1. 18 Jan, 2011 13 commits
    • mjs@apple.com's avatar
      2011-01-18 Maciej Stachowiak <mjs@apple.com> · 5ef0e668
      mjs@apple.com authored
              Reviewed by Sam Weinig.
      
              Skip (and in a few cases fix) tests for WebKit2
              https://bugs.webkit.org/show_bug.cgi?id=52698
      
              * editing/pasteboard/copy-null-characters.html: Make this test fail in a more
              obvious way when it fails.
              * fast/events/scroll-event-does-not-bubble.html: Make this test properly
              handle the fact that scroll events are async. The job was half-done before.
              * platform/mac-wk2/Skipped: Skip!
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76097 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      5ef0e668
    • mjs@apple.com's avatar
      Not reviewed. · 1e83c546
      mjs@apple.com authored
      Revert inadvertantly committed test changes.
      
      * editing/pasteboard/copy-null-characters.html:
      * fast/events/scroll-event-does-not-bubble.html:
      * platform/mac-wk2/Skipped:
      * transitions/remove-transition-style.html:
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76094 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      1e83c546
    • mjs@apple.com's avatar
      2011-01-18 Maciej Stachowiak <mjs@apple.com> · 54741f66
      mjs@apple.com authored
              Reviewed by Sam Weinig.
      
              WebKitTestRunner should track loading more like DumpRenderTree
              https://bugs.webkit.org/show_bug.cgi?id=52692
      
              Change load tracking to track the current top loading frame, in the manner of DumpRenderTree.
              This makes some tests that call notifyDone multiple times pass.
              
              * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
              (WTR::InjectedBundle::InjectedBundle):
              (WTR::InjectedBundle::done):
              * WebKitTestRunner/InjectedBundle/InjectedBundle.h:
              (WTR::InjectedBundle::topLoadingFrame):
              (WTR::InjectedBundle::setTopLoadingFrame):
              * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
              (WTR::InjectedBundlePage::InjectedBundlePage):
              (WTR::InjectedBundlePage::stopLoading):
              (WTR::InjectedBundlePage::didStartProvisionalLoadForFrame):
              (WTR::InjectedBundlePage::didFailProvisionalLoadWithErrorForFrame):
              (WTR::InjectedBundlePage::didFinishLoadForFrame):
              (WTR::InjectedBundlePage::didFailLoadWithErrorForFrame):
              * WebKitTestRunner/InjectedBundle/InjectedBundlePage.h:
              * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
              (WTR::LayoutTestController::notifyDone):
              * WebKitTestRunner/TestController.cpp:
              (WTR::TestController::didReceiveMessageFromInjectedBundle):
      2011-01-18  Maciej Stachowiak  <mjs@apple.com>
      
              Reviewed by Sam Weinig.
      
              WebKitTestRunner should track loading more like DumpRenderTree
              https://bugs.webkit.org/show_bug.cgi?id=52692
              
              Relax the message check in didSaveFrameToPageCache a bit more, since
              layout tests were still hitting the old one.
      
              * UIProcess/WebPageProxy.cpp:
              (WebKit::isDisconnectedFrame):
              (WebKit::WebPageProxy::didSaveFrameToPageCache):
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76092 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      54741f66
    • oliver@apple.com's avatar
      2011-01-18 Oliver Hunt <oliver@apple.com> · 6b5d98b0
      oliver@apple.com authored
              Reviewed by Gavin Barraclough.
      
              [jsfunfuzz] Assertion asking activation for arguments when arguments is overridden
              https://bugs.webkit.org/show_bug.cgi?id=52690
      
              Add a few more tests.
      
              * fast/js/function-dot-arguments-expected.txt:
              * fast/js/script-tests/function-dot-arguments.js:
              (overwroteArgumentsInDynamicScope1):
              (overwroteArgumentsInDynamicScope2):
              (overwroteArgumentsInDynamicScope3):
      2011-01-18  Oliver Hunt  <oliver@apple.com>
      
              Reviewed by Gavin Barraclough.
      
              [jsfunfuzz] Assertion asking activation for arguments when arguments is overridden
              https://bugs.webkit.org/show_bug.cgi?id=52690
      
              Clean up code to retrieve arguments from activation and function objects.
              Remove the incorrect assertion from JSActivation's argumentsGetter.
      
              * interpreter/Interpreter.cpp:
              (JSC::Interpreter::retrieveArguments):
              * runtime/JSActivation.cpp:
              (JSC::JSActivation::argumentsGetter):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76090 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      6b5d98b0
    • jberlin@webkit.org's avatar
      Add a test that calling window.open with an empty URL does not trigger an assertion or · aabd7ed1
      jberlin@webkit.org authored
      cause a crash.
      https://bugs.webkit.org/show_bug.cgi?id=52654
      
      Reviewed by Adam Roben.
      
      * fast/dom/Window/open-window-empty-url-expected.txt: Added.
      * fast/dom/Window/open-window-empty-url.html: Added.
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76084 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      aabd7ed1
    • msaboff@apple.com's avatar
      2011-01-18 Michael Saboff <msaboff@apple.com> · 69e68d35
      msaboff@apple.com authored
              Reviewed by Oliver Hunt.
      
              <rdar://problem/8875432> Regression: Some text-only e-mails cause hang beneath RegExp::match (52540)
              https://bugs.webkit.org/show_bug.cgi?id=52540
              https://bugs.webkit.org/show_bug.cgi?id=52662
      
              Directly use backtrack label with parentheses nested under a
              non-capturing parentheses.  Also linked current parentheses
              tail code object for possible parens nested within a non-capturing
              parentheses.
      
              * yarr/YarrJIT.cpp:
              (JSC::Yarr::YarrGenerator::BacktrackDestination::linkBacktrackToLabel):
              (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
      2011-01-18  Michael Saboff  <msaboff@apple.com>
      
              Reviewed by Oliver Hunt.
      
              <rdar://problem/8875432> Regression: Some text-only e-mails cause hang beneath RegExp::match (52540)
              https://bugs.webkit.org/show_bug.cgi?id=52540
              https://bugs.webkit.org/show_bug.cgi?id=52662
      
              New tests to check for proper linking of parentheses nested under
              a non-capturing parentheses.
      
              * fast/regex/parentheses-expected.txt:
              * fast/regex/script-tests/parentheses.js:
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76076 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      69e68d35
    • hyatt@apple.com's avatar
      <rdar://problem/8479998> REGRESSION (r67660): broken button layout at devforums.apple.com · 6f7d9fb7
      hyatt@apple.com authored
              
      Reviewed by Dan Bernstein.
      
      Exclude floating objects from shrinking to avoid floats.  They should never do this.  Timing-related bugs could
      occur as a result of this mistake, and the change to rewrite pagination to defer layout of floats until they
      got encountered on the correct line exposed this issue.
      
      Source/WebCore: 
      
      Added /fast/block/float/float-overflow-hidden-containing-block-width.html.
      
      * rendering/RenderBox.cpp:
      (WebCore::RenderBox::shrinkToAvoidFloats):
      
      LayoutTests: 
      
      Added /fast/block/float/float-overflow-hidden-containing-block-width.html.
      * fast/block/float/float-overflow-hidden-containing-block-width.html: Added.
      * platform/mac/fast/block/float/float-overflow-hidden-containing-block-width-expected.checksum: Added.
      * platform/mac/fast/block/float/float-overflow-hidden-containing-block-width-expected.png: Added.
      * platform/mac/fast/block/float/float-overflow-hidden-containing-block-width-expected.txt: Added.
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76074 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      6f7d9fb7
    • kbr@google.com's avatar
      2011-01-18 Kenneth Russell <kbr@google.com> · 592c4269
      kbr@google.com authored
              Reviewed by David Levin.
      
              Must strip comments from WebGL shaders before enforcing character set
              https://bugs.webkit.org/show_bug.cgi?id=52390
      
              Strip comments from incoming shaders, preserving line numbers,
              before validating that they conform to the ESSL character set.
              Revert changes from http://trac.webkit.org/changeset/75735 which
              allowed invalid characters to be passed to certain APIs.
      
              Tested with WebGL layout tests, conformance test suite and several
              WebGL demos in both Safari and Chromium.
      
              * html/canvas/WebGLRenderingContext.cpp:
              (WebCore::StripComments::StripComments::process):
              (WebCore::WebGLRenderingContext::shaderSource):
      2011-01-18  Kenneth Russell  <kbr@google.com>
      
              Reviewed by David Levin.
      
              Must strip comments from WebGL shaders before enforcing character set
              https://bugs.webkit.org/show_bug.cgi?id=52390
      
              Incorporated non-ASCII GLSL conformance tests from Khronos
              repository. Updated and synchronized invalid-passed-params.html
              with Khronos repository, undoing changes from
              http://trac.webkit.org/changeset/75735 .
      
              * fast/canvas/webgl/glsl-conformance-expected.txt:
              * fast/canvas/webgl/invalid-passed-params-expected.txt:
              * fast/canvas/webgl/invalid-passed-params.html:
              * fast/canvas/webgl/shaders/00_shaders.txt:
              * fast/canvas/webgl/shaders/misc: Added.
              * fast/canvas/webgl/shaders/misc/00_shaders.txt: Added.
              * fast/canvas/webgl/shaders/misc/non-ascii-comments.vert: Added.
              * fast/canvas/webgl/shaders/misc/non-ascii.vert: Added.
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76063 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      592c4269
    • oliver@apple.com's avatar
      2011-01-18 Oliver Hunt <oliver@apple.com> · 536fb9cb
      oliver@apple.com authored
              Reviewed by Antti Koivisto.
      
              [jsfunfuzz] Assertion in codegen for array of NaN constants
              https://bugs.webkit.org/show_bug.cgi?id=52643
      
              Add a testcase to ensure we handle a large number of NaN literals
              in (0/0 is folded to NaN automatically during parsing).
      
              * fast/js/codegen-temporaries-expected.txt:
              * fast/js/script-tests/codegen-temporaries.js:
      2011-01-18  Oliver Hunt  <oliver@apple.com>
      
              Reviewed by Antti Koivisto.
      
              [jsfunfuzz] Assertion in codegen for array of NaN constants
              https://bugs.webkit.org/show_bug.cgi?id=52643
      
              Don't cache NaN literals in the code generator, as NaN doesn't compare
              as equal to itself it causes problems when rehashing the number cache.
      
              * bytecompiler/BytecodeGenerator.cpp:
              (JSC::BytecodeGenerator::emitLoad):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76049 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      536fb9cb
    • commit-queue@webkit.org's avatar
      2011-01-18 Krithigassree Sambamurthy <krithigassree.sambamurthy@nokia.com> · 24d88faf
      commit-queue@webkit.org authored
              Reviewed by Simon Fraser.
      
              Support background-clip: content-box
              https://bugs.webkit.org/show_bug.cgi?id=48771
      
              Addded content-box as a valid background-clip value.
      
              * WebCore/css/CSSParser.cpp:
              (WebCore::parseBackgroundClip):
      2011-01-18  Krithigassree Sambamurthy  <krithigassree.sambamurthy@nokia.com>
      
              Reviewed by Simon Fraser.
      
              Support background-clip: content-box
              https://bugs.webkit.org/show_bug.cgi?id=48771
      
              Added test cases to check the various valid background-clip values.
      
              * fast/css/background-clip-text-expected.txt:
              * fast/css/background-clip-values-expected.checksum: Added.
              * fast/css/background-clip-values-expected.txt: Added.
              * fast/css/background-clip-values.html: Added.
              * fast/css/script-tests/background-clip-text.js:
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76047 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      24d88faf
    • commit-queue@webkit.org's avatar
      2011-01-18 Helder Correia <helder@sencha.com> · 6f93041c
      commit-queue@webkit.org authored
              Reviewed by Kenneth Rohde Christiansen.
      
              [Qt] Incorrect shadow alpha with semi-transparent solid fillStyle
              https://bugs.webkit.org/show_bug.cgi?id=52611
      
              This is related to bug 52559. The shadow color alpha must be multiplied
              by the context brush alpha.
      
              New test to ensure correct behavior of canvas with fillPath using a
              semi-transparent fillStyle color and a shadow.
      
              * fast/canvas/canvas-fillPath-alpha-shadow-expected.txt: Added.
              * fast/canvas/canvas-fillPath-alpha-shadow.html: Added.
              * fast/canvas/script-tests/canvas-fillPath-alpha-shadow.js: Added.
      2011-01-18  Helder Correia  <helder@sencha.com>
      
              Reviewed by Kenneth Rohde Christiansen.
      
              [Qt] Incorrect shadow alpha with semi-transparent solid fillStyle
              https://bugs.webkit.org/show_bug.cgi?id=52611
      
              This is related to bug 52559. The shadow color alpha must be multiplied
              by the context brush alpha.
      
              Test: fast/canvas/canvas-fillPath-alpha-shadow.html
      
              * platform/graphics/qt/GraphicsContextQt.cpp:
              (WebCore::GraphicsContext::fillPath):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76033 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      6f93041c
    • philn@webkit.org's avatar
      2011-01-18 Philippe Normand <pnormand@igalia.com> · e4ac69da
      philn@webkit.org authored
              Unreviewed, rolling out r76002.
              http://trac.webkit.org/changeset/76002
              https://bugs.webkit.org/show_bug.cgi?id=49790
      
              breaks a bunch of fast/forms tests on mac and GTK
      
              * fast/forms/select-option-background-color-change.html: Removed.
              * fast/forms/select-option-color-change.html: Removed.
              * fast/forms/select-option-visibility-change.html: Removed.
              * platform/mac/fast/forms/select-option-background-color-change-expected.checksum: Removed.
              * platform/mac/fast/forms/select-option-background-color-change-expected.png: Removed.
              * platform/mac/fast/forms/select-option-background-color-change-expected.txt: Removed.
              * platform/mac/fast/forms/select-option-color-change-expected.checksum: Removed.
              * platform/mac/fast/forms/select-option-color-change-expected.png: Removed.
              * platform/mac/fast/forms/select-option-color-change-expected.txt: Removed.
              * platform/mac/fast/forms/select-option-visibility-change-expected.checksum: Removed.
              * platform/mac/fast/forms/select-option-visibility-change-expected.png: Removed.
              * platform/mac/fast/forms/select-option-visibility-change-expected.txt: Removed.
      2011-01-18  Philippe Normand  <pnormand@igalia.com>
      
              Unreviewed, rolling out r76002.
              http://trac.webkit.org/changeset/76002
              https://bugs.webkit.org/show_bug.cgi?id=49790
      
              breaks a bunch of fast/forms tests on mac and GTK
      
              * html/HTMLOptionElement.cpp:
              (WebCore::HTMLOptionElement::setRenderStyle):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76006 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      e4ac69da
    • rwlbuis@webkit.org's avatar
      2011-01-17 Rob Buis <rwlbuis@gmail.com> · f5461080
      rwlbuis@webkit.org authored
              Reviewed by Kent Tamura.
      
              Color changes to option elements in a select multiple aren't drawn immediately
              https://bugs.webkit.org/show_bug.cgi?id=49790
      
              Redirect style changes on <option> element to the owner <select> element.
      
              Tests: fast/forms/select-option-background-color-change.html
                     fast/forms/select-option-color-change.html
                     fast/forms/select-option-visibility-change.html
      
              * html/HTMLOptionElement.cpp:
              (WebCore::HTMLOptionElement::setRenderStyle):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76002 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      f5461080
  2. 17 Jan, 2011 5 commits
  3. 16 Jan, 2011 2 commits
    • oliver@apple.com's avatar
      2011-01-16 Oliver Hunt <oliver@apple.com> · 3e7b1a63
      oliver@apple.com authored
              Reviewed by Sam Weinig.
      
              [jsfunfuzz] Parser doesn't correctly validate for-loop syntax
              https://bugs.webkit.org/show_bug.cgi?id=52516
      
              Add test for the case where a syntax error immediately follows
              multiple declarations in a for-loop initialiser.
      
              * fast/js/parser-syntax-check-expected.txt:
              * fast/js/script-tests/parser-syntax-check.js:
      2011-01-16  Oliver Hunt  <oliver@apple.com>
      
              Reviewed by Sam Weinig.
      
              [jsfunfuzz] Parser doesn't correctly validate for-loop syntax
              https://bugs.webkit.org/show_bug.cgi?id=52516
      
              Ensure that we always check for a semicolon after encountering
              multiple declarations in the initialiser portion of a for-loop.
      
              * parser/JSParser.cpp:
              (JSC::JSParser::parseForStatement):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75899 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      3e7b1a63
    • oliver@apple.com's avatar
      2011-01-16 Oliver Hunt <oliver@apple.com> · fc1b3f8f
      oliver@apple.com authored
              Reviewed by Geoffrey Garen.
      
              Strict mode restrictions on arguments and eval usage aren't complete
              https://bugs.webkit.org/show_bug.cgi?id=52528
      
              Add a helper function to aid parse failure tests by testing both direct
              eval/global code, and nested code (so that we test the syntax checker
              mode as well)
      
              * fast/js/basic-strict-mode-expected.txt:
              * fast/js/script-tests/basic-strict-mode.js:
              (shouldBeSyntaxError):
      2011-01-16  Oliver Hunt  <oliver@apple.com>
      
              Reviewed by Geoffrey Garen.
      
              Strict mode restrictions on arguments and eval usage aren't complete
              https://bugs.webkit.org/show_bug.cgi?id=52528
      
              Fix a few bugs in strict mode where we incorrect allow mutation of
              arguments and eval in the parser.
      
              Alas the "optimisation" used by the syntax checker for validating
              binary and unary expressions was too aggressive: we do actually need
              a stack for operations and operands although it needn't be as complete
              as that used for the full AST builder.
      
              Also disallow assignment to arguments in all cases as allowing arguments
              to be assignable is always an error in strict mode, regardless of context.
      
              * parser/ASTBuilder.h:
              (JSC::ASTBuilder::BinaryExprContext::BinaryExprContext):
              (JSC::ASTBuilder::UnaryExprContext::UnaryExprContext):
              * parser/JSParser.cpp:
              (JSC::JSParser::parseAssignmentExpression):
              (JSC::JSParser::parseBinaryExpression):
              (JSC::JSParser::parseUnaryExpression):
              * parser/SyntaxChecker.h:
              (JSC::SyntaxChecker::BinaryExprContext::BinaryExprContext):
              (JSC::SyntaxChecker::BinaryExprContext::~BinaryExprContext):
              (JSC::SyntaxChecker::UnaryExprContext::UnaryExprContext):
              (JSC::SyntaxChecker::UnaryExprContext::~UnaryExprContext):
              (JSC::SyntaxChecker::appendBinaryExpressionInfo):
              (JSC::SyntaxChecker::operatorStackPop):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75896 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      fc1b3f8f
  4. 15 Jan, 2011 2 commits
    • oliver@apple.com's avatar
      2011-01-15 Oliver Hunt <oliver@apple.com> · 1854231f
      oliver@apple.com authored
              Reviewed by Maciej Stachowiak.
      
              Incorrect behavior changing attributes of an accessor
              https://bugs.webkit.org/show_bug.cgi?id=52515
      
              defineProperty doesn't correctly handle changing attributes of an accessor
              property.  This is because we don't pass the full descriptor to the
              putDescriptor helper function, which means we have insufficient information
              to do the right thing. Once that's passed the correct behavior is relatively
              simple to implement.
      
              * runtime/JSObject.cpp:
              (JSC::putDescriptor):
              (JSC::JSObject::defineOwnProperty):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75884 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      1854231f
    • ddkilzer@apple.com's avatar
      <http://webkit.org/b/52512> REGRESSION(r73818): range.cloneContents() ignores end offset · d673f252
      ddkilzer@apple.com authored
      Reviewed by Adele Peterson.
      
      WebCore:
      
      The fix for Bug 50710 in r73799 introduced an off-by-one error
      when copying nodes to a local NodeVector for processing.  A fix
      was attempted for Bug 50854 in r73818, but instead of stopping
      at the end offset, it iterates through all the sibling nodes
      because the loop variable (i) is never incremented.  To clean
      this up, revert back to the code in r73799 and fix the
      off-by-one error.
      
      Test: fast/dom/Range/range-clone-contents.html
      
      * dom/Range.cpp:
      (WebCore::Range::processContents): Fix the loop that copies
      nodes to a local NodeVector by restoring the code from r73799
      and fixing the off-by-one error.
      
      LayoutTests:
      
      * fast/dom/Range/range-clone-contents-expected.txt: Added.
      * fast/dom/Range/range-clone-contents.html: Added.
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75882 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      d673f252
  5. 14 Jan, 2011 9 commits
    • oliver@apple.com's avatar
      2011-01-14 Oliver Hunt <oliver@apple.com> · edebdc12
      oliver@apple.com authored
              Reviewed by Maciej Stachowiak.
      
              [jsfunfuzz] Incorrect handling of consecutive duplicate labels
              https://bugs.webkit.org/show_bug.cgi?id=52505
      
              Add a few tests of consecutive labels containing duplicates to the parser check.
      
              * fast/js/parser-syntax-check-expected.txt:
              * fast/js/script-tests/parser-syntax-check.js:
      2011-01-14  Oliver Hunt  <oliver@apple.com>
      
              Reviewed by Maciej Stachowiak.
      
              [jsfunfuzz] Incorrect handling of consecutive duplicate labels
              https://bugs.webkit.org/show_bug.cgi?id=52505
      
              Compare StringImpl*'s instead of Identifier*'s when looking for duplicate
              labels.
      
              * parser/JSParser.cpp:
              (JSC::JSParser::parseExpressionOrLabelStatement):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75872 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      edebdc12
    • ericu@chromium.org's avatar
      2011-01-14 Eric Uhrhane <ericu@chromium.org> · bc3647f0
      ericu@chromium.org authored
              Reviewed by David Levin.
      
              Add tests for FileWriterSync
              https://bugs.webkit.org/show_bug.cgi?id=50720
      
              * fast/filesystem/resources/file-writer-sync-truncate-extend.js: Added.
              * fast/filesystem/workers/file-writer-sync-truncate-extend.html: Added.
              * fast/filesystem/workers/file-writer-sync-truncate-extend-expected.txt: Added.
              * fast/filesystem/resources/file-writer-sync-write-overlapped.js: Added.
              * fast/filesystem/workers/file-writer-sync-write-overlapped.html: Added.
              * fast/filesystem/workers/file-writer-sync-write-overlapped-expected.txt: Added.
              * fast/filesystem/resources/file-writer-utils.js:
              (assert): Make assert throw, rather than continue.
              (cleanUp): Always call finishJSTest, even without fileEntryForCleanup.
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75864 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      bc3647f0
    • oliver@apple.com's avatar
      2011-01-14 Oliver Hunt <oliver@apple.com> · 03954a3f
      oliver@apple.com authored
              Reviewed by Stephanie Lewis.
      
              [jsfunfuzz] We should be clearing the lexers temporary character buffers when switching to strict mode
              https://bugs.webkit.org/show_bug.cgi?id=52501
      
              Add checks for correct behaviour when the strict mode token is immediately followed
              by a value that needs a temporary buffer in the lexer.
      
              * fast/js/basic-strict-mode-expected.txt:
              * fast/js/script-tests/basic-strict-mode.js:
      2011-01-14  Oliver Hunt  <oliver@apple.com>
      
              Reviewed by Stephanie Lewis.
      
              [jsfunfuzz] We should be clearing the lexers temporary character buffers when switching to strict mode
              https://bugs.webkit.org/show_bug.cgi?id=52501
      
              Clear the temporary character buffers used for reading escaped characters and
              numbers.
      
              * parser/Lexer.h:
              (JSC::Lexer::setOffset):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75862 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      03954a3f
    • oliver@apple.com's avatar
      2011-01-14 Oliver Hunt <oliver@apple.com> · 1a6a9f7b
      oliver@apple.com authored
              Reviewed by Gavin Barraclough.
      
              [jsfunfuzz] parser doesn't enforce continue restrictions correctly.
              https://bugs.webkit.org/show_bug.cgi?id=52493
      
              Add a few tests for continue to cover the cases where continue
              isn't syntactically valid.
      
              * fast/js/js-continue-break-restrictions-expected.txt: Added.
              * fast/js/js-continue-break-restrictions.html: Added.
              * fast/js/script-tests/js-continue-break-restrictions.js: Added.
      2011-01-14  Oliver Hunt  <oliver@apple.com>
      
              Reviewed by Gavin Barraclough.
      
              [jsfunfuzz] parser doesn't enforce continue restrictions correctly.
              https://bugs.webkit.org/show_bug.cgi?id=52493
      
              This patch reworks handling of break, continue and label statements
              to correctly handle all the valid and invalid cases.  Previously certain
              errors would be missed by the parser in strict mode, but the bytecode
              generator needed to handle those cases for non-strict code so nothing
              failed, it simply became non-standard behaviour.
      
              Now that we treat break and continue errors as early faults in non-strict
              mode as well that safety net has been removed so the parser bugs result in
              crashes at codegen time.
      
              * parser/JSParser.cpp:
              (JSC::JSParser::ScopeLabelInfo::ScopeLabelInfo):
              (JSC::JSParser::next):
              (JSC::JSParser::nextTokenIsColon):
              (JSC::JSParser::continueIsValid):
                  Continue is only valid in loops so we can't use breakIsValid()
              (JSC::JSParser::pushLabel):
                  We now track whether the label is for a loop (and is therefore a
                  valid target for continue.
              (JSC::JSParser::popLabel):
              (JSC::JSParser::getLabel):
                  Replace hasLabel with getLabel so that we can validate the target
                  when parsing continue statements.
              (JSC::JSParser::Scope::continueIsValid):
              (JSC::JSParser::Scope::pushLabel):
              (JSC::JSParser::Scope::getLabel):
              (JSC::JSParser::JSParser):
              (JSC::JSParser::parseBreakStatement):
              (JSC::JSParser::parseContinueStatement):
              (JSC::LabelInfo::LabelInfo):
              (JSC::JSParser::parseExpressionOrLabelStatement):
                  Consecutive labels now get handled iteratively so that we can determine
                  whether they're valid targets for continue.
              * parser/Lexer.cpp:
              (JSC::Lexer::nextTokenIsColon):
              * parser/Lexer.h:
              (JSC::Lexer::setOffset):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75852 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      1a6a9f7b
    • commit-queue@webkit.org's avatar
      2011-01-14 Helder Correia <helder@sencha.com> · 7240bdcc
      commit-queue@webkit.org authored
              Reviewed by Simon Fraser.
      
              Shadow is not drawn when filling a path with a gradient
              https://bugs.webkit.org/show_bug.cgi?id=51982
      
              This happens in CG and is related to bug 51869, this time to be fixed
              in GraphicsContext::fillPath(const Path& path). We need to draw the
              gradient clipped to the path on a CGLayer first, and then draw the
              layer on the GraphicsContext.
      
              * fast/canvas/canvas-fillPath-gradient-shadow-expected.txt: Added.
              * fast/canvas/canvas-fillPath-gradient-shadow.html: Added.
              * fast/canvas/script-tests/canvas-fillPath-gradient-shadow.js: Added.
              * platform/chromium/test_expectations.txt: Skipping new test since it fails.
              * platform/qt/Skipped: Ditto.
      2011-01-14  Helder Correia  <helder@sencha.com>
      
              Reviewed by Simon Fraser.
      
              Shadow is not drawn when filling a path with a gradient
              https://bugs.webkit.org/show_bug.cgi?id=51982
      
              This happens in CG and is related to bug 51869, this time to be fixed
              in GraphicsContext::fillPath(const Path& path). We need to draw the
              gradient clipped to the path on a CGLayer first, and then draw the
              layer on the GraphicsContext.
      
              Test: fast/canvas/canvas-fillPath-gradient-shadow.html
      
              * platform/graphics/cg/GraphicsContextCG.cpp:
              (WebCore::GraphicsContext::fillPath):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75833 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      7240bdcc
    • inferno@chromium.org's avatar
      2011-01-14 Abhishek Arya <inferno@chromium.org> · e3baac1e
      inferno@chromium.org authored
              Reviewed by David Hyatt.
      
              Fix parent block calculation when trying to find top most node
              containing "this" float.
              https://bugs.webkit.org/show_bug.cgi?id=51711
      
              Replace use of containingBlock and traverse the parents directly
              to check for float existence. containingBlock can skip parents and
              jump to the RenderView directly which will cause floats to not get
              cleared from intermediate parents.
      
              Test: fast/block/float/floats-not-cleared-crash.html
      
              * rendering/RenderBox.cpp:
              (WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
      2011-01-14  Abhishek Arya  <inferno@chromium.org>
      
              Reviewed by Dave Hyatt.
      
              Tests that we do not crash due to uncleared floats in parent nodes.
              https://bugs.webkit.org/show_bug.cgi?id=51711
      
              * fast/block/float/floats-not-cleared-crash-expected.txt: Added.
              * fast/block/float/floats-not-cleared-crash.html: Added.
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75823 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      e3baac1e
    • satish@chromium.org's avatar
      2011-01-12 Satish Sampath <satish@chromium.org> · d12b0054
      satish@chromium.org authored
              Reviewed by Dimitri Glazkov.
      
              Fix a crash when accessing speech input from script.
              https://bugs.webkit.org/show_bug.cgi?id=52325
      
              Added a layout test to check enabling/disabling speech input from script.
      
              * fast/speech/speech-input-scripting-expected.txt: Added.
              * fast/speech/speech-input-scripting.html: Added.
      2011-01-12  Satish Sampath  <satish@chromium.org>
      
              Reviewed by Dimitri Glazkov.
      
              Fix a crash when accessing speech input from script.
              https://bugs.webkit.org/show_bug.cgi?id=52325
      
              Test: fast/speech/speech-input-scripting.html
      
              * html/HTMLInputElement.cpp:
              (WebCore::HTMLInputElement::parseMappedAttribute): Recreate renderer when speech input is enabled/disabled.
              * rendering/RenderTextControlSingleLine.cpp: Remove unused code.
              * rendering/RenderTextControlSingleLine.h:
              * rendering/TextControlInnerElements.cpp: Take self references before firing events and check for renderer validity after.
              (WebCore::InputFieldSpeechButtonElement::defaultEventHandler):
              (WebCore::InputFieldSpeechButtonElement::setRecognitionResult):
              (WebCore::InputFieldSpeechButtonElement::detach):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75811 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      d12b0054
    • inferno@chromium.org's avatar
      2011-01-14 Abhishek Arya <inferno@chromium.org> · ef0f5542
      inferno@chromium.org authored
              Reviewed by David Hyatt.
      
              Prevent merging of anonymous blocks if one of them is already getting
              destroyed.
              https://bugs.webkit.org/show_bug.cgi?id=52402
      
              Test: fast/block/merge-anonymous-block-remove-child-crash2.html
      
              * rendering/RenderBlock.cpp:
              (WebCore::RenderBlock::RenderBlock): initialize m_beingDestroyed to false.
              (WebCore::RenderBlock::destroy): set m_beingDestroyed to true.
              (WebCore::canMergeContiguousAnonymousBlocks): do not merge if any or prev or next is being destroyed.
              (WebCore::RenderBlock::removeChild): remove the hack previously done for preventing oldChild merging with nextBlock's next sibling.
              * rendering/RenderBlock.h:
              (WebCore::RenderBlock::beingDestroyed): public function for m_beingDestroyed.
      2011-01-14  Abhishek Arya  <inferno@chromium.org>
      
              Reviewed by David Hyatt.
      
              Tests that we do not crash when trying to merge anonymous blocks, one of which
              is already getting destroyed.
              https://bugs.webkit.org/show_bug.cgi?id=52402
      
              * fast/block/merge-anonymous-block-remove-child-crash2-expected.txt: Added.
              * fast/block/merge-anonymous-block-remove-child-crash2.html: Added.
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75810 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      ef0f5542
    • msaboff@apple.com's avatar
      2011-01-14 Michael Saboff <msaboff@apple.com> · 0fcfa8d1
      msaboff@apple.com authored
              Reviewed by Oliver Hunt.
      
              Incorrect backtracking for nested alternatives
              https://bugs.webkit.org/show_bug.cgi?id=52387
      
              Added tests to verfiy backtracking of alternatives following 
              parenthesis.
      
              * fast/regex/parentheses-expected.txt:
              * fast/regex/script-tests/parentheses.js:
      2011-01-14  Michael Saboff  <msaboff@apple.com>
      
              Reviewed by Oliver Hunt.
      
              Incorrect backtracking for nested alternatives
              https://bugs.webkit.org/show_bug.cgi?id=52387
      
              In the process of propigating a datalabel it wasn't getting connected
              to a destination when the destination was an indirect jump.  Added
              code to recognize a direct backtrack destination that was an indirect
              jump and added mechanism to associate DataLabelPtrs with indirect
              jump entries.
              Removed dead method
              BacktrackDestination::linkDataLabelToHereIfExists()
      
              * yarr/YarrJIT.cpp:
              (JSC::Yarr::YarrGenerator::IndirectJumpEntry::IndirectJumpEntry):
              (JSC::Yarr::YarrGenerator::IndirectJumpEntry::addDataLabel):
              (JSC::Yarr::YarrGenerator::GenerationState::addIndirectJumpEntry):
              (JSC::Yarr::YarrGenerator::GenerationState::emitIndirectJumpTable):
              Changes to link indirect jumps with DataLabelPtr's.
              (JSC::Yarr::YarrGenerator::BacktrackDestination::clearSubDataLabelPtr):
              (JSC::Yarr::YarrGenerator::TermGenerationState::linkDataLabelToBacktrackIfExists): 
              Updated to handle immediate linking of indirect jumps to
              DataLabelPtr.
              (JSC::Yarr::YarrGenerator::generateParenthesesDisjunction): Changed to
              reflect updated linkDataLabelToBacktrackIfExists().
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75796 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      0fcfa8d1
  6. 13 Jan, 2011 6 commits
    • jianli@chromium.org's avatar
      Change createObjectURL and revokeObjectURL to put under webkitURL. · 1c19f401
      jianli@chromium.org authored
      https://bugs.webkit.org/show_bug.cgi?id=52257
      
      Reviewed by Darin Fisher.
      
      Source/WebCore:
      
      Note that we add "webkit" vendor prefix to URL that is introduced in
      the latest File API spec.
      
      For the time being, we implement webkitURL as a readonly attribute
      instead of a constructor so that we will not expose prototype property,
      as required by the spec.
      
      * Android.derived.jscbindings.mk:
      * Android.derived.v8bindings.mk:
      * Android.mk:
      * CMakeLists.txt:
      * DerivedSources.cpp:
      * DerivedSources.make:
      * GNUmakefile.am:
      * WebCore.gypi:
      * WebCore.pri:
      * WebCore.pro:
      * WebCore.vcproj/WebCore.vcproj:
      * WebCore.xcodeproj/project.pbxproj:
      * html/DOMURL.cpp: Added.
      * html/DOMURL.h: Added.
      * html/DOMURL.idl: Added.
      * inspector/front-end/NetworkPanel.js:
      * inspector/front-end/utilities.js:
      * page/DOMWindow.cpp:
      (WebCore::DOMWindow::webkitURL):
      * page/DOMWindow.h:
      * page/DOMWindow.idl:
      * workers/WorkerContext.cpp:
      (WebCore::WorkerContext::webkitURL):
      * workers/WorkerContext.h:
      * workers/WorkerContext.idl:
      
      LayoutTests:
      
      Change all related test scripts and results to account for this change.
      
      * fast/dom/Window/script-tests/window-property-descriptors.js:
      * fast/dom/Window/window-properties-expected.txt:
      * fast/dom/Window/window-properties.html:
      * fast/dom/script-tests/prototype-inheritance-2.js:
      * fast/dom/script-tests/prototype-inheritance.js:
      * fast/files/apply-blob-url-to-img.html:
      * fast/files/apply-blob-url-to-xhr.html:
      * fast/files/create-blob-url-crash.html:
      * fast/files/revoke-blob-url.html:
      * fast/files/workers/resources/worker-apply-blob-url-to-xhr.js:
      (onmessage):
      * platform/qt/fast/dom/Window/window-properties-expected.txt:
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75739 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      1c19f401
    • commit-queue@webkit.org's avatar
      2011-01-13 Emil Eklund <eae@chromium.org> · 129fb5fc
      commit-queue@webkit.org authored
              Reviewed by Dimitri Glazkov.
      
              Setting outerText should convert CR/LF to <br>
              https://bugs.webkit.org/show_bug.cgi?id=52268
      
              Add test for setting Element.outerText.
      
              * fast/dom/set-outer-text-expected.txt: Added.
              * fast/dom/set-outer-text.html: Added.
              * fast/dom/text-node-append-data-remove-crash-expected.txt: Changed
                  expectation to "didn't crash" from "threw dom exception" as test
                  assumed the DOMCharacterDataModified event would fire before the node
                  would be replaced.
              * fast/dom/text-node-append-data-remove-crash.html:
      2011-01-13  Emil Eklund  <eae@chromium.org>
      
              Reviewed by Dimitri Glazkov.
      
              Setting outerText should convert CR/LF to <br>
              https://bugs.webkit.org/show_bug.cgi?id=52268
      
              Make set outerText support line breaks (sharing the text to fragment code
              with setInnerText) and handle empty text nodes the same way IE does.
      
              Test: fast/dom/set-outer-text.html
      
              * html/HTMLElement.cpp:
              (WebCore::HTMLElement::textToFragment): Shared between setInnerText and setOuterText
              (WebCore::HTMLElement::setInnerText): Split out text parsing code.
              (WebCore::mergeWithNextTextNode): Split out text node merging code.
              (WebCore::HTMLElement::setOuterText): Added support for line breaks.
              * html/HTMLElement.h:
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75738 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      129fb5fc
    • zmo@google.com's avatar
      2011-01-13 Zhenyao Mo <zmo@google.com> · 4a8acbe1
      zmo@google.com authored
              Reviewed by Kenneth Russell.
      
              Relax the ESSL valid charset a little bit to include " ' `
              https://bugs.webkit.org/show_bug.cgi?id=52396
      
              * html/canvas/WebGLRenderingContext.cpp:
      2011-01-13  Zhenyao Mo  <zmo@google.com>
      
              Reviewed by Kenneth Russell.
      
              Relax the ESSL valid charset a little bit to include " ' `
              https://bugs.webkit.org/show_bug.cgi?id=52396
      
              * fast/canvas/webgl/invalid-passed-params-expected.txt:
              * fast/canvas/webgl/invalid-passed-params.html:
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75735 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      4a8acbe1
    • mdelaney@apple.com's avatar
      2011-01-13 Matthew Delaney <mdelaney@apple.com> · 53c870c2
      mdelaney@apple.com authored
              Reviewed by nobody - reinstrumenting a test to save burning trees.
      
              fast/canvas/canvas-large-dimensions.html (introduced in r75648) is failing on all platforms except Snow Leopard
              https://bugs.webkit.org/show_bug.cgi?id=52341
      
              * fast/canvas/canvas-large-dimensions-expected.txt: Replaced.
              * fast/canvas/canvas-large-dimensions.html:
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75732 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      53c870c2
    • aroben@apple.com's avatar
      Disable fast/profiler/throw-exception-from-eval.html · 985ebca1
      aroben@apple.com authored
      This test fails non-deterministically. See <http://webkit.org/b/49801>.
      
      * fast/profiler/throw-exception-from-eval.html-disabled: Renamed from LayoutTests/fast/profiler/throw-exception-from-eval.html.
      
      * platform/gtk/Skipped:
      * platform/mac-leopard/Skipped:
      * platform/qt/Skipped:
      Un-skipped this test now that it's been disabled by other means.
      
      * platform/win-xp/fast/profiler/throw-exception-from-eval-expected.txt: Removed.
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75723 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      985ebca1
    • mitz@apple.com's avatar
      <rdar://problem/8858548> Disable inheritance of text emphasis marks to ruby text · e15908bc
      mitz@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=52359
      
      Reviewed by Dave Hyatt.
      
      Source/WebCore: 
      
      Test: fast/ruby/text-emphasis.html
      
      * css/html.css:
      (rt):
      
      LayoutTests: 
      
      * fast/ruby/text-emphasis-expected.txt: Added.
      * fast/ruby/text-emphasis.html: Added.
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75707 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      e15908bc
  7. 12 Jan, 2011 3 commits
    • rniwa@webkit.org's avatar
      2011-01-12 Ryosuke Niwa <rniwa@webkit.org> · a0ffb017
      rniwa@webkit.org authored
              Reviewed by Eric Seidel.
      
              REGRESSION(r69831): focus() in onkeypress discards input (affects chaseonline.chase.com)
              https://bugs.webkit.org/show_bug.cgi?id=52241
      
              The bug was caused by RenderTextControl::selection's creating a Range with m_insertText
              which is a shadow DOM div as both start and end containers. Fixed the bug by traversing
              through the descendents of m_innerText and using the right start and end containers to
              create a Range.
      
              Test: fast/forms/focus-change-on-keypress.html
      
              * rendering/RenderTextControl.cpp:
              (WebCore::setContainerAndOffsetForRange): Added; a helper function.
              (WebCore::RenderTextControl::selection): See above.
      2011-01-12  Ryosuke Niwa  <rniwa@webkit.org>
      
              Reviewed by Eric Seidel.
      
              REGRESSION(r69831): focus() in onkeypress discards input (affects chaseonline.chase.com)
              https://bugs.webkit.org/show_bug.cgi?id=52241
      
              Added a test to ensure WebKit inserts the character typed by a user when focus's node
              is changed by a presskey event handler.
      
              * fast/forms/focus-change-on-keypress-expected.txt: Added.
              * fast/forms/focus-change-on-keypress.html: Added.
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75677 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      a0ffb017
    • tkent@chromium.org's avatar
      2011-01-12 Kenichi Ishibashi <bashi@google.com> · 46a996c0
      tkent@chromium.org authored
              Reviewed by Kent Tamura.
      
              M_formElementsWithFormAttribute not cleared when FormAssociatedElement is inserted with a null m_form and then removed.
              https://bugs.webkit.org/show_bug.cgi?id=51905
      
              Calls unregisterFormElementWithFormAttribute() when 'form' attribute
              is removed.
      
              Tests: fast/forms/form-associated-element-crash.html
                     fast/forms/form-associated-element-crash2.html
      
              * html/FormAssociatedElement.cpp:
              (WebCore::FormAssociatedElement::formAttributeChanged):
      
      2011-01-12  Kenichi Ishibashi  <bashi@google.com>
      
              Reviewed by Kent Tamura.
      
              M_formElementsWithFormAttribute not cleared when FormAssociatedElement is inserted with a null m_form and then removed.
              https://bugs.webkit.org/show_bug.cgi?id=51905
      
              Add test for crash when modifying the form attribute of a form
              associated element before removing it.
      
              * fast/forms/form-associated-element-crash-expected.txt: Added.
              * fast/forms/form-associated-element-crash.html: Added.
              * fast/forms/form-associated-element-crash2-expected.txt: Added.
              * fast/forms/form-associated-element-crash2.html: Added.
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75676 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      46a996c0
    • tkent@chromium.org's avatar
      2011-01-12 Kenichi Ishibashi <bashi@google.com> · d408e11e
      tkent@chromium.org authored
              Reviewed by Kent Tamura.
      
              M_formElementsWithFormAttribute not cleared when Node is moved to another document.
              https://bugs.webkit.org/show_bug.cgi?id=51418
      
              Calls unregisterFormElementWithFormAttribute() when form associated elements
              are moved to another document.
      
              Test: fast/forms/change-form-element-document-crash.html
      
              * html/FormAssociatedElement.cpp:
              (WebCore::FormAssociatedElement::willMoveToNewOwnerDocument): Added.
              * html/FormAssociatedElement.h: Added willMoveToNewOwnerDocument().
              * html/HTMLFormControlElement.cpp:
              (WebCore::HTMLFormControlElement::willMoveToNewOwnerDocument): Added.
              * html/HTMLFormControlElement.h: Added willMoveToNewOwnerDocument().
              * html/HTMLObjectElement.cpp:
              (WebCore::HTMLObjectElement::willMoveToNewOwnerDocument): Added.
              * html/HTMLObjectElement.h: Added willMoveToNewOwnerDocument().
              * html/HTMLPlugInImageElement.h: Moves willMoveToNewOwnerDocument() to protected.
      
      2011-01-12  Kenichi Ishibashi  <bashi@google.com>
      
              Reviewed by Kent Tamura.
      
              M_formElementsWithFormAttribute not cleared when Node is moved to another document.
              https://bugs.webkit.org/show_bug.cgi?id=51418
      
              Added test for crash when moving form elements from one document to another.
      
              * fast/forms/change-form-element-document-crash-expected.txt: Added.
              * fast/forms/change-form-element-document-crash.html: Added.
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75675 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      d408e11e