Reviewed by darin
        
        <rdar://problem/5046875> 
        Gmail Editor: Applying alignment to selected text in message also applies alignment to signature

        Added:
        * editing/style/5046875-1-expected.checksum: Added.
        * editing/style/5046875-1-expected.png: Added.
        * editing/style/5046875-1-expected.txt: Added.
        * editing/style/5046875-1.html: Added.
        * editing/style/5046875-2-expected.checksum: Added.
        * editing/style/5046875-2-expected.png: Added.
        * editing/style/5046875-2-expected.txt: Added.
        * editing/style/5046875-2.html: Added.
        moveParagraphs doesn't move unnecessary brs:
        * editing/style/create-block-for-style-002-expected.txt:
        * editing/style/create-block-for-style-004-expected.txt:
        * editing/style/create-block-for-style-001-expected.txt:
        * editing/style/create-block-for-style-009-expected.txt:
        * editing/style/create-block-for-style-010-expected.txt:
        moveParagraphs clears out unrendered text during the move:
        * editing/style/create-block-for-style-011-expected.txt:
        * editing/style/create-block-for-style-007-expected.txt:
        * editing/style/create-block-for-style-012-expected.txt:

WebCore:

        Reviewed by darin
        
        <rdar://problem/5046875> 
        Gmail Editor: Applying alignment to selected text in message also applies alignment to signature

        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::doApply): Don't call applyBlockStyle unless
        there is a block style to apply.
        (WebCore::ApplyStyleCommand::applyBlockStyle): Don't do the remove step.
        It was unnecessary and removed properties from blocks that could contain 
        content outside the range being operated on (added a testcase).
        (WebCore::ApplyStyleCommand::addBlockStyleIfNeeded): Used an early return
        instead of if-nesting.
        * editing/ApplyStyleCommand.h:
        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary):
        Return the new block, if one was created.  Use moveParagraphs to move
        paragraphs into the new block, instead of moving nodes.  The old code moved
        too much (added a testcase).
        * editing/CompositeEditCommand.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20181 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Brady.
WebCore:
        To fix <rdar://problem/5044366> we now pass a NSString
        representation of the URL extracted with _web_originalDataAsString
        instead of relying on [NSURL absoluteString] in the bridge

        * page/mac/WebCoreFrameBridge.h:
        * page/mac/WebCoreFrameBridge.mm:
        (-[WebCoreFrameBridge getData:andResponse:forURL:]):
WebKit:
        Modify subresourceForURL to take NSString argument 
        so we can avoid [NSURL absoluteString]

        * WebView/WebDataSource.mm:
        (-[WebDataSource subresourceForURL:]):
LayoutTests:
        Test for <rdar://problem/5044366> make sure we can create
        a WebArchive from a page with a partially decoded url.

        * webarchive/archive-with-unencoded-url-expected.txt: Added.
        * webarchive/archive-with-unencoded-url.html: Added.




git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20180 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Rendering part reviewed by Hyatt. Editing part consulted with and 
        rubber stamped by Justin and Harrison.

        Fix for <rdar://problem/5025925> A hang occurs in Safari when 
        attempting to print page at http://www.pcadvisor.co.uk

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::makeChildrenNonInline): 
        RenderBlock::makeChildrenNonInline() takes a block's inline 
        children and turns them into block children. If the children had 
        line boxes, those boxes were being leaked. In the layout test I 
        added with the change (and at pcadvisor.co.uk during printing) 
        children were being made non-inline, and then they were being made 
        inline again. This meant that some of the children ended up 
        pointing to totally stale line boxes that are normally just leaked. 
        This caused an infinite loop in RenderFlow::destroy(). This patch 
        simply deletes everyone's line boxes in 
        RenderBlock::makeChildrenNonInline()

        * editing/InsertParagraphSeparatorCommand.cpp:
        (WebCore::InsertParagraphSeparatorCommand::doApply): The other part 
        of this fix is that I added a call to updateLayout in 
        InsertParagraphSeparatorCommand::doApply(). One layout test 
        (editing/spelling/spelling.html) was changed by my patch to 
        RenderBlock. doApply() inserts a node into the render tree. In at 
        least one case in spelling.html, that caused some line boxes to be 
        deleted. Back in doApply() this meant that the RenderTree was out-
        of-date, and we mistakenly thought we were at the end of the 
        paragraph. This caused us to insert a RenderBR() at the end of the 
        tree instead of an empty RenderText(). No one seems to know exactly 
        why we insert either, or if the change is necessarily a problem. It 
        is clear, though, that the RenderTree in doApply() is out-of-date 
        after inserting the node and deleting some line boxes, so it seems 
        prudent to call into updateLayout().

LayoutTests:
        Reviewed by Hyatt.

        Test for <rdar://problem/5025925> A hang occurs in Safari when 
        attempting to print page at http://www.pcadvisor.co.uk

        * fast/block/float/nestedAnonymousBlocks-expected.checksum: Added.
        * fast/block/float/nestedAnonymousBlocks-expected.png: Added.
        * fast/block/float/nestedAnonymousBlocks-expected.txt: Added.
        * fast/block/float/nestedAnonymousBlocks.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20177 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        <rdar://problem/5031189> REGRESSION: cntl-y yanks only the most recently killed content

        Updated results.

        * editing/deleting/delete-to-end-of-paragraph-expected.checksum:
        * editing/deleting/delete-to-end-of-paragraph-expected.txt:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20175 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Maciej.

        - tests for http://bugs.webkit.org/show_bug.cgi?id=12794
          <rdar://problem/5028154> REGRESSION: TripTik planner at aaa.com never
          finishes loading due to unclosed canvas tag (12794)

        * fast/canvas/canvas-hides-fallback-expected.txt: Added.
        * fast/canvas/canvas-hides-fallback.html: Added.
        * fast/canvas/script-inside-canvas-fallback-expected.txt: Added.
        * fast/canvas/script-inside-canvas-fallback.html: Added.
        * fast/canvas/unclosed-canvas-1-expected.txt: Added.
        * fast/canvas/unclosed-canvas-1.html: Added.
        * fast/canvas/unclosed-canvas-2-expected.txt: Added.
        * fast/canvas/unclosed-canvas-2.html: Added.
        * fast/canvas/unclosed-canvas-3-expected.txt: Added.
        * fast/canvas/unclosed-canvas-3.html: Added.
        * fast/canvas/unclosed-canvas-4-expected.txt: Added.
        * fast/canvas/unclosed-canvas-4.html: Added.

WebCore:

        Reviewed by Maciej.

        - fix http://bugs.webkit.org/show_bug.cgi?id=12794
          <rdar://problem/5028154> REGRESSION: TripTik planner at aaa.com never
          finishes loading due to unclosed canvas tag (12794)

        Change <canvas> elements so that their contents are parsed normally,
        but not rendered. This change fixes the bug, because normal parsing
        rules close the <canvas> element in that case. The special parser
        stuff was just getting in the way.

        Also do some basic cleanup to the HTML parser. This was motivated by
        an earlier version of this patch that made even more changes to the
        parser, but the cleanup is still worth landing.

        Test: fast/canvas/canvas-hides-fallback.html
        Test: fast/canvas/script-inside-canvas-fallback.html
        Test: fast/canvas/unclosed-canvas-1.html
        Test: fast/canvas/unclosed-canvas-2.html
        Test: fast/canvas/unclosed-canvas-3.html
        Test: fast/canvas/unclosed-canvas-4.html

        * html/HTMLCanvasElement.h: Added a data member to keep track of whether the
        renderer is a RenderHTMLCanvas or not.
        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::createRenderer): If JavaScript is enabled, create
        a RenderHTMLCanvas. If it's not, let the default code create the default type
        of renderer, which will result in fallback content being visible. The
        RenderHTMLCanvas class already hides all of its children. Set the m_rendererIsCanvas
        boolean accordingly. Since the actual storage for the canvas is allocated lazily
        when you actually get a drawing context, we don't need to do anything special
        to prevent it when JavaScript is disabled; the relevant functions won't be called.
        (WebCore::HTMLCanvasElement::reset): Protect the code that manipulates the
        RenderHTMLCanvas with a check of m_rendererIsCanvas. This is the only code inside
        the DOM element that relies on the renderer type.

        * html/HTMLParser.h: Removed unneeded includes. Marked HTMLParser as
        Noncopyable. Changed the Document parameter to the constructor to instead
        of HTMLDocument. Renamed discard_until to m_skipModeTag for clarity.
        Removed unused noSpaces function and unneeded public doc() function.
        Moved data members all down to the end so you can see them together in order.
        Renamed map to m_currentMapElement and isindex to m_isindexElement.
        Removed unused end and headLoaded data members.  Renamed m_fragment to
        m_isParsingFragment to make it clearer that it's a boolean, not a fragment.

        * html/HTMLParser.cpp:
        (WebCore::HTMLParser::HTMLParser): Changed to use member construction
        syntax instead of calling reset(). This is especially helpful in the
        fragment case, where calling reset() later on is illegal, so not using
        it in the constructor lets us assert.
        (WebCore::HTMLParser::~HTMLParser): Did an explicit deref instead of
        calling setCurrent for its side effect.
        (WebCore::HTMLParser::reset): Updated for member name changes and removal
        and to use document instead of doc().
        (WebCore::HTMLParser::setCurrent): Use document instead of doc().
        (WebCore::HTMLParser::setSkipMode): Added. No longer inline. Now sets the
        m_inCanvasBeforeFirstOpenTag data member to false.
        (WebCore::HTMLParser::parseToken): Tightened up the skip mode logic at the
        top of the function, and added a FIXME about the strange case there where
        we don't skip yet stay in skip mode. Updated for renaming and doc().
        (WebCore::HTMLParser::insertNode): Updated for renaming and doc().
        (WebCore::HTMLParser::handleError): Ditto.
        (WebCore::HTMLParser::framesetCreateErrorCheck): Ditto.
        (WebCore::HTMLParser::isindexCreateErrorCheck): Changed to use RefPtr.
        (WebCore::HTMLParser::noscriptCreateErrorCheck): Updated for renaming and doc().
        (WebCore::HTMLParser::mapCreateErrorCheck): Ditto.
        (WebCore::HTMLParser::getNode): Removed the special case for canvas here.
        Canvas fallback is now handled in the DOM, not the parser. Updated for
        renaming and doc().
        (WebCore::HTMLParser::allowNestedRedundantTag): Changed a #define into a C++
        constant.
        (WebCore::HTMLParser::processCloseTag): Updated for renaming and doc().
        (WebCore::HTMLParser::isInline): Ditto.
        (WebCore::HTMLParser::tagIsOnStack): Added. Used by new canvas logic.
        (WebCore::HTMLParser::popBlock): Updated for renaming and doc(). Also renamed
        the local variable Elem to elem.
        (WebCore::HTMLParser::createHead): Ditto.
        (WebCore::HTMLParser::handleIsindex): Changed to use RefPtr.
        (WebCore::HTMLParser::startBody): Updated for renaming and doc().
        (WebCore::HTMLParser::finished): Ditto.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20170 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Justin.

        <rdar://problem/5031181> cntl-k at end of paragraph adds nothing to the kill ring
        <rdar://problem/5031189> REGRESSION: cntl-y yanks only the most recently killed content

        * editing/pasteboard/emacs-ctrl-k-y-001-expected.checksum: Added.
        * editing/pasteboard/emacs-ctrl-k-y-001-expected.png: Added.
        * editing/pasteboard/emacs-ctrl-k-y-001-expected.txt: Added.
        * editing/pasteboard/emacs-ctrl-k-y-001.html: Added.

WebCore:

        Reviewed by Justin.

        <rdar://problem/5031181> cntl-k at end of paragraph adds nothing to the kill ring
        <rdar://problem/5031189> REGRESSION: cntl-y yanks only the most recently killed content

        For rdar://5031181, properly extend the selection before the killring handling, and
        make sure plainText of that selection returns a linefeed.
        
        For rdar://5031189, restore Editor::deleteRange() code that continued current killring,
        even though the range deletion implicitly stopped it via changing the selection.
        
        A byproduct of this change is the elimination of RUNDFINDER vs CONTENT TextIterator. The
        only difference between the two was whether to emit a newline when the range started
        with a blockflow element. No callers actually need that any more.

        Tests added:
        * editing/pasteboard/emacs-ctrl-k-y-001-expected.checksum: Added.
        * editing/pasteboard/emacs-ctrl-k-y-001-expected.png: Added.
        * editing/pasteboard/emacs-ctrl-k-y-001-expected.txt: Added.
        * editing/pasteboard/emacs-ctrl-k-y-001.html: Added.

        * editing/Editor.cpp:
        (WebCore::Editor::deleteRange):
        Clear the "start new kill ring sequence" setting, because it was set to true
        when the selection was updated by deleting the range.
        
        (WebCore::Editor::deleteWithDirection):
        If extending the selection to the end of paragraph resulted in a caret selection,
        extend by character, to handle the case when the selection started as a caret at
        the end of paragraph.
        
        * editing/TextIterator.cpp:
        (WebCore::TextIterator::TextIterator):
        Initialize new member variables for tracking handling of the beginning of the range.
        
        (WebCore::TextIterator::advance):
        Call representNodeOffsetZero on the m_endContainer.
        Move visibility checks into handleTextNode and handleReplacedElement.
        
        (WebCore::TextIterator::handleTextNode):
        (WebCore::TextIterator::handleTextBox):
        Call emitText.
        
        (WebCore::TextIterator::handleReplacedElement):
        Moved visibility check into here.
        
        (WebCore::shouldEmitNewlinesBeforeAndAfterNode):
        
        (WebCore::TextIterator::shouldRepresentNodeOffsetZero):
        (WebCore::TextIterator::representNodeOffsetZero):
        New. Emits proper sequence when encountering offset 0 of a node, including the
        m_endContainer. Started with code from handleNonTextNode.
        
        (WebCore::TextIterator::handleNonTextNode):
        Call representNodeOffsetZero.
        
        (WebCore::TextIterator::exitNode):
        Similar to shouldRepresentNodeOffsetZero, do not emit the newline if the node
        was collapsed, and before any other emitted content.
        
        (WebCore::TextIterator::emitCharacter):
        
        (WebCore::TextIterator::emitText):
        New. Consolidates code used by handleText and handleTextBox.
        
        (WebCore::CharacterIterator::CharacterIterator):
        Removed RUNFINDER.

        (WebCore::WordAwareIterator::WordAwareIterator):
        Removed RUNFINDER.
        
        (WebCore::WordAwareIterator::advance):
        Formatting.

        (WebCore::TextIterator::rangeLength):
        Formatting.
        
        * editing/TextIterator.h:
        Added member variables for tracking handling of the beginning of the range.
        Eliminated concept of RUNDFINDER vs CONTENT TextIterator.
        
        * editing/visible_units.cpp:
        (WebCore::nextBoundary):
        Eliminated concept of RUNDFINDER vs CONTENT TextIterator.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20166 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin.
        
        http://bugs.webkit.org/show_bug.cgi?id=11083
        REGRESSION: Typing tab key fails to insert a tab character in Google Docs editable area
        <rdar://problem/4757650>

        * editing/inserting/typing-tab-designmode-expected.txt: Added.
        * editing/inserting/typing-tab-designmode-forms-expected.checksum: Added.
        * editing/inserting/typing-tab-designmode-forms-expected.png: Added.
        * editing/inserting/typing-tab-designmode-forms-expected.txt: Added.
        * editing/inserting/typing-tab-designmode-forms.html: Added.
        * editing/inserting/typing-tab-designmode.html: Added.

WebCore:

        Reviewed by Darin.
        
        Fix http://bugs.webkit.org/show_bug.cgi?id=11083
        REGRESSION: Typing tab key fails to insert a tab character in Google Docs editable area
        <rdar://problem/4757650>
        
        Allow inserting tabs in designMode. Backtab behaves like before (matches FF).

        * page/EventHandler.cpp:
        (WebCore::EventHandler::defaultTabEventHandler):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20159 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        the js-test-pre.js change.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20149 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Adele.

        - test for http://bugs.webkit.org/show_bug.cgi?id=12595
          <rdar://problem/4722863> REGRESSION: Can't add item to cart at lnt.com
          (JS type error) (12595)

        * fast/forms/old-names-expected.txt: Added.
        * fast/forms/old-names.html: Added.

        - check in files that were somehow left out in the last check-in

        * fast/js/resources/js-test-pre.js: Improve the format of the failure message when
        both the real results and expected results are strings.
        * fast/dom/wrapper-classes-expected.txt: Changed back to use the new format.

WebCore:

        Reviewed by Adele.

        - fix http://bugs.webkit.org/show_bug.cgi?id=12595
          <rdar://problem/4722863> REGRESSION: Can't add item to cart at lnt.com
          (JS type error) (12595)

        Test: fast/forms/old-names.html

        * bindings/js/JSHTMLFormElementCustom.cpp:
        (WebCore::JSHTMLFormElement::canGetItemsForName): If the form collection has
        nothing for a given name, try the form's oldNamedElement function.
        (WebCore::JSHTMLFormElement::nameGetter): Ditto.

        * bindings/js/kjs_dom.h: Removed the DOMNamedNodesCollection. Instead we will use
        a class derived from NodeList.
        * bindings/js/kjs_dom.cpp: Ditto.

        * bindings/js/kjs_html.cpp:
        (KJS::VectorNodeList::VectorNodeList): Added. Constructor for a new class derived
        from NodeList to be used for the named items result from a collection -- uses a
        vector of node pointers.
        (KJS::VectorNodeList::length): Added.
        (KJS::VectorNodeList::item): Added.
        (KJS::JSHTMLCollection::getNamedItems): Use VectorNodeList and the existing wrapper
        for NodeList rather than a custom JavaScript class, DOMNamedNodesCollection.

        * dom/ChildNodeList.h:
        * dom/ChildNodeList.cpp:
        (WebCore::ChildNodeList::ChildNodeList): Updated to derive from TreeNodeList,
        since NodeList is now a simpler class.
        (WebCore::ChildNodeList::elementMatches): Updated for name and parameter change.

        * dom/NameNodeList.h:
        * dom/NameNodeList.cpp:
        (WebCore::NameNodeList::NameNodeList): Updated to derive from TreeNodeList,
        since NodeList is now a simpler class.
        (WebCore::NameNodeList::rootNodeAttributeChanged): Updated for name and
        parameter change.

        * dom/Node.h: Change register/unregister functions to take TreeNodeList.
        * dom/Node.cpp:
        (WebCore::TagNodeList::TagNodeList): Updated to derive from TreeNodeList,
        since NodeList is now a simpler abstract class.
        (WebCore::TagNodeList::elementMatches): Updated for name and parameter change.
        (WebCore::Node::registerNodeList): Changed type from NodeList to TreeNodeList.
        (WebCore::Node::unregisterNodeList): Ditto.

        * dom/NodeList.h: Broke NodeList into a simpler base class and a derived class
        with the machinery for iterating a tree, called TreeNodeList.
        * dom/NodeList.cpp:
        (WebCore::NodeList::~NodeList): Added.
        (WebCore::NodeList::itemWithName): Factored out of the old itemWithName.
        (WebCore::TreeNodeList::TreeNodeList): Renamed from NodeList.
        (WebCore::TreeNodeList::~TreeNodeList): Ditto.
        (WebCore::TreeNodeList::recursiveLength): Ditto.
        (WebCore::TreeNodeList::itemForwardsFromCurrent): Ditto.
        (WebCore::TreeNodeList::itemBackwardsFromCurrent): Ditto.
        (WebCore::TreeNodeList::recursiveItem): Ditto.
        (WebCore::TreeNodeList::itemWithName): Factored half of this into this function,
        the other half in NodeList::itemWithName.
        (WebCore::TreeNodeList::rootNodeAttributeChanged): Added. No longer inline.
        (WebCore::TreeNodeList::rootNodeChildrenChanged): Renamed from NodeList.

        * html/HTMLFormElement.h: Added formElementNameChanged and oldNamedElement
        fucntions, and a map called m_oldNames. Also removed m_boundary, which I
        thought I had already done.
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::HTMLFormElement): Initialize m_oldNames to 0.
        Switched the rest of the members to initialization syntax.
        (WebCore::HTMLFormElement::~HTMLFormElement): Delete m_oldNames.
        (WebCore::HTMLFormElement::formElementNameChanged): Added. Stores a reference
        to one element under each of its old names.
        (WebCore::HTMLFormElement::oldNamedElement): Added. Returns the old element
        that once had a given name.

        * html/HTMLGenericFormElement.h:
        * html/HTMLGenericFormElement.cpp:
        (WebCore::HTMLGenericFormElement::parseMappedAttribute): When the name
        attribute changes, tell the form about the old name.
        (WebCore::HTMLGenericFormElement::insertedIntoTree): When telling a form
        about an element, also store away the old name so that we can use it
        when the name changes later.

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::parseMappedAttribute): Added a call to the
        base class in the nameAttr case, so the code in HTMLGenericFormElement
        above will get called in the input element case.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20148 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Update text in tests to match expected output.

        * fast/dom/gc-6-expected.txt:
        * fast/dom/gc-6.html:
        * fast/dom/gc-7-expected.txt:
        * fast/dom/gc-7.html:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20147 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Alexey.
        
        Test for DOS using composed character.

        * fast/text/large-text-composed-char-dos-expected.txt: Added.
        * fast/text/large-text-composed-char-dos.html: Added.

WebCore:

        Reviewed by Alexey.

        Alexey spotted a DOS by using string of 64k unbreakable character in
        fix for http://bugs.webkit.org/show_bug.cgi?id=12833

        * dom/Text.cpp:
        (WebCore::Text::createWithLengthLimit):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20146 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        - fix test results for http://bugs.webkit.org/show_bug.cgi?id=13054
          Layout tests results require updates after JavaScript wrapper class name fixes

        * fast/dom/gc-6-expected.txt: Renamed DOMHTMLElement to HTMLElement.
        * fast/dom/gc-7-expected.txt: Ditto.
        * fast/dom/prototype-chain-expected.txt: Renamed DOMHTMLElementPrototype to HTMLElementPrototype.
        * fast/dom/undetectable-document-all-expected.txt: Renamed Collection to HTMLCollection.
        * fast/dom/wrapper-classes-expected.txt: Updated for change to output for string comparison failure
        in fast/js/resources/js-test-pre.js.
        * fast/events/mouseclick-target-and-positioning-expected.txt: Renamed DOMHTMLElement to HTMLElement.
        * fast/tokenizer/external-script-document-write-expected.checksum: Ditto.
        * fast/tokenizer/external-script-document-write-expected.png: Ditto.
        * fast/tokenizer/external-script-document-write-expected.txt: Ditto.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20145 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin.

        <rdar://problem/4743256> ctrl-y key binding (yank) should do nothing when kill ring is empty

        * editing/pasteboard/emacs-cntl-y-001-expected.checksum:
        * editing/pasteboard/emacs-cntl-y-001-expected.png:
        * editing/pasteboard/emacs-cntl-y-001-expected.txt:
        * editing/pasteboard/emacs-cntl-y-001.html:

WebKit:

        Reviewed by Darin.

        <rdar://problem/4743256> ctrl-y key binding (yank) should do nothing when kill ring is empty

        Test updated:
        * editing/pasteboard/emacs-cntl-y-001.html:
        
        * WebView/WebHTMLView.mm:
        (-[WebHTMLView yank:]):
        (-[WebHTMLView yankAndSelect:]):
        Do nothing if the killring is empty.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20138 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Anders.

        - test for http://bugs.webkit.org/show_bug.cgi?id=13015
          REGRESSION (r17233-r17241): Repro crash when leaving a page whose unload handler submits a form

        * fast/loader/onunload-form-submit-crash-2-expected.txt: Added.
        * fast/loader/onunload-form-submit-crash-2.html: Added.

WebCore:

        Reviewed by Anders.

        - fix http://bugs.webkit.org/show_bug.cgi?id=13015
          REGRESSION (r17233-r17241): Repro crash when leaving a page whose unload handler submits a form

        Test: fast/loader/onunload-form-submit-crash-2.html

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::finishedLoading): Added null check.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20135 268f45cc-cd09-0410-ab3c-d52691b4dbfc

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20134 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        
        * fast/frames/frame-navigation-expected.txt: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20133 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin.

        <rdar://problem/4900071>
        http://bugs.webkit.org/show_bug.cgi?id=6454
        ASSERTION: Navigating 'back' in frameset: !_private->previousItem (6454)

        * fast/frames/frame-navigation.html: Added.
        * fast/frames/resources/frame-navigation-child.html: Added.

WebCore:

        Reviewed by Darin.

        <rdar://problem/4900071>
        http://bugs.webkit.org/show_bug.cgi?id=6454
        ASSERTION: Navigating 'back' in frameset: !_private->previousItem (6454)

        Change back the behavior of checkLoadComplete to traverse the entire frame tree instead of
        just the parent frames of the current frame. This is needed in order to reset the previous history item
        for all frames when doing a frame navigation. (This was changed in revision 11819)
        
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::recursiveCheckLoadComplete):
        (WebCore::FrameLoader::checkLoadComplete):
        * loader/FrameLoader.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20132 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Tim Hatcher.

        - added a test that checks the classes of wrappers created by both
          the JavaScript binding and the Objective-C binding

        * fast/dom/wrapper-classes-expected.txt: Added.
        * fast/dom/wrapper-classes.html: Added.
        * fast/js/resources/js-test-pre.js: Improve the format of the failure message when
        both the real results and expected results are strings.

WebCore:

        Reviewed by Tim Hatcher.

        - fixed JavaScript wrapper classes to be correct for a variety of cases
          that a new test uncovered: was broken for at least 5 classes

        - fixed Objective-C wrapper classes to be correct for a variety of cases
          that a test case uncovered: was broken for ast least 50 classes

        - added missing DOM API for creating OverflowEvent and WheelEvent instances

        Test: fast/dom/wrapper-classes.html

        * DerivedSources.make: Added missing bindings: HTMLCanvasElement for ObjC,
        CDATASection, Comment, and EntityReference for JavaScript.
        * WebCore.xcodeproj/project.pbxproj: Added those new generated files.

        * bindings/js/JSHTMLElementWrapperFactory.cpp:
        (WebCore::createJSHTMLWrapper): Corrected the wrapper classes for <keygen>,
        which needs an HTMLSelectElement wrapper, and <xmp>, which needs an
        HTMLPreElement wrapper.

        * bindings/objc/DOMInternal.h: Updated for new naming scheme.
        Also moved createDOMWrapper from the KJS namespace to the WebCore namespace.
        * bindings/objc/DOMUtility.mm:
        (KJS::createDOMWrapper): Broke the core function into a separate one, and
        left it in the KJS namespace because Objective-C++ rules make it impossible
        for it to work in the WebCore namespace. Used a macro-based implementation
        to cut down on repeated code, and added missing cases for Counter,
        HTMLOptionsCollection, Range, XPathExpression, XPathResult, Event, RGBColor,
        Rect, Window, DOMImplementation, NodeIterator, TreeWalker, and HTMLCollection.
        (WebCore::createDOMWrapper): The other half of the function.

        * bindings/objc/DOM.mm:
        (WebCore::createElementClassMap): Corrected the wrapper classes for
        <canvas>, which needs a DOMHTMLCanvasElement wrapper, <del>, which needs
        a DOMHTMLModElement wrapper, <embed>, which needs a DOMHTMLEmbedElement
        wrapper, <ins>, which needs a DOMHTMLModElement wrapper, <th>, which needs
        a DOMHTMLTableCellElement wrapper, and <xmp>, which needs an
        DOMHTMLPreElement wrapper.
        (+[DOMNode _wrapNode:]): Updated for new naming scheme.
        (+[DOMNode _wrapEventTarget:]): Ditto.
        (+[DOMNodeFilter _wrapNodeFilter:]): Ditto.
        (ObjCNodeFilterCondition::acceptNode): Ditto.
        (-[DOMDocument createNodeIterator:whatToShow:filter:expandEntityReferences:]): Ditto.
        (-[DOMDocument createTreeWalker:whatToShow:filter:expandEntityReferences:]): Ditto.
        (WebCore::ObjCEventListener::handleEvent): Ditto.

        * dom/Document.cpp: (WebCore::Document::createEvent):
        Added cases for OverflowEvent and WheelEvent.

        * dom/OverflowEvent.h: Added empty constructor and initOverflowEvent.
        * dom/OverflowEvent.cpp:
        (WebCore::OverflowEvent::OverflowEvent): Added.
        (WebCore::OverflowEvent::initOverflowEvent): Added.
        * dom/OverflowEvent.idl: Added initOverflowEvent.

        * bindings/objc/PublicDOMInterfaces.h: Added initOverflowEvent.

        * bindings/objc/DOMCSS.mm:
        (+[DOMStyleSheet _wrapStyleSheet:]): Updated for new naming scheme.
        (+[DOMCSSRule _wrapCSSRule:]): Corrected wrapper for CSSUnknownRule.
        (+[DOMCSSValue _wrapCSSValue:]): Updated for new naming scheme.

        * bindings/js/kjs_css.h:
        (KJS::DOMRGBColor::impl): Added. Used when making an ObjC wrapper.
        (KJS::DOMRect::impl): Ditto.

        * bindings/js/kjs_dom.cpp: (KJS::toJS): Corrected the wrapper classes for
        CDATASection, Comment, and EntityReference.

        * bindings/js/kjs_html.cpp: Corrected the class name for HTMLElement
        (was "DOMHTMLElement") and HTMLCollection (was "Collection").

        * bindings/objc/DOMImplementationFront.h:
        * bindings/objc/DOMImplementationFront.cpp:
        (WebCore::implementationFront): Added new overload that returns a front given
        a JavaScript wrapper. Needed by the code that makes the Objective-C wrapper.

        * bindings/objc/WebScriptObject.mm:
        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
        Updated since createDOMWrapper is now in the WebCore namespace.

        * bindings/scripts/CodeGeneratorObjC.pm: Update the naming scheme for the
        wrapper creation functions to use _wrapElement: rather then _elementWith:
        style. Removed now-unneeded special cases for things that needed to stay
        upper-case, since we don't have to do the whole lcfirst thing.

        * html/HTMLCanvasElement.idl: Added #if so we can successfully generate the
        Objective-C wrapper for this class, even though we can't yet handle the
        DOMObject return type.

        * html/HTMLOptionsCollection.idl: Added GenerateNativeConverter so we get
        an appropriate toJS function.

        * bindings/objc/DOMEvents.mm:
        (+[DOMEvent _wrapEvent:]):
        * bindings/objc/DOMHTML.mm:
        (-[DOMHTMLDocument createDocumentFragmentWithMarkupString:baseURL:]):
        (-[DOMHTMLDocument createDocumentFragmentWithText:]):
        * bindings/objc/DOMObject.mm:
        (-[DOMObject sheet]):
        * bindings/objc/DOMRGBColor.mm:
        (-[DOMRGBColor red]):
        (-[DOMRGBColor green]):
        (-[DOMRGBColor blue]):
        (-[DOMRGBColor alpha]):
        (+[DOMRGBColor _wrapRGBColor:]):
        * bindings/objc/DOMSVGPathSegInternal.mm:
        (+[DOMSVGPathSeg _wrapSVGPathSeg:]):
        * bindings/objc/DOMXPath.mm:
        (+[DOMNativeXPathNSResolver _wrapXPathNSResolver:]):
        * page/mac/WebCoreFrameBridge.mm:
        (-[WebCoreFrameBridge nodesFromList:]):
        (-[WebCoreFrameBridge elementWithName:inForm:]):
        (-[WebCoreFrameBridge formForElement:]):
        (-[WebCoreFrameBridge currentForm]):
        (-[WebCoreFrameBridge controlsInForm:]):
        (-[WebCoreFrameBridge rangeByAlteringCurrentSelection:SelectionController::direction:SelectionController::granularity:]):
        (-[WebCoreFrameBridge convertNSRangeToDOMRange:]):
        (-[WebCoreFrameBridge markDOMRange]):
        (-[WebCoreFrameBridge markedTextDOMRange]):
        (-[WebCoreFrameBridge smartDeleteRangeForProposedRange:]):
        (-[WebCoreFrameBridge documentFragmentWithMarkupString:baseURLString:]):
        (-[WebCoreFrameBridge documentFragmentWithText:inContext:]):
        (-[WebCoreFrameBridge documentFragmentWithNodesAsParagraphs:]):
        (-[WebCoreFrameBridge replaceSelectionWithNode:selectReplacement:smartReplace:matchStyle:]):
        (-[WebCoreFrameBridge replaceSelectionWithText:selectReplacement:smartReplace:]):
        (-[WebCoreFrameBridge increaseSelectionListLevel]):
        (-[WebCoreFrameBridge increaseSelectionListLevelOrdered]):
        (-[WebCoreFrameBridge increaseSelectionListLevelUnordered]):
        (-[WebCoreFrameBridge dragCaretDOMRange]):
        (-[WebCoreFrameBridge editableDOMRangeForPoint:]):
        (-[WebCoreFrameBridge characterRangeAtPoint:]):
        (-[WebCoreFrameBridge typingStyle]):
        (-[WebCoreFrameBridge rangeOfCharactersAroundCaret]):
        * platform/mac/ClipboardMac.mm:
        (WebCore::ClipboardMac::declareAndWriteDragImage):
        * platform/mac/PasteboardMac.mm:
        (WebCore::Pasteboard::writeSelection):
        Updated for new naming scheme.

WebKit:

        Reviewed by Tim Hatcher.

        - update for the new naming scheme for the Objective-C wrapper-creation
          functions: _wrapElement: instead of _elementWith:, etc.

        * WebCoreSupport/WebEditorClient.mm:
        (WebEditorClient::textFieldDidBeginEditing):
        (WebEditorClient::textFieldDidEndEditing):
        (WebEditorClient::textDidChangeInTextField):
        (WebEditorClient::doTextFieldCommandFromEvent):
        (WebEditorClient::textWillBeDeletedInTextField):
        (WebEditorClient::textDidChangeInTextArea):
        * WebCoreSupport/WebFrameLoaderClient.mm:
        (WebFrameLoaderClient::createPlugin):
        (WebFrameLoaderClient::createJavaAppletWidget):
        * WebView/WebFrame.mm: (kit):
        Use the _wrapElement-style functions.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20130 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Alexey
        
        Test that this works correctly with composed characters
        http://bugs.webkit.org/show_bug.cgi?id=12833
        REGRESSION: Selecting text in 6.6MB txt file is sluggish as of the Feb 19th nightly
        <rdar://problem/5028159>

        * fast/text/large-text-composed-char-expected.checksum: Added.
        * fast/text/large-text-composed-char-expected.png: Added.
        * fast/text/large-text-composed-char-expected.txt: Added.
        * fast/text/large-text-composed-char.html: Added.

WebCore:

        Reviewed by Alexey.

        Fix http://bugs.webkit.org/show_bug.cgi?id=12833
        REGRESSION: Selecting text in 6.6MB txt file is sluggish as of the Feb 19th nightly
        <rdar://problem/5028159>
        
        Divide large text blocks (>64kB) over multiple text nodes. This limits linebox searches to
        a manageable subset.
        
        * dom/Text.cpp:
        (WebCore::Text::createWithLengthLimit):
        * dom/Text.h:
        * html/HTMLParser.cpp:
        (WebCore::HTMLParser::parseToken):
        * loader/TextDocument.cpp:
        (WebCore::TextTokenizer::write):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20127 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        http://bugs.webkit.org/show_bug.cgi?id=12500
        SVG fails to correctly handle all link style selectors
        http://bugs.webkit.org/show_bug.cgi?id=12567
        <text> elements ignore <a> children

        Allow <a> inside svg text and handle xlink:show.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20122 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        http://bugs.webkit.org/show_bug.cgi?id=12560
        W3C XPath test Text_Nodes.svg fails

WebCore:
        * xml/XPathStep.cpp:
        (WebCore::XPath::Step::nodeTestMatches): Revert the fix, as the behavior doesn't appear 
        all that desirable as it did at first glance.

LayoutTests:
        * dom/svg/level3/xpath/Text_Nodes-expected.txt: This fails again.

        * fast/xpath/4XPath/Borrowed/kd_20010423-expected.txt:
        * fast/xpath/4XPath/Borrowed/kd_20010423.html:
        Brought the test back to its original form (in which Firefox passes).

        * fast/xpath/text-nodes-expected.txt: Added.
        * fast/xpath/text-nodes.html: Added.
        A new test for text nodes, verifying some more arcane cases.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20110 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by hyatt.

        Fix for <rdar://problem/5055690> ASSERTION failure on drop into 
        editable element with content changed on drop 

        After setting the selection for a drop into an editable region 
        we make sure the we succeeded.  If we didn't we assume a focus handler
        or similar altered the element contents and try again, if the second
        attempt fails we bail out.

        * page/DragController.cpp:
        (WebCore::setSelectionToDragCaret):
        (WebCore::DragController::concludeDrag):

LayoutTests:
        <rdar://problem/5055690> ASSERTION failure on drop into editable element with content changed on drop

        * fast/events/content-changed-during-drop-expected.txt: Added.
        * fast/events/content-changed-during-drop.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20109 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        A partial fix for http://bugs.webkit.org/show_bug.cgi?id=13021
        XPath can be very slow

        * xml/XPathExpression.cpp:
        (WebCore::XPathExpression::evaluate): Cache evaluationContext in a local variable.

        * xml/XPathExpressionNode.cpp:
        (WebCore::XPath::Expression::evaluationContext):
        * xml/XPathExpressionNode.h:
        (WebCore::XPath::Expression::addSubExpression):
        (WebCore::XPath::Expression::subExprCount):
        (WebCore::XPath::Expression::subExpr):
        * xml/XPathFunctions.cpp:
        * xml/XPathFunctions.h:
        (WebCore::XPath::Function::setName):
        (WebCore::XPath::Function::arg):
        (WebCore::XPath::Function::argCount):
        (WebCore::XPath::Function::name):
        Made one-liners critical for performance inline.

        * xml/XPathGrammar.y: Fully parse NodeTests, so that strings are no longer passed for what is
        essentially an enum. Use LocationPath accessors to add steps, instead of directly manipulating
        internal data members.

        * xml/XPathParser.cpp:
        (WebCore::XPath::Parser::parseStatement):
        (WebCore::XPath::Parser::registerNodeTest):
        (WebCore::XPath::Parser::deleteNodeTest):
        * xml/XPathParser.h:
        Added support methods for changes in XPathGrammar.y.

        * xml/XPathPath.cpp:
        (WebCore::XPath::Filter::evaluate): Cache evaluationContext in a local variable. Use swap() to avoid
        performing vector assignments.
        (WebCore::XPath::LocationPath::evaluate): Use swap() to avoid performing vector assignments.
        (WebCore::XPath::LocationPath::optimizeStepPair): This new method is called during LocationPath construction, 
        to simplify the path as it's being built. Currently, the only optimized case is "//*" - it is a basis for
        important operations that cannot be efficiently written in XPath 1.0, but can be optimized with a little bit
        of XPath 2.0.
        (WebCore::XPath::LocationPath::appendStep): A new accessor that modifies m_steps and calls optimizeStepPair().
        (WebCore::XPath::LocationPath::insertFirstStep): Ditto.
        * xml/XPathPath.h:
        (WebCore::XPath::LocationPath::setAbsolute): A new accessor.

        * xml/XPathStep.h:
        (WebCore::XPath::Step::NodeTest::):
        (WebCore::XPath::Step::NodeTest::NodeTest):
        (WebCore::XPath::Step::NodeTest::kind):
        (WebCore::XPath::Step::NodeTest::data):
        Step::NodeTest is a new sub-class that represents a fully parsed NodeTest.
        (WebCore::XPath::Step::axis):
        (WebCore::XPath::Step::nodeTest):
        (WebCore::XPath::Step::nodeTestData):
        (WebCore::XPath::Step::namespaceURI):
        (WebCore::XPath::Step::predicates):
        (WebCore::XPath::Step::setAxis):
        (WebCore::XPath::Step::setNodeTest):
        (WebCore::XPath::Step::setNodeTestData):
        (WebCore::XPath::Step::setNamespaceURI):
        (WebCore::XPath::Step::setPredicates):
        New accessors that let optimizeStepPair() manipulate Step data.

        * xml/XPathStep.cpp:
        (WebCore::XPath::Step::Step): Use the new NodeTest class.
        (WebCore::XPath::Step::evaluate): Cache evaluationContext in a local variable. Use swap() to avoid
        performing unneeded vector assignments.
        (WebCore::XPath::Step::nodesInAxis): Cosmetic changes.
        (WebCore::XPath::Step::nodeTestMatches): Use NodeTest instead of parsing the test from string each time.
        Added a partial implementation of XPath 2.0 element() node test.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20102 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        http://bugs.webkit.org/show_bug.cgi?id=12249
        FCKeditor: <hr>, <ul> and <ol> have id="undefined"

        This fixes the attached reduction, but not the original issue.

        Test: editing/execCommand/default-parameters.html

        * dom/Document.h:
        * dom/Document.idl:
        Make second and third execCommand() parameters optional.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20101 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin.

        - test for http://bugs.webkit.org/show_bug.cgi?id=13013
          REGRESSION: Selection box does not scroll to where the focus jumps when pressing an alphanumeric key

        * fast/forms/listbox-typeahead-scroll-expected.txt: Added.
        * fast/forms/listbox-typeahead-scroll.html: Added.

WebCore:

        Reviewed by Darin.

        - fix http://bugs.webkit.org/show_bug.cgi?id=13013
          REGRESSION: Selection box does not scroll to where the focus jumps when pressing an alphanumeric key

        Test: fast/forms/listbox-typeahead-scroll.html

        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::setSelectedIndex): Reordered to set the active selection's
        anchor and end before selecting the option, since the active selection is used to
        decide where to scroll when the selection is made.
        (WebCore::HTMLSelectElement::defaultEventHandler): Removed redundant check.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20099 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin.

        - test for http://bugs.webkit.org/show_bug.cgi?id=12973
          REGRESSION: Reproducible assert while loading this test file if css is already in the cache

        * fast/dom/css-cached-import-rule-expected.checksum: Added.
        * fast/dom/css-cached-import-rule-expected.png: Added.
        * fast/dom/css-cached-import-rule-expected.txt: Added.
        * fast/dom/css-cached-import-rule.html: Added.

WebCore:

        Reviewed by Darin.

        - fix http://bugs.webkit.org/show_bug.cgi?id=12973
          REGRESSION: Reproducible assert while loading this test file if css is already in the cache

        Test: fast/dom/css-cached-import-rule.html

        Replaced some direct calls to document->stylesheetLoaded() with calls to
        the sheet's checkLoaded(). The latter calls back to the element's sheetLoaded() --
        which notifies the document of the load -- and then updates the sheet's
        loadCompleted() flag, ensuring that it stays in sync with whether the stylesheet
        is still considered pending by the document.

        * dom/ProcessingInstruction.cpp:
        (WebCore::ProcessingInstruction::parseStyleSheet):
        * dom/StyleElement.cpp:
        (WebCore::StyleElement::childrenChanged):
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::process):
        (WebCore::HTMLLinkElement::setCSSStyleSheet):
        * ksvg2/svg/SVGStyleElement.cpp:
        (WebCore::SVGStyleElement::sheetLoaded):
        * ksvg2/svg/SVGStyleElement.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20098 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Justin.

        - test for http://bugs.webkit.org/show_bug.cgi?id=8928
          <rdar://problem/5045708> REPRODUCIBLE ASSERT: Cannot paste HTML into a
          contenteditable region in an XHTML document (8928)

        * editing/pasteboard/paste-xml-expected.checksum: Added.
        * editing/pasteboard/paste-xml-expected.png: Added.
        * editing/pasteboard/paste-xml-expected.txt: Added.
        * editing/pasteboard/paste-xml.xhtml: Added.

WebCore:

        Reviewed by Justin.

        - fix http://bugs.webkit.org/show_bug.cgi?id=8928
          <rdar://problem/5045708> REPRODUCIBLE ASSERT: Cannot paste HTML into a
          contenteditable region in an XHTML document (8928)

        Test: editing/pasteboard/paste-xml.xhtml

        * editing/markup.cpp: (WebCore::createFragmentFromMarkup): Added a check for 0
        here, since createContextualFragment can return 0 for XML documents that fail
        to parse. In my testing, callers all seem equipped to handle 0.

WebKit:

        Reviewed by Justin.

        - fix http://bugs.webkit.org/show_bug.cgi?id=8928
          <rdar://problem/5045708> REPRODUCIBLE ASSERT: Cannot paste HTML into a
          contenteditable region in an XHTML document (8928)

        * WebView/WebHTMLView.mm:
        (-[WebHTMLView _hasHTMLDocument]): Added.
        (-[WebHTMLView _documentFragmentFromPasteboard:forType:inContext:subresources:]):
        Don't call AppKit's conversion from the DOM to an attributed string if the document
        is not an HTML document, to work around an AppKit limitation (Radar 5052390).



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20092 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin.

        - test for http://bugs.webkit.org/show_bug.cgi?id=9929
          REGRESSION: crash on logging in on mijnpostbank.nl

        * http/tests/misc/onload-remove-iframe-crash-2-expected.txt: Added.
        * http/tests/misc/onload-remove-iframe-crash-2.html: Added.
        * http/tests/misc/resources/onload-remove-iframe-crash-2.html: Added.
        * http/tests/misc/resources/onload-remove-iframe.html: Added.

WebCore:

        Reviewed by Darin.

        - fix http://bugs.webkit.org/show_bug.cgi?id=9929
          REGRESSION: crash on logging in on mijnpostbank.nl

        Test: http/tests/misc/onload-remove-iframe-crash-2.html

        The resulted from an iframe's load event handler removing the iframe
        from the document.

        * dom/Document.cpp:
        (WebCore::Document::implicitClose): Bail out early if an event handler
        removed the frame.
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::FrameLoader):
        (WebCore::FrameLoader::clear):
        (WebCore::FrameLoader::checkCompleted): Protect the frame from deletion
        by event handlers.
        (WebCore::FrameLoader::checkCompletedTimerFired):
        (WebCore::FrameLoader::scheduleCheckCompleted):
        (WebCore::FrameLoader::detachFromParent): Schedule a completion check
        on the parent (in case the child is what has been keeping it from completing).
        * loader/FrameLoader.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20090 268f45cc-cd09-0410-ab3c-d52691b4dbfc

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20088 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Brady.

        - fix http://bugs.webkit.org/show_bug.cgi?id=13015
          REGRESSION (r17233-r17241): Repro crash when leaving a page whose unload handler submits a form

        Test: fast/loader/onunload-form-submit-crash-2.html

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::finishedLoading): Added null check.

2007-03-08  Mitz Pettel  <mitz@webkit.org>

        Reviewed by Brady.

        - test for http://bugs.webkit.org/show_bug.cgi?id=13015
          REGRESSION (r17233-r17241): Repro crash when leaving a page whose unload handler submits a form

        * fast/loader/onunload-form-submit-crash-2-expected.txt: Added.
        * fast/loader/onunload-form-submit-crash-2.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20078 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by harrison
        
        <rdar://problem/4903193> 
        On particular page, Copy is so slow it seems like a hang

        Less messy DOM trees:
        * editing/deleting/delete-3857753-fix-expected.txt:
        * editing/inserting/insert-3786362-fix-expected.txt:
        * editing/inserting/insert-3907422-fix-expected.txt:
        * editing/pasteboard/display-block-on-spans-expected.txt:
        * editing/pasteboard/paste-4035648-fix-expected.txt:
        * editing/pasteboard/paste-4039777-fix-expected.txt:
        * editing/pasteboard/paste-line-endings-001-expected.txt:
        * editing/pasteboard/paste-line-endings-006-expected.txt:
        * editing/pasteboard/paste-list-001-expected.txt:
        * editing/pasteboard/paste-pre-001-expected.txt:
        * editing/pasteboard/paste-pre-002-expected.txt:
        * editing/pasteboard/paste-table-001-expected.txt:
        * editing/pasteboard/paste-table-002-expected.txt:
        * editing/pasteboard/paste-text-003-expected.txt:
        * editing/pasteboard/paste-text-011-expected.txt:
        * editing/pasteboard/paste-text-015-expected.txt:
        * editing/pasteboard/paste-text-016-expected.txt:
        * editing/pasteboard/paste-text-017-expected.txt:
        * editing/pasteboard/styled-element-markup-expected.txt:
        * editing/pasteboard/testcase-9507-expected.txt:
        * editing/style/smoosh-styles-001-expected.txt:
        * editing/style/smoosh-styles-002-expected.txt:
        * fast/lists/drag-into-marker-expected.txt:
        Styles from style sheets are now inlined:
        * webarchive/test-duplicate-resources-expected.txt:
        * webarchive/test-frameset-expected.txt:
        * webarchive/test-link-href-expected.txt:\
        Two levels of nesting are removed, but text nodes are no
        longer coalesced when they should be, investigating:
        * editing/pasteboard/block-wrappers-necessary-expected.txt:

WebCore:

        Reviewed by harrison
        
        <rdar://problem/4903193> 
        On particular page, Copy is so slow it seems like a hang
        
        ~2x speedup copying:
        http://shakespeare.mit.edu/henryviii/full.html 
        Also produces less bloated markup.

        * editing/markup.cpp:
        (WebCore::startMarkup): Don't wrap text nodes in style spans.
        For Elements, don't inline styles inherited from ancestors.
        (WebCore::createMarkup): No longer necessary to find 
        the root's default style and pass it to startMarkup.
        Add a wrapper span around the markup with the styles
        that all nodes in the markup inherit (the inheritable 
        styles from the common ancestor container's computed style).
        Added a FIXME about unecessary markup for inline ancestors 
        up to the commonAncestorBlock.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20075 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Adele.

        <rdar://problem/4646563> REGRESSION: Unable to send text message from Verizon text message website: vtext.com (12588)
        http://bugs.webkit.org/show_bug.cgi?id=12588

        Carefully revised which focus operations restore previous selection, which clear it, and which
        select the whole control contents, these test cases cover every focus call I could find.
        
        * fast/forms/focus-selection-input-expected.txt: Added.
        * fast/forms/focus-selection-input.html: Added.
        * fast/forms/focus-selection-textarea-expected.txt: Added.
        * fast/forms/focus-selection-textarea.html: Added.
        * fast/forms/onselect-textfield-expected.txt:

WebCore:

        Reviewed by Adele.
        
        <rdar://problem/4646563> REGRESSION: Unable to send text message from Verizon text message website: vtext.com (12588)
        http://bugs.webkit.org/show_bug.cgi?id=12588

        Carefully revised which focus operations restore previous selection, which clear it, and which
        select the whole control contents.
        
        Tests:
        fast/forms/focus-selection-input.html
        fast/forms/focus-selection-textarea.html
        
        * dom/Element.cpp:
        (WebCore::Element::focus):
        * dom/Element.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::focus):
        (WebCore::HTMLInputElement::accessKeyAction):
        * html/HTMLInputElement.h:
        * html/HTMLLabelElement.cpp:
        (WebCore::HTMLLabelElement::focus):
        (WebCore::HTMLLabelElement::accessKeyAction):
        * html/HTMLLabelElement.h:
        * html/HTMLLegendElement.cpp:
        (WebCore::HTMLLegendElement::focus):
        * html/HTMLLegendElement.h:
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::focus):
        * html/HTMLTextAreaElement.h:
        * page/FocusController.cpp:
        (WebCore::FocusController::advanceFocus):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20072 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by harrison
        
        <http://bugs.webkit.org/show_bug.cgi?id=12244>
        FCKeditor: Find dialog doesn't work

        * editing/execCommand/12244-expected.txt: Added.
        * editing/execCommand/12244.html: Added.
        * fast/dom/Window/window-properties-expected.txt:

WebCore:

        Reviewed by harrison

        <http://bugs.webkit.org/show_bug.cgi?id=12244>
        FCKeditor: Find dialog doesn't work

        * bindings/js/kjs_window.cpp:
        (KJS::Window::find): Added.  This function doesn't yet 
        support whole word searches, searching in subframes, or
        opening the find dialog.
        (KJS::WindowFunc::callAsFunction):
        * bindings/js/kjs_window.h:
        (KJS::Window::):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20071 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by harrison
        
        <http://bugs.webkit.org/show_bug.cgi?id=13000>
        Range.createContextualFragment is not supported

        * fast/dom/Range/13000-expected.txt: Added.
        * fast/dom/Range/13000.html: Added.

WebCore:

        Reviewed by harrison
        
        <http://bugs.webkit.org/show_bug.cgi?id=13000>
        Range.createContextualFragment is not supported

        * dom/Range.cpp:
        (WebCore::Range::createContextualFragment): The
        "startContainer" may not be a container, if the
        range starts inside text.  In that case, look
        to the parent of the start node for an HTMLElement.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20066 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by harrison
        
        <rdar::/problem/5049671>
        Gmail Editor: With linked text, Remove Formatting doesn't always remove underline

        * editing/execCommand/5049671-expected.checksum: Added.
        * editing/execCommand/5049671-expected.png: Added.
        * editing/execCommand/5049671-expected.txt: Added.
        * editing/execCommand/5049671.html: Added.

WebCore:

        Reviewed by harrison
        
        <rdar://problem/5049671>
        Gmail Editor: With linked text, Remove Formatting doesn't always remove underline

        * editing/Editor.cpp:
        (WebCore::Editor::removeFormattingAndStyle): Clear removed
        anchors after the deletion.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20065 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Adam.
WebCore:
        To match old TEC behaviour when using ICU we need to use 
        a few manual fallback encodings for the GBK/EUC-CN charsets

        <rdar://problem/4708689> -- REGRESSION: Some symbols with 2-byte display as garbage in Hotmail.

        * platform/TextCodecICU.cpp:
        (WebCore::TextCodecICU::TextCodecICU):
        (WebCore::TextCodecICU::createICUConverter):
        (WebCore::gbkEscapes):
        (WebCore::gbkCallbackEscape):
        (WebCore::gbkCallbackSubstitute):
        (WebCore::TextCodecICU::encode):
        * platform/TextCodecICU.h:
        (WebCore::TextCodecICU::needsGBKFallbacks):
        (WebCore::TextCodecICU::setNeedsGBKFallbacks):
        
LayoutTests:
        Adding GBK character encoding tests

        * fast/encoding/char-encoding-expected.txt:
        * fast/encoding/char-encoding.html:
        


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20059 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Build fix.

        * xml/XPathUtil.cpp:
        (WebCore::XPath::stringValue):

LayoutTests:
        Added a test for attribute node string-value.

        * fast/xpath/string-value-expected.txt:
        * fast/xpath/string-value.html:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20057 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        http://bugs.webkit.org/show_bug.cgi?id=13006
        XPath string-value is broken for some node types

        Test: fast/xpath/string-value.html

        * xml/XPathUtil.cpp:
        (WebCore::XPath::stringValue): Fix it :-)



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20055 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin.

        http://bugs.webkit.org/show_bug.cgi?id=13004
        Repeatedly calling XPathExpression.evaluate() causes crashes or memory leaks

        * fast/xpath/evaluate-twice-expected.txt: Added.
        * fast/xpath/evaluate-twice.html: Added.

WebCore:

        Reviewed by Darin.

        http://bugs.webkit.org/show_bug.cgi?id=13004
        Repeatedly calling XPathExpression.evaluate() causes crashes or memory leaks

        Removed XPath::Expression::optimize() and related methods, since they were buggy and almost useless.
        Merged doEvaluate() into evaluate(), since this was all evaluate() was doing after the above changes.

        Test: fast/xpath/evaluate-twice.html

        * xml/XPathExpression.cpp:
        (WebCore::XPathExpression::evaluate):
        * xml/XPathExpressionNode.cpp:
        (WebCore::XPath::Expression::Expression):
        (WebCore::XPath::Expression::~Expression):
        * xml/XPathExpressionNode.h:
        * xml/XPathFunctions.cpp:
        (WebCore::XPath::FunLast::evaluate):
        (WebCore::XPath::FunPosition::evaluate):
        (WebCore::XPath::FunId::evaluate):
        (WebCore::XPath::FunLocalName::evaluate):
        (WebCore::XPath::FunNamespaceURI::evaluate):
        (WebCore::XPath::FunName::evaluate):
        (WebCore::XPath::FunCount::evaluate):
        (WebCore::XPath::FunString::evaluate):
        (WebCore::XPath::FunConcat::evaluate):
        (WebCore::XPath::FunStartsWith::evaluate):
        (WebCore::XPath::FunContains::evaluate):
        (WebCore::XPath::FunSubstringBefore::evaluate):
        (WebCore::XPath::FunSubstringAfter::evaluate):
        (WebCore::XPath::FunSubstring::evaluate):
        (WebCore::XPath::FunStringLength::evaluate):
        (WebCore::XPath::FunNormalizeSpace::evaluate):
        (WebCore::XPath::FunTranslate::evaluate):
        (WebCore::XPath::FunBoolean::evaluate):
        (WebCore::XPath::FunNot::evaluate):
        (WebCore::XPath::FunTrue::evaluate):
        (WebCore::XPath::FunLang::evaluate):
        (WebCore::XPath::FunFalse::evaluate):
        (WebCore::XPath::FunNumber::evaluate):
        (WebCore::XPath::FunSum::evaluate):
        (WebCore::XPath::FunFloor::evaluate):
        (WebCore::XPath::FunCeiling::evaluate):
        (WebCore::XPath::FunRound::evaluate):
        * xml/XPathPath.cpp:
        (WebCore::XPath::Filter::evaluate):
        (WebCore::XPath::LocationPath::evaluate):
        (WebCore::XPath::Path::evaluate):
        * xml/XPathPath.h:
        * xml/XPathPredicate.cpp:
        (WebCore::XPath::Number::evaluate):
        (WebCore::XPath::StringExpression::evaluate):
        (WebCore::XPath::Negative::evaluate):
        (WebCore::XPath::NumericOp::evaluate):
        (WebCore::XPath::EqTestOp::evaluate):
        (WebCore::XPath::LogicalOp::evaluate):
        (WebCore::XPath::Union::evaluate):
        * xml/XPathPredicate.h:
        * xml/XPathStep.cpp:
        * xml/XPathStep.h:
        * xml/XPathVariableReference.cpp:
        (WebCore::XPath::VariableReference::evaluate):
        * xml/XPathVariableReference.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20051 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin.

        - fix http://bugs.webkit.org/show_bug.cgi?id=13002
          Incomplete repaint of inset outlines

        Test: fast/repaint/outline-inset.html

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):

2007-03-07  Mitz Pettel  <mitz@webkit.org>

        Reviewed by Darin.

        - repaint test for http://bugs.webkit.org/show_bug.cgi?id=13002
          Incomplete repaint of inset outlines

        * fast/repaint/outline-inset-expected.checksum: Added.
        * fast/repaint/outline-inset-expected.png: Added.
        * fast/repaint/outline-inset-expected.txt: Added.
        * fast/repaint/outline-inset.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20041 268f45cc-cd09-0410-ab3c-d52691b4dbfc