GitLab

        Reviewed by Darin Adler.

        Clean up use of const and mutable in StorageMap
        https://bugs.webkit.org/show_bug.cgi?id=29933

        What's the point of having every single member variable be mutable and nearly
        every method be const?  Let's clean it up.

        * storage/StorageMap.cpp:
        (WebCore::StorageMap::setIteratorToIndex):
        (WebCore::StorageMap::key):
        (WebCore::StorageMap::importItem):
        * storage/StorageMap.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48992 268f45cc-cd09-0410-ab3c-d52691b4dbfc

ligature
-and corresponding-
https://bugs.webkit.org/show_bug.cgi?id=6136

Reviewed by Dave Hyatt.

This patch makes the SVG CSS property text-rendering work with any 
HTML, much like it does in Firefox. It accepts four possible input 
values: auto, optimizeSpeed, optimizeLegibility, and 
geometricPrecision. Right now, in this implementation, here is what 
those values correspond to:

auto = optimizeSpeed = what we normally when the value's not set
optimizeLegibility = geometricPrecision = ligatures + kerning

Add new file TextRenderingMode.h to the project files.
* WebCore.vcproj/WebCore.vcproj:
* WebCore.xcodeproj/project.pbxproj:

CSS support for the new CSSPropertyTextRendering
* css/CSSComputedStyleDeclaration.cpp:
(WebCore::):
(WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
* css/CSSParser.cpp:
(WebCore::CSSParser::parseValue):
* css/CSSPrimitiveValueMappings.h:
(WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
(WebCore::CSSPrimitiveValue::operator TextRenderingMode):
* css/CSSPropertyNames.in:
* css/CSSStyleSelector.cpp:
(WebCore::CSSStyleSelector::applyProperty):
* css/CSSValueKeywords.in:

All the old SVG CSS support for this property can go away. When 
it's used in SVG, it will just fall into the normal HTML case.
* css/SVGCSSComputedStyleDeclaration.cpp:
(WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
* css/SVGCSSParser.cpp:
(WebCore::CSSParser::parseSVGValue):
* css/SVGCSSPropertyNames.in:
* css/SVGCSSStyleSelector.cpp:
(WebCore::CSSStyleSelector::applySVGProperty):
* css/SVGCSSValueKeywords.in:

FontDescription stores the m_textRendering bit.
* platform/graphics/FontDescription.h:
(WebCore::FontDescription::FontDescription):
(WebCore::FontDescription::textRenderingMode):
(WebCore::FontDescription::setTextRenderingMode):
(WebCore::FontDescription::operator==):

We want to fall into the complex text rendering code path if 
kerning and ligatures have been enabled with this property.
* platform/graphics/FontFastPath.cpp:
(WebCore::Font::canUseGlyphCache):

Now takes a TextRenderingMode as a parameter.
* platform/graphics/SimpleFontData.h:

New header for the enum.
* platform/graphics/TextRenderingMode.h: Added.
(WebCore::):

getCFStringAttributes() now takes a TextRenderingMode as an 
attribute.
* platform/graphics/mac/CoreTextController.cpp:
(WebCore::CoreTextController::collectCoreTextRunsForCharacters):

Enable kerning and ligatures whenever the TextRenderingMode is 
OptimizeLegibility or GeometricPrecision
* platform/graphics/mac/FontMacATSUI.mm:
(WebCore::disableLigatures):
(WebCore::initializeATSUStyle):
(WebCore::ATSULayoutParameters::initialize):
* platform/graphics/mac/SimpleFontDataMac.mm:
(WebCore::SimpleFontData::getCFStringAttributes):

More SVG CSS stuff that isn't needed anymore since SVG will use the 
new HTML CSS implementation.
* rendering/style/SVGRenderStyle.h:
(WebCore::SVGRenderStyle::InheritedFlags::operator==):
(WebCore::SVGRenderStyle::setBitDefaults):
* rendering/style/SVGRenderStyleDefs.h:

LayoutTests: Tests for <rdar://problem/6934421> Support CSS for Text Kerning and 
ligature
-and corresponding-
https://bugs.webkit.org/show_bug.cgi?id=6136

Reviewed by Dave Hyatt.

New tests.
* fast/css/parsing-text-rendering-expected.txt: Added.
* fast/css/parsing-text-rendering.html: Added.
* fast/css/resources/parsing-text-rendering.js: Added.
(test):
* fast/css/text-rendering.html: Added.
* platform/mac/fast/css/text-rendering-expected.checksum: Added.
* platform/mac/fast/css/text-rendering-expected.png: Added.
* platform/mac/fast/css/text-rendering-expected.txt: Added.

New and improved results.
* platform/mac/fast/css/getComputedStyle/computed-style-expected.txt:
* platform/mac/fast/css/getComputedStyle/computed-style-without-renderer-expected.txt:
* platform/mac/svg/W3C-SVG-1.1/filters-conv-01-f-expected.checksum:
* platform/mac/svg/W3C-SVG-1.1/filters-conv-01-f-expected.png:
* platform/mac/svg/W3C-SVG-1.1/filters-conv-01-f-expected.txt:
* svg/css/getComputedStyle-basic-expected.txt:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48989 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Timothy Hatcher.

        Use isClosure property of scope proxy to decide whether the
        scope is a closure.

        https://bugs.webkit.org/show_bug.cgi?id=29965

        * inspector/front-end/ScopeChainSidebarPane.js:
        (WebInspector.ScopeChainSidebarPane.prototype.update):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48983 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Dave Hyatt.

        Odd color transitions on anchors with transition-property: all
        https://bugs.webkit.org/show_bug.cgi?id=29911

        When transitioning maybe-invalid colors, if the source and destination
        color are both invalid, then don't animate.

        This fixes an issue where a child element of an element running a color
        transition, with -webkit-transition-property:all, would show a color change.
        This happened because the "maybe invalid color" logic copied the color style
        into -webkit-text-fill-color for both endpoints, causing -webkit-text-fill-color
        to animate while the transition ran, and to then to disappear when the transition
        finished.

        Test: transitions/color-transition-all.html

        * page/animation/AnimationBase.cpp:
        (WebCore::PropertyWrapperMaybeInvalidColor::equals):
        (WebCore::PropertyWrapperMaybeInvalidColor::blend):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48982 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Oliver Hunt.

        Allow dragging a node who has child nodes.

        https://bugs.webkit.org/show_bug.cgi?id=28632

        * fast/events/drag-parent-node-expected.txt: Added.
        * fast/events/drag-parent-node.html: Added.
        * fast/events/resources/bookmark.gif: Added.
2009-10-01  Victor Wang  <victorw@chromium.org>

        Reviewed by Oliver Hunt.

        Allow dragging a node who has child nodes.

        https://bugs.webkit.org/show_bug.cgi?id=28632

        Test: fast/events/drag-parent-node.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::shouldDragAutoNode):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48981 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Gustavo Noronha.

        [GTK] media player: better mute support
        https://bugs.webkit.org/show_bug.cgi?id=29960

        Handle volume and mute state with the two corresponding properties
        of playbin2.

        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivate::setMuted):
        (WebCore::MediaPlayerPrivate::setVolume):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48980 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Gustavo Noronha.

        [GTK] video sink pad template colorspace is wrong
        https://bugs.webkit.org/show_bug.cgi?id=29953

        Set sink pad template colorspace depending on byte order.

        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
        (webkit_video_sink_idle_func):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48979 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Dimitri Glazkov.

        [V8] Refactored V8 event listeners:
        (This change should fix http://crbug.com/21079 and
        https://bugs.webkit.org/show_bug.cgi?id=29093.)
         o All listeners use weak handles to JS objects to avoid creating
           cycles and leaking memory.
         o "Object" variants of listeners removed.
         o All event accessor callbacks are generated.
         o Custom event accessors removed.
         o All wrappers have hidden dependencies on their listeners to
           prevent listeners from being collected.
         o All variats of getEventListener function grouped in V8DOMWrapper.
         o Pointers to C++ EventListener wrappers are stored in JS objects
           instead of event listener lists.
        https://bugs.webkit.org/show_bug.cgi?id=29825

        * WebCore.gypi: Removed "Object" listeners.
        * bindings/scripts/CodeGeneratorV8.pm: Now handles event accessors.
        * bindings/v8/DOMObjectsInclude.h:

        V8AbstractEventListener manages weak JS handle:
        * bindings/v8/V8AbstractEventListener.cpp:
        (WebCore::weakEventListenerCallback):
        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
        (WebCore::V8AbstractEventListener::handleEvent):
        (WebCore::V8AbstractEventListener::disposeListenerObject):
        (WebCore::V8AbstractEventListener::setListenerObject):
        * bindings/v8/V8AbstractEventListener.h:
        (WebCore::V8AbstractEventListener::cast):
        (WebCore::V8AbstractEventListener::isLazy):
        (WebCore::V8AbstractEventListener::getListenerObject):
        (WebCore::V8AbstractEventListener::getExistingListenerObject):
        (WebCore::V8AbstractEventListener::hasExistingListenerObject):
        (WebCore::V8AbstractEventListener::disconnectFrame):
        (WebCore::V8AbstractEventListener::disconnected):
        (WebCore::V8AbstractEventListener::prepareListenerObject):
        (WebCore::V8AbstractEventListener::lineNumber):
        (WebCore::V8AbstractEventListener::virtualisAttribute):

        Grouped getEventListener functions:
        * bindings/v8/V8DOMWrapper.cpp:
        (WebCore::V8DOMWrapper::getTemplate):
        (WebCore::V8DOMWrapper::getEventListener):
        * bindings/v8/V8DOMWrapper.h:

        Removed most event listener objects bookkeeping:
        * bindings/v8/V8EventListenerList.cpp:
        * bindings/v8/V8EventListenerList.h:
        (WebCore::V8EventListenerList::findWrapper):
        (WebCore::V8EventListenerList::clearWrapper):
        (WebCore::V8EventListenerList::doFindWrapper):
        (WebCore::V8EventListenerList::getHiddenProperty):
        (WebCore::V8EventListenerList::findOrCreateWrapper):

        Added hidden properties for storing EventListener wrappers:
        * bindings/v8/V8HiddenPropertyName.cpp:
        (WebCore::V8HiddenPropertyName::listener):
        (WebCore::V8HiddenPropertyName::attributeListener):
        * bindings/v8/V8HiddenPropertyName.h:

        * bindings/v8/V8LazyEventListener.cpp:
        (WebCore::V8LazyEventListener::V8LazyEventListener):
        (WebCore::V8LazyEventListener::callListenerFunction):
        (WebCore::V8LazyEventListener::prepareListenerObject):
        * bindings/v8/V8LazyEventListener.h:
        (WebCore::V8LazyEventListener::isLazy):
        * bindings/v8/V8ObjectEventListener.cpp: Removed.
        * bindings/v8/V8ObjectEventListener.h: Removed.
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::disconnectFrame):
        (WebCore::V8Proxy::disconnectEventListeners):
        * bindings/v8/V8Proxy.h:
        * bindings/v8/V8WorkerContextEventListener.cpp:
        (WebCore::V8WorkerContextEventListener::reportError):
        (WebCore::V8WorkerContextEventListener::getReceiverObject):
        * bindings/v8/V8WorkerContextEventListener.h:
        * bindings/v8/V8WorkerContextObjectEventListener.cpp: Removed.
        * bindings/v8/V8WorkerContextObjectEventListener.h: Removed.
        * bindings/v8/WorkerContextExecutionProxy.cpp:
        (WebCore::WorkerContextExecutionProxy::dispose):
        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
        * bindings/v8/WorkerContextExecutionProxy.h:
        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8CustomBinding.h:
        * bindings/v8/custom/V8CustomEventListener.cpp:
        (WebCore::V8EventListener::V8EventListener):
        (WebCore::V8EventListener::getListenerFunction):
        (WebCore::V8EventListener::callListenerFunction):
        * bindings/v8/custom/V8CustomEventListener.h:
        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
        * bindings/v8/custom/V8MessagePortCustom.cpp:
        (WebCore::getEventListener):
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8NodeCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8WebSocketCustom.cpp:
        * bindings/v8/custom/V8WorkerContextCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8WorkerCustom.cpp:
        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48978 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Patch by Alexis Menard <alexis.menard@nokia.com> on 2009-10-01
Reviewed by Tor Arne Vestbø.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48974 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Dimitri Glazkov.

        Read-only transactions do not change file sizes and therefore
        should not trigger quota updates.

        https://bugs.webkit.org/show_bug.cgi?id=29945

        * storage/SQLTransaction.cpp:
        (WebCore::SQLTransaction::openTransactionAndPreflight):
        (WebCore::SQLTransaction::runStatements):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48973 268f45cc-cd09-0410-ab3c-d52691b4dbfc

function on RenderBox.

<rdar://problem/7255440> REGRESSION (r48683): Mousewheel scrolling
of listboxes is broken (29756)

Reviewed by Dan Bernstein.

* rendering/RenderListBox.cpp:
(WebCore::RenderListBox::scroll):
* rendering/RenderListBox.h:
* rendering/RenderTextControlSingleLine.cpp:
(WebCore::RenderTextControlSingleLine::scroll):
* rendering/RenderTextControlSingleLine.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48971 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Timothy Hatcher.

        Make a copy of listeners array before dispatching an event in
        WebInspector.Object.prototype.dispatchEventToListeners. Otherwise if current
        listener removes itself from the array next listener will be skipped.

        https://bugs.webkit.org/show_bug.cgi?id=29920

        * inspector/front-end/Object.js:
        (WebInspector.Object.prototype.dispatchEventToListeners): make a copy of listeners array before dispatching an event

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48970 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Xan Lopez.

        [GTK] GtkIMContext filtering interferes with DOM key events
        https://bugs.webkit.org/show_bug.cgi?id=28733

        Add new key event test ensuring that IME keypresses are handled.

        * GNUmakefile.am:
2009-10-01  Martin Robinson  <martin.james.robinson@gmail.com>

        Reviewed by Xan Lopez.

        [GTK] GtkIMContext filtering interferes with DOM key events
        https://bugs.webkit.org/show_bug.cgi?id=28733

        Re-enable skipped tests which were previously failing.

        * platform/gtk/Skipped:
2009-10-01  Martin Robinson  <martin.james.robinson@gmail.com>

        Reviewed by Xan Lopez.

        [GTK] GtkIMContext filtering interferes with DOM key events
        https://bugs.webkit.org/show_bug.cgi?id=28733

        Ensure that keyboard events filtered by the GtkIMContext still create
        the proper DOM events.

        No tests added. Instead previously skipped tests have been enabled.

        * platform/gtk/KeyEventGtk.cpp:
        (WebCore::keyIdentifierForGdkKeyCode):
        (WebCore::singleCharacterString):
2009-10-01  Martin Robinson  <martin.james.robinson@gmail.com>

        Reviewed by Xan Lopez.

        [GTK] GtkIMContext filtering interferes with DOM key events
        https://bugs.webkit.org/show_bug.cgi?id=28733

        Ensure that keyboard events filtered by the GtkIMContext still create
        the proper DOM events.

        * WebCoreSupport/EditorClientGtk.cpp:
        (WebKit::clearPendingIMData):
        (WebKit::imContextCommitted):
        (WebKit::imContextPreeditChanged):
        (WebKit::EditorClient::shouldBeginEditing):
        (WebKit::EditorClient::shouldEndEditing):
        (WebKit::interpretEditorCommandKeyEvent):
        (WebKit::handleCaretBrowsingKeyboardEvent):
        (WebKit::EditorClient::handleKeyboardEvent):
        (WebKit::EditorClient::handleInputMethodKeydown):
        * tests/testkeyevents.c: Added.
        (test_info_new):
        (test_info_destroy):
        (key_event_fixture_setup):
        (key_event_fixture_teardown):
        (key_press_event_cb):
        (key_release_event_cb):
        (load_status_cb):
        (map_event_cb):
        (test_keypress):
        (main):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48964 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Xan Lopez.

        [GTK] data: uri support in media player
        https://bugs.webkit.org/show_bug.cgi?id=29842

        Check presence of gstreamer-pbutils-0.10.

        * configure.ac:
2009-10-01  Philippe Normand  <pnormand@igalia.com>

        Reviewed by Xan Lopez.

        [GTK] data: uri support in media player
        https://bugs.webkit.org/show_bug.cgi?id=29842

        Re-enable media/audio-data-url.html.

        * platform/gtk/Skipped:
2009-10-01  Philippe Normand  <pnormand@igalia.com>

        Reviewed by Xan Lopez.

        [GTK] data: uri support in media player
        https://bugs.webkit.org/show_bug.cgi?id=29842

        New GStreamer element to handle data: uris. For now only base64
        encoded data is supported. Decoded data is handed over to
        giostreamsrc.

        * GNUmakefile.am:
        * platform/graphics/gtk/DataSourceGStreamer.cpp: Added.
        (_do_init):
        (webkit_data_src_base_init):
        (webkit_data_src_class_init):
        (webkit_data_src_reset):
        (webkit_data_src_init):
        (webkit_data_src_finalize):
        (webkit_data_src_uri_get_type):
        (webkit_data_src_uri_get_protocols):
        (webkit_data_src_uri_get_uri):
        (webkit_data_src_uri_set_uri):
        (webkit_data_src_uri_handler_init):
        * platform/graphics/gtk/DataSourceGStreamer.h: Added.
        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::do_gst_init):
        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
        (WebCore::MediaPlayerPrivate::mimeTypeCache):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48963 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Adam Barth.

        https://bugs.webkit.org/show_bug.cgi?id=29944
        
        Reduces false positives in the XSSAuditor by explicitly allowing requests
        that do not contain illegal URI characters.
        
        As a side effect of this change, the tests property-inject.html, 
        property-escape-noquotes.html, and property-escape-noquotes-tab-slash-chars.html 
        fail because these attacks do not contain any illegal URI characters and 
        thus are now allowed by the XSSAuditor, where previously they weren't. A future
        change may reinstate this functionality.

        Tests: http/tests/security/xssAuditor/script-tag-safe2.html
               http/tests/security/xssAuditor/script-tag-safe3.html

        * page/XSSAuditor.cpp:
        (WebCore::isIllegalURICharacter): Added method.
        (WebCore::XSSAuditor::canEvaluate):
        (WebCore::XSSAuditor::canCreateInlineEventListener):
        (WebCore::XSSAuditor::findInRequest): Added parameter 
        allowRequestIfNoIllegalURICharacters.
        * page/XSSAuditor.h:
2009-09-30  Daniel Bates  <dbates@webkit.org>

        Reviewed by Adam Barth.

        https://bugs.webkit.org/show_bug.cgi?id=29944
        
        Tests that the XSSAuditor allows requests that do not contain illegal URI 
        characters.
        
        Added a notice regarding the failure of tests property-inject.html, 
        property-escape-noquotes.html and property-escape-noquotes-tab-slash-chars.html, 
        and rebased the expected results of these tests.

        * http/tests/security/xssAuditor/property-escape-noquotes-expected.txt:
        * http/tests/security/xssAuditor/property-escape-noquotes-tab-slash-chars-expected.txt:
        * http/tests/security/xssAuditor/property-escape-noquotes-tab-slash-chars.html:
        * http/tests/security/xssAuditor/property-escape-noquotes.html:
        * http/tests/security/xssAuditor/property-inject-expected.txt:
        * http/tests/security/xssAuditor/property-inject.html:
        * http/tests/security/xssAuditor/resources/safe-script-noquotes.js: Added.
        * http/tests/security/xssAuditor/resources/script-tag-safe2.html: Added.
        * http/tests/security/xssAuditor/resources/script-tag-safe3.html: Added.
        * http/tests/security/xssAuditor/script-tag-safe2-expected.txt: Added.
        * http/tests/security/xssAuditor/script-tag-safe2.html: Added.
        * http/tests/security/xssAuditor/script-tag-safe3-expected.txt: Added.
        * http/tests/security/xssAuditor/script-tag-safe3.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48961 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=28948

Reviewed by Maciej Stachowiak.

showModalDialog calls getDirect on what is actually a window shell,
so ends up not getting a value (since no value can ever be placed
directly on the shell), which leads to incorrect behaviour.

We use a manual test rather than automatic as it was not
possible to get a modal run loop to work inside DRT.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48960 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin Adler.

        Add ValidityState.tooLong support for <input> and <textarea>.
        https://bugs.webkit.org/show_bug.cgi?id=27454

        * fast/forms/ValidityState-tooLong-input-expected.txt: Added.
        * fast/forms/ValidityState-tooLong-input.html: Added.
        * fast/forms/ValidityState-tooLong-textarea-expected.txt: Added.
        * fast/forms/ValidityState-tooLong-textarea.html: Added.
        * fast/forms/script-tests/ValidityState-tooLong-input.js: Added.
        * fast/forms/script-tests/ValidityState-tooLong-textarea.js: Added.
2009-09-30  Kent Tamura  <tkent@chromium.org>

        Reviewed by Darin Adler.

        Adds ValidityState.tooLong support for <input> and <textarea>.

        Introduces tooLong() in HTMLFormControlElement and it always returns false.
        HTMLInputElement and HTMLTextAreaElement overrides it and checks the text
        length and maxLength.  tooLong() should work only for `dirty' values.
        So, introduces m_isDirty flag for HTMLTextAreaElement, and
        !m_data.value().isNull() works as a dirty flag for HTMLInputElement.

        Renames parameter names of setMaxLength().

        https://bugs.webkit.org/show_bug.cgi?id=27454

        Tests: fast/forms/ValidityState-tooLong-input.html
               fast/forms/ValidityState-tooLong-textarea.html

        * html/HTMLFormControlElement.h:
        (WebCore::HTMLFormControlElement::tooLong):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::tooLong):
        (WebCore::HTMLInputElement::setMaxLength):
        * html/HTMLInputElement.h:
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
        (WebCore::HTMLTextAreaElement::reset):
        (WebCore::HTMLTextAreaElement::updateValue):
        (WebCore::HTMLTextAreaElement::setMaxLength):
        (WebCore::HTMLTextAreaElement::tooLong):
        * html/HTMLTextAreaElement.h:
        * html/ValidityState.h:
        (WebCore::ValidityState::tooLong):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48959 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Maciej Stachowiak.

        Factor RedirectScheduler out of FrameLoader
        https://bugs.webkit.org/show_bug.cgi?id=29948

        This change introduces a new sub-object of Frame, redirectScheduler.
        The redirectScheduler is responsible for scheduling redirects.

        This change leaves the code for the redirectScheduler in
        FrameLoader.cpp.  A future change will move the class into its own
        file.

        No behavior change (hopefully!).

        * loader/FrameLoader.cpp:
        (WebCore::RedirectScheduler::RedirectScheduler):
        (WebCore::RedirectScheduler::~RedirectScheduler):
        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
        (WebCore::RedirectScheduler::clear):
        (WebCore::FrameLoader::FrameLoader):
        (WebCore::FrameLoader::setDefersLoading):
        (WebCore::FrameLoader::stopLoading):
        (WebCore::FrameLoader::didOpenURL):
        (WebCore::FrameLoader::didExplicitOpen):
        (WebCore::FrameLoader::cancelAndClear):
        (WebCore::FrameLoader::clear):
        (WebCore::FrameLoader::checkCompleted):
        (WebCore::FrameLoader::isScheduledLocationChangePending):
        (WebCore::FrameLoader::scheduleHTTPRedirection):
        (WebCore::RedirectScheduler::scheduleRedirect):
        (WebCore::RedirectScheduler::mustLockBackForwardList):
        (WebCore::FrameLoader::scheduleLocationChange):
        (WebCore::RedirectScheduler::scheduleLocationChange):
        (WebCore::FrameLoader::scheduleFormSubmission):
        (WebCore::RedirectScheduler::scheduleFormSubmission):
        (WebCore::FrameLoader::scheduleRefresh):
        (WebCore::RedirectScheduler::scheduleRefresh):
        (WebCore::RedirectScheduler::locationChangePending):
        (WebCore::FrameLoader::scheduleHistoryNavigation):
        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
        (WebCore::RedirectScheduler::timerFired):
        (WebCore::FrameLoader::provisionalLoadStarted):
        (WebCore::RedirectScheduler::schedule):
        (WebCore::RedirectScheduler::startTimer):
        (WebCore::RedirectScheduler::cancel):
        (WebCore::FrameLoader::completed):
        (WebCore::FrameLoader::open):
        * loader/FrameLoader.h:
        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
        * page/Frame.cpp:
        (WebCore::Frame::Frame):
        (WebCore::Frame::redirectScheduler):
        * page/Frame.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48958 268f45cc-cd09-0410-ab3c-d52691b4dbfc

More Windows build fixes for https://bugs.webkit.org/show_bug.cgi?id=29943

* platform/network/cf/ResourceHandleCFNet.cpp:
(WebCore::willSendRequest):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48957 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix windows build for fix for https://bugs.webkit.org/show_bug.cgi?id=29943

* platform/network/cf/ResourceHandleCFNet.cpp:
(WebCore::willSendRequest):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48956 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin Fisher.

        [V8] HTMLAudioElement, HTMLImageElement, and HTMLOptionElement are constructable, but they shouldn't be.
        Only Audio, Image, and Option should be constructable.
        https://bugs.webkit.org/show_bug.cgi?id=29940

        Test: fast/dom/dom-constructor.html

        * WebCore.gypi: Added new files to project.
        * bindings/scripts/CodeGeneratorV8.pm: Modified to generate custom constructors.
        * bindings/v8/V8DOMWrapper.cpp:
        (WebCore::V8DOMWrapper::getTemplate): Removed handling of HTMLImageElement, HTMLOptionElement
          and HTMLAudioElement construction.
        * bindings/v8/V8HTMLAudioElementConstructor.h: Added.
        * bindings/v8/V8HTMLImageElementConstructor.h: Added.
        * bindings/v8/V8HTMLOptionElementConstructor.h: Added.
        * bindings/v8/V8Index.cpp: Added new headers.
        * bindings/v8/V8Index.h: Added Audio, Image and Option decls.
        * bindings/v8/custom/V8CustomBinding.h: Ditto.
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::ACCESSOR_GETTER): Added custom constructors.
        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Added custom template creator.
        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
        (WebCore::V8HTMLOptionElementConstructor::GetTemplate): Ditto.
        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48955 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Brady Eidson.

        307 redirects should pass along http body and Content-Type header
        https://bugs.webkit.org/show_bug.cgi?id=29943

        Follow-up fix for:
        <rdar://problem/3802660> SAP: 307 (Temporary Redirect) responses should use POST, not GET
        
        Test: http/tests/loading/resources/redirect-methods-result.php

        * platform/network/cf/ResourceHandleCFNet.cpp:
        (WebCore::willSendRequest): Pass along http body and Content-Type header.
        * platform/network/mac/ResourceHandleMac.mm:
        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): ditto
2009-09-30  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Brady Eidson.

        307 redirects should pass along http body and Content-Type header
        https://bugs.webkit.org/show_bug.cgi?id=29943

        Follow-up fix for:
        <rdar://problem/3802660> SAP: 307 (Temporary Redirect) responses should use POST, not GET

        * http/tests/loading/redirect-methods.html: Updated test to show the http body and content-type header.
        * http/tests/loading/redirect-methods-expected.txt:
        * http/tests/loading/resources/redirect-methods-result.php: 


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48953 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (r48882-r48888): Many memory leaks on SnowLeopard leaks bot

Patch by Geoffrey Garen <ggaren@apple.com> on 2009-09-30
Reviewed by Mark Rowe.

Forgot to implement a destructor for JSDOMWindowBaseData, so it was
leaking its RefPtr data member.

* bindings/js/JSDOMWindowBase.cpp:
(WebCore::JSDOMWindowBase::destroyJSDOMWindowBaseData):
* bindings/js/JSDOMWindowBase.h:
(WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData::JSDOMWindowBaseData):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48952 268f45cc-cd09-0410-ab3c-d52691b4dbfc

reflect the changes.

Reviewed by Tim Hatcher.

* page/PageGroup.cpp:
(WebCore::PageGroup::removeUserContentWithURLForWorld):
(WebCore::PageGroup::removeUserContentForWorld):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48951 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=29209

Reviewed by Sam Weinig.

WebCore: 

Test: fast/inline/relative-positioned-overflow.html

* rendering/InlineFlowBox.cpp:
(WebCore::InlineFlowBox::computeVerticalOverflow): Add self-painting
inlines to overflow to ensure that they are included in hit-testing.

LayoutTests: 

* fast/inline/relative-positioned-overflow-expected.txt: Added.
* fast/inline/relative-positioned-overflow.html: Added.
* platform/mac/fast/repaint/transform-absolute-in-positioned-container-expected.txt:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48947 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Mark Rowe.

        transforms/3d tests are not run in Release builds
        https://bugs.webkit.org/show_bug.cgi?id=29827

        Make sure we export the WebCoreHas3DRendering symbol in Release builds,
        because this symbols is used by run-webkit-tests (via 'nm') to detect whether
        WebCore was built with ENABLE_3D_RENDERING turned on.

        * DerivedSources.make:
        * WebCore.3DRendering.exp: Added.
        * WebCore.xcodeproj/project.pbxproj:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48945 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Patch by Jeremy Orlow <jorlow@chromium.org> on 2009-09-30
* WebCore.pro:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48942 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Reviewed by Adam Roben.

* page/PageGroup.cpp:
(WebCore::PageGroup::removeUserContentURLForWorld):
* page/PageGroup.h:

WebKit/mac: Add the ability to remove user stylesheets and scripts by URL.

Reviewed by Adam Roben.

* WebView/WebView.mm:
(+[WebView _removeUserContentFromGroup:url:worldID:]):
* WebView/WebViewPrivate.h:

WebKit/win: Add the ability to remove user stylesheets and scripts by URL.

Reviewed by Adam Roben.

* Interfaces/IWebViewPrivate.idl:
* WebView.cpp:
(WebView::removeUserContentWithURLFromGroup):
* WebView.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48941 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Dimitri Glazkov.

        Fix for conditionals in the WebCore gyp file, which contained two separate
        'conditions' values for the webcore target. The first entry was ignored,
        resulting in some missine defines.
        https://bugs.webkit.org/show_bug.cgi?id=29907

        * WebCore.gyp/WebCore.gyp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48940 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Adam Barth.

        DOM Storage needs to be more careful about where "ThreadSafe" objects are destroyed.
        https://bugs.webkit.org/show_bug.cgi?id=29265

        DOM Storage needs to be more careful about where "ThreadSafe" objects are
        destroyed.  With the current code, there actually isn't a race condition, but
        it sure would be easy for someone to introduce one.  A bunch of
        ThreadSafeShared objects have RefPtrs to objects that are NOT ThreadSafeShared
        objects.  If it were possible any of these objects' destructors to be fired off
        the main thread, then the you'd have a race condition.  The code should be more
        clear and self-documenting about how things related to each other.

        Since the lifetime of a LocalStorageTask is bounded by the LocalStorageThread
        which is bounded by the StorageSyncManager, StorageAreaImpl, and
        StorageAreaSync, there's no reason for LocalStorageTask to store anything other
        than pointers.  By breaking this dependency, we can eliminate the risk.

        Note that we _could_ have LocalStorageThread's task queue just store
        LocalStorageTask*'s rather than RefPtr<LocalStorageTask>s but then we'd need to
        manually take care of deleting.  It'd probably also be possible to change
        LocalStorageThread around so that it needn't hold onto a reference of itself
        and have a more deterministic shutdown, but my initial attempts to do so
        failed, and I decided it wasn't worth changing.  The queue is killed before
        hand, so the thread is 100% impotent before the main thread continues anyway.

        The constructors and destructors of StorageSyncManager, StorageAreaImpl, and
        StorageAreaSync now have ASSERTs to verify they're running on the main thread. 
        I'm fairly positive that it'd be impossible to hit these asserts and the fact
        that these classes are no longer ThreadSafeShared should make it clear how
        they're meant to be used, but I think it's worth it to be extra sure.  Of
        course, ideally, we'd have such an assert every time a ref is incremented or
        decremented.

        Behavior should be unchanged and this is just an internal code cleanup, so no
        new tests.

        * storage/LocalStorageTask.cpp:
        (WebCore::LocalStorageTask::LocalStorageTask):
        (WebCore::LocalStorageTask::performTask):
        * storage/LocalStorageTask.h:
        (WebCore::LocalStorageTask::createImport):
        (WebCore::LocalStorageTask::createSync):
        (WebCore::LocalStorageTask::createTerminate):
        * storage/LocalStorageThread.cpp:
        (WebCore::LocalStorageThread::scheduleImport):
        (WebCore::LocalStorageThread::scheduleSync):
        * storage/LocalStorageThread.h:
        * storage/StorageArea.h:
        * storage/StorageAreaImpl.cpp:
        (WebCore::StorageAreaImpl::~StorageAreaImpl):
        (WebCore::StorageAreaImpl::StorageAreaImpl):
        * storage/StorageAreaSync.cpp:
        (WebCore::StorageAreaSync::StorageAreaSync):
        (WebCore::StorageAreaSync::~StorageAreaSync):
        * storage/StorageSyncManager.cpp:
        (WebCore::StorageSyncManager::StorageSyncManager):
        (WebCore::StorageSyncManager::~StorageSyncManager):
        (WebCore::StorageSyncManager::scheduleImport):
        (WebCore::StorageSyncManager::scheduleSync):
        * storage/StorageSyncManager.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48939 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin Fisher.

        Chromium needs to be able to override the way storage events are delivered
        https://bugs.webkit.org/show_bug.cgi?id=29655

        Chromium needs to be able to override the way storage events are delivered.
        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
        injection).  This is necessary because Chromium needs to transport events across
        a process barrier and then dispatch them without use of a Frame*.

        Behavior should not change with this, so no updates to tests.

        * GNUmakefile.am:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * WebCoreSources.bkl:
        * storage/StorageAreaImpl.cpp:
        (WebCore::StorageAreaImpl::setItem):
        (WebCore::StorageAreaImpl::removeItem):
        (WebCore::StorageAreaImpl::clear):
        * storage/StorageAreaImpl.h:
        * storage/StorageEventDispatcher.cpp: Copied from WebCore/storage/StorageAreaImpl.cpp.
        (WebCore::StorageEventDispatcher::dispatch):
        * storage/StorageEventDispatcher.h: Added.  (Well, technically in the other half of this patch.)


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48937 268f45cc-cd09-0410-ab3c-d52691b4dbfc

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48936 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=29929

Reviewed by Darin Adler.

WebCore:

Test: http/tests/misc/drag-over-iframe-invalid-source-crash.html

* page/EventHandler.cpp:
(WebCore::EventHandler::updateDragAndDrop):

LayoutTests:

Add a new test for the bug.

* http/tests/misc/drag-over-iframe-invalid-source-crash-expected.txt: Added.
* http/tests/misc/drag-over-iframe-invalid-source-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48934 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Dan Bernstein.

        ASSERTION FAILED: !repaintContainer || repaintContainer == this
        https://bugs.webkit.org/show_bug.cgi?id=29755

        Generalize the fix for this bug to account for cases where there may be multiple
        containing blocks between the repaint container, and the container of the element
        being repainted.

        Test: compositing/repaint/opacity-between-absolute2.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::mapLocalToContainer):
        Call offsetFromAncestorContainer() to get the correct offset.

        (WebCore::RenderBox::computeRectForRepaint): Ditto
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::computeRectForRepaint): Ditto.

        * rendering/RenderObject.h:
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::offsetFromAncestorContainer):
        New method that computes an offset from some object in the ancestor container() chain.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48932 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Simon Hausmann.

        [Qt] Fix TextCodecQt::decode method after r48752 to return a non-null string if the length of the input is 0.
        This fixes https://bugs.webkit.org/show_bug.cgi?id=29736.

        * platform/text/qt/TextCodecQt.cpp:
        (WebCore::TextCodecQt::decode):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48929 268f45cc-cd09-0410-ab3c-d52691b4dbfc

selector gets constructed so that pattern match testing gets the correct URL.

Reviewed by Jon Honeycutt.

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::begin):
* page/UserContentURLPattern.cpp:
(WebCore::UserContentURLPattern::parse):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48919 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Assertion failure in http/tests/xmlhttprequest/failed-auth.html.

        I couldn't find out why this only started to happen now, but it was incorrect to check
        persistence of a credential returned by CredentialStorage::get() without checking that it
        was non-null. When there is no credential for the protection space in storage, get()
        returns a new object, and Credentil constructor doesn't initialize m_persistence.

        * platform/network/mac/ResourceHandleMac.mm:
        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Moved the
        assertion after credential null check.
        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Added the same persistence
        assertion, matching sync code (and CF one, as well).



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48918 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin Adler.

        Add an ASSERT for UTF8Encoding().isValid()
        https://bugs.webkit.org/show_bug.cgi?id=29908

        * platform/text/TextEncoding.cpp:
        (WebCore::UTF8Encoding):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48913 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add support for whitelist patterns to control conditional injection of user scripts and
user stylesheets.

Reviewed by Jon Honeycutt.

No new tests. Not testable until WebKit portion is added in followup patch.

* GNUmakefile.am:
* WebCore.gypi:
* WebCore.pro:
* WebCore.vcproj/WebCore.vcproj:
* WebCore.xcodeproj/project.pbxproj:
* dom/Document.cpp:
(WebCore::Document::pageGroupUserSheets):
* page/Frame.cpp:
(WebCore::Frame::injectUserScriptsForWorld):
* page/UserContentURLPattern.cpp: Added.
(WebCore::UserContentURLPattern::matchesPatterns):
(WebCore::UserContentURLPattern::parse):
(WebCore::UserContentURLPattern::matches):
(WebCore::UserContentURLPattern::matchesHost):
(WebCore::MatchTester::MatchTester):
(WebCore::MatchTester::testStringFinished):
(WebCore::MatchTester::patternStringFinished):
(WebCore::MatchTester::eatWildcard):
(WebCore::MatchTester::eatSameChars):
(WebCore::MatchTester::test):
(WebCore::UserContentURLPattern::matchesPath):
* page/UserContentURLPattern.h: Added.
(WebCore::UserContentURLPattern::UserContentURLPattern):
(WebCore::UserContentURLPattern::scheme):
(WebCore::UserContentURLPattern::host):
(WebCore::UserContentURLPattern::path):
(WebCore::UserContentURLPattern::matchSubdomains):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48912 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Adele Peterson.

        Test case for <rdar://problem/7085453>.

        * editing/selection/blockquote-crash-expected.txt: Added.
        * editing/selection/blockquote-crash.html: Added.
2009-09-29  Enrica Casucci  <enrica@apple.com>

        Reviewed by Adele Peterson.

        Reproducible crash pressing return inside quoted content
        at WebCore::BreakBlockquoteCommand::doApply.
        <rdar://problem/7085453>
        In some case, like the one provided in the test case, m_downStreamEnd
        refers to a node that gets deleted when executing the DeleteSelectionCommand.
        We shouldn't use m_downStreamEnd to recalculate the new m_endPosition when
        pruning is needed, because it may be point to a node that has been deleted, but
        rather rely on removeNode in CompositeEditCommand to update m_endPosition correctly.

        Test: editing/selection/blockquote-crash.html

        * editing/BreakBlockquoteCommand.cpp:
        (WebCore::BreakBlockquoteCommand::doApply): Added check for invalid position
        to avoid dereferencing a null node pointer.
        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::mergeParagraphs): Don't reset m_endPosition
        using the value in m_downStreamEnd when it is necessary to prune the start block.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48910 268f45cc-cd09-0410-ab3c-d52691b4dbfc