reviewed by Ojan Vafai.

        This patch contains almost all the layout changes needed for seamless iframes.
        I removed the scroll-bar avoiding code at the last moment, as it didn't
        work for platforms other than mac-lion.  I'll add that, as well as the
        HTMLIFrameElement.seamless idl attribute in a follow-up patch.

        Seamless iframes piggy-back a bit on the existing frame-flattening
        logic, however seamless is different from frame-flattening in a few ways:
        - Frame flattening can only ever make an iframe larger (seamless just behaves like a normal div).
        - Frame flattening disables scrollbars (seamless frames behave like normal overflow: auto divs).
        - Seamless only has to work with iframes (flattening works with frame/frameset as well).
        - Seamless support shrink-wrap size negotiation when the iframe is inline.

        Test: fast/frames/seamless/seamless-percent-height.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::adjustRenderStyle): map inline -> inline-block for seamless iframes.
        * dom/Document.cpp:
        (WebCore::Document::scheduleStyleRecalc):
         - Seamless iframes don't manage their own style recalc.
        (WebCore::Document::recalcStyle):
         - We should make sure our parent is resolved before we are, but currently that causes some tests to crash
           I don't have a test to demonstrate this need yet, as presumably it's fulfilled through other codepaths atm.
        * page/FrameView.cpp:
        (WebCore::FrameView::scheduleRelayout): Do the cheaper check first.
        (WebCore::FrameView::isInChildFrameWithFrameFlattening): Make frameview layout abort child layouts like how frame flattening does.
        * rendering/RenderBox.h:
        (WebCore::RenderBox::stretchesToViewport): Disable the stretch-to-viewport quirk for seamless iframes (it makes no sense and breaks the layout code).
        * rendering/RenderIFrame.cpp:
        (WebCore::RenderIFrame::computeLogicalHeight):
         - This function is needed for the child document to participate in the normal block shrink-wrap algorithm.
           Thankfully all the shrink-wrap logic is in RenderBox instead of RenderBlock. In the future we may make
           RenderIframe a RenderBlock for the seamless case. We may just split RenderIframe into two renderers.
        (WebCore::RenderIFrame::computeLogicalWidth):
        (WebCore::RenderIFrame::shouldComputeSizeAsReplaced):
         - seamless iframes behave like blocks, not inline replaced elements.
        (WebCore):
        (WebCore::RenderIFrame::isInlineBlockOrInlineTable):
         - Behave like an inline-block when marked inline.
        (WebCore::RenderIFrame::minPreferredLogicalWidth):
         - When asked for our pref widths, return those of our child document.
        (WebCore::RenderIFrame::maxPreferredLogicalWidth):
        (WebCore::RenderIFrame::isSeamless): helper function
        (WebCore::RenderIFrame::contentRootRenderer): helper function
        (WebCore::RenderIFrame::flattenFrame): seamless iframes never use the frame-flattening feature.
        (WebCore::RenderIFrame::layoutSeamlessly): The guts of seamless layout.
        (WebCore::RenderIFrame::layout):
        * rendering/RenderIFrame.h:
        (WebCore):
        (RenderIFrame):

2012-05-23  Rafael Brandao  <rafael.lobo@openbossa.org>

        [Qt] GraphicsContext should avoid converting rotation angle to degrees
        https://bugs.webkit.org/show_bug.cgi?id=87317

        Reviewed by Noam Rosenthal.

        The angle for rotate is already in radians, so we should take advantage of it
        by using QTransform::rotateRadians, rather than converting it back internally.

        * platform/graphics/qt/GraphicsContextQt.cpp:
        (WebCore::GraphicsContext::rotate):

2012-05-23  David Tseng  <dtseng@google.com>

        AX: Prevents assertion from potentially dereferencing null pointer.
        https://bugs.webkit.org/show_bug.cgi?id=87290

        Reviewed by Chris Fleizach.

        Changes to assertions. Coverage by existing tests.

        * accessibility/AccessibilityTable.cpp:
        (WebCore::AccessibilityTable::cellForColumnAndRow):

2012-05-23  Tony Chang  <tony@chromium.org>

        auto margins on flexbox should allocate space in the cross direction
        https://bugs.webkit.org/show_bug.cgi?id=86913

        Reviewed by Ojan Vafai.

        Test: css3/flexbox/auto-margins.html

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::hasAutoMarginsInCrossAxis):
        (WebCore):
        (WebCore::RenderFlexibleBox::updateAutoMarginsInCrossAxis):
        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren): If we have flex-align: baseline and auto margins, we ignore flex-align: baseline.
        (WebCore::RenderFlexibleBox::alignChildren): auto margins apply before flex-align.
        * rendering/RenderFlexibleBox.h:

2012-05-23  Kentaro Hara  <haraken@chromium.org>

        Unreviewed, rolling out r118120.
        http://trac.webkit.org/changeset/118120
        https://bugs.webkit.org/show_bug.cgi?id=87193

        some LayoutTests crash since the patch passes a NULL to
        Null(isolate)

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateHeader):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestEventConstructor.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestEventTarget.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestException.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestInterface.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestNode.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestObj.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
        (WebCore::toV8):

2012-05-23  Kentaro Hara  <haraken@chromium.org>

        Unreviewed, rolling out r118129.
        http://trac.webkit.org/changeset/118129
        https://bugs.webkit.org/show_bug.cgi?id=87202

        some LayoutTests crash since the patch passes a NULL to
        Null(isolate)

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrGetter):
        (GenerateFunctionCallback):
        (NativeToJSValue):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::contentDocumentAttrGetter):
        (WebCore::TestObjV8Internal::getSVGDocumentCallback):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::valueAttrGetter):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::readonlyValueAttrGetter):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedValueAttrGetter):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedReadonlyValueAttrGetter):

2012-05-23  Kentaro Hara  <haraken@chromium.org>

        Unreviewed, rolling out r118133.
        http://trac.webkit.org/changeset/118133
        https://bugs.webkit.org/show_bug.cgi?id=87207

        some LayoutTests crash since the patch passes a NULL to
        Null(isolate)

        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8CSSRuleCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8CSSValueCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ClipboardCustom.cpp:
        (WebCore::V8Clipboard::typesAccessorGetter):
        * bindings/v8/custom/V8CoordinatesCustom.cpp:
        (WebCore::V8Coordinates::altitudeAccessorGetter):
        (WebCore::V8Coordinates::altitudeAccuracyAccessorGetter):
        (WebCore::V8Coordinates::headingAccessorGetter):
        (WebCore::V8Coordinates::speedAccessorGetter):
        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DOMTokenListCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DataViewCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DeviceMotionEventCustom.cpp:
        (WebCore::V8DeviceMotionEvent::accelerationAccessorGetter):
        (WebCore::V8DeviceMotionEvent::accelerationIncludingGravityAccessorGetter):
        (WebCore::V8DeviceMotionEvent::rotationRateAccessorGetter):
        (WebCore::V8DeviceMotionEvent::intervalAccessorGetter):
        * bindings/v8/custom/V8DeviceOrientationEventCustom.cpp:
        (WebCore::V8DeviceOrientationEvent::alphaAccessorGetter):
        (WebCore::V8DeviceOrientationEvent::betaAccessorGetter):
        (WebCore::V8DeviceOrientationEvent::gammaAccessorGetter):
        (WebCore::V8DeviceOrientationEvent::absoluteAccessorGetter):
        * bindings/v8/custom/V8DocumentCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
        (WebCore::V8Document::locationAccessorGetter):
        * bindings/v8/custom/V8EntryCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8EntrySyncCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8EventCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Float32ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Float64ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
        (WebCore::V8HTMLCanvasElement::getContextCallback):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::toV8):

2012-05-23  Kentaro Hara  <haraken@chromium.org>

        Unreviewed, rolling out r118134.
        http://trac.webkit.org/changeset/118134
        https://bugs.webkit.org/show_bug.cgi?id=87209

        some LayoutTests crash since the patch passes a NULL to
        Null(isolate)

        * bindings/v8/custom/V8HTMLElementCustom.cpp:
        (WebCore::toV8Object):
        (WebCore::toV8):
        * bindings/v8/custom/V8HistoryCustom.cpp:
        (WebCore::V8History::stateAccessorGetter):
        * bindings/v8/custom/V8IDBAnyCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8IDBKeyCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ImageDataCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Int16ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Int32ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Int8ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8LocationCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8MessageEventCustom.cpp:
        (WebCore::V8MessageEvent::dataAccessorGetter):
        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8NodeCustom.cpp:
        (WebCore::V8Node::insertBeforeCallback):
        (WebCore::V8Node::replaceChildCallback):
        (WebCore::V8Node::removeChildCallback):
        (WebCore::V8Node::appendChildCallback):
        (WebCore::toV8Slow):
        * bindings/v8/custom/V8PopStateEventCustom.cpp:
        (WebCore::V8PopStateEvent::stateAccessorGetter):
        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
        (WebCore::V8SQLResultSetRowList::itemCallback):
        * bindings/v8/custom/V8SVGDocumentCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8SVGElementCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8SVGPathSegCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ScriptProfileCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ScriptProfileNodeCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8StyleSheetCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8TrackEventCustom.cpp:
        (WebCore::V8TrackEvent::trackAccessorGetter):
        * bindings/v8/custom/V8Uint16ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Uint32ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Uint8ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Uint8ClampedArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
        (WebCore::toV8Object):
        (WebCore::V8WebGLRenderingContext::getAttachedShadersCallback):
        (WebCore::V8WebGLRenderingContext::getSupportedExtensionsCallback):
        * bindings/v8/custom/V8WorkerContextCustom.cpp:
        (WebCore::toV8):

2012-05-23  James Robinson  <jamesr@chromium.org>

        Add a Setting to make position:fixed form a new stacking context
        https://bugs.webkit.org/show_bug.cgi?id=87186

        Reviewed by Adam Barth.

        position:fixed elements form a new stacking context in several mobile WebKit ports and in the Qt port always. To
        be consistent across devices, we want to try turning it on everywhere. This will likely cause compatibility
        issues, so we need a runtime setting in order to stage the change carefully.

        Tests: fast/block/positioning/fixed-position-stacking-context.html
               fast/block/positioning/fixed-position-stacking-context2.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (WebCore::Settings::setFixedPositionCreatesStackingContext):
        (WebCore::Settings::fixedPositionCreatesStackingContext):
        (Settings):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::InternalSettings):
        (WebCore::InternalSettings::restoreTo):
        (WebCore::InternalSettings::setFixedPositionCreatesStackingContext):
        (WebCore):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-05-23  Michael Nordman  <michaeln@google.com>

        [chromium] DomStorage events handling needs TLC (3)
        https://bugs.webkit.org/show_bug.cgi?id=87031
        https://code.google.com/p/chromium/issues/detail?id=128482
        Create WebCore::Storage instances as a side effect of attaching storage event handlers.
        This allows storage events in chromium to be propagated with less IPC chatter.

        Worth noting that in non-chromium ports, creation of the localStorage instance can have
        an additional side effect of scheduling a background task to read the area's values
        from disk, which given the interest in events is probably a beneficial side effect.

        Reviewed by Adam Barth.

        No new tests. Existing tests cover this.

        * page/DOMWindow.cpp:
        (WebCore::didAddStorageEventListener):
        (WebCore::DOMWindow::addEventListener):

2012-05-23  Michael Saboff  <msaboff@apple.com>

        Crash in fast/files/read tests during Garbage Collection
        https://bugs.webkit.org/show_bug.cgi?id=87165

        Reviewed by Alexey Proskuryakov.

        Changed hasPendingActivity() processing to use ActiveDOMObject::hasPendingActivity()
        and associated setPendingActivity() / unsetPendingActivity().

        Fixed two existing tests with change.

        * Modules/filesystem/FileWriter.cpp:
        (WebCore::FileWriter::stop):
        (WebCore::FileWriter::write):
        (WebCore::FileWriter::truncate):
        (WebCore::FileWriter::signalCompletion):
        * Modules/filesystem/FileWriter.h:
        * fileapi/FileReader.cpp:
        (WebCore::FileReader::readInternal):
        (WebCore::FileReader::doAbort):
        (WebCore::FileReader::didFinishLoading):
        (WebCore::FileReader::didFail):
        * fileapi/FileReader.h:

2012-05-23  Abhishek Arya  <inferno@chromium.org>

        Crash in run-ins with continuations while moving back to original position.
        https://bugs.webkit.org/show_bug.cgi?id=87264

        Reviewed by Julien Chaffraix.

        Run-in that are now placed in sibling block can break up into continuation
        chains when new children are added to it. We cannot easily send them back to their
        original place since that requires writing integration logic with RenderInline::addChild
        and all other places that might cause continuations to be created (without blowing away
        |this|). Disabling this feature for now to prevent crashes.

        Test: fast/runin/runin-continuations-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::moveRunInToOriginalPosition):

2012-05-23  Abhishek Arya  <inferno@chromium.org>

        Crash in RenderInline::linesVisualOverflowBoundingBox.
        https://bugs.webkit.org/show_bug.cgi?id=85804

        Reviewed by Dave Hyatt.

        Defer layout of replaced elements to the next line break function.
        We shouldn't do it while we are clearing our inline chilren
        lineboxes in full layout mode.

        Test: fast/block/inline-children-root-linebox-crash.html

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::layoutInlineChildren):
        (WebCore::RenderBlock::LineBreaker::nextLineBreak):

2012-05-23  Chris Rogers  <crogers@google.com>

        AudioParam must support fan-in (multiple audio connections) (take 2)
        https://bugs.webkit.org/show_bug.cgi?id=83610

        Reviewed by Kenneth Russell.
        
        This re-lands bug: https://bugs.webkit.org/show_bug.cgi?id=83610
        Now that a fix has been landed: http://trac.webkit.org/changeset/118099

        Test: webaudio/audioparam-summingjunction.html

        * Modules/webaudio/AudioParam.cpp:
        * Modules/webaudio/AudioParam.h:
        (WebCore::AudioParam::calculateSampleAccurateValues):
        (WebCore::AudioParam::calculateAudioRateSignalValues):
        Sums intrinsic parameter value with all audio-rate connections.
        
        (WebCore::AudioParam::connect):
        (WebCore::AudioParam::disconnect):
        Support multiple connections.
        
        (WebCore::AudioParam::hasSampleAccurateValues):
        If we have one or more audio-rate connections.
        
        (WebCore::AudioParam::AudioParam):
        AudioParam now sub-classes AudioSummingJunction.

2012-05-23  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] webintents/web-intents-delivery-reuse.html is failing on EFL port
        https://bugs.webkit.org/show_bug.cgi?id=87092

        Reviewed by Adam Barth.

        Remove readonly keyword from the webkitIntent attribute. This is
        needed otherwise the [Replaceable] extended attribute has not effect
        with JSC. This is tested by webintents/web-intents-delivery-reuse.html
        test case.

        * Modules/intents/DOMWindowIntents.idl:

2012-05-23  Abhishek Arya  <inferno@chromium.org>

        ASSERT failure toRenderProgress in HTMLProgressElement::didElementStateChange
        https://bugs.webkit.org/show_bug.cgi?id=87274

        Reviewed by Darin Adler.

        Progress bar can't run-in. Prevent it from becoming a run-in, leading to an
        unworkable RenderInline.

        Test: fast/runin/progress-run-in-crash.html

        * html/HTMLProgressElement.cpp:
        (WebCore::HTMLProgressElement::didElementStateChange):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::moveRunInUnderSiblingBlockIfNeeded):

2012-05-23  Andrew Lo  <anlo@rim.com>

        [BlackBerry] UI thread unnecessarily blocks on WebKit thread when servicing requestAnimationFrames
        https://bugs.webkit.org/show_bug.cgi?id=87289

        Reviewed by Antonio Gomes.

        requestAnimationFrame already covered by tests in LayoutTests/fast/animation.

        If UI thread cannot acquire DisplayRefreshMonitor mutex immediately,
        avoid blocking on the mutex, it can trigger the frame change on the next
        animation tick instead.

        * platform/graphics/blackberry/DisplayRefreshMonitorBlackBerry.cpp:
        (WebCore::DisplayRefreshMonitor::displayLinkFired):

2012-05-23  Alec Flett  <alecflett@chromium.org>

        Implement DOM4 DOMError
        https://bugs.webkit.org/show_bug.cgi?id=87055

        Reviewed by Adam Barth.

        Implement the DOMError class and it's IDL interface.

        No new tests. Not testable yet, as it's not used.

        * WebCore.gypi:
        * dom/DOMError.cpp: Added.
        (WebCore):
        (WebCore::DOMError::DOMError):
        * dom/DOMError.h: Added.
        (WebCore):
        (DOMError):
        (WebCore::DOMError::create):
        (WebCore::DOMError::name):
        * dom/DOMError.idl: Added.

2012-05-23  Kenneth Russell  <kbr@google.com>

        REGRESSION(117918) - 4 webgl/tex-iomage-and-sub-image-2d-with-image tests failing on Mac bots.
        https://bugs.webkit.org/show_bug.cgi?id=87136

        Reviewed by Stephen White.

        Fixed longstanding bug in GraphicsContext3D constructor in Mac
        port, and logic error in tracking of texture bound to unit 0. Also
        fixed up Cairo port's constructor by code inspection. This code is
        ripe for cleanup; Bug 87198 filed for this.

        Covered by existing tests.

        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
        (WebCore::GraphicsContext3D::GraphicsContext3D):
            Initialize missing members.
        * platform/graphics/mac/GraphicsContext3DMac.mm:
        (WebCore::GraphicsContext3D::GraphicsContext3D):
            Correctly initialize m_activeTexture.
        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
        (WebCore::GraphicsContext3D::bindTexture):
            Fix logic error in tracking of texture bound to unit 0.

2012-05-23  Dana Jansens  <danakj@chromium.org>

        [chromium] Layers on main thread should get a RenderSurface for animating transform only if masksToBounds is true also
        https://bugs.webkit.org/show_bug.cgi?id=87184

        Reviewed by James Robinson.

        Layers on main thread get a RenderSurface if their impl counterpart may
        have a RenderSurface due to its animating transform. We currently create
        a RenderSurface for all layers with an animating transform and
        a descendant that drawsContents. But a RenderSurface on impl also
        implies that the layer masksToBounds. So only make a RenderSurface on
        main thread when the layer also masksToBounds.

        Modified unit test CCLayerTreeHostCommonTest.verifyAnimationsForRenderSurfaceHierarchy.

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::subtreeShouldRenderToSeparateSurface):

2012-05-23  Chris Fleizach  <cfleizach@apple.com>

        Regression(r112694): Crash in WebCore::AXObjectCache::postNotification 
        https://bugs.webkit.org/show_bug.cgi?id=86029

        Reviewed by Abhishek Arya.

        Test: accessibility/content-changed-notification-causes-crash.html

        * accessibility/AccessibilityObject.h:
        (WebCore::AccessibilityObject::isDetached):
        (AccessibilityObject):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::contentChanged):

2012-05-23  Robin Dunn  <robin@alldunn.com>

        [wx] Fix memory leak in FontHolder.
        https://bugs.webkit.org/show_bug.cgi?id=87281

        Reviewed by Kevin Ollivier.

        * platform/graphics/wx/FontPlatformData.h:

2012-05-23  Robin Dunn  <robin@alldunn.com>

        [wx] Make sure we do not create a substitute font if the facename is not found.
        https://bugs.webkit.org/show_bug.cgi?id=87280

        Reviewed by Kevin Ollivier.

        * platform/graphics/wx/FontCacheWx.cpp:
        (WebCore::FontCache::createFontPlatformData):

2012-05-23  Robin Dunn  <robin@alldunn.com>

        [wx] Implement transparency layer support.
        https://bugs.webkit.org/show_bug.cgi?id=87279

        Reviewed by Kevin Ollivier.

        * platform/graphics/wx/GraphicsContextWx.cpp:
        (WebCore::GraphicsContext::beginPlatformTransparencyLayer):
        (WebCore::GraphicsContext::endPlatformTransparencyLayer):
        (WebCore::GraphicsContext::supportsTransparencyLayers):

2012-05-23  Jer Noble  <jer.noble@apple.com>

        GenericClock loses precision due to float->double conversion.
        https://bugs.webkit.org/show_bug.cgi?id=87227

        Reviewed by Darin Adler.

        No new tests; fixes media/media-controller-time.html on Chromium.

        Only narrow to float after the entire calculation is complete. This requires now() and m_offset
        to be double-precision.

        * platform/ClockGeneric.cpp:
        (ClockGeneric::currentTime): 
        (ClockGeneric::now): Make double-precision.
        * platform/ClockGeneric.h:
        (ClockGeneric): Make m_offset double-precision.

2012-05-22  Jer Noble  <jer.noble@apple.com>

        PlatformClockCM has uninitialized m_rate member.
        https://bugs.webkit.org/show_bug.cgi?id=87217

        Reviewed by Eric Carlson.

        Test: media/media-controller-time.html

        Initialize the m_rate member to a default of 1 (second-per-second), matching the implementation
        of ClockGeneric.

        * platform/mac/PlatformClockCM.mm:
        (PlatformClockCM::PlatformClockCM):

2012-05-23  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118096.
        http://trac.webkit.org/changeset/118096
        https://bugs.webkit.org/show_bug.cgi?id=87285

        caused multiple crashes on the mac bots (Requested by
        jessieberlin on #webkit).

        * dom/ContainerNodeAlgorithms.h:

2012-05-23  Darin Adler  <darin@apple.com>

        Speed up traverseNextNode when called on a ContainerNode or Element
        https://bugs.webkit.org/show_bug.cgi?id=87224

        Reviewed by Geoffrey Garen.

        * dom/ContainerNode.h: Added overrides of traverseNextNode for ContainerNode.
        That way, when we know at compile time something is ContainerNode, we can
        skip a branch at the start of this hot function.

2012-05-23  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>

        Use PluginDataNone.cpp always when NETSCAPE_PLUGIN_API is OFF
        https://bugs.webkit.org/show_bug.cgi?id=87096

        Reviewed by Andy Estes.

        Fix a build error by adding an extra check in PluginData.cpp to use
        PluginStrategy only when NETSCAPE_PLUGIN_API is ON.

        No new tests. This is only a build fix.

        * plugins/PluginData.cpp:
        (WebCore):

2012-05-23  Malcolm MacLeod  <malcolm.macleod@tshwanedje.com>

        [wx] Fix scrollbar drawing under wxGTK.
        https://bugs.webkit.org/show_bug.cgi?id=87150

        Reviewed by Kevin Ollivier.

        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
        (wxRenderer_DrawScrollbar):

2012-05-23  Antti Koivisto  <antti@apple.com>

        Rename StyleSheetInternal to StyleSheetContents
        https://bugs.webkit.org/show_bug.cgi?id=87272

        Reviewed by Andreas Kling.

        The name is more descriptive and the code reads better.
        
        Plain "StyleSheet" would be good too but that is a CSSOM type and the name can't be used without
        changing idl code generation and resolving bunch of other issues.

        * css/CSSFontFaceSrcValue.cpp:
        (WebCore::CSSFontFaceSrcValue::addSubresourceStyleURLs):
        * css/CSSFontFaceSrcValue.h:
        (CSSFontFaceSrcValue):
        * css/CSSImportRule.cpp:
        (WebCore::StyleRuleImport::setCSSStyleSheet):
        (WebCore::StyleRuleImport::requestStyleSheet):
        * css/CSSImportRule.h:
        (WebCore):
        (WebCore::StyleRuleImport::parentStyleSheet):
        (WebCore::StyleRuleImport::setParentStyleSheet):
        (WebCore::StyleRuleImport::styleSheet):
        (StyleRuleImport):
        * css/CSSMediaRule.cpp:
        (WebCore::CSSMediaRule::insertRule):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseSheet):
        (WebCore::CSSParser::parseRule):
        (WebCore::CSSParser::parseKeyframeRule):
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseSelector):
        (WebCore::CSSParser::parseDeclaration):
        (WebCore::CSSParser::setStyleSheet):
        (WebCore::CSSParser::parseFlowThread):
        * css/CSSParser.h:
        (WebCore):
        (CSSParser):
        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::addSubresourceStyleURLs):
        * css/CSSPrimitiveValue.h:
        (CSSPrimitiveValue):
        * css/CSSReflectValue.cpp:
        (WebCore::CSSReflectValue::addSubresourceStyleURLs):
        * css/CSSReflectValue.h:
        (CSSReflectValue):
        * css/CSSRule.cpp:
        (WebCore::CSSRule::parserContext):
        * css/CSSStyleSheet.cpp:
        (WebCore::StyleSheetContents::estimatedSizeInBytes):
        (WebCore::StyleSheetContents::StyleSheetContents):
        (WebCore::StyleSheetContents::~StyleSheetContents):
        (WebCore::StyleSheetContents::isCacheable):
        (WebCore::StyleSheetContents::parserAppendRule):
        (WebCore::StyleSheetContents::ruleAt):
        (WebCore::StyleSheetContents::ruleCount):
        (WebCore::StyleSheetContents::clearCharsetRule):
        (WebCore::StyleSheetContents::clearRules):
        (WebCore::StyleSheetContents::parserSetEncodingFromCharsetRule):
        (WebCore::StyleSheetContents::wrapperInsertRule):
        (WebCore::StyleSheetContents::wrapperDeleteRule):
        (WebCore::StyleSheetContents::parserAddNamespace):
        (WebCore::StyleSheetContents::determineNamespace):
        (WebCore::StyleSheetContents::parseAuthorStyleSheet):
        (WebCore::StyleSheetContents::parseString):
        (WebCore::StyleSheetContents::parseStringAtLine):
        (WebCore::StyleSheetContents::isLoading):
        (WebCore::StyleSheetContents::checkLoaded):
        (WebCore::StyleSheetContents::notifyLoadedSheet):
        (WebCore::StyleSheetContents::startLoadingDynamicSheet):
        (WebCore::StyleSheetContents::rootStyleSheet):
        (WebCore::StyleSheetContents::singleOwnerNode):
        (WebCore::StyleSheetContents::singleOwnerDocument):
        (WebCore::StyleSheetContents::completeURL):
        (WebCore::StyleSheetContents::addSubresourceStyleURLs):
        (WebCore::StyleSheetContents::parentStyleSheet):
        (WebCore::StyleSheetContents::registerClient):
        (WebCore::StyleSheetContents::unregisterClient):
        (WebCore::StyleSheetContents::addedToMemoryCache):
        (WebCore::StyleSheetContents::removedFromMemoryCache):
        (WebCore::CSSStyleSheet::createInline):
        (WebCore::CSSStyleSheet::CSSStyleSheet):
        (WebCore::CSSStyleSheet::~CSSStyleSheet):
        (WebCore::CSSStyleSheet::willMutateRules):
        (WebCore::CSSStyleSheet::didMutateRules):
        (WebCore::CSSStyleSheet::reattachChildRuleCSSOMWrappers):
        (WebCore::CSSStyleSheet::length):
        (WebCore::CSSStyleSheet::item):
        (WebCore::CSSStyleSheet::rules):
        (WebCore::CSSStyleSheet::insertRule):
        (WebCore::CSSStyleSheet::deleteRule):
        (WebCore::CSSStyleSheet::cssRules):
        * css/CSSStyleSheet.h:
        (WebCore::StyleSheetContents::create):
        (StyleSheetContents):
        (WebCore::StyleSheetContents::copy):
        (WebCore::CSSStyleSheet::create):
        (WebCore::CSSStyleSheet::contents):
        (CSSStyleSheet):
        * css/CSSValue.cpp:
        (WebCore::CSSValue::addSubresourceStyleURLs):
        * css/CSSValue.h:
        (WebCore):
        (CSSValue):
        * css/CSSValueList.cpp:
        (WebCore::CSSValueList::addSubresourceStyleURLs):
        * css/CSSValueList.h:
        (CSSValueList):
        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::contextStyleSheet):
        * css/PropertySetCSSStyleDeclaration.h:
        (WebCore):
        (PropertySetCSSStyleDeclaration):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::setProperty):
        (WebCore::StylePropertySet::parseDeclaration):
        (WebCore::StylePropertySet::addSubresourceStyleURLs):
        * css/StylePropertySet.h:
        (WebCore):
        (StylePropertySet):
        * css/StyleResolver.cpp:
        (RuleSet):
        (WebCore):
        (WebCore::StyleResolver::StyleResolver):
        (WebCore::StyleResolver::addAuthorRulesAndCollectUserRulesFromSheets):
        (WebCore::StyleResolver::appendAuthorStylesheets):
        (WebCore::parseUASheet):
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleResolver.h:
        (StyleResolver):
        * css/WebKitCSSKeyframesRule.cpp:
        (WebCore::WebKitCSSKeyframesRule::insertRule):
        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::createCSSStyleSheet):
        * dom/Document.cpp:
        (WebCore::Document::recalcStyle):
        (WebCore::Document::updateBaseURL):
        (WebCore::Document::pageUserSheet):
        (WebCore::Document::pageGroupUserSheets):
        (WebCore::Document::addUserSheet):
        (WebCore::Document::testAddedStylesheetRequiresStyleRecalc):
        (WebCore::Document::analyzeStylesheetChange):
        (WebCore::styleSheetsUseRemUnits):
        * dom/Document.h:
        (WebCore):
        (Document):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::updateInlineStyleAvoidingMutation):
        * dom/ProcessingInstruction.cpp:
        (WebCore::ProcessingInstruction::setCSSStyleSheet):
        (WebCore::ProcessingInstruction::parseStyleSheet):
        * dom/StyleElement.cpp:
        (WebCore::StyleElement::createSheet):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::setInlineStyleProperty):
        (WebCore::StyledElement::addSubresourceAttributeURLs):
        (WebCore::StyledElement::addPropertyToAttributeStyle):
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::setCSSStyleSheet):
        (WebCore::HTMLLinkElement::styleSheetIsLoading):
        (WebCore::HTMLLinkElement::addSubresourceAttributeURLs):
        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::addSubresourceAttributeURLs):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::fillMediaListChain):
        (WebCore::InspectorStyle::setPropertyText):
        (WebCore::InspectorStyleSheet::styleSheetURL):
        (WebCore::InspectorStyleSheet::reparseStyleSheet):
        (WebCore::InspectorStyleSheet::ensureSourceData):
        (WebCore::InspectorStyleSheetForInlineStyle::getStyleAttributeRanges):
        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::restoreParsedStyleSheet):
        (WebCore::CachedCSSStyleSheet::saveParsedStyleSheet):
        * loader/cache/CachedCSSStyleSheet.h:
        (WebCore):
        (CachedCSSStyleSheet):
        * page/PageSerializer.cpp:
        (WebCore::PageSerializer::serializeCSSStyleSheet):

2012-05-23  Darin Adler  <darin@apple.com>

        Use ContainerNode instead of Node where possible
        https://bugs.webkit.org/show_bug.cgi?id=87220

        Reviewed by Geoffrey Garen.

        It's better to use a more specific type; in some cases we even generate
        more efficient code if we have a more specific type. Also, we want any
        type casts to be as close as possible to the corresponding type checks,
        so eliminating these uses of toContainerNode is a plus, also.

        * dom/ContainerNodeAlgorithms.h: Changed insertionPoint to be a ContainerNode
        instead of a Node. Fixed spelling error "inseretions". Changed
        (WebCore::ChildFrameDisconnector::Target::Target): Changed type of frame owner
        element to HTMLFrameOwnerElement from Node.

        * dom/DocumentType.cpp:
        (WebCore::DocumentType::insertedInto):
        (WebCore::DocumentType::removedFrom):
        * dom/DocumentType.h:
        * dom/Element.cpp:
        (WebCore::Element::insertedInto):
        (WebCore::Element::removedFrom):
        * dom/Element.h:
        * dom/Node.cpp:
        (WebCore::Node::insertedInto):
        (WebCore::Node::removedFrom):
        * dom/Node.h:
        * dom/ProcessingInstruction.cpp:
        (WebCore::ProcessingInstruction::insertedInto):
        (WebCore::ProcessingInstruction::removedFrom):
        * dom/ProcessingInstruction.h:
        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::insertedInto):
        * dom/ScriptElement.h:
        * html/FormAssociatedElement.cpp:
        (WebCore::FormAssociatedElement::insertedInto):
        (WebCore::FormAssociatedElement::removedFrom):
        * html/FormAssociatedElement.h:
        * html/HTMLBaseElement.cpp:
        (WebCore::HTMLBaseElement::insertedInto):
        (WebCore::HTMLBaseElement::removedFrom):
        * html/HTMLBaseElement.h:
        * html/HTMLBodyElement.cpp:
        (WebCore::HTMLBodyElement::insertedInto):
        (WebCore::HTMLBodyElement::didNotifyDescendantInsertions):
        * html/HTMLBodyElement.h:
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::insertedInto):
        (WebCore::HTMLFormControlElement::removedFrom):
        * html/HTMLFormControlElement.h:
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::insertedInto):
        (WebCore::HTMLFormElement::didNotifyDescendantInsertions):
        (WebCore::HTMLFormElement::removedFrom):
        * html/HTMLFormElement.h:
        * html/HTMLFrameElementBase.cpp:
        (WebCore::HTMLFrameElementBase::insertedInto):
        (WebCore::HTMLFrameElementBase::didNotifyDescendantInsertions):
        * html/HTMLFrameElementBase.h:
        * html/HTMLFrameSetElement.cpp:
        (WebCore::HTMLFrameSetElement::insertedInto):
        (WebCore::HTMLFrameSetElement::removedFrom):
        * html/HTMLFrameSetElement.h:
        * html/HTMLIFrameElement.cpp:
        (WebCore::HTMLIFrameElement::insertedInto):
        (WebCore::HTMLIFrameElement::removedFrom):
        * html/HTMLIFrameElement.h:
        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::insertedInto):
        (WebCore::HTMLImageElement::removedFrom):
        * html/HTMLImageElement.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::insertedInto):
        (WebCore::HTMLInputElement::removedFrom):
        * html/HTMLInputElement.h:
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::insertedInto):
        (WebCore::HTMLLinkElement::removedFrom):
        * html/HTMLLinkElement.h:
        * html/HTMLMapElement.cpp:
        (WebCore::HTMLMapElement::insertedInto):
        (WebCore::HTMLMapElement::removedFrom):
        * html/HTMLMapElement.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::insertedInto):
        (WebCore::HTMLMediaElement::removedFrom):
        * html/HTMLMediaElement.h:
        * html/HTMLMetaElement.cpp:
        (WebCore::HTMLMetaElement::insertedInto):
        * html/HTMLMetaElement.h:
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::insertedInto):
        (WebCore::HTMLObjectElement::removedFrom):
        * html/HTMLObjectElement.h:
        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::insertedInto):
        * html/HTMLOptionElement.h:
        * html/HTMLQuoteElement.cpp:
        (WebCore::HTMLQuoteElement::insertedInto):
        * html/HTMLQuoteElement.h:
        * html/HTMLScriptElement.cpp:
        (WebCore::HTMLScriptElement::insertedInto):
        * html/HTMLScriptElement.h:
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::insertedInto):
        * html/HTMLSelectElement.h:
        * html/HTMLSourceElement.cpp:
        (WebCore::HTMLSourceElement::insertedInto):
        (WebCore::HTMLSourceElement::removedFrom):
        * html/HTMLSourceElement.h:
        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::insertedInto):
        (WebCore::HTMLStyleElement::removedFrom):
        * html/HTMLStyleElement.h:
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::insertedInto):
        * html/HTMLTextFormControlElement.h:
        * html/HTMLTitleElement.cpp:
        (WebCore::HTMLTitleElement::insertedInto):
        (WebCore::HTMLTitleElement::removedFrom):
        * html/HTMLTitleElement.h:
        * html/HTMLTrackElement.cpp:
        (WebCore::HTMLTrackElement::insertedInto):
        (WebCore::HTMLTrackElement::removedFrom):
        * html/HTMLTrackElement.h:
        * mathml/MathMLMathElement.cpp:
        (WebCore::MathMLMathElement::insertedInto):
        * mathml/MathMLMathElement.h:
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::removedFrom):
        * svg/SVGElement.h:
        * svg/SVGFEImageElement.cpp:
        (WebCore::SVGFEImageElement::insertedInto):
        (WebCore::SVGFEImageElement::removedFrom):
        * svg/SVGFEImageElement.h:
        * svg/SVGFontFaceElement.cpp:
        (WebCore::SVGFontFaceElement::insertedInto):
        (WebCore::SVGFontFaceElement::removedFrom):
        * svg/SVGFontFaceElement.h:
        * svg/SVGFontFaceUriElement.cpp:
        (WebCore::SVGFontFaceUriElement::insertedInto):
        * svg/SVGFontFaceUriElement.h:
        * svg/SVGGlyphElement.cpp:
        (WebCore::SVGGlyphElement::insertedInto):
        (WebCore::SVGGlyphElement::removedFrom):
        * svg/SVGGlyphElement.h:
        * svg/SVGHKernElement.cpp:
        (WebCore::SVGHKernElement::insertedInto):
        (WebCore::SVGHKernElement::removedFrom):
        * svg/SVGHKernElement.h:
        * svg/SVGImageElement.cpp:
        (WebCore::SVGImageElement::insertedInto):
        * svg/SVGImageElement.h:
        * svg/SVGSVGElement.cpp:
        (WebCore::SVGSVGElement::insertedInto):
        (WebCore::SVGSVGElement::removedFrom):
        * svg/SVGSVGElement.h:
        * svg/SVGScriptElement.cpp:
        (WebCore::SVGScriptElement::insertedInto):
        * svg/SVGScriptElement.h:
        * svg/SVGStyleElement.cpp:
        (WebCore::SVGStyleElement::insertedInto):
        (WebCore::SVGStyleElement::removedFrom):
        * svg/SVGStyleElement.h:
        * svg/SVGStyledElement.cpp:
        (WebCore::SVGStyledElement::insertedInto):
        (WebCore::SVGStyledElement::removedFrom):
        * svg/SVGStyledElement.h:
        * svg/SVGTRefElement.cpp:
        (WebCore::SVGTRefElement::insertedInto):
        (WebCore::SVGTRefElement::removedFrom):
        * svg/SVGTRefElement.h:
        * svg/SVGTextPathElement.cpp:
        (WebCore::SVGTextPathElement::insertedInto):
        * svg/SVGTextPathElement.h:
        * svg/SVGTitleElement.cpp:
        (WebCore::SVGTitleElement::insertedInto):
        (WebCore::SVGTitleElement::removedFrom):
        * svg/SVGTitleElement.h:
        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::insertedInto):
        (WebCore::SVGUseElement::removedFrom):
        * svg/SVGUseElement.h:
        * svg/SVGVKernElement.cpp:
        (WebCore::SVGVKernElement::insertedInto):
        (WebCore::SVGVKernElement::removedFrom):
        * svg/SVGVKernElement.h:
        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::insertedInto):
        (WebCore::SVGSMILElement::removedFrom):
        * svg/animation/SVGSMILElement.h:
        Changed arguments of insertedInto and removedFrom to ContainerNode instead of Node.
        Did the same with didNotifyDescendantInsertions, while fixing the typo in its name.

        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplaceSelectionCommand::doApply): Put a typecast toHTMLElement here.
        The check for isListElement and isLegacyAppleStyleSpan takes care of the type checking.
        (WebCore::ReplaceSelectionCommand::insertAsListItems): Changed this function to take
        an HTMLElement instead of a Node, then we can drop use of the toContainerNode function.
        * editing/ReplaceSelectionCommand.h:

        * editing/TextIterator.cpp: Fixed a typo in a comment.

2012-05-23  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: filter out debugging stuff from the heap class view
        https://bugs.webkit.org/show_bug.cgi?id=86723

        We mark objects that are accessible from user roots (e.g. Window)
        with pageObject attribute. This fix filters out all non-pageObjects
        from the classes view.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotNode.prototype.isPageObject):
        (WebInspector.HeapSnapshot.prototype._buildAggregates):
        (WebInspector.HeapSnapshot.prototype._calculateClassesRetainedSize):
        (WebInspector.HeapSnapshot.prototype._buildPostOrderIndex):
        (WebInspector.HeapSnapshot.prototype._markPageOwnedNodes):
        (WebInspector.HeapSnapshot.prototype.createNodesProviderForClass):

2012-05-23  Andrei Bucur  <abucur@adobe.com>

        [CSSRegions]Implement NamedFlow::name attribute
        https://bugs.webkit.org/show_bug.cgi?id=79645

        Implementation for the NamedFlow::name attribute per the CSS Regions WD 3-May-2012 recommendation:
        http://www.w3.org/TR/2012/WD-css3-regions-20120503/

        Reviewed by Andreas Kling.

        Test: fast/regions/webkit-named-flow-name.html

        * dom/WebKitNamedFlow.cpp:
        (WebCore::WebKitNamedFlow::name):
        (WebCore):
        * dom/WebKitNamedFlow.h:
        (WebKitNamedFlow):
        * dom/WebKitNamedFlow.idl:

2012-05-23  Andreas Kling  <kling@webkit.org>

        Let the compiler generate FontFamily's copy ctor and assignment operator.

        Blindly rubberstamped by the brave Antti Koivisto.

        * platform/graphics/FontFamily.cpp:
        * platform/graphics/FontFamily.h:

2012-05-23  Andreas Kling  <kling@webkit.org>

        CSSParser: Simplify StylePropertySet creation.
        <http://webkit.org/b/87259>

        Reviewed by Alexis Menard.

        Turn CSSParser's filteredProperties() into createStylePropertySet() which filters the parsed
        properties and creates a new StylePropertySet, adopting the vector to avoid the Vector copy we
        were previously incurring.

        Added a StylePropertyVector typedef for Vector<CSSProperty, 4> since we need to pass this type
        to the constructor for Vector::swap() to work.

        And thus StylePropertySet::create(const Vector<CSSProperty>&, CSSParserMode) became
        StylePropertySet::adopt(StylePropertyVector&, CSSParserMode).

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::copyPropertiesInSet):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::createStylePropertySet):
        (WebCore::CSSParser::createStyleRule):
        (WebCore::CSSParser::createFontFaceRule):
        (WebCore::CSSParser::createPageRule):
        (WebCore::CSSParser::createKeyframe):
        * css/CSSParser.h:
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::StylePropertySet):
        (WebCore::StylePropertySet::removePropertiesInSet):
        (WebCore::StylePropertySet::copyPropertiesInSet):
        (SameSizeAsStylePropertySet):
        * css/StylePropertySet.h:
        (WebCore::StylePropertySet::adopt):
        (StylePropertySet):

2012-05-23  Andreas Kling  <kling@webkit.org>

        Kill some frivolous null-checking of Element::m_attributeData.
        <http://webkit.org/b/87248>

        Reviewed by Antti Koivisto.

        Replace unnecessary Element::m_attributeData with assertions where it makes sense.
        Others are flat out removed because it should be obvious from context that it's non-null.
        E.g if an attribute has changed, we're obviously storing it somewhere.

        Also added a short-circuit to Element::normalize() if there are no Attr objects
        associated with the element.

        * dom/Element.cpp:
        (WebCore::Element::~Element):
        (WebCore::Element::attributeChanged):
        (WebCore::Element::insertedInto):
        (WebCore::Element::removedFrom):
        (WebCore::Element::removeAttributeNode):
        (WebCore::Element::normalizeAttributes):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::classAttributeChanged):

2012-05-23  Andreas Kling  <kling@webkit.org>

        Let Element::detachAttribute() handle removal of the attribute.
        <http://webkit.org/b/87242>

        Reviewed by Antti Koivisto.

        All the call sites were removing the attribute after detaching it, so move
        that into detachAttribute(). The function name already made it sound like it
        removes the attribute anyway.

        Also sprinkle some assertions wrt being called with guaranteed presence of
        attributeData() and the provided index in the attribute vector.

        * dom/Element.cpp:
        (WebCore::Element::detachAttribute):
        (WebCore::Element::removeAttributeNode):
        * dom/NamedNodeMap.cpp:
        (WebCore::NamedNodeMap::removeNamedItem):
        (WebCore::NamedNodeMap::removeNamedItemNS):

2012-05-23  Andreas Kling  <kling@webkit.org>

        Streamline Element teardown for the no-Attr-objects case.
        <http://webkit.org/b/87228>

        Reviewed by Antti Koivisto.

        Dodge one function call in ~Element() if the element has no Attr objects
        associated (the typical case.)

        Renamed detachAttributes to detachAttrObjectsFromElement to reduce ambiguity.

        * dom/Element.cpp:
        (WebCore::Element::~Element):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::detachAttrObjectsFromElement):
        (WebCore::ElementAttributeData::clearAttributes):
        * dom/ElementAttributeData.h:
        (ElementAttributeData):

2012-05-23  Jochen Eisinger  <jochen@chromium.org>

        Fix incomplete switch statement in CSSParser after r118082
        https://bugs.webkit.org/show_bug.cgi?id=87250

        Reviewed by Alexis Menard.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):

2012-05-23  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118105.
        http://trac.webkit.org/changeset/118105
        https://bugs.webkit.org/show_bug.cgi?id=87255

        New LayoutTest is causing several cookie tests to fail on
        numerous bots (Requested by steveblock on #webkit).

        * platform/blackberry/CookieJarBlackBerry.cpp:
        (WebCore::setCookies):
        * platform/blackberry/CookieManager.cpp:
        (WebCore::CookieManager::setCookies):
        (WebCore::CookieManager::checkAndTreatCookie):
        (WebCore::CookieManager::addCookieToMap):
        (WebCore::CookieManager::setPrivateMode):
        (WebCore):
        * platform/blackberry/CookieManager.h:
        * platform/blackberry/CookieMap.cpp:
        (WebCore::CookieMap::addOrReplaceCookie):
        (WebCore::CookieMap::removeCookie):
        * platform/blackberry/CookieMap.h:
        (CookieMap):

2012-05-23  Zan Dobersek  <zandobersek@gmail.com>

        [Gtk] EventSender should properly handle (left|right)(control|shift|alt) after r118001
        https://bugs.webkit.org/show_bug.cgi?id=87221

        Reviewed by Martin Robinson.

        No new tests - covered by fast/events/keydown-leftright-keys.html.

        Windows key code for shift, control and alt keys should respect the
        left or right position of that key. This way the DOM location code of
        a key event is properly determined for these keys.

        * platform/gtk/PlatformKeyboardEventGtk.cpp:
        (WebCore::PlatformKeyboardEvent::windowsKeyCodeForGdkKeyCode):

2012-05-23  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: eliminate getters from HeapSnapshot.js
        https://bugs.webkit.org/show_bug.cgi?id=87241

        getters can't be inlined by engine at the moment.
        I found that conversion getters into functions gives us about 600 ms

        RESULT heap-snapshot: switch-to-containment-view= 1920 ms
        vs
        RESULT heap-snapshot: switch-to-containment-view= 1367 ms

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotEdge.prototype.hasStringName):
        (WebInspector.HeapSnapshotEdge.prototype.isElement):
        (WebInspector.HeapSnapshotEdge.prototype.isHidden):
        (WebInspector.HeapSnapshotEdge.prototype.isWeak):
        (WebInspector.HeapSnapshotEdge.prototype.isInternal):
        (WebInspector.HeapSnapshotEdge.prototype.isInvisible):
        (WebInspector.HeapSnapshotEdge.prototype.isShortcut):
        (WebInspector.HeapSnapshotEdge.prototype.name):
        (WebInspector.HeapSnapshotEdge.prototype.node):
        (WebInspector.HeapSnapshotEdge.prototype.nodeIndex):
        (WebInspector.HeapSnapshotEdge.prototype.rawEdges):
        (WebInspector.HeapSnapshotEdge.prototype.toString):
        (WebInspector.HeapSnapshotEdge.prototype.type):
        (WebInspector.HeapSnapshotEdge.prototype._hasStringName):
        (WebInspector.HeapSnapshotEdge.prototype._name):
        (WebInspector.HeapSnapshotEdge.prototype._nameOrIndex):
        (WebInspector.HeapSnapshotEdgeIterator.prototype.index):
        (WebInspector.HeapSnapshotEdgeIterator.prototype.setIndex):
        (WebInspector.HeapSnapshotEdgeIterator.prototype.item):
        (WebInspector.HeapSnapshotRetainerEdge):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.clone):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.hasStringName):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.isElement):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.isHidden):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.isInternal):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.isInvisible):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.isShortcut):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.isWeak):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.name):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.node):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.nodeIndex):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.retainerIndex):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.setRetainerIndex):
        (WebInspector.HeapSnapshotRetainerEdge.prototype._node):
        (WebInspector.HeapSnapshotRetainerEdge.prototype._edge):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.toString):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.type):
        (WebInspector.HeapSnapshotRetainerEdgeIterator.prototype.first):
        (WebInspector.HeapSnapshotRetainerEdgeIterator.prototype.hasNext):
        (WebInspector.HeapSnapshotRetainerEdgeIterator.prototype.index):
        (WebInspector.HeapSnapshotRetainerEdgeIterator.prototype.setIndex):
        (WebInspector.HeapSnapshotRetainerEdgeIterator.prototype.item):
        (WebInspector.HeapSnapshotRetainerEdgeIterator.prototype.next):
        (WebInspector.HeapSnapshotNode.prototype.canBeQueried):
        (WebInspector.HeapSnapshotNode.prototype.distanceToWindow):
        (WebInspector.HeapSnapshotNode.prototype.className):
        (WebInspector.HeapSnapshotNode.prototype.dominatorIndex):
        (WebInspector.HeapSnapshotNode.prototype.edges):
        (WebInspector.HeapSnapshotNode.prototype.edgesCount):
        (WebInspector.HeapSnapshotNode.prototype.flags):
        (WebInspector.HeapSnapshotNode.prototype.id):
        (WebInspector.HeapSnapshotNode.prototype.isHidden):
        (WebInspector.HeapSnapshotNode.prototype.isNative):
        (WebInspector.HeapSnapshotNode.prototype.isSynthetic):
        (WebInspector.HeapSnapshotNode.prototype.isWindow):
        (WebInspector.HeapSnapshotNode.prototype.isDetachedDOMTreesRoot):
        (WebInspector.HeapSnapshotNode.prototype.isDetachedDOMTree):
        (WebInspector.HeapSnapshotNode.prototype.isRoot):
        (WebInspector.HeapSnapshotNode.prototype.name):
        (WebInspector.HeapSnapshotNode.prototype.rawEdges):
        (WebInspector.HeapSnapshotNode.prototype.retainedSize):
        (WebInspector.HeapSnapshotNode.prototype.retainers):
        (WebInspector.HeapSnapshotNode.prototype.selfSize):
        (WebInspector.HeapSnapshotNode.prototype.type):
        (WebInspector.HeapSnapshotNode.prototype._name):
        (WebInspector.HeapSnapshotNode.prototype._edgeIndexesEnd):
        (WebInspector.HeapSnapshotNode.prototype._nextNodeIndex):
        (WebInspector.HeapSnapshotNode.prototype._type):
        (WebInspector.HeapSnapshotNodeIterator):
        (WebInspector.HeapSnapshotNodeIterator.prototype.hasNext):
        (WebInspector.HeapSnapshotNodeIterator.prototype.index):
        (WebInspector.HeapSnapshotNodeIterator.prototype.setIndex):
        (WebInspector.HeapSnapshotNodeIterator.prototype.item):
        (WebInspector.HeapSnapshotNodeIterator.prototype.next):
        (WebInspector.HeapSnapshot.prototype._allNodes):
        (WebInspector.HeapSnapshot.prototype.rootNode):
        (WebInspector.HeapSnapshot.prototype.get totalSize):
        (WebInspector.HeapSnapshot.prototype._dominatedNodesOfNode):
        (WebInspector.HeapSnapshot.prototype.aggregatesForDiff):
        (WebInspector.HeapSnapshot.prototype._calculateObjectToWindowDistance):
        (WebInspector.HeapSnapshot.prototype._buildAggregates):
        (WebInspector.HeapSnapshot.prototype._calculateClassesRetainedSize):
        (WebInspector.HeapSnapshot.prototype._sortAggregateIndexes):
        (WebInspector.HeapSnapshot.prototype._markInvisibleEdges):
        (WebInspector.HeapSnapshot.prototype._markDetachedDOMTreeNodes):
        (WebInspector.HeapSnapshot.prototype._markQueriableHeapObjects):
        (WebInspector.HeapSnapshot.prototype._calculateDiffForClass):
        (WebInspector.HeapSnapshot.prototype._nodeForSnapshotObjectId):
        (WebInspector.HeapSnapshot.prototype.nodeClassName):
        (WebInspector.HeapSnapshot.prototype.dominatorIdsForNode):
        (WebInspector.HeapSnapshot.prototype.createEdgesProvider):
        (WebInspector.HeapSnapshot.prototype.createRetainingEdgesProvider):
        (WebInspector.HeapSnapshotFilteredOrderedIterator.prototype._createIterationOrder):
        (WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.isEmpty):
        (WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.item):
        (WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.serializeItemsRange):
        (WebInspector.HeapSnapshotEdgesProvider.prototype.serializeItem):
        (WebInspector.HeapSnapshotEdgesProvider.prototype.sort.compareEdgeFieldName):
        (WebInspector.HeapSnapshotEdgesProvider.prototype.sort.compareNodeField):
        (WebInspector.HeapSnapshotNodesProvider):
        (WebInspector.HeapSnapshotNodesProvider.prototype.nodePosition):
        (WebInspector.HeapSnapshotNodesProvider.prototype.serializeItem):
        (WebInspector.HeapSnapshotNodesProvider.prototype.sort.sortByNodeField):
        * inspector/front-end/HeapSnapshotGridNodes.js:
        * inspector/front-end/HeapSnapshotProxy.js:
        (WebInspector.HeapSnapshotProviderProxy.prototype.isEmpty):

2012-05-22  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: Debugger should correctly show catch scope
        https://bugs.webkit.org/show_bug.cgi?id=87197

        Reviewed by Vsevolod Vlasov.

        * bindings/v8/DebuggerScript.js: In case of Catch scope the scope object
        is a synthetic one which means that it contains all standard object properties.
        When passing this object further we need to leave only properties available in
        the catch block(only variable thar stores the exception in fact).

2012-05-23  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        [Qt] FloatSize Qt Support
        https://bugs.webkit.org/show_bug.cgi?id=87237

        Reviewed by Andreas Kling.

        No new functionality. No new tests.

        * Target.pri:
        * platform/graphics/FloatSize.h:
        (FloatSize):
        * platform/graphics/qt/FloatSizeQt.cpp: Added.
        (WebCore::FloatSize::FloatSize):
        (WebCore::FloatSize::operator QSizeF):

2012-05-23  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Enable HeapSnapshotRealWorker in production mode.
        https://bugs.webkit.org/show_bug.cgi?id=87240

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshotProxy.js:
        (WebInspector.HeapSnapshotWorker):

2012-05-23  'Pavel Feldman'  <pfeldman@chromium.org>

        Not reviewed: inspector's Find is not consuming event as of r117974.

        * inspector/front-end/AdvancedSearchController.js:
        (WebInspector.AdvancedSearchController.prototype.handleShortcut):
        * inspector/front-end/SearchController.js:
        (WebInspector.SearchController.prototype.handleShortcut):

2012-05-23  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: enable drag-an-drop from the navigator panel.
        https://bugs.webkit.org/show_bug.cgi?id=87238

        Reviewed by Vsevolod Vlasov.

        Making tree item draggable.

        * inspector/front-end/NavigatorView.js:
        (WebInspector.NavigatorSourceTreeElement.prototype.onattach):
        (WebInspector.NavigatorSourceTreeElement.prototype._onmousedown.callback):
        (WebInspector.NavigatorSourceTreeElement.prototype._onmousedown):
        (WebInspector.NavigatorSourceTreeElement.prototype._ondragstart):

2012-05-23  Ryosuke Niwa  <rniwa@webkit.org>

        WebKit spends ~20% of time in HTMLTextAreaElement::defaultValue() when opening a review page
        https://bugs.webkit.org/show_bug.cgi?id=86813

        Reviewed by Eric Seidel.

        Replace String and calls to String::operator+= by StringBuilder and calls to append respectively.
        While there are other optimizations we can implement such as not replacing all nodes in the shadow DOM,
        or not serializing the value when detecting whether the value had changed, they require considerable
        amount of refactoring and this change alone seems to buy us a lot so let us defer those 'til later time.

        Also avoid the redundant call to setValue in childrenChanged when the value is dirty.
        This should halve the time we spend in setting the value.

        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::childrenChanged):
        (WebCore::HTMLTextAreaElement::defaultValue):

2012-05-23  Alice Boxhall  <aboxhall@chromium.org>

        AX: Contenteditable tables should always be exposed as data tables
        https://bugs.webkit.org/show_bug.cgi?id=87052

        Reviewed by Chris Fleizach.

        Tested in accessibility/table-detection.html.

        * accessibility/AccessibilityTable.cpp:
        (WebCore::AccessibilityTable::isDataTable): Return true if the node is contenteditable.

2012-05-23  Ryosuke Niwa  <rniwa@webkit.org>

        Fix a typo per Darin's comment.

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::constructBidiRuns):

2012-05-23  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to v8::Null() in custom bindings (Part 2)
        https://bugs.webkit.org/show_bug.cgi?id=87209

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to v8::Null() in custom bindings.

        No tests. No change in behavior.

        * bindings/v8/custom/V8HTMLElementCustom.cpp:
        (WebCore::toV8Object):
        (WebCore::toV8):
        * bindings/v8/custom/V8HistoryCustom.cpp:
        (WebCore::V8History::stateAccessorGetter):
        * bindings/v8/custom/V8IDBAnyCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8IDBKeyCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ImageDataCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Int16ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Int32ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Int8ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8LocationCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8MessageEventCustom.cpp:
        (WebCore::V8MessageEvent::dataAccessorGetter):
        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8NodeCustom.cpp:
        (WebCore::V8Node::insertBeforeCallback):
        (WebCore::V8Node::replaceChildCallback):
        (WebCore::V8Node::removeChildCallback):
        (WebCore::V8Node::appendChildCallback):
        (WebCore::toV8Slow):
        * bindings/v8/custom/V8PopStateEventCustom.cpp:
        (WebCore::V8PopStateEvent::stateAccessorGetter):
        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
        (WebCore::V8SQLResultSetRowList::itemCallback):
        * bindings/v8/custom/V8SVGDocumentCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8SVGElementCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8SVGPathSegCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ScriptProfileCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ScriptProfileNodeCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8StyleSheetCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8TrackEventCustom.cpp:
        (WebCore::V8TrackEvent::trackAccessorGetter):
        * bindings/v8/custom/V8Uint16ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Uint32ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Uint8ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Uint8ClampedArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
        (WebCore::toV8Object):
        (WebCore::V8WebGLRenderingContext::getAttachedShadersCallback):
        (WebCore::V8WebGLRenderingContext::getSupportedExtensionsCallback):
        * bindings/v8/custom/V8WorkerContextCustom.cpp:
        (WebCore::toV8):

2012-05-23  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to v8::Null() in custom bindings (Part 1)
        https://bugs.webkit.org/show_bug.cgi?id=87207

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to v8::Null() in custom bindings.

        Also this patch makes V8DeviceMotionEventCustom::createAccelerationObject()
        and V8DeviceMotionEventCustom::createRotationRateObject() static.

        No tests. No change in behavior.

        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8CSSRuleCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8CSSValueCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ClipboardCustom.cpp:
        (WebCore::V8Clipboard::typesAccessorGetter):
        * bindings/v8/custom/V8CoordinatesCustom.cpp:
        (WebCore::V8Coordinates::altitudeAccessorGetter):
        (WebCore::V8Coordinates::altitudeAccuracyAccessorGetter):
        (WebCore::V8Coordinates::headingAccessorGetter):
        (WebCore::V8Coordinates::speedAccessorGetter):
        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DOMTokenListCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DataViewCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DeviceMotionEventCustom.cpp:
        (WebCore::V8DeviceMotionEvent::accelerationAccessorGetter):
        (WebCore::V8DeviceMotionEvent::accelerationIncludingGravityAccessorGetter):
        (WebCore::V8DeviceMotionEvent::rotationRateAccessorGetter):
        (WebCore::V8DeviceMotionEvent::intervalAccessorGetter):
        * bindings/v8/custom/V8DeviceOrientationEventCustom.cpp:
        (WebCore::V8DeviceOrientationEvent::alphaAccessorGetter):
        (WebCore::V8DeviceOrientationEvent::betaAccessorGetter):
        (WebCore::V8DeviceOrientationEvent::gammaAccessorGetter):
        (WebCore::V8DeviceOrientationEvent::absoluteAccessorGetter):
        * bindings/v8/custom/V8DocumentCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
        (WebCore::V8Document::locationAccessorGetter):
        * bindings/v8/custom/V8EntryCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8EntrySyncCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8EventCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Float32ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Float64ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
        (WebCore::V8HTMLCanvasElement::getContextCallback):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::toV8):

2012-05-22  MORITA Hajime  <morrita@google.com>

        [Refactoring] ElementShadow::m_needsRedistributing  should be on ContentDistributor
        https://bugs.webkit.org/show_bug.cgi?id=87216

        Reviewed by Kentaro Hara.

        Moved ElementShadow::m_needsRedistributing to ContentDistributor::m_needsRedistributing

        No new tests. No behavior change.

        * dom/ElementShadow.cpp:
        (WebCore::ElementShadow::recalcStyle):
        (WebCore::ElementShadow::needsRedistributing):
        (WebCore::ElementShadow::setNeedsRedistributing):
        * dom/ElementShadow.h:
        (ElementShadow):
        * dom/ShadowRoot.h: Removed outdated declarations.
        * html/shadow/ContentDistributor.cpp:
        (WebCore::ContentDistributor::ContentDistributor):
        * html/shadow/ContentDistributor.h:
        (WebCore::ContentDistributor::needsRedistributing):
        (WebCore::ContentDistributor::setNeedsRedistributing):
        (WebCore::ContentDistributor::clearNeedsRedistributing):

2012-05-22  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to v8::Null() in CodeGeneratorV8.pm
        https://bugs.webkit.org/show_bug.cgi?id=87202

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to v8::Null() in CodeGeneratorV8.pm.

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrGetter):
        (GenerateFunctionCallback):
        (NativeToJSValue):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::contentDocumentAttrGetter):
        (WebCore::TestObjV8Internal::getSVGDocumentCallback):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::valueAttrGetter):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::readonlyValueAttrGetter):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedValueAttrGetter):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedReadonlyValueAttrGetter):

2012-05-22  Andreas Kling  <kling@webkit.org>

        Short-circuit Element::attrIfExists() when the Element has no Attr list.
        <http://webkit.org/b/87214>

        Reviewed by Ryosuke Niwa.

        This function was lukewarm on Dromaeo/dom-attr (0.4% of samples.)
        Added an early return if !hasAttrList() to avoid the function call overhead of
        ElementAttributeData::attrIfExists().

        * dom/Element.cpp:
        (WebCore::Element::attrIfExists):

2012-05-22  Hayato Ito  <hayato@chromium.org>

        Remove an assertion since an event's target might be a shadow root if a text node is clicked.
        https://bugs.webkit.org/show_bug.cgi?id=87072

        Reviewed by Dimitri Glazkov.

        Tests: fast/dom/shadow/shadow-dom-event-dispatching.html

        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::ComposedShadowTreeWalker::ComposedShadowTreeWalker):

2012-05-22  Dongwoo Im  <dw.im@samsung.com>

        [EFL] Implements the registerProtocolHandler method and option.
        https://bugs.webkit.org/show_bug.cgi?id=73638

        Reviewed by Andreas Kling.

        The registerProtocolHandler() method allows Web sites to register themselves
        as possible handlers for particular schemes.

        http://dev.w3.org/html5/spec/Overview.html#dom-navigator-registerprotocolhandler

        * CMakeLists.txt: Add page/NavigatorRegisterProtocolHandler.idl into WebCore_IDL_FILES.

2012-05-22  Kentaro Hara  <haraken@chromium.org>

        [V8][Performance] Pass Isolate to v8::Null() in V8Node::toV8()
        https://bugs.webkit.org/show_bug.cgi?id=87193

        Reviewed by Adam Barth.

        This patch improves the performance of Bindings/undefined-first-child.html by 58.7%,
        Bindings/undefined-get-element-by-id.html by 26.8%,
        Dromaeo/dom-query.html(getElementById (not in document)) by 9.8%,
        and Dromaeo/dom-query.html(getElementsByName (not in document)) by 2.1%.
        These benchmarks test the performance of accessing an undefined Node object.

        Performance test results in my Linux desktop:

        [Bindings/undefined-first-child.html]
          - without my patch
          RESULT Bindings: undefined-first-child= 481.843775891 runs/s
          median= 474.934036939 runs/s, stdev= 17.7753278263 runs/s, min= 471.204188482 runs/s, max= 534.629404617 runs/s

          - with my patch
          RESULT Bindings: undefined-first-child= 764.720531908 runs/s
          median= 803.515696424 runs/s, stdev= 54.7402312963 runs/s, min= 688.806888069 runs/s, max= 807.061790668 runs/s

        [Bindings/undefined-get-element-by-id.html]
          - without my patch
          RESULT Bindings: undefined-get-element-by-id= 236.642705579 runs/s
          median= 234.527786832 runs/s, stdev= 5.77090297761 runs/s, min= 231.362467866 runs/s, max= 246.305418719 runs/s

          - with my patch
          RESULT Bindings: undefined-get-element-by-id= 300.031032067 runs/s
          median= 303.797468354 runs/s, stdev= 6.99060409266 runs/s, min= 287.581699346 runs/s, max= 304.955527319 runs/s

        [Dromaeo/dom-query.html(getElementById (not in document))]
          - without my patch
          2855.80runs/s ±0.30%

          - with my patch
          3136.20runs/s ±0.22%

        [Dromaeo/dom-query.html(getElementsByName (not in document))]
          - without my patch
          2198.00runs/s ±0.50%

          - with my patch
          2243.40runs/s ±3.39%

        Currently v8::Null() looks up Isolate, which is a bottleneck of
        V8Node::toV8() for undefined Nodes. This patch removes the Isolate
        look-up by passing Isolate to v8::Null(), like v8::Null(isolate).

        * bindings/scripts/CodeGeneratorV8.pm: Modified as described above.
        (GenerateHeader):

        * bindings/scripts/test/V8/V8TestActiveDOMObject.h: Updated run-bindings-tests results.
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestEventConstructor.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestEventTarget.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestException.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestInterface.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestNode.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestObj.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
        (WebCore::toV8):

2012-05-22  MORITA Hajime  <morrita@google.com>

        REGRESSION(r116629) tests for <style scoped> is crashing
        https://bugs.webkit.org/show_bug.cgi?id=87191

        Reviewed by Kent Tamura.

        unregisterWithScopingNode() and registerWithScopingNode() doesn't follow
        refactoring around removedFrom(), insertedInto() and willRemove().
        This change aligns them to such recent changes.

        No new tests. Covered by existing tests.

        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::unregisterWithScopingNode)
        (WebCore::HTMLStyleElement::insertedInto):
        - Allowed registerWithScopingNode() only for in-document traversal.
          That is how it originally did.
        (WebCore::HTMLStyleElement::removedFrom):
        - Gave ex-parent to unregisterWithScopingNode().
        * html/HTMLStyleElement.h:
        (WebCore::HTMLStyleElement::unregisterWithScopingNode):
        (HTMLStyleElement):

2012-05-21  Shawn Singh  <shawnsingh@chromium.org>

        Improve W3C conformance of backface-visibility
        https://bugs.webkit.org/show_bug.cgi?id=84195

        Reviewed by Adrienne Walker.

        Tests: compositing/backface-visibility/backface-visibility-3d.html
               compositing/backface-visibility/backface-visibility-hierarchical-transform.html
               compositing/backface-visibility/backface-visibility-non3d.html
               compositing/backface-visibility/backface-visibility-simple.html

        Unit Tests: CCLayerTreeHostCommonTest::verifyBackFaceCullingWithoutPreserves3d
                    CCLayerTreeHostCommonTest::verifyBackFaceCullingWithPreserves3d

        Also updated a few other layout and unit tests.

        This patch updates chromium to conform to the W3C spec on CSS
        transforms, Section 12 about backface visibility. This patch also
        updates layout tests to reflect the latest W3C spec. In
        particular, rule #1 on section 12, http://dev.w3.org/csswg/css3-transforms/#backface-visibility-property
        states which transforms should be used to determine backface-visibility.

        Because chromium has an additional quirk of the concept of render
        surfaces, unit tests needed to be updated as well.

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::layerIsRootOfNewRenderingContext):
        (WebCore):
        (WebCore::isLayerBackFaceVisible):
        (WebCore::isSurfaceBackFaceVisible):
        (WebCore::calculateVisibleLayerRect):
        (WebCore::layerShouldBeSkipped):
        (WebCore::calculateDrawTransformsAndVisibilityInternal):

2012-05-22  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118095.
        http://trac.webkit.org/changeset/118095
        https://bugs.webkit.org/show_bug.cgi?id=87201

        "Causing crashes on Mac in
        WebCore::StyleResolver::adjustRenderStyle (Requested by
        sundiamonde on #webkit).

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (Settings):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::InternalSettings):
        (WebCore::InternalSettings::restoreTo):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-05-22  Levi Weintraub  <leviw@chromium.org>

        NULL ptr in WebCore::RenderBlock::layoutRunsAndFloatsInRange
        https://bugs.webkit.org/show_bug.cgi?id=77786

        Reviewed by Ryosuke Niwa.

        InlineBidiResolver adds one fake TextRun for isolated inlines in the process of creating the
        list of TextRuns to send to the UBA. After the UBA has been run and the TextRuns reordered,
        we re-run InlineBidiResolver rooted in the isolate and replace the fake run with those
        generated by the subsequent pass by calling the method BidiRunList::replaceRunWithRuns.
        This method assumes there are runs to replace the fake run with.

        Positioned inline children are ignored when creating TextRuns, so when an isolated inline
        has only positioned children we end up with an empty set of runs to pass to replaceRunWithRuns.
        Ideally, we'd remove the fake run and not replace it with anything, but BidiRunList keeps
        a pointer to the logically last run, which we're unable to easily re-determine after the UBA
        has been run. Instead, we leave the fake run in the list and simply avoid calling
        replaceRunWithRuns when we don't have any replacement runs.

        Test: fast/block/line-layout/crash-in-isolate-with-positioned-child.html

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::constructBidiRuns):

2012-05-22  Kent Tamura  <tkent@chromium.org>

        [V8] Refactor generation code for non-standard functions
        https://bugs.webkit.org/show_bug.cgi?id=87185

        Reviewed by Kentaro Hara.

        No behavior change. Just a refactoring.

        * bindings/scripts/CodeGeneratorV8.pm:
        (IsStandardFunction): Introduce a new function to check if a
        function can be in a batch registration.
        (GenerateNonStandardFunction): Factor out a code to generate
        non-standard functions.
        (GenerateImplementation):
        Use IsStandardFunction and GenerateNonStandardFunction.

2012-05-22  Hayato Ito  <hayato@chromium.org>

        Make ComposedShadowTreeWalker traverse inactive insertion points correctly.
        https://bugs.webkit.org/show_bug.cgi?id=86830

        Reviewed by Dimitri Glazkov.

        Fixed InsertionPoint::isActive() issue, which may return true
        wrongly even if the insertion point is not in Shadow DOM subtree.
        Now ComposedShadowTreeWalker can traverse inactive insertion
        points correctly using InsertionPoint::isActive().

        Test: fast/dom/shadow/composed-shadow-tree-walker.html

        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::ComposedShadowTreeWalker::traverseNode):
        (WebCore::ComposedShadowTreeWalker::escapeFallbackContentElement):
        (WebCore::ComposedShadowTreeWalker::traverseNodeEscapingFallbackContents):
        * html/shadow/InsertionPoint.cpp:
        (WebCore::InsertionPoint::isActive):
        * html/shadow/InsertionPoint.h:
        (WebCore::isActiveInsertionPoint):
        (WebCore):

2012-05-22  Mark Pilgrim  <pilgrim@chromium.org>

        [Chromium] Call canAccelerate2dCanvas directly
        https://bugs.webkit.org/show_bug.cgi?id=86893

        Reviewed by James Robinson.

        Part of a refactoring series. See tracking bug 82948.

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::shouldAccelerate):
        * platform/chromium/PlatformSupport.h:

2012-05-22  Jason Liu  <jason.liu@torchmobile.com.cn>

        [BlackBerry] Possible to clobber httponly cookie.
        https://bugs.webkit.org/show_bug.cgi?id=86067

        Reviewed by Rob Buis.

        If a cookie is set by javaScript and there is already a same httpOnly cookie in cookieManager,
        we should reject it. If it has a httpOnly property, we reject it, too.

        Test: http/tests/cookies/js-get-and-set-http-only-cookie.php

        * platform/blackberry/CookieJarBlackBerry.cpp:
        (WebCore::setCookies):
        * platform/blackberry/CookieManager.cpp:
        (WebCore::CookieManager::setCookies):
        (WebCore::CookieManager::shouldRejectNotHttpCookie):
        (WebCore):
        * platform/blackberry/CookieManager.h:

2012-05-22  Dana Jansens  <danakj@chromium.org>

        [chromium] Don't drop children of a RenderSurface from the renderSurfaceLayerList when then position of the surface in its clipRect is not known
        https://bugs.webkit.org/show_bug.cgi?id=87181

        Reviewed by Adrienne Walker.

        We want to avoid dropping things from the renderSurfaceLayerList on main
        thread when they may be in the renderSurfaceLayerList on impl thread due
        to animation. A render surface would drop all its children if its
        contentRect was clipped to become empty by its parent. But when the
        surface is being animated, then we can't be sure how its parent will
        clip the surface's content, so we don't clip it at all.

        Chromium bug: http://crbug.com/128739

        Unit test: CCLayerTreeHostCommonTest.verifyClipRectCullsSurfaceWithoutVisibleContent

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateDrawTransformsAndVisibilityInternal):

2012-05-22  Kangil Han  <kangil.han@samsung.com>

        [EFL][DRT] Implement touch event
        https://bugs.webkit.org/show_bug.cgi?id=86720

        Reviewed by Hajime Morita.

        Currently EFL DRT doesn't support touch event.
        Therefore, this patch enabled it and implemented some eventSender function callbacks.

        * platform/PlatformTouchEvent.h:
        (PlatformTouchEvent): Implement meta state.
        * platform/efl/PlatformTouchEventEfl.cpp:
        (WebCore::PlatformTouchEvent::PlatformTouchEvent): Implement meta state.

2012-05-22  Chris Rogers  <crogers@google.com>

        AudioNodeOutput::disconnectAllParams() must take care when iterating through its parameter list
        https://bugs.webkit.org/show_bug.cgi?id=87190

        Reviewed by Kenneth Russell.

        No new tests. Covered by existing tests.

        * Modules/webaudio/AudioNodeOutput.cpp:
        (WebCore::AudioNodeOutput::disconnectAllParams):

2012-05-22  MORITA Hajime  <morrita@google.com>

        <shadow> and <content> should be hidden behind ContextEnabledFeatures
        https://bugs.webkit.org/show_bug.cgi?id=87063

        This change repalces "runtimeConditional" tag definition property
        with new "contextConditional" property, which refers
        ContextEnabledFeatures instead of RuntimeEnabledFeatures.

        Reviewed by Dimitri Glazkov.

        No new tests. DRT cannot test this. No behaviour change on DRT.

        * dom/make_names.pl:
        (defaultTagPropertyHash):
        (printConstructorInterior):
        (printFactoryCppFile):
        (printWrapperFunctions):
        (printWrapperFactoryCppFile):
        * html/HTMLTagNames.in:

2012-05-22  Kent Tamura  <tkent@chromium.org>

        Fix a crash in HTMLFormControlElement::disabled().
        https://bugs.webkit.org/show_bug.cgi?id=86534

        Reviewed by Hajime Morita.

        Node::removedFrom() was not called in some cases. This patch fixes it.

        No new tests. It's almost impossible to make a reliable test.

        * dom/ContainerNodeAlgorithms.h:
        Remove inDocument() check so that Node::removedFrom() is called even if
        a parent node in an orphan tree is deleted but a child node remains,

2012-05-22  James Robinson  <jamesr@chromium.org>

        Add a Setting to make position:fixed form a new stacking context
        https://bugs.webkit.org/show_bug.cgi?id=87186

        Reviewed by Adam Barth.

        position:fixed elements form a new stacking context in several mobile WebKit ports and in the Qt port always. To
        be consistent across devices, we want to try turning it on everywhere. This will likely cause compatibility
        issues, so we need a runtime setting in order to stage the change carefully.

        Tests: fast/block/positioning/fixed-position-stacking-context.html
               fast/block/positioning/fixed-position-stacking-context2.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (WebCore::Settings::setFixedPositionCreatesStackingContext):
        (WebCore::Settings::fixedPositionCreatesStackingContext):
        (Settings):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::InternalSettings):
        (WebCore::InternalSettings::restoreTo):
        (WebCore::InternalSettings::setFixedPositionCreatesStackingContext):
        (WebCore):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-05-22  Adam Barth  <abarth@webkit.org>

        RenderInline::absoluteRects does some incorrect layout math
        https://bugs.webkit.org/show_bug.cgi?id=87036

        Reviewed by Eric Seidel.

        http://trac.webkit.org/changeset/88297/trunk/Source/WebCore/rendering/RenderInline.cpp
        contained a typo.  We should accumulate offsets, not add sizes to
        offsets.

        Test: fast/inline/boundingBox-with-continuation.html

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::absoluteRects):
        (WebCore):

2012-05-22  Dana Jansens  <danakj@chromium.org>

        [chromium] Don't force the visibleLayerRect to be empty for animating layers whose front face is not visible
        https://bugs.webkit.org/show_bug.cgi?id=86886

        Reviewed by Adrienne Walker.

        Previously we would force the visibleLayerRect to be empty for these
        animating layers, and then special case the pre-painting code to
        paint them if they were within some size limit, to avoid having the
        layer steal too much memory.

        Instead, just use the visibleLayerRect given to the layer. Since the
        transform flips the layer such that its back face is visible, it will
        also compute a visibleLayerRect in the front face of the layer, and
        its size will be bounded by the viewport. This will cause the
        layer to be painted with visible priority instead of prepainted, but
        ensures the visible parts of the layer is painted and ready to go when
        the animation flips the layer around.

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateVisibleLayerRect):

2012-05-22  Jer Noble  <jer.noble@apple.com>

        REGRESSION (r98359): Video does not render on http://panic.com/dietcoda/
        https://bugs.webkit.org/show_bug.cgi?id=87171

        Reviewed by Maciej Stachowiak.

        No new tests; behavior is very timing specific and only occurs on a subset of all platforms.

        Instead of calling prepareForRendering() from metadataLoaded(), which may fail and cause subsequent
        calls to prepareForRendering() to short circuit, call createVideoLayer() directly, which achieves
        the original goals of the fix for http://webkit.org/b/70448, but without breaking subsequent calls
        to prepareForRendering() if called at the wrong time.

        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::metadataLoaded):

2012-05-22  Tim Horton  <timothy_horton@apple.com>

        Add a quirk for applications that depend on the relative ordering of progressCompleted/didFinishLoad
        https://bugs.webkit.org/show_bug.cgi?id=87178
        <rdar://problem/11468434>

        Reviewed by Maciej Stachowiak.

        Some applications depend on the relative ordering of progressCompleted/didFinishLoad, which was changed
        to be more correct in http://trac.webkit.org/changeset/94105. For applications built before 94105, we can
        provide the old behavior. For the time being, this will only apply to Mail.app.

        No new tests, will not affect behavior for any application except Mail.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (WebCore::Settings::setNeedsDidFinishLoadOrderQuirk):
        (WebCore::Settings::needsDidFinishLoadOrderQuirk):

2012-05-22  Alexis Menard  <alexis.menard@openbossa.org>

        Move some CSS regions properties to CSSParser::isValidKeywordPropertyAndValue.
        https://bugs.webkit.org/show_bug.cgi?id=87169

        Reviewed by Tony Chang.

        Move some CSS regions properties to the fast path implemented by
        CSSParser::isValidKeywordPropertyAndValue.

        No new tests : Existing tests should cover.

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue):

2012-05-22  Emil A Eklund  <eae@chromium.org>

        Represents margins as box and simplify writing mode logic
        https://bugs.webkit.org/show_bug.cgi?id=86952

        Reviewed by Eric Seidel.
        
        Add a new class, FractionalLayoutBox, that represents the four sides of a
        box and change RenderBox to use it to represent margins.

        The new box class is intended to be used to represent things like
        margins, paddings and borders where the current rect class isn't a good
        fit. It also encapsulated a lot of the horizontal/vertical writing mode
        and bidi logic allowing it to be reused.

        No new tests, no change in functionality.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/FractionalLayoutBoxExtent.cpp: Added.
        * platform/graphics/FractionalLayoutBoxExtent.h: Added.
        * rendering/LayoutTypes.h:
        * rendering/RenderBlock.cpp:
        * rendering/RenderBox.cpp:
        * rendering/RenderBox.h:
        * rendering/RenderScrollbarPart.cpp:
        * rendering/RenderScrollbarPart.h:

2012-05-22  Kentaro Hara  <haraken@chromium.org>

        [V8] Replace 'throwTypeError(); return Undefined();' with 'return throwTypeError();'
        https://bugs.webkit.org/show_bug.cgi?id=87106

        Reviewed by Adam Barth.

        This patch replaces

            throwTypeError();
            return v8::Undefined();

        with

            return throwTypeError();

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateOverloadedFunctionCallback):
        (GenerateParametersCheck):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::overloadedMethodCallback):
        (WebCore::TestObjV8Internal::overloadedMethod1Callback):

2012-05-22  Dan Bernstein  <mitz@apple.com>

        REGRESSION (r105513): CSS max-width is not applied to SVG element
        https://bugs.webkit.org/show_bug.cgi?id=87050

        Reviewed by Darin Adler.

        Tests: svg/css/max-height.html
               svg/css/max-width.html

        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth): Changed to also call into the base
        class implementation of this function if max-width was specified.
        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight): Changed to call into the bas class
        implementation of this function if either height or max-height were specified.

2012-05-22  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to throwTypeError()
        https://bugs.webkit.org/show_bug.cgi?id=87111

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to throwTypeError() in custom bindings.

        No tests. No change in behavior.

        * bindings/v8/custom/V8ArrayBufferCustom.cpp:
        (WebCore::V8ArrayBuffer::constructorCallback):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore::constructWebGLArrayWithArrayBufferArgument):
        (WebCore::constructWebGLArray):
        * bindings/v8/custom/V8AudioBufferSourceNodeCustom.cpp:
        (WebCore::V8AudioBufferSourceNode::bufferAccessorSetter):
        * bindings/v8/custom/V8AudioContextCustom.cpp:
        (WebCore::V8AudioContext::constructorCallback):
        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::V8Blob::constructorCallback):
        * bindings/v8/custom/V8ClipboardCustom.cpp:
        (WebCore::V8Clipboard::setDragImageCallback):
        * bindings/v8/custom/V8DOMFormDataCustom.cpp:
        (WebCore::V8DOMFormData::constructorCallback):
        * bindings/v8/custom/V8DataViewCustom.cpp:
        (WebCore::V8DataView::constructorCallback):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::V8HTMLDocument::openCallback):
        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
        (WebCore::v8HTMLImageElementConstructorCallback):
        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
        (WebCore::V8HTMLInputElement::selectionStartAccessorGetter):
        (WebCore::V8HTMLInputElement::selectionStartAccessorSetter):
        (WebCore::V8HTMLInputElement::selectionEndAccessorGetter):
        (WebCore::V8HTMLInputElement::selectionEndAccessorSetter):
        (WebCore::V8HTMLInputElement::selectionDirectionAccessorGetter):
        (WebCore::V8HTMLInputElement::selectionDirectionAccessorSetter):
        (WebCore::V8HTMLInputElement::setSelectionRangeCallback):
        * bindings/v8/custom/V8HTMLMediaElementCustom.cpp:
        (WebCore::V8HTMLMediaElement::controllerAccessorSetter):
        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
        (WebCore::V8InjectedScriptHost::inspectedObjectCallback):
        * bindings/v8/custom/V8IntentConstructor.cpp:
        (WebCore::V8Intent::constructorCallback):
        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
        (WebCore::V8MessageChannel::constructorCallback):
        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
        (WebCore::V8NotificationCenter::requestPermissionCallback):
        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
        (WebCore::V8SQLResultSetRowList::itemCallback):
        * bindings/v8/custom/V8WebKitMutationObserverCustom.cpp:
        (WebCore::V8WebKitMutationObserver::constructorCallback):
        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
        (WebCore::V8WebKitPoint::constructorCallback):
        * bindings/v8/custom/V8WebSocketCustom.cpp:
        (WebCore::V8WebSocket::constructorCallback):
        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
        (WebCore::V8XMLHttpRequest::constructorCallback):

2012-05-22  Kentaro Hara  <haraken@chromium.org>

        [V8] Replace 'setDOMException(); return Undefined();' with 'return setDOMException();'
        https://bugs.webkit.org/show_bug.cgi?id=87102

        Reviewed by Adam Barth.

        This patch replaces

            setDOMException();
            return v8::Undefined();

        with

            return setDOMException();

        In addition, just in case, this patch replaces

            if (...)
                setDOMException();
            return v8::Undefined();

        with

            if (...)
                return setDOMException();
            return v8::Undefined();

        because people might insert some code just above
        'return v8::Undefined()' in the future.

        No tests. No change in behavior.

        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore::constructWebGLArrayWithArrayBufferArgument):
        (WebCore::setWebGLArrayHelper):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::WindowSetTimeoutImpl):
        * bindings/v8/custom/V8DataViewCustom.cpp:
        (WebCore::V8DataView::getInt8Callback):
        (WebCore::V8DataView::getUint8Callback):
        (WebCore::V8DataView::setInt8Callback):
        (WebCore::V8DataView::setUint8Callback):
        * bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp:
        (WebCore::V8DirectoryEntrySync::getDirectoryCallback):
        (WebCore::V8DirectoryEntrySync::getFileCallback):
        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
        (WebCore::V8HTMLOptionsCollection::addCallback):
        * bindings/v8/custom/V8NodeCustom.cpp:
        (WebCore::V8Node::insertBeforeCallback):
        (WebCore::V8Node::replaceChildCallback):
        (WebCore::V8Node::removeChildCallback):
        (WebCore::V8Node::appendChildCallback):
        * bindings/v8/custom/V8SVGLengthCustom.cpp:
        (WebCore::V8SVGLength::valueAccessorGetter):
        (WebCore::V8SVGLength::convertToSpecifiedUnitsCallback):
        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
        (WebCore::getObjectParameter):
        (WebCore::V8WebGLRenderingContext::getFramebufferAttachmentParameterCallback):
        (WebCore::V8WebGLRenderingContext::getParameterCallback):
        (WebCore::V8WebGLRenderingContext::getProgramParameterCallback):
        (WebCore::V8WebGLRenderingContext::getShaderParameterCallback):
        (WebCore::V8WebGLRenderingContext::getUniformCallback):
        (WebCore::vertexAttribAndUniformHelperf):
        (WebCore::uniformHelperi):
        (WebCore::uniformMatrixHelper):
        * bindings/v8/custom/V8WebKitMutationObserverCustom.cpp:
        (WebCore::V8WebKitMutationObserver::observeCallback):
        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
        (WebCore::V8XMLHttpRequest::responseAccessorGetter):

2012-05-22  Martin Robinson  <mrobinson@igalia.com>

        [TextureMapper] [Cairo] Implement repaint counters
        https://bugs.webkit.org/show_bug.cgi?id=87062

        Reviewed by Gustavo Noronha Silva.

        No new tests. This just adds a debugging feature that shouldn't
        affect the normal drawing of a page.

        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::updateBackingStore): Now, if repaint counters are
        enabled, increment the repaint count and call drawRepaintCounter.
        (WebCore::TextureMapperLayer::drawRepaintCounter): Added.
        * platform/graphics/texmap/TextureMapperLayer.h:
        (TextureMapperLayer): Added declaration for drawRepaintCounter.

2012-05-22  Simon Fraser  <simon.fraser@apple.com>

        Use the same animation begin time while updating compositing layers
        https://bugs.webkit.org/show_bug.cgi?id=87080

        Reviewed by Dean Jackson.
        
        Tidied up some beginAnimationUpdate/endAnimationUpdate logic,
        but further cleaning is required. We currently bracket some calls
        to recaclcStyle() with begin/endAnimationUpdate, but not all.
        We don't bracket layout, or compositing updates. This patch
        adds bracketing around compositing updates, in order to be
        able to add some assertions in a later patch that rely on
        RenderLayer::currentTransform() giving consistent results,
        since currentTransform() depends on the animation begin time.
        
        Made AnimationController::beginAnimationUpdate() and
        AnimationController::endAnimationUpdate() nestable by adding
        a counter.
        
        Added a stack-based class, AnimationUpdateBlock, which
        calls begin/endAnimationUpdate.
        
        Replaced calls to begin/endAnimationUpdate in Document::updateStyleIfNeeded()
        and Document::styleResolverChanged() with AnimationUpdateBlock. Filed a bug
        to cover other calls to recalcStyle which might need this (87159).
        
        Removed a call to beginAnimationUpdate() in Document::implicitOpen(),
        which was added in r42415. I believe that r57390 makes this unnecessary,
        and was not able to reproduce the original bug after removing it. It
        was the only unpaired beginAnimationUpdate call.
        
        Made AnimationControllerPrivate::getAnimatedStyleForRenderer() not 
        use a new beginTime each time it was called, so its beginTime now
        depends on some earlier beginAnimationUpdate.
        
        Fixed CSSComputedStyleDeclaration::getPropertyCSSValue() to use
        an AnimationUpdateBlock so that calls to computed style do
        use the current time to compute an animating value (as before).

        Not testable.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * dom/Document.cpp:
        (WebCore::Document::updateStyleIfNeeded):
        (WebCore::Document::implicitOpen):
        (WebCore::Document::styleResolverChanged):
        * page/animation/AnimationController.cpp:
        (WebCore::AnimationControllerPrivate::getAnimatedStyleForRenderer):
        (WebCore::AnimationController::AnimationController):
        (WebCore::AnimationController::beginAnimationUpdate):
        (WebCore::AnimationController::endAnimationUpdate):
        * page/animation/AnimationController.h:
        (AnimationController):
        (WebCore):
        (AnimationUpdateBlock):
        (WebCore::AnimationUpdateBlock::AnimationUpdateBlock):
        (WebCore::AnimationUpdateBlock::~AnimationUpdateBlock):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateCompositingLayers):

2012-05-22  Tony Chang  <tony@chromium.org>

        REGRESSION(r117613): Dromaeo/jslib-style-prototype regressed by 20%
        https://bugs.webkit.org/show_bug.cgi?id=87142

        Reviewed by Alexis Menard.

        Move CSSPropertyDisplay back into isValidKeywordPropertyAndValue.
        Pass in the parser context so we can check whether we're grid or not.

        No new tests. Covered by Dromaeo/jslib-style-prototype perf test.

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::parseKeywordValue):
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseFont):

== Rolled over to ChangeLog-2012-05-22 ==