GitLab

        Reviewed by Kent Tamura.

        2x execCommand ReadAV@NULL
        https://bugs.webkit.org/show_bug.cgi?id=35791

        This test passes if it doesn't crash.

        * editing/execCommand/35791-expected.txt: Added.
        * editing/execCommand/35791.html: Added.
2010-05-20  MORITA Hajime  <morrita@google.com>

        Reviewed by Kent Tamura.

        2x execCommand ReadAV@NULL
        https://bugs.webkit.org/show_bug.cgi?id=35791

        In applyBlockStyle(), a node which is referred from
        nextParagraphStart sometimes removed from the document and goes
        orphan, and that causes an assertion failed. This is because
        moveParagraphs() replaces the node with a new one with some new
        styles applied. So we re-compute nextParagraphStart in that case.

        Test: editing/execCommand/35791.html

        * dom/Position.h:
        (WebCore::Position::isOrphan):
        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::applyBlockStyle):
        * editing/VisiblePosition.h:
        (WebCore::VisiblePosition::isOrphan):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59828 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin Adler.

        Misleading variable name in a11y test
        https://bugs.webkit.org/show_bug.cgi?id=38465

        Use a more appropriate variable name for the return
        value of accessibilityController.rootElement

        * accessibility/aria-controls-with-tabs.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59818 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Unreviewed. Update Chromium test expectations.

        * platform/chromium-linux/fast/multicol/layers-split-across-columns-expected.checksum: Added.
        * platform/chromium-linux/fast/multicol/layers-split-across-columns-expected.png: Added.
        * platform/chromium-mac/fast/multicol/layers-in-multicol-expected.checksum:
        * platform/chromium-mac/fast/multicol/layers-in-multicol-expected.png: Removed.
        * platform/chromium-mac/fast/multicol/layers-split-across-columns-expected.checksum: Added.
        * platform/chromium-win/fast/multicol/layers-in-multicol-expected.txt:
        * platform/chromium-win/fast/multicol/layers-split-across-columns-expected.checksum: Added.
        * platform/chromium-win/fast/multicol/layers-split-across-columns-expected.png: Added.
        * platform/chromium-win/fast/multicol/layers-split-across-columns-expected.txt: Added.
        * platform/chromium-win/fast/multicol/nested-columns-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59799 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Geoffrey Garen.

        emitJumpIfNotJSCell should special case constant immediate values
        https://bugs.webkit.org/show_bug.cgi?id=39392
        <rdar://problem/8001324>

        Make emitJumpSlowCaseIfNotJSCell special case constant immediate
        values, in addition to the immediate JSCell optimisation.

        Also add assertions to make sure no one else produces code that
        attempts to load constants from the register file.

        * jit/JITInlineMethods.h:
        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
        * jit/JSInterfaceJIT.h:
        (JSC::JSInterfaceJIT::emitJumpIfNotJSCell):
        (JSC::JSInterfaceJIT::emitLoadInt32):
        (JSC::JSInterfaceJIT::tagFor):
        (JSC::JSInterfaceJIT::payloadFor):
        (JSC::JSInterfaceJIT::emitLoadDouble):
        (JSC::JSInterfaceJIT::addressFor):
        * jit/ThunkGenerators.cpp:
2010-05-19  Oliver Hunt  <oliver@apple.com>

        Reviewed by Geoffrey Garen.

        emitJumpIfNotJSCell should special case constant immediate values
        https://bugs.webkit.org/show_bug.cgi?id=39392

        Add tests for immediate constants being used where cells are expected.

        * fast/js/immediate-constant-instead-of-cell-expected.txt: Added.
        * fast/js/immediate-constant-instead-of-cell.html: Added.
        * fast/js/script-tests/immediate-constant-instead-of-cell.js: Added.
        ():

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59798 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=39131

Reviewed by Alexey Proskuryakov.

WebCore:

Changed FileReader::convertToText to call TextResourceDecoder::decode to
detect the encoding from BOM and decode the text. Though the File API
spec says that the supplied encoding should be used if it is valid, we
choose to ignore this requirement in order to be consistent with how
WebKit decodes the web content: always has the BOM override the provided
encoding.

* html/FileReader.cpp:
(WebCore::FileReader::convertToText):
* html/FileReader.h:

LayoutTests:

Add more test coverage for FileReader.

* fast/files/file-reader-expected.txt:
* fast/files/file-reader.html:
* fast/files/resources/binary-file: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59797 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=39388

Disabling geolocation tests until blockers are fixed.

* platform/gtk/Skipped: Skipping geolocation tests for now.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59796 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by David Hyatt.

        Check that the node is a text node before doing a static cast
        to a Text class pointer.
        https://bugs.webkit.org/show_bug.cgi?id=38626    

        Test: fast/text/text-transform-nontext-node-crash.xhtml

        * rendering/RenderText.cpp:
        (WebCore::RenderText::originalText):
        * rendering/RenderTextFragment.cpp:
        (WebCore::RenderTextFragment::originalText):
        (WebCore::RenderTextFragment::previousCharacter):
2010-05-19  Abhishek Arya  <inferno@chromium.org>

        Reviewed by David Hyatt.

        Tests that text transformation applied to a non-text node
        does not result in crash.
        https://bugs.webkit.org/show_bug.cgi?id=38626        

        * fast/text/text-transform-nontext-node-crash-expected.txt: Added.
        * fast/text/text-transform-nontext-node-crash.xhtml: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59795 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Not reviewed.

        Updated multi-column test baselines.

        * platform/gtk/fast/multicol/layers-in-multicol-expected.txt: Updated.
        * platform/gtk/fast/multicol/layers-split-across-columns-expected.txt: Added.
        * platform/gtk/fast/multicol/nested-columns-expected.txt: Updated.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59792 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Unreviewed, rolling out r59769.
        http://trac.webkit.org/changeset/59769
        https://bugs.webkit.org/show_bug.cgi?id=37815

        Broke GTK again

        * Android.jscbindings.mk:
        * CMakeLists.txt:
        * GNUmakefile.am:
        * WebCore.gypi:
        * WebCore.pro:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSCallbackData.cpp:
        (WebCore::JSCallbackData::invokeCallback):
        * bindings/js/JSEventListener.cpp:
        (WebCore::JSEventListener::handleEvent):
        * bindings/js/JSInjectedScriptHostCustom.cpp:
        (WebCore::InjectedScriptHost::createInjectedScript):
        * bindings/js/JSMainThreadExecState.cpp: Removed.
        * bindings/js/JSMainThreadExecState.h: Removed.
        * bindings/js/ScheduledAction.cpp:
        (WebCore::ScheduledAction::executeFunctionInContext):
        (WebCore::Sch...

        Try again to roll out r58765

        * fast/notifications/notifications-replace-expected.txt: Removed.
        * fast/notifications/notifications-replace.html: Removed.
        * fast/notifications/notifications-rtl-expected.txt: Removed.
        * fast/notifications/notifications-rtl.html: Removed.
2010-05-19  Dirk Pranke  <dpranke@chromium.org>

        Try again to roll out r58675.

        * notifications/Notification.h:
        * notifications/Notification.idl:
2010-05-19  Dirk Pranke  <dpranke@chromium.org>

        Try again to roll out r58765.

        * public/WebNotification.h:
        * src/WebNotification.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59787 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=39143
<rdar://problem/8003662>
        
Reviewed by Dave Hyatt.

The goal of r59385 was to make sure that the layout of block after all its children had been removed produced the identical result
as the one of a newly created empty block. In order to do so, we had to make sure that the m_inlineChildren flag was reset to true when
the block had no children (as it is upon creation).
I discovered that, by doing that for anonymous blocks it leads removeChild to conclude that the anonymous children can be removed,
without considering that the anonymous block could be part of a continuation chain. For this reason, when RenderInline::destroy()
tries to remove the continuations we are effectively deleting a renderer that had been deleted already.
        
Test: fast/inline-block/anonymous-block-crash.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::layoutBlock): resetting the flag m_inlineChildren only for non anonymous blocks otherwise we incurr in
a double deletion of the renderer that causes the crash.

LayoutTests: REGRESSION (r59385) crash destroying inline renderers
https://bugs.webkit.org/show_bug.cgi?id=39143
<rdar://problem/8003662>

Reviewed by Dave Hyatt.

* fast/inline-block/anonymous-block-crash-expected.txt: Added.
* fast/inline-block/anonymous-block-crash.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59786 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Unreviewed, rolling out r59782.
        http://trac.webkit.org/changeset/59782
        https://bugs.webkit.org/show_bug.cgi?id=39379

        broke DRT build (Requested by dpranke on #webkit).

        * fast/notifications/notifications-replace-expected.txt: Added.
        * fast/notifications/notifications-replace.html: Added.
        * fast/notifications/notifications-rtl-expected.txt: Added.
        * fast/notifications/notifications-rtl.html: Added.
2010-05-19  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r59782.
        http://trac.webkit.org/changeset/59782
        https://bugs.webkit.org/show_bug.cgi?id=39379

        broke DRT build (Requested by dpranke on #webkit).

        * notifications/Notification.h:
        (WebCore::Notification::dir):
        (WebCore::Notification::setDir):
        (WebCore::Notification::replaceId):
        (WebCore::Notification::setReplaceId):
        * notifications/Notification.idl:
2010-05-19  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r59782.
        http://trac.webkit.org/changeset/59782
        https://bugs.webkit.org/show_bug.cgi?id=39379

        broke DRT build (Requested by dpranke on #webkit).

        * public/WebNotification.h:
        * src/WebNotification.cpp:
        (WebKit::WebNotification::dir):
        (WebKit::WebNotification::replaceId):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59785 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=21049, opacity and position:relative fail in multi-column layouts.
        
Reviewed by Oliver Hunt.

Make layers split painting across columns just as normal flow content does.  This is actually very
challenging, since intermediate multicol layers can exist between a child that has to be split and
its enclosing stacking context.
        
In order to properly paginate layers, a bit is set on all pagination roots, i.e., layers that will get
split and thus split any descendant layers that they are also responsible for painting.  For a paginated
root, we walk up the layer hierarchy and collect all intermediate multicol blocks between the child
and the enclosing stacking context.
        
We then recur from the outside in, applying clipping and translation as we break up the layer into strips.
        
Composited layers remain unsplittable and have a hacked offset still in order to be placed in the right
column.
        
Painting and hit testing of columns has been simplified in all of the functions to use the x position of
the column rect instead of trying to increment an x offset by adding in widths and column gaps.  This
makes those functions directionality-independent (and the LTR/RTL code paths are now the same).
        
Fix repainting of columns as well to make sure rects are split across columns only after relative position
and transforms have been applied.
        
Added fast/multicol/layers-split-across-columns.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::paintColumnContents):
(WebCore::RenderBlock::adjustRectForColumns):
(WebCore::RenderBlock::adjustForColumns):
* rendering/RenderBlock.h:
* rendering/RenderBox.cpp:
(WebCore::RenderBox::computeRectForRepaint):
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::RenderLayer):
(WebCore::RenderLayer::updateLayerPositions):
(WebCore::RenderLayer::updatePagination):
(WebCore::RenderLayer::updateLayerPosition):
(WebCore::RenderLayer::paintLayer):
(WebCore::RenderLayer::paintList):
(WebCore::RenderLayer::paintPaginatedChildLayer):
(WebCore::RenderLayer::paintChildLayerIntoColumns):
(WebCore::RenderLayer::hitTestLayer):
(WebCore::RenderLayer::hitTestList):
(WebCore::RenderLayer::hitTestPaginatedChildLayer):
(WebCore::RenderLayer::hitTestChildLayerColumns):
* rendering/RenderLayer.h:
(WebCore::RenderLayer::):
(WebCore::RenderLayer::isPaginated):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59784 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Dimitri Glazkov.

        Attempt to revert r58765 to see if it was causing a performance
        regression.

        https://bugs.webkit.org/show_bug.cgi?id=39328

        * fast/notifications/notifications-replace-expected.txt: Removed.
        * fast/notifications/notifications-replace.html: Removed.
        * fast/notifications/notifications-rtl-expected.txt: Removed.
        * fast/notifications/notifications-rtl.html: Removed.
2010-05-18  Dirk Pranke  <dpranke@chromium.org>

        Reviewed by Dimitri Glazkov.

        Attempt to revert r58765 to see if it was causing a performance
        regression.

        https://bugs.webkit.org/show_bug.cgi?id=39328

        * notifications/Notification.h:
        * notifications/Notification.idl:
2010-05-18  Dirk Pranke  <dpranke@chromium.org>

        Reviewed by Dimitri Glazkov.

        Attempt to revert r58765 to see if it was causing a performance
        regression.

        https://bugs.webkit.org/show_bug.cgi?id=39328

        * public/WebNotification.h:
        * src/WebNotification.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59782 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Not reviewed.

        Add baselines for new multi-column tests.

        * platform/gtk/fast/multicol/column-count-with-rules-expected.txt: Added.
        * platform/gtk/fast/multicol/layers-in-multicol-expected.txt: Added.
        * platform/gtk/fast/multicol/nested-columns-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59770 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Adam Barth.

        Moving frame.src checks out of the bindings
        https://bugs.webkit.org/show_bug.cgi?id=37815

        Moved JavaScript frame.src checks out of bindings and into
        HTMLFrameElementBase. Added main thread state stack to JavaScriptCore
        so ExecState is available inside core DOM. Updated affected bindings
        (except for GObject, which will need to be updated to avoid origin
        failures inside native code).

        * Android.jscbindings.mk:
        * CMakeLists.txt:
        * GNUmakefile.am:
        * WebCore.gypi:
        * WebCore.pro:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSCallbackData.cpp:
        (WebCore::JSCallbackData::invokeCallback):
        * bindings/js/JSEventListener.cpp:
        (WebCore::JSEventListener::handleEvent):
        * bindings/js/JSInjectedScriptHostCustom.cpp:
        (WebCore::InjectedScriptHost::createInjectedScript):
        * bindings/js/JSMainThreadExecState.cpp: Added.
        * bindings/js/JSMainThreadExecState.h: Added.
        (WebCore::JSMainThreadExecState::currentState):
        (WebCore::JSMainThreadExecState::call):
        (WebCore::JSMainThreadExecState::evaluate):
        (WebCore::JSMainThreadExecState::JSMainThreadExecState):
        (WebCore::JSMainThreadExecState::~JSMainThreadExecState):
        (WebCore::JSMainThreadNullState::JSMainThreadNullState):
        * bindings/js/ScheduledAction.cpp:
        (WebCore::ScheduledAction::executeFunctionInContext):
        (WebCore::ScheduledAction::execute):
        * bindings/js/ScheduledAction.h:
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::evaluateInWorld):
        (WebCore::ScriptController::canAccessFromCurrentOrigin):
        * bindings/js/ScriptController.h:
        * bindings/js/ScriptFunctionCall.cpp:
        (WebCore::ScriptFunctionCall::call):
        * bindings/objc/ObjCEventListener.mm:
        * bindings/objc/WebScriptObject.mm:
        (-[WebScriptObject callWebScriptMethod:withArguments:]):
        (-[WebScriptObject evaluateWebScript:]):
        * bindings/scripts/CodeGeneratorObjC.pm:
        * bindings/scripts/test/ObjC/DOMTestCallback.mm:
        (-[DOMTestCallback callbackWithClass1Param:]):
        (-[DOMTestCallback callbackWithClass2Param:strArg:]):
        (-[DOMTestCallback callbackWithNonBoolReturnType:]):
        (-[DOMTestCallback customCallback:class6Param:]):
        * bindings/scripts/test/ObjC/DOMTestInterface.mm:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj readOnlyIntAttr]):
        (-[DOMTestObj readOnlyStringAttr]):
        (-[DOMTestObj readOnlyTestObjAttr]):
        (-[DOMTestObj intAttr]):
        (-[DOMTestObj setIntAttr:]):
        (-[DOMTestObj longLongAttr]):
        (-[DOMTestObj setLongLongAttr:]):
        (-[DOMTestObj unsignedLongLongAttr]):
        (-[DOMTestObj setUnsignedLongLongAttr:]):
        (-[DOMTestObj stringAttr]):
        (-[DOMTestObj setStringAttr:]):
        (-[DOMTestObj testObjAttr]):
        (-[DOMTestObj setTestObjAttr:]):
        (-[DOMTestObj attrWithException]):
        (-[DOMTestObj setAttrWithException:]):
        (-[DOMTestObj attrWithSetterException]):
        (-[DOMTestObj setAttrWithSetterException:]):
        (-[DOMTestObj attrWithGetterException]):
        (-[DOMTestObj setAttrWithGetterException:]):
        (-[DOMTestObj customAttr]):
        (-[DOMTestObj setCustomAttr:]):
        (-[DOMTestObj scriptStringAttr]):
        (-[DOMTestObj voidMethod]):
        (-[DOMTestObj voidMethodWithArgs:strArg:objArg:]):
        (-[DOMTestObj intMethod]):
        (-[DOMTestObj intMethodWithArgs:strArg:objArg:]):
        (-[DOMTestObj objMethod]):
        (-[DOMTestObj objMethodWithArgs:strArg:objArg:]):
        (-[DOMTestObj methodThatRequiresAllArgs:objArg:]):
        (-[DOMTestObj methodThatRequiresAllArgsAndThrows:objArg:]):
        (-[DOMTestObj serializedValue:]):
        (-[DOMTestObj methodWithException]):
        (-[DOMTestObj customMethod]):
        (-[DOMTestObj customMethodWithArgs:strArg:objArg:]):
        (-[DOMTestObj customArgsAndException:]):
        (-[DOMTestObj addEventListener:listener:useCapture:]):
        (-[DOMTestObj removeEventListener:listener:useCapture:]):
        (-[DOMTestObj withDynamicFrame]):
        (-[DOMTestObj withDynamicFrameAndArg:]):
        (-[DOMTestObj withDynamicFrameAndOptionalArg:optionalArg:]):
        (-[DOMTestObj withDynamicFrameAndUserGesture:]):
        (-[DOMTestObj withDynamicFrameAndUserGestureASAD:optionalArg:]):
        (-[DOMTestObj withScriptStateVoid]):
        (-[DOMTestObj withScriptStateObj]):
        (-[DOMTestObj withScriptStateVoidException]):
        (-[DOMTestObj withScriptStateObjException]):
        (-[DOMTestObj methodWithOptionalArg:]):
        (-[DOMTestObj methodWithNonOptionalArgAndOptionalArg:opt:]):
        (-[DOMTestObj methodWithNonOptionalArgAndTwoOptionalArgs:opt1:opt2:]):
        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::canAccessFromCurrentOrigin):
        * bindings/v8/ScriptController.h:
        * html/HTMLFrameElementBase.cpp:
        (WebCore::HTMLFrameElementBase::isURLAllowed):
2010-05-19  Justin Schuh  <jschuh@chromium.org>

        Reviewed by Adam Barth.

        Moving frame.src checks out of the bindings
        https://bugs.webkit.org/show_bug.cgi?id=37815

        * http/tests/security/xss-DENIED-iframe-src-alias-expected.txt:
        * http/tests/security/xss-DENIED-iframe-src-alias.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59769 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin Adler.

        CanvasRenderingContext2D's property getters that return colors should
        serialize them in accordance with the HTML5 spec (4.8.11.1.4)
        Setters should ignore invalid colors.

        Also, shadowColor should initially be transparent black (4.8.11.1.6)

        https://bugs.webkit.org/show_bug.cgi?id=38845

        Refactored CanvasStyle to store an RGBA32 instead of RGBA components and/or the color string.

        Spec links:
        http://www.whatwg.org/specs/web-apps/current-work/#serialization-of-a-color
        http://www.whatwg.org/specs/web-apps/current-work/#dom-context-2d-shadowcolor

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::State::State):
        (WebCore::CanvasRenderingContext2D::shadowColor):
        (WebCore::CanvasRenderingContext2D::setShadowColor):
        (WebCore::CanvasRenderingContext2D::setShadow):
        (WebCore::CanvasRenderingContext2D::clearShadow):
        (WebCore::CanvasRenderingContext2D::applyShadow):
        * html/canvas/CanvasRenderingContext2D.h:
        * html/canvas/CanvasStyle.cpp:
        (WebCore::CanvasStyle::CanvasStyle):
        (WebCore::CanvasStyle::create):
        (WebCore::CanvasStyle::applyStrokeColor):
        (WebCore::CanvasStyle::applyFillColor):
        * html/canvas/CanvasStyle.h:
        (WebCore::CanvasStyle::create):
        (WebCore::CanvasStyle::color):
        (WebCore::CanvasStyle::):
        (WebCore::CanvasStyle::CMYKAValues::CMYKAValues):
        * platform/graphics/Color.cpp:
        (WebCore::Color::serialized):
        * platform/graphics/Color.h:


2010-05-19  Andreas Kling  <andreas.kling@nokia.com>

        Reviewed by Darin Adler.

        Added a test to verify proper color serialization in CanvasRenderingContext2D's getters.
        https://bugs.webkit.org/show_bug.cgi?id=38845

        Spec link:
        http://www.whatwg.org/specs/web-apps/current-work/#serialization-of-a-color

        * fast/canvas/canvas-color-serialization-expected.txt: Added.
        * fast/canvas/canvas-color-serialization.html: Added.
        * fast/canvas/canvas-set-properties-with-non-invertible-ctm-expected.txt: Updated baseline.
        * fast/canvas/script-tests/canvas-color-serialization.js: Added.
        (trySettingStrokeStyle):
        (trySettingFillStyle):
        (trySettingShadowColor):
        (trySettingColor):
        (trySettingStrokeColorWithSetter):
        (trySettingFillColorWithSetter):
        (trySettingShadowWithSetter):
        (trySettingColorWithSetter):
        (trySettingFillColorRGBA):
        (trySettingStrokeColorRGBA):
        (trySettingShadowRGBA):
        (trySettingRGBA):
        (trySettingFillColorCMYKA):
        (trySettingStrokeColorCMYKA):
        (trySettingShadowCMYKA):
        (trySettingCMYKA):
        (trySettingFillColorWithOverrideAlpha):
        (trySettingStrokeColorWithOverrideAlpha):
        (trySettingShadowWithOverrideAlpha):
        (trySettingColorWithOverrideAlpha):
        (trySettingFillColorGrayLevel):
        (trySettingStrokeColorGrayLevel):
        (trySettingShadowGrayLevel):
        (trySettingGrayLevel):
        (trySettingFillColorGrayLevelWithAlpha):
        (trySettingStrokeColorGrayLevelWithAlpha):
        (trySettingShadowGrayLevelWithAlpha):
        (trySettingGrayLevelWithAlpha):
        (tryClearShadowAfterSettingColor):
        (checkDefaultValue):
        * fast/canvas/script-tests/canvas-set-properties-with-non-invertible-ctm.js:
        * fast/dom/canvasContext2d-element-attribute-js-null-expected.txt: Updated baseline.
        * fast/dom/canvasContext2d-element-attribute-js-null.html:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59768 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Simon Hausmann.

        [Qt] REGRESSION: CoolClock isn't rendered properly

        https://bugs.webkit.org/show_bug.cgi?id=38526

        CanvasRenderingContext2D's arc() should connect to the previous point
        with a straight line (HTML5 spec 4.8.11.1.8), but if the path is empty
        to begin with, we don't want a line back to (0,0)
        This also fixes the rendering artifact discussed in bug 36226.

        Spec link:
        http://www.whatwg.org/specs/web-apps/current-work/#dom-context-2d-arc

        Test: fast/canvas/canvas-arc-connecting-line.html

        * platform/graphics/qt/PathQt.cpp:
        (WebCore::Path::addArc):

2010-05-19  Andreas Kling  <andreas.kling@nokia.com>

        Reviewed by Simon Hausmann.

        Add test to verify that CanvasRenderingContext2D's arc() connects arcs
        by a straight line (unless it's the first element in the path.)
        https://bugs.webkit.org/show_bug.cgi?id=38526

        * fast/canvas/canvas-arc-connecting-line-expected.txt: Added.
        * fast/canvas/canvas-arc-connecting-line.html: Added.
        * fast/canvas/script-tests/canvas-arc-connecting-line.js: Added.
        (deg2rad):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59767 268f45cc-cd09-0410-ab3c-d52691b4dbfc

of the subpattern's non-greedy match at the place of the subpattern's
start index in the output array instead of the place of the
subpattern's end index.
Add layout test for checking of non-greedy matching of subpattern in
regular expressions.
https://bugs.webkit.org/show_bug.cgi?id=39289

Patch by Peter Varga <pvarga@inf.u-szeged.hu> on 2010-05-19
Reviewed by Darin Adler.

JavaScriptCore: 

* yarr/RegexInterpreter.cpp:
(JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):

LayoutTests: 

* fast/js/regexp-non-greedy-parentheses-expected.txt: Added.
* fast/js/regexp-non-greedy-parentheses.html: Added.
* fast/js/script-tests/regexp-non-greedy-parentheses.js: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59766 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Unreviewed, rolling out r59758.
        http://trac.webkit.org/changeset/59758
        https://bugs.webkit.org/show_bug.cgi?id=39361

        This patch adds a test that fails on Leopard (Requested by
        abarth on #webkit).

        * fast/canvas/webgl/texture-npot-expected.txt:
        * fast/canvas/webgl/texture-npot.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59764 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin Adler.

        fast/canvas/webgl/texture-npot.html failed on leopard bot
        https://bugs.webkit.org/show_bug.cgi?id=39128

        * fast/canvas/webgl/texture-npot-expected.txt: Skip pixel (0, 0); print out actual color when failing.
        * fast/canvas/webgl/texture-npot.html: Ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59758 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin Adler.

        Touch events are marked DontEnum in DOMWindow.idl
        https://bugs.webkit.org/show_bug.cgi?id=39118

        Update the expected results for enumerating the window object
        properties now touch event listeners are no longer marked DontEnum.

        * platform/qt/fast/dom/Window/window-properties-expected.txt:
2010-05-19  Ben Murdoch  <benm@google.com>

        Reviewed by Darin Adler.

        Touch events are marked DontEnum in DOMWindow.idl
        https://bugs.webkit.org/show_bug.cgi?id=39118

        Touch events are the only attribute event listeners on the
        window object that are marked DontEnum. For consistency allow
        them to be enumerated.

        * page/DOMWindow.idl: Remove DontEnum from touchcancel, touchend,
            touchstart and touchmove attributes.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59754 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Shinichiro Hamaji.

        Make CSS Parser properly handle only-for-pages pseudo-classes.

        https://bugs.webkit.org/show_bug.cgi?id=38731

        * fast/css/misplaced-paged-media-pseudo-expected.txt: Removed.
        * fast/css/misplaced-paged-media-pseudo.html: Removed.
        * printing/page-rule-css-text-expected.txt:
        * printing/page-rule-css-text.html:
        * printing/pseudo-class-outside-page-expected.txt:
        * printing/pseudo-class-outside-page.html:
2010-05-18  Yuzo Fujishima  <yuzo@google.com>

        Reviewed by Shinichiro Hamaji.

        Make CSS Parser properly handle only-for-pages pseudo-classes.

        A new Match category, PagePseudoClass, is introduced to distinguish
        only-for-pages pseudo-classes from others. A new symbol, pseudo_page,
        is introduced to handle them separately.

        https://bugs.webkit.org/show_bug.cgi?id=38731

        * css/CSSGrammar.y:
        * css/CSSPars...

        Unreviewed, skip test.

        Skipping fast/workers/storage
        https://bugs.webkit.org/show_bug.cgi?id=39346

        * platform/gtk/Skipped:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59748 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=39200
        
Reviewed by Darin Adler.

Removed the reserved OptionalCalleeArguments slot from the CallFrame.
Now, slots for 'arguments' are allocated and initialized only by
functions that might need them.
        
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dump): Updated for new bytecode operands.

(JSC::CodeBlock::CodeBlock):
* bytecode/CodeBlock.h:
(JSC::unmodifiedArgumentsRegister): Added a helper function for mapping
from the arguments register to its unmodified counterpart.

(JSC::CodeBlock::setArgumentsRegister):
(JSC::CodeBlock::argumentsRegister):
(JSC::CodeBlock::usesArguments):  Changed from a "usesArguments" bool to
an optional int index representing the arguments register.

* bytecode/Opcode.h: Updated for new bytecode operands.

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::addVar): Factored out a helper function for
allocating an anonymous var.

(JSC::BytecodeGenerator::BytecodeGenerator): Merged / simplified some
arguments vs activation logic, and added code to allocate the arguments
registers when needed.

(JSC::BytecodeGenerator::createArgumentsIfNecessary): Updated for new bytecode operands.

(JSC::BytecodeGenerator::emitCallEval): No need to create the arguments
object before calling eval; the activation object will lazily create the
arguments object if eval resolves it.

(JSC::BytecodeGenerator::emitReturn): Updated for new bytecode operands.

(JSC::BytecodeGenerator::emitPushScope):
(JSC::BytecodeGenerator::emitPushNewScope): Ditto emitCallEval.

* bytecompiler/BytecodeGenerator.h:
(JSC::BytecodeGenerator::addVar): Factored out a helper function for
allocating an anonymous var.

(JSC::BytecodeGenerator::registerFor): No more need for special handling
of the arguments registers; they're allocated just like normal registers
now.

* interpreter/CallFrame.h:
(JSC::ExecState::callerFrame):
(JSC::ExecState::init):
* interpreter/CallFrameClosure.h:
(JSC::CallFrameClosure::resetCallFrame): Nixed optionalCalleeArguments.

* interpreter/Interpreter.cpp:
(JSC::Interpreter::dumpRegisters):
(JSC::Interpreter::unwindCallFrame):
(JSC::Interpreter::privateExecute):
(JSC::Interpreter::retrieveArguments): Opcodes accessing 'arguments' now
take operands specifying registers, just like all other opcodes.
JSActivation::copyRegisters is no longer responsible for tearing off the
arguments object; instead, the VM is responsible for both.

Also, a behavior change: Each access to f.arguments creates a new object,
unless f itself uses 'arguments'. This matches Chrome, and is necessary
for the optimization. f.arguments is a nonstandard, deprecated feature,
so high fidelity to a given implementation is not necessarily a goal.
Also, as illustrated by the new test case, the identity of f.arguments
has been broken since 2008, except in the case where f itself accesses
f.arguments -- but nobody seemed to notice. So, hopefully this change won't
break the web.
        
* interpreter/Register.h: Nixed the special arguments accessor. It's no
longer needed.

* interpreter/RegisterFile.h:
(JSC::RegisterFile::):
* jit/JITCall.cpp:
(JSC::JIT::compileOpCallInitializeCallFrame):
(JSC::JIT::compileOpCall):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_tear_off_activation):
(JSC::JIT::emit_op_tear_off_arguments):
(JSC::JIT::emit_op_create_arguments):
(JSC::JIT::emit_op_init_arguments):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_tear_off_activation):
(JSC::JIT::emit_op_tear_off_arguments):
(JSC::JIT::emit_op_create_arguments):
(JSC::JIT::emit_op_init_arguments): The actual optimization: Removed
OptionalCalleeArguments from the callframe slot. Now, it doesn't need
to be initialized for most calls.

* jit/JITStubs.cpp:
(JSC::DEFINE_STUB_FUNCTION):
* jit/JITStubs.h:
(JSC::): Updated stubs to support arbitrary 'arguments' registers,
instead of hard-coding something in the call frame.

* runtime/Arguments.h:
(JSC::JSActivation::copyRegisters): Removed some obfuscatory abstraction.

* runtime/Executable.h:
(JSC::FunctionExecutable::generatedByteCode): Added a helper for accessing
the 'arguments' register. In a future patch, that kind of data should
probably move out of CodeBlock and into Executable.

* runtime/JSActivation.cpp:
(JSC::JSActivation::getOwnPropertySlot):
(JSC::JSActivation::argumentsGetter):
* runtime/JSActivation.h: Simplified / fixed access to 'arguments' via
the activation object. It now implements the same behavior implemented
by optimized variable access in the VM. This simplifies some other
things, too -- like eval code generation.

LayoutTests: Simplified handling of 'arguments' -- 1.2% SunSpider speedup
https://bugs.webkit.org/show_bug.cgi?id=39200

Reviewed by Darin Adler.

* fast/js/function-dot-arguments-expected.txt:
* fast/js/script-tests/function-dot-arguments.js:
(argumentsIdentity): Updated to match new behavior.

* fast/js/function-dot-arguments2-expected.txt:
* fast/js/function-dot-arguments2.html: New tests for some things that
weren't covered before.

* fast/js/global-recursion-on-full-stack.html: Rejiggered the stack
usage in this test. Since stack usage is more efficient now, you
need a slightly different usage pattern to hit the exact thing this
test wanted to test.

* fast/js/kde/script-tests/function_arguments.js:
(f): Updated to more specifically test what this was trying to test,
to avoid just testing the identity of f.arguments.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59742 268f45cc-cd09-0410-ab3c-d52691b4dbfc

fast/css/pseudo-required-optional-unapplied.html failure with ENABLE_METER_TAG
https://bugs.webkit.org/show_bug.cgi?id=39341

Remove test elements at the end of the test because dumpAsText() output
for <meter> depends on ENABLE_METER_TAG.

* fast/css/pseudo-required-optional-unapplied-expected.txt:
* fast/css/pseudo-required-optional-unapplied.html:
* platform/qt/Skipped:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59741 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=39341

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59740 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Ojan Vafai.

        REGRESSION: crash in WebCore::CompositeEditCommand::splitTreeToNode when indenting in an empty li
        https://bugs.webkit.org/show_bug.cgi?id=38232

        * editing/execCommand/crash-indenting-list-item-expected.txt: Added.
        * editing/execCommand/crash-indenting-list-item.html: Added.
2010-05-18  Tony Chang  <tony@chromium.org>

        Reviewed by Ojan Vafai.

        REGRESSION: crash in WebCore::CompositeEditCommand::splitTreeToNode when indenting in an empty li
        https://bugs.webkit.org/show_bug.cgi?id=38232

        Test: editing/execCommand/crash-indenting-list-item.html

        * editing/IndentOutdentCommand.cpp:
        (WebCore::IndentOutdentCommand::tryIndentingAsListItem):
        (WebCore::IndentOutdentCommand::indentIntoBlockquote):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59739 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=39292

Reviewed by Darin Adler.

WebCore:

Test: fast/css/pseudo-required-optional-unapplied.html

* html/HTMLKeygenElement.h:
(WebCore::HTMLKeygenElement::isOptionalFormControl):
  Add isOptionalFormControl() returning false.
  HTMLKeygenElement inherits HTMLSelectElement, which should return true
  for isOptionalFormControl(). However, <keygen> is not :optional
  according to the standard.
* html/HTMLProgressElement.h:
  Remove isOptionalFormControl().

LayoutTests:

Add a test for non-optional form elements.

* fast/css/pseudo-required-optional-unapplied-expected.txt: Added.
* fast/css/pseudo-required-optional-unapplied.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59738 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Unreviewed.

        Add leopard-specific pixel results for more tests that need them
        https://bugs.webkit.org/show_bug.cgi?id=39325

        This adds new Leopard baselines for all tests that currently
        pass with tolerance=0 on Snow Leopard but fail on Leopard
        with an image diff of <= 0.1%.  These tests previously had
        expectations in platform/mac that were Snow Leopard specific.

        * platform/mac-leopard/animations: Added.
        * platform/mac-leopard/animations/3d: Added.
        * platform/mac-leopard/animations/3d/change-transform-in-end-event-expected.checksum: Added.
        * platform/mac-leopard/animations/3d/change-transform-in-end-event-expected.png: Added.
        * platform/mac-leopard/compositing/animation: Added.
        * platform/mac-leopard/compositing/animation/state-at-end-event-transform-layer-expected.checksum: Added.
        * platform/mac-leopard/compositing/animation/state-at-end-event-transform-layer-expected.png: Added.
        * platform/mac-leopard/compositing/compositing-visible-descendant-expected.checksum: Added.
        * platform/mac-leopard/compositing/compositing-visible-descendant-expected.png: Added.
        * platform/mac-leopard/compositing/geometry/abs-position-inside-opacity-expected.checksum: Added.
        * platform/mac-leopard/compositing/geometry/abs-position-inside-opacity-expected.png: Added.
        * platform/mac-leopard/compositing/geometry/fixed-position-expected.checksum: Added.
        * platform/mac-leopard/compositing/geometry/fixed-position-expected.png: Added.
        * platform/mac-leopard/compositing/geometry/horizontal-scroll-composited-expected.checksum: Added.
        * platform/mac-leopard/compositing/geometry/horizontal-scroll-composited-expected.png: Added.
        * platform/mac-leopard/compositing/geometry/partial-layout-update-expected.checksum: Added.
        * platform/mac-leopard/compositing/geometry/partial-layout-update-expected.png: Added.
        * platform/mac-leopard/compositing/geometry/transfrom-origin-on-zero-size-layer-expected.checksum: Added.
        * platform/mac-leopard/compositing/geometry/transfrom-origin-on-zero-size-layer-expected.png: Added.
        * platform/mac-leopard/compositing/geometry/vertical-scroll-composited-expected.checksum: Added.
        * platform/mac-leopard/compositing/geometry/vertical-scroll-composited-expected.png: Added.
        * platform/mac-leopard/compositing/iframes/iframe-copy-on-scroll-expected.checksum: Added.
        * platform/mac-leopard/compositing/iframes/iframe-copy-on-scroll-expected.png: Added.
        * platform/mac-leopard/compositing/masks: Added.
        * platform/mac-leopard/compositing/masks/direct-image-mask-expected.checksum: Added.
        * platform/mac-leopard/compositing/masks/direct-image-mask-expected.png: Added.
        * platform/mac-leopard/compositing/overflow/fixed-position-ancestor-clip-expected.checksum: Added.
        * platform/mac-leopard/compositing/overflow/fixed-position-ancestor-clip-expected.png: Added.
        * platform/mac-leopard/compositing/reflections/reflection-in-composited-expected.checksum: Added.
        * platform/mac-leopard/compositing/reflections/reflection-in-composited-expected.png: Added.
        * platform/mac-leopard/compositing/reflections/reflection-ordering-expected.checksum: Added.
        * platform/mac-leopard/compositing/reflections/reflection-ordering-expected.png: Added.
        * platform/mac-leopard/compositing/repaint/content-into-overflow-expected.checksum: Added.
        * platform/mac-leopard/compositing/repaint/content-into-overflow-expected.png: Added.
        * platform/mac-leopard/compositing/repaint/layer-repaint-expected.checksum: Added.
        * platform/mac-leopard/compositing/repaint/layer-repaint-expected.png: Added.
        * platform/mac-leopard/compositing/repaint/opacity-between-absolute-expected.checksum: Added.
        * platform/mac-leopard/compositing/repaint/opacity-between-absolute-expected.png: Added.
        * platform/mac-leopard/compositing/repaint/opacity-between-absolute2-expected.checksum: Added.
        * platform/mac-leopard/compositing/repaint/opacity-between-absolute2-expected.png: Added.
        * platform/mac-leopard/fast/borders: Added.
        * platform/mac-leopard/fast/borders/svg-as-border-image-2-expected.checksum: Added.
        * platform/mac-leopard/fast/borders/svg-as-border-image-2-expected.png: Added.
        * platform/mac-leopard/fast/borders/svg-as-border-image-expected.checksum: Added.
        * platform/mac-leopard/fast/borders/svg-as-border-image-expected.png: Added.
        * platform/mac-leopard/fast/forms/placeholder-stripped-expected.checksum: Added.
        * platform/mac-leopard/fast/forms/placeholder-stripped-expected.png: Added.
        * platform/mac-leopard/fast/multicol: Added.
        * platform/mac-leopard/fast/multicol/column-count-with-rules-expected.checksum: Added.
        * platform/mac-leopard/fast/multicol/column-count-with-rules-expected.png: Added.
        * platform/mac-leopard/media/controls-strict-expected.checksum:
        * platform/mac-leopard/media/controls-strict-expected.png:
        * platform/mac-leopard/media/video-display-toggle-expected.checksum:
        * platform/mac-leopard/media/video-display-toggle-expected.png:
        * platform/mac-leopard/media/video-replaces-poster-expected.checksum: Added.
        * platform/mac-leopard/media/video-replaces-poster-expected.png: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59730 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Not reviewed.

        [GTK] fast/dom/Geolocation/enabled.html is crashing on the bots
        https://bugs.webkit.org/show_bug.cgi?id=39326

        * platform/gtk/Skipped: Skip another test causing crashes.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59728 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Unreviewed, rolling out r59693.
        http://trac.webkit.org/changeset/59693
        https://bugs.webkit.org/show_bug.cgi?id=37815

        Broke GTK Release

        * Android.jscbindings.mk:
        * CMakeLists.txt:
        * GNUmakefile.am:
        * WebCore.gypi:
        * WebCore.pro:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSCallbackData.cpp:
        (WebCore::JSCallbackData::invokeCallback):
        * bindings/js/JSEventListener.cpp:
        (WebCore::JSEventListener::handleEvent):
        * bindings/js/JSInjectedScriptHostCustom.cpp:
        (WebCore::InjectedScriptHost::createInjectedScript):
        * bindings/js/JSMainThreadExecState.cpp: Removed.
        * bindings/js/JSMainThreadExecState.h: Removed.
        * bindings/js/ScheduledAction.cpp:
        (WebCore::ScheduledAction::executeFunctionInContext):
        (WebCore::ScheduledAction::execute):
        * bindings/js/ScheduledAction.h:
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::evaluateInWorld):
        * bindings/js/ScriptController.h:
        * bindings/js/ScriptFunctionCall.cpp:
        (WebCore::ScriptFunctionCall::call):
        * bindings/objc/ObjCEventListener.mm:
        * bindings/objc/WebScriptObject.mm:
        (-[WebScriptObject callWebScriptMethod:withArguments:]):
        (-[WebScriptObject evaluateWebScript:]):
        * bindings/scripts/CodeGeneratorObjC.pm:
        * bindings/scripts/test/ObjC/DOMTestCallback.mm:
        (-[DOMTestCallback callbackWithClass1Param:]):
        (-[DOMTestCallback callbackWithClass2Param:strArg:]):
        (-[DOMTestCallback callbackWithNonBoolReturnType:]):
        (-[DOMTestCallback customCallback:class6Param:]):
        * bindings/scripts/test/ObjC/DOMTestInterface.mm:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj readOnlyIntAttr]):
        (-[DOMTestObj readOnlyStringAttr]):
        (-[DOMTestObj readOnlyTestObjAttr]):
        (-[DOMTestObj intAttr]):
        (-[DOMTestObj setIntAttr:]):
        (-[DOMTestObj longLongAttr]):
        (-[DOMTestObj setLongLongAttr:]):
        (-[DOMTestObj unsignedLongLongAttr]):
        (-[DOMTestObj setUnsignedLongLongAttr:]):
        (-[DOMTestObj stringAttr]):
        (-[DOMTestObj setStringAttr:]):
        (-[DOMTestObj testObjAttr]):
        (-[DOMTestObj setTestObjAttr:]):
        (-[DOMTestObj attrWithException]):
        (-[DOMTestObj setAttrWithException:]):
        (-[DOMTestObj attrWithSetterException]):
        (-[DOMTestObj setAttrWithSetterException:]):
        (-[DOMTestObj attrWithGetterException]):
        (-[DOMTestObj setAttrWithGetterException:]):
        (-[DOMTestObj customAttr]):
        (-[DOMTestObj setCustomAttr:]):
        (-[DOMTestObj scriptStringAttr]):
        (-[DOMTestObj voidMethod]):
        (-[DOMTestObj voidMethodWithArgs:strArg:objArg:]):
        (-[DOMTestObj intMethod]):
        (-[DOMTestObj intMethodWithArgs:strArg:objArg:]):
        (-[DOMTestObj objMethod]):
        (-[DOMTestObj objMethodWithArgs:strArg:objArg:]):
        (-[DOMTestObj methodThatRequiresAllArgs:objArg:]):
        (-[DOMTestObj methodThatRequiresAllArgsAndThrows:objArg:]):
        (-[DOMTestObj serializedValue:]):
        (-[DOMTestObj methodWithException]):
        (-[DOMTestObj customMethod]):
        (-[DOMTestObj customMethodWithArgs:strArg:objArg:]):
        (-[DOMTestObj customArgsAndException:]):
        (-[DOMTestObj addEventListener:listener:useCapture:]):
        (-[DOMTestObj removeEventListener:listener:useCapture:]):
        (-[DOMTestObj withDynamicFrame]):
        (-[DOMTestObj withDynamicFrameAndArg:]):
        (-[DOMTestObj withDynamicFrameAndOptionalArg:optionalArg:]):
        (-[DOMTestObj withDynamicFrameAndUserGesture:]):
        (-[DOMTestObj withDynamicFrameAndUserGestureASAD:optionalArg:]):
        (-[DOMTestObj withScriptStateVoid]):
        (-[DOMTestObj withScriptStateObj]):
        (-[DOMTestObj withScriptStateVoidException]):
        (-[DOMTestObj withScriptStateObjException]):
        (-[DOMTestObj methodWithOptionalArg:]):
        (-[DOMTestObj methodWithNonOptionalArgAndOptionalArg:opt:]):
        (-[DOMTestObj methodWithNonOptionalArgAndTwoOptionalArgs:opt1:opt2:]):
        * bindings/v8/ScriptController.cpp:
        * bindings/v8/ScriptController.h:
        * html/HTMLFrameElementBase.cpp:
        (WebCore::HTMLFrameElementBase::isURLAllowed):
2010-05-18  Yaar Schnitman  <yaar@chromium.org>

        Unreviewed, rolling out r59693.
        http://trac.webkit.org/changeset/59693
        https://bugs.webkit.org/show_bug.cgi?id=37815

        Broke GTK Release

        * http/tests/security/xss-DENIED-iframe-src-alias-expected.txt:
        * http/tests/security/xss-DENIED-iframe-src-alias.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59727 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Unreviewed.

        Add leopard-specific pixel results for tests that need them
        https://bugs.webkit.org/show_bug.cgi?id=39325

        This adds new Leopard baselines for all tests that currently
        pass with tolerance=0 on Snow Leopard but fail on Leopard
        with an image diff of <= 0.01%.  These tests previously had
        expectations in platform/mac that were Snow Leopard specific.

        * platform/mac-leopard/compositing/color-matching: Added.
        * platform/mac-leopard/compositing/color-matching/pdf-image-match-expected.checksum: Added.
        * platform/mac-leopard/compositing/color-matching/pdf-image-match-expected.png: Added.
        * platform/mac-leopard/compositing/reflections: Added.
        * platform/mac-leopard/compositing/reflections/simple-composited-reflections-expected.checksum: Added.
        * platform/mac-leopard/compositing/reflections/simple-composited-reflections-expected.png: Added.
        * platform/mac-leopard/compositing/repaint/overflow-into-content-expected.checksum: Added.
        * platform/mac-leopard/compositing/repaint/overflow-into-content-expected.png: Added.
        * platform/mac-leopard/editing/pasteboard: Added.
        * platform/mac-leopard/editing/pasteboard/drag-image-to-contenteditable-in-iframe-expected.checksum: Added.
        * platform/mac-leopard/editing/pasteboard/drag-image-to-contenteditable-in-iframe-expected.png: Added.
        * platform/mac-leopard/fast/css: Added.
        * platform/mac-leopard/fast/css/pseudo-cache-stale-expected.checksum: Added.
        * platform/mac-leopard/fast/css/pseudo-cache-stale-expected.png: Added.
        * platform/mac-leopard/fast/frames: Added.
        * platform/mac-leopard/fast/frames/take-focus-from-iframe-expected.checksum: Added.
        * platform/mac-leopard/fast/frames/take-focus-from-iframe-expected.png: Added.
        * platform/mac-leopard/fast/repaint: Added.
        * platform/mac-leopard/fast/repaint/fixed-child-move-after-scroll-expected.checksum: Added.
        * platform/mac-leopard/fast/repaint/fixed-child-move-after-scroll-expected.png: Added.
        * platform/mac-leopard/fast/repaint/fixed-child-of-fixed-move-after-scroll-expected.checksum: Added.
        * platform/mac-leopard/fast/repaint/fixed-child-of-fixed-move-after-scroll-expected.png: Added.
        * platform/mac-leopard/fast/repaint/fixed-child-of-transformed-move-after-scroll-expected.checksum: Added.
        * platform/mac-leopard/fast/repaint/fixed-child-of-transformed-move-after-scroll-expected.png: Added.
        * platform/mac-leopard/fast/repaint/fixed-move-after-scroll-expected.checksum: Added.
        * platform/mac-leopard/fast/repaint/fixed-move-after-scroll-expected.png: Added.
        * platform/mac-leopard/fast/text/format-control-expected.checksum: Added.
        * platform/mac-leopard/fast/text/format-control-expected.png: Added.
        * platform/mac-leopard/plugins: Added.
        * platform/mac-leopard/plugins/qt-qwidget-plugin-expected.checksum: Added.
        * platform/mac-leopard/plugins/qt-qwidget-plugin-expected.png: Added.
        * platform/mac-leopard/transforms/svg-vs-css-expected.checksum: Added.
        * platform/mac-leopard/transforms/svg-vs-css-expected.png: Added.
        * platform/mac-leopard/transitions: Added.
        * platform/mac-leopard/transitions/move-after-transition-expected.checksum: Added.
        * platform/mac-leopard/transitions/move-after-transition-expected.png: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59723 268f45cc-cd09-0410-ab3c-d52691b4dbfc

<rdar://problem/7685669> and https://bugs.webkit.org/show_bug.cgi?id=39323

Reviewed by Maciej Stachowiak.

WebCore: 

When an iframe has a plugin resource as its src, that case bypassed the plugin sandboxing checks and continued to load
the data for the plugin resource. It handed that data off to a nonexistent Widget, causing a null deref and the crash.

By replacing PluginDocuments in sandboxes iframes with a new "SinkDocument" that just acts as a data sink, we prevent the
crash and also prevent actually loading the plugin binaries.

I filed https://bugs.webkit.org/show_bug.cgi?id=39330 to follow up and let us cancel the load as soon as we know we should.

Test: fast/loader/sandboxed-plugin-crash.html

* CMakeLists.txt:
* GNUmakefile.am:
* WebCore.gypi:
* WebCore.pro:
* WebCore.vcproj/WebCore.vcproj:
* WebCore.xcodeproj/project.pbxproj:

* loader/DocumentWriter.cpp:
(WebCore::DocumentWriter::begin): If the created document is a PluginDocument and the plugin sandbox flag is set,
  replace it with a SinkDocument.

* loader/PluginDocument.h:
(WebCore::PluginDocument::isPluginDocument): Make public (it was already public at the Document.h level).

Add a simple document/tokenizer pair that simply presents a blank HTML document and acts as a data sink for whatever
data is handed to it:
* loader/SinkDocument.cpp: Added.
(WebCore::SinkTokenizer::SinkTokenizer):
(WebCore::SinkTokenizer::write):
(WebCore::SinkTokenizer::isWaitingForScripts):
(WebCore::SinkTokenizer::wantsRawData):
(WebCore::SinkTokenizer::writeRawData):
(WebCore::SinkTokenizer::stopParsing):
(WebCore::SinkTokenizer::finish):
(WebCore::SinkDocument::SinkDocument):
(WebCore::SinkDocument::createTokenizer):
* loader/SinkDocument.h: Added.
(WebCore::SinkDocument::create):

LayoutTests: 

* fast/loader/resources/test.swf: Copied from LayoutTests/fast/replaced/resources/test.swf.
* fast/loader/sandboxed-plugin-crash-expected.txt: Added.
* fast/loader/sandboxed-plugin-crash.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59719 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        No review necessary.

        [GTK] fast/dom/Geolocation/enabled.html is crashing on the bots
        https://bugs.webkit.org/show_bug.cgi?id=39326

        * platform/gtk/Skipped: Skip the crashing tests.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59718 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=39135

Reviewed by Dmitry Titov.

WebCore:

The timeout is caused by 59659 that changed the GC timer to 0 and thus
triggered a bug in FileReader code. The fix is to add more states so
that hasPendingActivity() can do the check correctly.

* html/FileReader.cpp:
(WebCore::FileReader::FileReader):
(WebCore::FileReader::hasPendingActivity):
(WebCore::FileReader::readInternal):
(WebCore::FileReader::terminate):
(WebCore::FileReader::didStart):
(WebCore::FileReader::didGetSize):
(WebCore::FileReader::didRead):
(WebCore::FileReader::didFinish):
(WebCore::FileReader::didFail):
(WebCore::FileReader::readyState):
(WebCore::FileReader::result):
* html/FileReader.h:
(WebCore::FileReader::):

LayoutTests:

Re-enale the file reader test.

* fast/files/file-reader-expected.txt:
* fast/files/file-reader.html:
* platform/mac/Skipped:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59712 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Adam Barth.

        Moving frame.src checks out of the bindings
        https://bugs.webkit.org/show_bug.cgi?id=37815

        Moved JavaScript frame.src checks out of bindings and into
        HTMLFrameElementBase. Added main thread state stack to JavaScriptCore
        so ExecState is available inside core DOM. Updated affected bindings
        (except for GObject, which will need to be updated to avoid origin
        failures inside native code).

        * Android.jscbindings.mk:
        * CMakeLists.txt:
        * GNUmakefile.am:
        * WebCore.gypi:
        * WebCore.pro:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSCallbackData.cpp:
        (WebCore::JSCallbackData::invokeCallback):
        * bindings/js/JSEventListener.cpp:
        (WebCore::JSEventListener::handleEvent):
        * bindings/js/JSInjectedScriptHostCustom.cpp:
        (WebCore::InjectedScriptHost::createInjectedScript):
        * bindings/js/JSMainThreadExecState.cpp: Added.
        * bindings/js/JSMainThreadExecState.h: Added.
        (WebCore::JSMainThreadExecState::currentState):
        (WebCore::JSMainThreadExecState::call):
        (WebCore::JSMainThreadExecState::evaluate):
        (WebCore::JSMainThreadExecState::JSMainThreadExecState):
        (WebCore::JSMainThreadExecState::~JSMainThreadExecState):
        (WebCore::JSMainThreadNullState::JSMainThreadNullState):
        * bindings/js/ScheduledAction.cpp:
        (WebCore::ScheduledAction::executeFunctionInContext):
        (WebCore::ScheduledAction::execute):
        * bindings/js/ScheduledAction.h:
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::evaluateInWorld):
        (WebCore::ScriptController::canAccessFromCurrentOrigin):
        * bindings/js/ScriptController.h:
        * bindings/js/ScriptFunctionCall.cpp:
        (WebCore::ScriptFunctionCall::call):
        * bindings/objc/ObjCEventListener.mm:
        * bindings/objc/WebScriptObject.mm:
        (-[WebScriptObject callWebScriptMethod:withArguments:]):
        (-[WebScriptObject evaluateWebScript:]):
        * bindings/scripts/CodeGeneratorObjC.pm:
        * bindings/scripts/test/ObjC/DOMTestCallback.mm:
        (-[DOMTestCallback callbackWithClass1Param:]):
        (-[DOMTestCallback callbackWithClass2Param:strArg:]):
        (-[DOMTestCallback callbackWithNonBoolReturnType:]):
        (-[DOMTestCallback customCallback:class6Param:]):
        * bindings/scripts/test/ObjC/DOMTestInterface.mm:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj readOnlyIntAttr]):
        (-[DOMTestObj readOnlyStringAttr]):
        (-[DOMTestObj readOnlyTestObjAttr]):
        (-[DOMTestObj intAttr]):
        (-[DOMTestObj setIntAttr:]):
        (-[DOMTestObj longLongAttr]):
        (-[DOMTestObj setLongLongAttr:]):
        (-[DOMTestObj unsignedLongLongAttr]):
        (-[DOMTestObj setUnsignedLongLongAttr:]):
        (-[DOMTestObj stringAttr]):
        (-[DOMTestObj setStringAttr:]):
        (-[DOMTestObj testObjAttr]):
        (-[DOMTestObj setTestObjAttr:]):
        (-[DOMTestObj attrWithException]):
        (-[DOMTestObj setAttrWithException:]):
        (-[DOMTestObj attrWithSetterException]):
        (-[DOMTestObj setAttrWithSetterException:]):
        (-[DOMTestObj attrWithGetterException]):
        (-[DOMTestObj setAttrWithGetterException:]):
        (-[DOMTestObj customAttr]):
        (-[DOMTestObj setCustomAttr:]):
        (-[DOMTestObj scriptStringAttr]):
        (-[DOMTestObj voidMethod]):
        (-[DOMTestObj voidMethodWithArgs:strArg:objArg:]):
        (-[DOMTestObj intMethod]):
        (-[DOMTestObj intMethodWithArgs:strArg:objArg:]):
        (-[DOMTestObj objMethod]):
        (-[DOMTestObj objMethodWithArgs:strArg:objArg:]):
        (-[DOMTestObj methodThatRequiresAllArgs:objArg:]):
        (-[DOMTestObj methodThatRequiresAllArgsAndThrows:objArg:]):
        (-[DOMTestObj serializedValue:]):
        (-[DOMTestObj methodWithException]):
        (-[DOMTestObj customMethod]):
        (-[DOMTestObj customMethodWithArgs:strArg:objArg:]):
        (-[DOMTestObj customArgsAndException:]):
        (-[DOMTestObj addEventListener:listener:useCapture:]):
        (-[DOMTestObj removeEventListener:listener:useCapture:]):
        (-[DOMTestObj withDynamicFrame]):
        (-[DOMTestObj withDynamicFrameAndArg:]):
        (-[DOMTestObj withDynamicFrameAndOptionalArg:optionalArg:]):
        (-[DOMTestObj withDynamicFrameAndUserGesture:]):
        (-[DOMTestObj withDynamicFrameAndUserGestureASAD:optionalArg:]):
        (-[DOMTestObj withScriptStateVoid]):
        (-[DOMTestObj withScriptStateObj]):
        (-[DOMTestObj withScriptStateVoidException]):
        (-[DOMTestObj withScriptStateObjException]):
        (-[DOMTestObj methodWithOptionalArg:]):
        (-[DOMTestObj methodWithNonOptionalArgAndOptionalArg:opt:]):
        (-[DOMTestObj methodWithNonOptionalArgAndTwoOptionalArgs:opt1:opt2:]):
        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::canAccessFromCurrentOrigin):
        * bindings/v8/ScriptController.h:
        * html/HTMLFrameElementBase.cpp:
        (WebCore::HTMLFrameElementBase::isURLAllowed):
2010-05-18  Justin Schuh  <jschuh@chromium.org>

        Reviewed by Adam Barth.

        Moving frame.src checks out of the bindings
        https://bugs.webkit.org/show_bug.cgi?id=37815

        * http/tests/security/xss-DENIED-iframe-src-alias-expected.txt:
        * http/tests/security/xss-DENIED-iframe-src-alias.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59693 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=38711

Patch by Daniel Cheng <dcheng@chromium.org> on 2010-05-18
Reviewed by Darin Adler, Jian Li.

WebCore:

There's no point to trying to make sure the file is valid in
DragData::asURL(). It's better to ask for forgiveness than to ask for
permission, since asking for permission is prone to race conditions
and results in unnecessary I/O.  Consumers of this function either:
- need to verify the file exists themselves (e.g. the loader)
- don't care about file validity (rich text drag-and-drop)

* platform/chromium/DragDataChromium.cpp:
(WebCore::DragData::asURL):

WebKit/mac:

Change [NSPasteboard _web_bestURL] to still return a file URL for paths
that don't exist. Callers who care about the existence of the file or
whether or not it is a directory should check themselves when they
want to use the file. The directory check has been left in for now,
since the Mac implementation of ResourceHandle, which uses this function
indirectly via DragController::performDrag) handles directories somewhat
non-intuitively: it opens the parent directory in the Finder, rather
than opening the directory itself.

* Misc/WebNSPasteboardExtras.mm:
(-[NSPasteboard _web_bestURL]):

LayoutTests:

Several layout tests depended on the fact that dropping a file would
never trigger navigation. This never happened to occur in the past,
since it just so happened that the filenames used in the tests never
resolved to files that exist. Since DragData::asURL() no longer tries
to verify file existence, the layout tests were updated to either
suppress navigation or log any navigation that should occur as part of
the test.

* editing/pasteboard/file-input-files-access-expected.txt:
* editing/pasteboard/script-tests/file-input-files-access.js:
(runTest.window.onbeforeunload):
(runTest):
* http/tests/security/clipboard/script-tests/clipboard-file-access.js:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59689 268f45cc-cd09-0410-ab3c-d52691b4dbfc

* platform/mac/Skipped:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59675 268f45cc-cd09-0410-ab3c-d52691b4dbfc

cause time-out in mac bot for further investigation.

* fast/files/file-reader-expected.txt:
* fast/files/file-reader.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59672 268f45cc-cd09-0410-ab3c-d52691b4dbfc