https://bugs.webkit.org/show_bug.cgi?id=105988

Unreviewed gardening. Mark tests as flakey (crashing) in WK1 expectations as well as WK2.

* platform/mac-wk2/TestExpectations:
* platform/mac/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154189 268f45cc-cd09-0410-ab3c-d52691b4dbfc

* platform/graphics/qt/MediaPlayerPrivateQt.cpp:
(WebCore::MediaPlayerPrivateQt::commitLoad):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154188 268f45cc-cd09-0410-ab3c-d52691b4dbfc

* WebView.cpp:
(WebView::paintIntoBackingStore):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154187 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=119838

Reviewed by Jocelyn Turcotte.

Source/WebCore:

Mark fonts with both kerning and letter-spacing as unsupported by the simple font-path.

Test: fast/text/letter-spacing-kerned.html

* platform/graphics/WidthIterator.h:
(WebCore::WidthIterator::supportsTypesettingFeatures):

LayoutTests:

Test that kerning does not break letter spacing.

* fast/text/letter-spacing-kerned-expected.html: Added.
* fast/text/letter-spacing-kerned.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154186 268f45cc-cd09-0410-ab3c-d52691b4dbfc

* platform/win/TestExpectations: Reactivate fast/text/split-text-crash.xhtml



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154185 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Reviewed by Antti Koivisto.

FrameView::m_frame was only ever null for a brief moment during CachedFrame teardown.
Leave it alone instead, and update the assertion that depended on this behavior.
This enables us to make FrameView::frame() return a Frame&, exposing a ton of
unnecessary null checks.

* history/CachedFrame.cpp:
(WebCore::CachedFrame::destroy):

    Remove call to FrameView::clearFrame() that was the only way to get a null
    FrameView::m_frame. Immediately followed by a call to CachedFrame::clear() where
    the FrameView would get destroyed anyway.

(WebCore::CachedFrame::clear):

    Update an assertion to support the case where the Document's Frame pointer has
    been cleared out and CachedFrame is still clinging to the FrameView.

* history/CachedPage.h:

    Made CachedPage::destroy() private as it was only called by ~CachedPage().

* /:

    Frame* FrameView::frame() => Frame& FrameView::frame()

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154184 268f45cc-cd09-0410-ab3c-d52691b4dbfc

(NetworkProcess)  Sync XHRs should load using async ResourceHandles, not ResourceHandle::loadResourceSynchronously
https://bugs.webkit.org/show_bug.cgi?id=119493

Reviewed by Alexey Proskuryakov.

Source/WebCore:

No new tests (Covered by plenty of existing tests).

* WebCore.exp.in:
* WebCore.xcodeproj/project.pbxproj:

* platform/network/SynchronousLoaderClient.h: Make platformBadResponseError public

* platform/network/mac/ResourceHandleMac.mm:
(WebCore::ResourceHandle::platformLoadResourceSynchronously): Add comments/FIXMEs spelling out how wrong this code is.

Source/WebKit2:

This patch does the following:
  - Consolidates SchedulableLoader and NetworkResourceLoader into one class.
  - Removes SyncNetworkResourceLoader.
  - Adds a NetworkLoaderClient interface that customizes certain behaviors of the NetworkResourceLoader.
  - Implements a SynchronousNetworkLoaderClient and AsynchronousNetworkLoaderClient for the two different types of loads.

The AsynchronousNetworkLoaderClient results in messaging back progress to the WebProcess as the load progresses.
The SynchronousNetworkLoaderClient accumulates the response, data, and error to be communicated back to the WebProcess
only when the load is complete.

Update small swaths of code to reflect that NetworkResourceLoader is the One True Loader (tm):
* NetworkProcess/HostRecord.cpp:
(WebKit::HostRecord::scheduleResourceLoader):
(WebKit::HostRecord::addLoaderInProgress):
(WebKit::removeLoaderFromQueue):
(WebKit::HostRecord::removeLoader):
(WebKit::HostRecord::servePendingRequestsForQueue):
(WebKit::HostRecord::limitsRequests):
* NetworkProcess/HostRecord.h:

* NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::didClose):
(WebKit::NetworkConnectionToWebProcess::performSynchronousLoad):
(WebKit::NetworkConnectionToWebProcess::removeLoadIdentifier):
* NetworkProcess/NetworkConnectionToWebProcess.h:

* NetworkProcess/NetworkProcess.cpp:
* NetworkProcess/NetworkResourceLoadScheduler.cpp:
(WebKit::NetworkResourceLoadScheduler::scheduleLoader):
(WebKit::NetworkResourceLoadScheduler::removeLoader):
(WebKit::NetworkResourceLoadScheduler::receivedRedirect):
(WebKit::NetworkResourceLoadScheduler::removeScheduledLoaders):
(WebKit::NetworkResourceLoadScheduler::scheduleRemoveLoader):
* NetworkProcess/NetworkResourceLoadScheduler.h:

Combine ScheduleableLoader and NetworkResourceLoader into NetworkResourceLoader:
* NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::NetworkResourceLoader):
(WebKit::NetworkResourceLoader::~NetworkResourceLoader):
(WebKit::NetworkResourceLoader::isSynchronous):
(WebKit::NetworkResourceLoader::start):
(WebKit::NetworkResourceLoader::didReceiveResponseAsync):
(WebKit::NetworkResourceLoader::didReceiveBuffer):
(WebKit::NetworkResourceLoader::didFinishLoading):
(WebKit::NetworkResourceLoader::didFail):
(WebKit::NetworkResourceLoader::willSendRequestAsync):
(WebKit::NetworkResourceLoader::continueWillSendRequest):
(WebKit::NetworkResourceLoader::didSendData):
(WebKit::NetworkResourceLoader::shouldUseCredentialStorage):
(WebKit::NetworkResourceLoader::didReceiveAuthenticationChallenge):
(WebKit::NetworkResourceLoader::consumeSandboxExtensions):
(WebKit::NetworkResourceLoader::invalidateSandboxExtensions):
(WebKit::NetworkResourceLoader::canAuthenticateAgainstProtectionSpaceAsync):
* NetworkProcess/NetworkResourceLoader.h:
(WebKit::NetworkResourceLoader::create):
(WebKit::NetworkResourceLoader::connectionToWebProcess):
(WebKit::NetworkResourceLoader::priority):
(WebKit::NetworkResourceLoader::request):
(WebKit::NetworkResourceLoader::isLoadingMainResource):
(WebKit::NetworkResourceLoader::setHostRecord):
(WebKit::NetworkResourceLoader::hostRecord):
(WebKit::NetworkResourceLoader::sendAbortingOnFailure):

Add an abstract NetworkLoaderClient to adapt a load to be either synchronous or asynchronous:
* NetworkProcess/NetworkLoaderClient.h:
(WebKit::NetworkLoaderClient::~NetworkLoaderClient):
(WebKit::NetworkLoaderClient::isSynchronous):
(WebKit::NetworkLoaderClient::NetworkLoaderClient):

The asynchronous loader client, primarily to message progress back to the WebProcess as it happens:
* NetworkProcess/AsynchronousNetworkLoaderClient.cpp: Added.
(WebKit::AsynchronousNetworkLoaderClient::AsynchronousNetworkLoaderClient):
(WebKit::AsynchronousNetworkLoaderClient::willSendRequest):
(WebKit::AsynchronousNetworkLoaderClient::canAuthenticateAgainstProtectionSpace):
(WebKit::AsynchronousNetworkLoaderClient::didReceiveResponse):
(WebKit::AsynchronousNetworkLoaderClient::didReceiveBuffer):
(WebKit::AsynchronousNetworkLoaderClient::didSendData):
(WebKit::AsynchronousNetworkLoaderClient::didFinishLoading):
(WebKit::AsynchronousNetworkLoaderClient::didFail):
* NetworkProcess/AsynchronousNetworkLoaderClient.h:
(WebKit::AsynchronousNetworkLoaderClient::create):

The synchronous loader client, primarily to accumulate results of the load to send back to the WebProcess all at once:
* NetworkProcess/SynchronousNetworkLoaderClient.cpp: Added.
(WebKit::SynchronousNetworkLoaderClient::SynchronousNetworkLoaderClient):
(WebKit::SynchronousNetworkLoaderClient::~SynchronousNetworkLoaderClient):
(WebKit::SynchronousNetworkLoaderClient::willSendRequest):
(WebKit::SynchronousNetworkLoaderClient::canAuthenticateAgainstProtectionSpace):
(WebKit::SynchronousNetworkLoaderClient::didReceiveResponse):
(WebKit::SynchronousNetworkLoaderClient::didReceiveBuffer):
(WebKit::SynchronousNetworkLoaderClient::didFinishLoading):
(WebKit::SynchronousNetworkLoaderClient::didFail):
(WebKit::SynchronousNetworkLoaderClient::sendDelayedReply):
* NetworkProcess/SynchronousNetworkLoaderClient.h: Added.
(WebKit::SynchronousNetworkLoaderClient::create):

* NetworkProcess/SchedulableLoader.cpp: Removed.
* NetworkProcess/SchedulableLoader.h: Removed.
* NetworkProcess/SyncNetworkResourceLoader.cpp: Removed.
* NetworkProcess/SyncNetworkResourceLoader.h: Removed.

* WebKit2.xcodeproj/project.pbxproj:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154183 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Patch by peavo@outlook.com <peavo@outlook.com> on 2013-08-16
Reviewed by Brent Fulgham.

* platform/network/curl/ResourceHandleManager.cpp:
(WebCore::certificatePath): Use correct function name.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154182 268f45cc-cd09-0410-ab3c-d52691b4dbfc

* WebCore.vcxproj/copyForwardingHeaders.cmd: Copy html/shadow header files
to WebKit include location.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154181 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=119818

Reviewed by Darin Adler.

Covered by existing: compositing/tiling/empty-to-tiled.html

* platform/graphics/ca/win/PlatformCALayerWin.cpp:
(PlatformCALayer::~PlatformCALayer): Remove deleted layer from its
parent layer 

LayoutTests: [Windows] Enable previously-failing compositing/tiling/empty-to-tiled.html
https://bugs.webkit.org/show_bug.cgi?id=119818

Reviewed by Darin Adler.

* platform/win/TestExpectations: Re-enable empty-to-tiled.html


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154180 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Patch by Tamas Czene <tczene@inf.u-szeged.hu> on 2013-08-16

* platform/qt/fast/js/constructor-length-expected.txt:
* platform/qt/fast/js/global-constructors-attributes-expected.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154179 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Reviewed by Anders Carlsson.

Frame::m_eventHandler is never null.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154178 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed EFL gardening. unskip LayoutTests/fast/forms/datalist/input-list.html test.

Patch by Santosh Mahto <santosh.ma@samsung.com> on 2013-08-16

* platform/efl/TestExpectations:
* platform/efl/fast/forms/datalist/input-list-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154177 268f45cc-cd09-0410-ab3c-d52691b4dbfc

http://trac.webkit.org/changeset/153749
https://bugs.webkit.org/show_bug.cgi?id=119892

The bison generation of the glslang* files has now been fixed. (Requested by zdobersek on #webkit).

Patch by Commit Queue <commit-queue@webkit.org> on 2013-08-16

Source/ThirdParty/ANGLE: 

* GNUmakefile.am: Preserve the libANGLE.la dependency on the ANGLE's GNUmakefile.am.

Source/WebCore: 

* GNUmakefile.am:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154176 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=119884

The method name defined in LocalizedStringsGtk.cpp doesn't not match
the one used in LocalizedStrings.h

Patch by Danilo Cesar Lemes de Paula <danilo.cesar@collabora.co.uk> on 2013-08-16
Reviewed by Gustavo Noronha Silva.

* platform/gtk/LocalizedStringsGtk.cpp:
(WebCore::textTrackOffMenuItemText):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154175 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=119614

Source/WebCore:

Added the -webkit-mask-source-type property, which can have a value of auto, alpha or
luminance. The default value is auto. This patch contains only the parsing of the property,
not the actual implementation of the types of masks. The parsing of mask-source-type in the
-webkit-mask property will be handled in a separate patch.

Patch by Andrei Parvu <parvu@adobe.com> on 2013-08-16
Reviewed by Dirk Schulze.

Test: fast/masking/parsing-mask-source-type.html

* css/CSSComputedStyleDeclaration.cpp: Added case for CSSPropertyWebkitMaskType.
(WebCore::ComputedStyleExtractor::propertyValue):
* css/CSSParser.cpp: Parsed the values for CSSPropertyWebkitMaskType.
(WebCore::CSSParser::parseValue):
(WebCore::CSSParser::parseFillProperty):
* css/CSSProperty.cpp:
(WebCore::CSSProperty::isInheritedProperty):
* css/CSSPropertyNames.in: Added -webkit-mask-type property.
* css/CSSToStyleMap.cpp: map the provided mask type to the FillLayer class.
(WebCore::CSSToStyleMap::mapFillMaskType):
* css/CSSToStyleMap.h:
* css/DeprecatedStyleBuilder.cpp:
(WebCore::DeprecatedStyleBuilder::DeprecatedStyleBuilder):
* css/StyleResolver.cpp:
(WebCore::StyleResolver::applyProperty):
* rendering/style/FillLayer.cpp: Added the m_maskType property to the FillLayer class.
(WebCore::FillLayer::FillLayer):
(WebCore::FillLayer::operator=):
(WebCore::FillLayer::operator==):
* rendering/style/FillLayer.h: Added methods for working with m_maskType.
(WebCore::FillLayer::maskType):
(WebCore::FillLayer::isMaskTypeSet):
(WebCore::FillLayer::setMaskType):
(WebCore::FillLayer::clearMaskType):
(WebCore::FillLayer::initialMaskType):
* rendering/style/RenderStyleConstants.h: Added the EMaskSourceType enum.

LayoutTests:

Added tests for the parsing of the -webkit-mask-source-type property

Patch by Andrei Parvu <parvu@adobe.com> on 2013-08-16
Reviewed by Dirk Schulze.

* fast/masking/parsing-mask-expected.txt:
* fast/masking/parsing-mask-source-type-expected.txt: Added.
* fast/masking/parsing-mask-source-type.html: Added.
* fast/masking/parsing-mask.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154174 268f45cc-cd09-0410-ab3c-d52691b4dbfc

<https://webkit.org/b/119742> REGRESSION(FTL): Fix register usage in mips implementation of ctiVMHandleException

Patch by Balazs Kilvady <kilvadyb@homejinni.com> on 2013-08-16
Reviewed by Allan Sandfeld Jensen.

ctiVMHandleException must jump/return using register ra (r31).

* jit/JITStubsMIPS.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154173 268f45cc-cd09-0410-ab3c-d52691b4dbfc

<https://webkit.org/b/119885> [CMake] Always build our generated versions of ANGLE's glslang.cpp and glslang_tab.cpp

Reviewed by Gyuyoung Kim.

Now that r154109 has landed, all Bison versions (at least from 2.3 up
to the latest 3.0) should be able to generate versions of glslang* that
build correctly.

Since the idea is to remove the prebuilt files from future imports of
ANGLE, always building our own versions is a good idea, and allows us
to get rid of some very ugly CMake checks.

* CMakeLists.txt: Always build glslang.cpp and glslang_tab.cpp from
DERIVED_SOURCES_WEBCORE_DIR.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154172 268f45cc-cd09-0410-ab3c-d52691b4dbfc

* platform/gtk-wk1/TestExpectations:
x-frame-options-deny-meta-tag-in-body.html fails in Release and
Debug.
* platform/gtk/TestExpectations: CSS Image filter is not enabled
in GTK bots. Also remove entry for deleted test.
* platform/gtk/fast/forms/search/search-size-with-decorations-expected.png: Added.
* platform/gtk/fast/forms/search/search-size-with-decorations-expected.txt: Added.
* platform/gtk/fast/js/constructor-length-expected.txt:
Rebaselined after r154127.
* platform/gtk/fast/js/global-constructors-attributes-dedicated-worker-expected.txt:
ditto.
* platform/gtk/fast/js/global-constructors-attributes-expected.txt:
ditto.
* platform/gtk/fast/js/global-constructors-attributes-shared-worker-expected.txt:
ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154171 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Patch by Julien Brianceau <jbrianceau@nds.com> on 2013-08-16
Reviewed by Allan Sandfeld Jensen.

Fix typo in JITStubsSH4.h file.

* jit/JITStubsSH4.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154170 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed gardening.

* platform/qt/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154169 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Patch by Julien Brianceau <jbrianceau@nds.com> on 2013-08-16
Reviewed by Gyuyoung Kim.

Since r154142, Frame::loader() is a reference (and not a pointer anymore).

* xml/parser/XMLDocumentParserQt.cpp:
(WebCore::XMLDocumentParser::parseStartElement):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154168 268f45cc-cd09-0410-ab3c-d52691b4dbfc

* WebProcess/WebPage/CoordinatedGraphics/CoordinatedLayerTreeHost.h: Add missing header.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154167 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=119515

This patch refactors WebGLRenderingContext code by moving the vertex
attribute binding validation to a separate method. It is now
possible to use that validation in other parts of the code. The
code is more clear now.

Patch by Przemyslaw Szymanski <p.szymanski3@samsung.com> on 2013-08-16
Reviewed by Christophe Dumez.

No new tests. Covered by existing tests. No behaviour changed.
LayoutTests/webgl/resources/webgl_test_files/conformance/rendering/gl-drawelements.html
LayoutTests/webgl/resources/webgl_test_files/conformance/rendering/draw-elements-out-of-bounds.html
LayoutTests/webgl/resources/webgl_test_files/conformance/rendering/draw-arrays-out-of-bounds.html

* html/canvas/WebGLRenderingContext.cpp:
(WebCore::WebGLRenderingContext::validateVertexAttributes):
* html/canvas/WebGLVertexArrayObjectOES.h:
(WebCore::WebGLVertexArrayObjectOES::VertexAttribState::isBound):
(WebCore::WebGLVertexArrayObjectOES::VertexAttribState::validateBinding):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154166 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Reviewed by Andreas Kling.

Node::m_parentOrShadowHostNode is currently used both as the parent pointer for regular nodes and as the host
pointer for ShadowRoots. This is confusing. It is also slow as it introduces a branch to all code paths that 
want to traverse ancestors normally, without leaving the shadow trees. This is much more popular than
traversing through.
        
This patch makes the Node have a pure parent pointer only and adds the host element pointer as a separate
member in ShadowRoot. This eliminates the ShadowRoot test branch from Node::parentNode() as the pointer is
now always null in the root node.
        
ShadowRoot grows by a pointer. This is not significant as there are few ShadowRoots compared to Nodes.

* css/StyleResolver.cpp:
(WebCore::StyleResolver::pushParentShadowRoot):
(WebCore::StyleResolver::popParentShadowRoot):
* dom/Attr.cpp:
(WebCore::Attr::createTextChild):
* dom/ComposedShadowTreeWalker.cpp:
(WebCore::ComposedShadowTreeWalker::traverseParentBackToShadowRootOrHost):
* dom/ContainerNode.cpp:
(WebCore::ContainerNode::insertBeforeCommon):
(WebCore::ContainerNode::removeBetween):
* dom/ContainerNodeAlgorithms.cpp:
(WebCore::ChildNodeInsertionNotifier::notifyDescendantInsertedIntoDocument):
(WebCore::ChildNodeRemovalNotifier::notifyDescendantRemovedFromDocument):
* dom/ContainerNodeAlgorithms.h:
(WebCore::appendChildToContainer):
(WebCore::Private::addChildNodesToDeletionQueue):
* dom/Document.h:
(WebCore::Node::Node):
* dom/Element.cpp:
(WebCore::Element::addShadowRoot):
(WebCore::Element::removeShadowRoot):
* dom/ElementRareData.h:
(WebCore::ElementRareData::releasePseudoElement):
* dom/EventPathWalker.cpp:
(WebCore::EventPathWalker::moveToParent):
* dom/EventRetargeter.cpp:
(WebCore::determineDispatchBehavior):
* dom/EventRetargeter.h:
(WebCore::EventRetargeter::eventTargetRespectingTargetRules):
* dom/Node.cpp:
(WebCore::Node::shadowHost):
(WebCore::Node::deprecatedShadowAncestorNode):
(WebCore::Node::parentOrShadowHostElement):
* dom/Node.h:
(WebCore::Node::hasTreeSharedParent):
        
    Shadow host elements refs the ShadowRoot. There is no reason to use TreeShared to keep it alive.

(WebCore::Node::setParentNode):
(WebCore::Node::parentNode):
(WebCore::Node::parentNodeGuaranteedHostFree):
* dom/PseudoElement.cpp:
(WebCore::PseudoElement::PseudoElement):
* dom/ShadowRoot.cpp:
(WebCore::ShadowRoot::ShadowRoot):
(WebCore::ShadowRoot::setInnerHTML):
(WebCore::ShadowRoot::setApplyAuthorStyles):
(WebCore::ShadowRoot::setResetStyleInheritance):
* dom/ShadowRoot.h:
        
    Rename host() -> hostElement() for clarity.

(WebCore::Node::parentOrShadowHostNode):
* dom/Text.cpp:
(WebCore::isSVGShadowText):
* dom/TreeScope.cpp:
(WebCore::TreeScope::focusedElement):
* html/shadow/ContentDistributor.cpp:
(WebCore::ContentDistributor::ensureDistribution):
* html/shadow/InsertionPoint.cpp:
(WebCore::InsertionPoint::insertedInto):
(WebCore::InsertionPoint::removedFrom):
(WebCore::InsertionPoint::parseAttribute):
* page/DragController.cpp:
(WebCore::asFileInput):
* page/EventHandler.cpp:
(WebCore::EventHandler::handleMousePressEvent):
(WebCore::instanceAssociatedWithShadowTreeElement):
* page/FocusController.cpp:
(WebCore::FocusNavigationScope::owner):
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::hasLineIfEmpty):
* rendering/RenderLayer.cpp:
(WebCore::rendererForScrollbar):
* svg/SVGElementInstance.h:
(WebCore::SVGElementInstance::setParentNode):
            
    Renamed so it works with appendChildToContainer template.

* svg/SVGStyledElement.cpp:
(WebCore::SVGStyledElement::title):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154165 268f45cc-cd09-0410-ab3c-d52691b4dbfc

* webkit/webkitwebframe.cpp:
(WebKit::kit): Remove the bogus assertion for Frame::loader() that now returns a reference.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154164 268f45cc-cd09-0410-ab3c-d52691b4dbfc

* platform/win/editing/selection/caret-ltr-right-expected.txt:
* platform/win/editing/selection/caret-rtl-2-left-expected.txt:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154163 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Reviewed by Oliver Hunt.

The concurrent compilation thread should interact minimally with the Heap, including not
triggering WriteBarriers. This is a prerequisite for generational GC.

* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::addOrFindConstant):
(JSC::CodeBlock::findConstant):
* bytecode/CodeBlock.h:
(JSC::CodeBlock::addConstantLazily):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::getJSConstantForValue):
(JSC::DFG::ByteCodeParser::constantUndefined):
(JSC::DFG::ByteCodeParser::constantNull):
(JSC::DFG::ByteCodeParser::one):
(JSC::DFG::ByteCodeParser::constantNaN):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
* dfg/DFGCommonData.cpp:
(JSC::DFG::CommonData::notifyCompilingStructureTransition):
* dfg/DFGCommonData.h:
* dfg/DFGDesiredTransitions.cpp: Added.
(JSC::DFG::DesiredTransition::DesiredTransition):
(JSC::DFG::DesiredTransition::reallyAdd):
(JSC::DFG::DesiredTransitions::DesiredTransitions):
(JSC::DFG::DesiredTransitions::~DesiredTransitions):
(JSC::DFG::DesiredTransitions::addLazily):
(JSC::DFG::DesiredTransitions::reallyAdd):
* dfg/DFGDesiredTransitions.h: Added.
* dfg/DFGDesiredWeakReferences.cpp: Added.
(JSC::DFG::DesiredWeakReferences::DesiredWeakReferences):
(JSC::DFG::DesiredWeakReferences::~DesiredWeakReferences):
(JSC::DFG::DesiredWeakReferences::addLazily):
(JSC::DFG::DesiredWeakReferences::reallyAdd):
* dfg/DFGDesiredWeakReferences.h: Added.
* dfg/DFGDesiredWriteBarriers.cpp: Added.
(JSC::DFG::DesiredWriteBarrier::DesiredWriteBarrier):
(JSC::DFG::DesiredWriteBarrier::trigger):
(JSC::DFG::DesiredWriteBarriers::DesiredWriteBarriers):
(JSC::DFG::DesiredWriteBarriers::~DesiredWriteBarriers):
(JSC::DFG::DesiredWriteBarriers::addImpl):
(JSC::DFG::DesiredWriteBarriers::trigger):
* dfg/DFGDesiredWriteBarriers.h: Added.
(JSC::DFG::DesiredWriteBarriers::add):
(JSC::DFG::initializeLazyWriteBarrier):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::truncateConstantToInt32):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::convertToConstant):
* dfg/DFGJITCompiler.h:
(JSC::DFG::JITCompiler::addWeakReference):
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::Plan):
(JSC::DFG::Plan::reallyAdd):
* dfg/DFGPlan.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* runtime/WriteBarrier.h:
(JSC::WriteBarrierBase::set):
(JSC::WriteBarrier::WriteBarrier):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154162 268f45cc-cd09-0410-ab3c-d52691b4dbfc

* assembler/X86Assembler.h: Add missing #ifdef for the x86_64 instructions.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154161 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=116412

Reviewed by Daniel Bates.

* dom/Clipboard.h: Turn off legacy style clipboard for iOS.
Next patch will be able to remove legacy style entirely!

* editing/Editor.cpp:
(WebCore::Editor::dispatchCPPEvent): Attach the frame to the
pasteboard directly explicitly. This is a layering violation, but
is needed until we change how iOS pasteboard communicates with the
host to use platform strategies instead of the editor client.

* editing/ios/EditorIOS.mm: Removed Editor::newGeneralClipboard and
the include of ClipboardIOS.h.

* platform/Pasteboard.h: Added the setFrame function (iOS-only) and
frame and change count data members.

* platform/ios/ClipboardIOS.h: Emptied out. Later we can remove this.
* platform/ios/ClipboardIOS.mm: Ditto.

* platform/ios/PasteboardIOS.mm:
(WebCore::Pasteboard::Pasteboard): Initialize m_frame to zero.
(WebCore::Pasteboard::createForCopyAndPaste): Added.
(WebCore::Pasteboard::createPrivate): Added.
(WebCore::Pasteboard::writePasteboard): Added. Empty function, like
writeClipboard. Eventually need to remove or implement this.
(WebCore::Pasteboard::setFrame): Added. Sets frame and change count.
(WebCore::Pasteboard::hasData): Moved here from ClipboardIOS.
(WebCore::utiTypeFromCocoaType): Ditto.
(WebCore::cocoaTypeFromHTMLClipboardType): Ditto.
(WebCore::Pasteboard::clear): Ditto.
(WebCore::Pasteboard::readString): Ditto.
(WebCore::addHTMLClipboardTypesForCocoaType): Ditto.
(WebCore::Pasteboard::writeString): Ditto.
(WebCore::Pasteboard::types): Ditto.
(WebCore::Pasteboard::readFilenames): Ditto.

* WebCore.exp.in: Move Clipboard destructor from Mac-only section to
common section shared by Mac and iOS.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154160 268f45cc-cd09-0410-ab3c-d52691b4dbfc

* jit/JITStubs.cpp:
(JSC::cti_vm_handle_exception): encode!



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154159 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=119831

Reviewed by Geoffrey Garen.

When incrementing or decrementing by an immediate of 1, use the insctructions
inc and dec instead of add and sub.
The instructions have good timing and their encoding is smaller.

* assembler/MacroAssemblerX86Common.h:
(JSC::MacroAssemblerX86_64::add32):
(JSC::MacroAssemblerX86_64::sub32):
* assembler/MacroAssemblerX86_64.h:
(JSC::MacroAssemblerX86_64::add64):
(JSC::MacroAssemblerX86_64::sub64):
* assembler/X86Assembler.h:
(JSC::X86Assembler::dec_r):
(JSC::X86Assembler::decq_r):
(JSC::X86Assembler::inc_r):
(JSC::X86Assembler::incq_r):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154158 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Sometimes, the DFG uses a GetById for typed array length accesses despite profiling data that indicates that it's a typed array length access
https://bugs.webkit.org/show_bug.cgi?id=119874

Reviewed by Oliver Hunt and Mark Hahnenberg.
        
It was a confusion between heuristics in DFG::ArrayMode that are assuming that
you'll use ForceExit if array profiles are empty, the JIT creating empty profiles
sometimes for typed array length accesses, and the FixupPhase assuming that a
ForceExit ArrayMode means that it should continue using a generic GetById.

This fixes the confusion.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154157 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=119848

Reviewed by Oliver Hunt.

The activation tearoff crash was due to a bug in the baseline JIT.
If we have a scenario where the a baseline JIT frame calls a LLINT
frame, an exception may be thrown while in the LLINT.

Interpreter::throwException() which handles the exception will unwind
all frames until it finds a catcher or sees a host frame. When we
return from the LLINT to the baseline JIT code, the baseline JIT code
errorneously sets topCallFrame to the value in its call frame register,
and starts unwinding the stack frames that have already been unwound.

The fix is:
1. Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
   This is a more accurate description of what this runtime function
   is supposed to do i.e. it handles the exception which include doing
   nothing (if there are no more frames to unwind).
2. Fix up topCallFrame values so that the HostCallFrameFlag is never
   set on it.
3. Reloading the call frame register from topCallFrame when we're
   returning from a callee and detect exception handling in progress.

* interpreter/Interpreter.cpp:
(JSC::Interpreter::unwindCallFrame):
- Ensure that topCallFrame is not set with the HostCallFrameFlag.
(JSC::Interpreter::getStackTrace):
* interpreter/Interpreter.h:
(JSC::TopCallFrameSetter::TopCallFrameSetter):
(JSC::TopCallFrameSetter::~TopCallFrameSetter):
(JSC::NativeCallFrameTracer::NativeCallFrameTracer):
- Ensure that topCallFrame is not set with the HostCallFrameFlag.
* jit/JIT.h:
* jit/JITExceptions.cpp:
(JSC::uncaughtExceptionHandler):
- Convenience function to get the handler for uncaught exceptions.
* jit/JITExceptions.h:
* jit/JITInlines.h:
(JSC::JIT::reloadCallFrameFromTopCallFrame):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::privateCompileCTINativeCall):
- Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
* jit/JITStubs.cpp:
(JSC::throwExceptionFromOpCall):
- Ensure that topCallFrame is not set with the HostCallFrameFlag.
(JSC::cti_vm_handle_exception):
- Check for the case when there are no more frames to unwind.
* jit/JITStubs.h:
* jit/JITStubsARM.h:
* jit/JITStubsARMv7.h:
* jit/JITStubsMIPS.h:
* jit/JITStubsSH4.h:
* jit/JITStubsX86.h:
* jit/JITStubsX86_64.h:
- Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
* jit/SlowPathCall.h:
(JSC::JITSlowPathCall::call):
- reload cfr from topcallFrame when handling an exception.
- Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
* jit/ThunkGenerators.cpp:
(JSC::nativeForGenerator):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
- reload cfr from topcallFrame when handling an exception.
* runtime/VM.cpp:
(JSC::VM::VM):
- Ensure that topCallFrame is not set with the HostCallFrameFlag.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154156 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore:

* platform/efl/ErrorsEfl.cpp: Follow the changes of r154142.
(WebCore::printError):
(WebCore::printerNotFoundError):
(WebCore::invalidPageRangeToPrint):

Source/WebKit/efl:

* ewk/ewk_frame.cpp: Follow the changes of r154142.
(ewk_frame_uri_set):
(ewk_frame_certificate_status_get):

Source/WebKit2:

* UIProcess/WebContext.cpp:
(WebKit::WebContext::useTestingNetworkSession):
Fixed build break when NETWORK_PROCESS is disabled after r154144.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154155 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=119809

Source/WebCore:

Added minimal support for shape-outside image values. A new method that computes
the excluded intervals for a horizontal line segment was added to the RasterIntervals
class. The stub RasterShape getExcludedIntervals() method has been replaced by
one that uses the new method.

Image shapes are represented by a RasterIntervals object, which just encapsulates a
Region object. The new getExcludedIntervals() method computes the excluded intervals
for a horizontal line segment between y1 and y2. To find the excluded intervals we
vertically expand each of the image shape Region's rectangles that fall within the line
segment, so that they begin at y1 and have height = y2 - y1. The union of the expanded
rectangles produces a new Region whose horizontal projection defines the excluded intervals.

Reviewed by Alexandru Chiculita.

Tests: fast/shapes/shape-outside-floats/shape-outside-floats-image-001.html
       fast/shapes/shape-outside-floats/shape-outside-floats-image-002.html

* rendering/shapes/RasterShape.cpp:
(WebCore::RasterShapeIntervals::getExcludedIntervals): See above.
(WebCore::RasterShape::getExcludedIntervals): Stub method has been replaced by one that uses RasterShapeIntervals::getExcludedIntervals().
* rendering/shapes/RasterShape.h:
* rendering/shapes/ShapeOutsideInfo.cpp:
(WebCore::ShapeOutsideInfo::isEnabledFor): Enable Image valued shapes.

LayoutTests:

Two tests to verify that the initial implementation of shape valued images is working
for shape-outside.

Reviewed by Alexandru Chiculita.

* fast/shapes/shape-outside-floats/shape-outside-floats-image-001-expected.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-image-001.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-image-002-expected.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-image-002.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154152 268f45cc-cd09-0410-ab3c-d52691b4dbfc

<https://webkit.org/b/119858> AX: Crash: com.apple.WebKit.WebContent at com.apple.WebKit2: WebKit::WebPage::accessibilityObjectForMainFramePlugin + 8

Reviewed by Tim Horton.

Ensure that the page is available before accessing it.

* WebProcess/WebPage/mac/WebPageMac.mm:
(WebKit::WebPage::accessibilityObjectForMainFramePlugin):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154151 268f45cc-cd09-0410-ab3c-d52691b4dbfc

* TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154150 268f45cc-cd09-0410-ab3c-d52691b4dbfc

<https://webkit.org/b/119873> REGRESSION(r154057): platform/mac/accessibility/role-subrole-roledescription.html fails

Add a test expectation.

* TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154149 268f45cc-cd09-0410-ab3c-d52691b4dbfc

<https://webkit.org/b/119821>

Updating our layout test now that accessibleElementById is able
to fetch the math element correctly.

Patch by Sam White <samuel_white@apple.com> on 2013-08-15
Reviewed by Chris Fleizach.

* platform/mac/accessibility/role-subrole-roledescription-expected.txt:
* platform/mac/accessibility/role-subrole-roledescription.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154148 268f45cc-cd09-0410-ab3c-d52691b4dbfc