GitLab

        Reviewed by Maciej.

        Test for <rdar://problem/5329841>
        Calling window.closed on a closed window causes Safari to crash

        * fast/dom/Window/window-closed-crash-expected.txt: Added.
        * fast/dom/Window/window-closed-crash.html: Added.

WebCore:

        Reviewed by Maciej.

        Patch for <rdar://problem/5329841>
        Calling window.closed on a closed window causes Safari to crash

        - Replaces the Frame member variable in KJS::Window for more appropriate DOMWindow
        - Adds additional new null checks as necessary
        - Removes bogus toBoolean method
        - Removes unused scheduleClose method

        Test: fast/dom/Window/window-closed-crash.html

        * bindings/js/JSCustomXPathNSResolver.cpp:
        (WebCore::JSCustomXPathNSResolver::create):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::customGetOwnPropertySlot):
        (WebCore::JSDOMWindow::customPut):
        * bindings/js/JSXMLHttpRequest.cpp:
        (KJS::JSXMLHttpRequestPrototypeFunction::callAsFunction):
        * bindings/js/kjs_events.cpp:
        (WebCore::JSAbstractEventListener::handleEvent):
        (WebCore::JSLazyEventListener::parseCode):
        * bindings/js/kjs_window.cpp:
        (KJS::Window::Window):
        (KJS::Window::impl):
        (KJS::Window::interpreter):
        (KJS::Window::location):
        (KJS::Window::find):
        (KJS::allowPopUp):
        (KJS::createWindow):
        (KJS::canShowModalDialog):
        (KJS::canShowModalDialogNow):
        (KJS::showModalDialog):
        (KJS::Window::getValueProperty):
        (KJS::Window::childFrameGetter):
        (KJS::Window::indexGetter):
        (KJS::Window::namedItemGetter):
        (KJS::Window::getOwnPropertySlot):
        (KJS::Window::put):
        (KJS::Window::isSafeScript):
        (KJS::Window::setListener):
        (KJS::Window::getListener):
        (KJS::Window::clear):
        (KJS::WindowFunc::callAsFunction):
        (KJS::Window::updateLayout):
        (KJS::ScheduledAction::execute):
        (KJS::Window::disconnectFrame):
        (KJS::Location::put):
        (KJS::LocationFunc::callAsFunction):
        * bindings/js/kjs_window.h:
        * page/mac/WebCoreFrameBridge.mm:
        (updateRenderingForBindings):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24241 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Ada.

        <rdar://problem/5329877> REGRESSION: Document::setTransformSource leaks an xmlDocPtr if called more than once per document

        * dom/Document.cpp:
        (WebCore::Document::setTransformSource): Free any existing m_transformSource before overwriting it, rather than simply leaking it.
        * dom/Document.h:

2007-07-12  Mark Rowe  <mrowe@apple.com>

        Reviewed by Ada.

        Remove leak suppression for xmlDocPtrForString now that <rdar://problem/5329877> is fixed.

        * Scripts/run-webkit-tests:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24238 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Mark Rowe.

        Fix compilation of the CURL backend after the removing of accessors from ResourceHandle in r24202

        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::ResourceHandleManager::setupPOST):
        (WebCore::ResourceHandleManager::startJob):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24236 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin.

        <rdar://problem/5327189> Logic error in DeprecatedString::to{,U}Int{,64} can lead to reading past end of buffer

        The fix for reading past the end of the buffer is to verify we are not at the end of the string before checking
        for a leading '+' character.  Rather than fixing the logic error in four nearly-identical functions I chose to
        extract the common functionality into the toIntegralType helper function which the four functions call through to.

        * platform/DeprecatedString.cpp:
        (WebCore::isCharacterAllowedInBase):
        (WebCore::toIntegralType):
        (WebCore::DeprecatedString::toInt):
        (WebCore::DeprecatedString::toInt64):
        (WebCore::DeprecatedString::toUInt):
        (WebCore::DeprecatedString::toUInt64):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24234 268f45cc-cd09-0410-ab3c-d52691b4dbfc

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24229 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Fix for <rdar://problem/5329712> GMail crash when trying to compose new message

        * platform/win/FontDataWin.cpp:
        (WebCore::FontData::containsCharacters):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24228 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        http://bugs.webkit.org/show_bug.cgi?id=14584
        XMLHttpRequest treats null login/password incorrectly

        Test: http/tests/xmlhttprequest/null-auth.php

        * xml/xmlhttprequest.cpp:
        (WebCore::XMLHttpRequest::open):
        * xml/xmlhttprequest.h:
        Split the open() method into three to distinguish between missing and null credentials.

        * bindings/js/JSXMLHttpRequest.cpp:
        (KJS::JSXMLHttpRequestPrototypeFunction::callAsFunction): Call the appropriate open().



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24227 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        * page/Frame.cpp:
        (WebCore::Frame::firstRectForRange):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24223 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Fix <rdar://problem/5329481> Character range rect code for IME support needs to be crossplatform

        Move -[WebCoreFrameBridge firstRectForDOMRange:] to Frame::firstRectForRange

        * page/Frame.cpp:
        (WebCore::Frame::firstRectForRange):
        * page/Frame.h:
        * page/mac/WebCoreFrameBridge.mm:
        (-[WebCoreFrameBridge firstRectForDOMRange:]):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24222 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        
        Only specify /analyze (PREfast) if it is available.
        Prevents entire project from rebuilding each time.        

        Reviewed by Hyatt.

        * WebCore.vcproj/WebCore.vcproj:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24214 268f45cc-cd09-0410-ab3c-d52691b4dbfc

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24213 268f45cc-cd09-0410-ab3c-d52691b4dbfc

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24212 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin.

        As of http://bugs.webkit.org/show_bug.cgi?id=14527 move the
        WebCore/ForwardingHeader/JavaScriptCore to JavaScriptCore

        * WebKit.pri: Adjust INCLUDEPATH

JavaScriptCore:

        Reviewed by Darin.

        As of http://bugs.webkit.org/show_bug.cgi?id=14527 move the
        WebCore/ForwardingHeader/JavaScriptCore to JavaScriptCore

        * ForwardingHeaders: Added.
        * ForwardingHeaders/JavaScriptCore: Copied from WebCore/ForwardingHeaders/JavaScriptCore.

WebCore:

        Reviewed by Darin.

        As of http://bugs.webkit.org/show_bug.cgi?id=14527 move the
        WebCore/ForwardingHeader/JavaScriptCore to JavaScriptCore

        * ForwardingHeaders/JavaScriptCore: Removed.
        * ForwardingHeaders/JavaScriptCore/APICast.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JSBase.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JSContextRef.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JSLock.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JSObjectRef.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JSStringRef.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JSStringRefCF.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JSValueRef.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JavaScriptCore.h: Removed.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24210 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        
        * platform/network/cf/ResourceHandleCFNet.cpp:
        (WebCore::willSendRequest):
        (WebCore::didReceiveResponse):
        (WebCore::didReceiveData):
        (WebCore::didFinishLoading):
        (WebCore::didFail):
        (WebCore::didReceiveChallenge):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24209 268f45cc-cd09-0410-ab3c-d52691b4dbfc

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24207 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Fix for <rdar://problem/5230188> REGRESSION: Active/inactive marked text is not distinguished in textfields and textareas

        We were previously trying to leave room for 1px of space between the text and the underline.
        This change removes that requirement so that if we don't have room for the extra space, we still draw the thick underline
        touching the text.

        * rendering/InlineTextBox.cpp: (WebCore::InlineTextBox::paintMarkedTextUnderline):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24206 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        <rdar://problem/5313508>
        REGRESSION (Leopard): http/tests/xmlhttprequest/basic-auth.html hangs
        
        Leopard Foundation now ignores credentials passed in as part of the URL so we need to pass them ourselves.
        
        For the asynchronous case, we simply keep track of the URL and if it has a user name and password, we
        pass those if we're asked to authenticate.
                
        For the synchronous case, implement a new connection delegate and run it in a separate mode so 
        no other sources will fire.

        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::loadResourceSynchronously):
        (-[WebCoreResourceHandleAsDelegate dealloc]):
        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
        (-[WebCoreResourceHandleAsDelegate connection:didReceiveAuthenticationChallenge:]):
        (-[WebCoreSynchronousLoader _isDone]):
        (-[WebCoreSynchronousLoader dealloc]):
        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]):
        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]):
        (-[WebCoreSynchronousLoader connection:didReceiveResponse:]):
        (-[WebCoreSynchronousLoader connection:didReceiveData:]):
        (-[WebCoreSynchronousLoader connectionDidFinishLoading:]):
        (-[WebCoreSynchronousLoader connection:didFailWithError:]):
        (-[WebCoreSynchronousLoader _data]):
        (-[WebCoreSynchronousLoader _response]):
        (-[WebCoreSynchronousLoader _error]):
        (+[WebCoreSynchronousLoader loadRequest:returningResponse:error:]):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24205 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        - fix <rdar://problem/5315265> REGRESSION: Leopard launch time -
          there are about 190 stats of icudt36b files during launch

        * platform/TextEncodingRegistry.cpp: (WebCore::atomicCanonicalTextEncodingName):
        Add a special case for the empty string so we don't load the extended text
        encodings just so we can return 0 for that case.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24203 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Remove a bunch of unneeded accessors from ResourceHandle.
        
        * loader/icon/IconLoader.cpp:
        (WebCore::IconLoader::didReceiveResponse):
        (WebCore::IconLoader::didFail):
        (WebCore::IconLoader::didFinishLoading):
        * platform/network/ResourceHandle.cpp:
        * platform/network/ResourceHandle.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24202 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin.
        
        <rdar://problem/5234383> REGRESSION: Sentence breaker method returning entire document length

        * editing/selection/5234383-1-expected.checksum: Added.
        * editing/selection/5234383-1-expected.png: Added.
        * editing/selection/5234383-1-expected.txt: Added.
        * editing/selection/5234383-1.html: Added.
        * editing/selection/5234383-2-expected.checksum: Added.
        * editing/selection/5234383-2-expected.png: Added.
        * editing/selection/5234383-2-expected.txt: Added.
        * editing/selection/5234383-2.html: Added.

WebCore:

        Reviewed by Darin.
        
        <rdar://problem/5234383> REGRESSION: Sentence breaker method returning entire document length
        
        The functions for moving the caret to the next/previous sentence boundary
        were in many cases moving to the beginning/end of the document.  The functions that 
        should move the caret to an equivalent position in the next/previous sentence behaved
        like the aforementioned functions ought to.  Put the code from the second two functions
        in the first and made sure that the second two are properly FIXMEd.  They're rarely 
        used (filed 5323691).
        
        * editing/SelectionController.cpp:
        (WebCore::SelectionController::modify): Added an option for sentenceBoundary granularity,
        so that we can test the functions that were broken from JS.
        * editing/visible_units.cpp:
        (WebCore::startOfSentence): Removed the FIXME about 5234383.
        (WebCore::endSentenceBoundary): Make this function do what nextSentencePositionBoundary
        current does.
        (WebCore::endOfSentence): Removed the FIXME about 5234383.
        (WebCore::previousSentencePosition): Removed an incorrect FIXME.
        (WebCore::nextSentencePositionBoundary): Tweaked FIXME.  This function is
        identical, not close to endSentenceBoundary.
        (WebCore::nextSentencePosition): Removed an incorrect FIXME.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24187 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        http://bugs.webkit.org/show_bug.cgi?id=14453
        REGRESSION: www.nzherald.co.nz almost all the formating is gone

        Be less strict for the hex color definition.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24185 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Forgot to commit this as part of commit r24146. Now we are sure
        createElement creates elements in the xhtml namespace only.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24184 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Oliver.

        * fast/dom/Window/get-set-properties-expected.txt: Added.
        * fast/dom/Window/get-set-properties.html: Added.

WebCore:

        Reviewed by Oliver.

        Move more attributes from the pure JS bindings in KJS::Window
        to the implementation in DOMWindow and autogenerate the new bindings

        Test: fast/dom/Window/get-set-properties.html

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::customGetOwnPropertySlot): Change to use propHashTable in
        JSDOMWindow instead of KJS::Window
        * bindings/js/kjs_window.cpp:
        (KJS::Window::getValueProperty):
        (KJS::Window::put):
        * bindings/js/kjs_window.h:
        (KJS::Window::):
        * bindings/scripts/CodeGeneratorJS.pm: Cleanup getValueProperty and put generation
        to reduce code duplication. 
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::closed):
        (WebCore::DOMWindow::length):
        (WebCore::DOMWindow::name):
        (WebCore::DOMWindow::setName):
        (WebCore::DOMWindow::status):
        (WebCore::DOMWindow::setStatus):
        (WebCore::DOMWindow::defaultStatus):
        (WebCore::DOMWindow::setDefaultStatus):
        * page/DOMWindow.h:
        (WebCore::DOMWindow::defaultstatus):
        (WebCore::DOMWindow::setDefaultstatus):
        * page/DOMWindow.idl:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24182 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Geoff.

        Tests for <rdar://problem/5326791>

        * http/tests/security/cross-frame-access-expected.txt:
        * http/tests/security/cross-frame-access-put-expected.txt: Added.
        * http/tests/security/cross-frame-access-put.html: Added.
        * http/tests/security/resources/cross-frame-iframe-for-put-test.html: Added.

WebCore:

        Reviewed by Geoff.

        Fix for <rdar://problem/5326791> XSS vulnerability: ability to set window.defaultStatus,
        window.defaultstatus and window.status cross domains

        Test: http/tests/security/cross-frame-access-put.html

        * bindings/js/kjs_window.cpp:
        (KJS::Window::put): Adds isSafeScript check for defaultStatus,
        defaultstatus and status cases.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24181 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::outerHeight):
        (WebCore::DOMWindow::outerWidth):
        (WebCore::DOMWindow::screenX):
        (WebCore::DOMWindow::screenY):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24178 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        <rdar://problem/5326653> - REGRESSION: [WebBackForwardList forwardListCount] might return incorrect result

        No layout test because this is an API issue that can't be tested in DRT or the browser

        * history/BackForwardList.cpp:
        (WebCore::BackForwardList::forwardListCount): If the index is NoCurrentItemIndex, return 0



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24177 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Move more readonly attributes from pure JS bindings in KJS::Window
        to the implementation in DOMWindow and autogenerate the new bindings.

        * bindings/js/kjs_window.cpp:
        (KJS::Window::getValueProperty):  Sort the hashmap comment into categories
        to make further migration easier.
        * bindings/js/kjs_window.h: Sort the enum into categories to make further
        migration easier.
        (KJS::Window::):
        * page/DOMWindow.cpp: Add new methods.
        (WebCore::DOMWindow::focus):
        (WebCore::DOMWindow::blur):
        (WebCore::DOMWindow::offscreenBuffering):
        (WebCore::DOMWindow::outerHeight):
        (WebCore::DOMWindow::outerWidth):
        (WebCore::DOMWindow::innerHeight):
        (WebCore::DOMWindow::innerWidth):
        (WebCore::DOMWindow::screenX):
        (WebCore::DOMWindow::screenY):
        (WebCore::DOMWindow::scrollX):
        (WebCore::DOMWindow::scrollY):
        (WebCore::DOMWindow::getComputedStyle):
        (WebCore::DOMWindow::getMatchedCSSRules): Add null Document assertion.
        (WebCore::DOMWindow::devicePixelRatio): Add null Frame and Page checks.
        * page/DOMWindow.h:
        (WebCore::DOMWindow::screenLeft):
        (WebCore::DOMWindow::screenTop):
        (WebCore::DOMWindow::pageXOffset):
        (WebCore::DOMWindow::pageYOffset):
        * page/DOMWindow.idl:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24176 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Fix for <rdar://problem/5326417> Editor::unmarkText needs to be crossplatform

        Missed this in earlier patch to make text marking platform independent.

        * editing/Editor.cpp:
        (WebCore::Editor::unmarkText):
           Add platform independent impl
        * editing/mac/EditorMac.mm:
           Remove the old mac path.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24175 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Tim Hatcher.

        Added a Page counter. This helped me while investigating 
        <rdar://problem/5314463> 40MB of WebKit memory still allocated after 
        closing large email in Mail

        * WebCore.xcodeproj/project.pbxproj:
        * page/Page.cpp:
        (WebCore::):
        (WebCore::PageCounter::~PageCounter):
        (WebCore::Page::Page):
        (WebCore::Page::~Page):

WebKitTools:

        Reviewed by Tim Hatcher.

        Ignore Page.o in debug builds because it now has a static PageCounter
        object.

        * Scripts/check-for-global-initializers:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24174 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        <rdar://problem/5326126> InspectorResource holds onto more data than it needs

        Reduces the fixed size of InspectorResource from 630 bytes to 224 bytes. Now
        selectively pick out parts of the ResourceRequest and ResourceResponse objects
        for the info needed and store that directly in InspectorResource.

        The ResourceRequest and ResourceResponse objects hold a reference to the original
        NSURL object, so almost double the data was being kept around. So the struct size
        reduction is just the tip of the ice burg on what this really saves.

        In a test of 100,000 XMLHTTPRequests using a 85 byte long data URL, I see ~21 MB less
        RSIZE compared to Safari running without this change.

        * page/InspectorController.cpp:
        (WebCore::InspectorResource::InspectorResource):
        (WebCore::InspectorResource::type):
        (WebCore::addSourceToFrame):
        (WebCore::scriptObjectForRequest):
        (WebCore::scriptObjectForResponse):
        (WebCore::InspectorController::addScriptResource):
        (WebCore::InspectorController::addAndUpdateScriptResource):
        (WebCore::updateResourceRequest):
        (WebCore::updateResourceResponse):
        (WebCore::InspectorController::updateScriptResourceRequest):
        (WebCore::InspectorController::updateScriptResourceResponse):
        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
        (WebCore::InspectorController::identifierForInitialRequest):
        (WebCore::InspectorController::willSendRequest):
        (WebCore::InspectorController::didReceiveResponse):
        (WebCore::InspectorController::didFailLoading):
        * page/InspectorController.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24173 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        - fix crash introduced by my patch for 5318732, only seen in release builds

        * page/Page.cpp: (WebCore::Page::~Page): Added a missing null check.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24171 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Bug #14576


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24170 268f45cc-cd09-0410-ab3c-d52691b4dbfc

bit more work once we figure out how to use QPainterPathStroker in a more
sophisticated manner.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24168 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix 'unsigned int' overflow in CodeGeneratorJS.pm.
This fixes hashing of "SVG_FEBLEND_MODE_NORMAL". Its hashvalue exceeded 2^32, which
is no problem in perl but in the cpp code. Emulate C/C++ behaviour by using "% 2^32" in
the perl code. Testcase available in feature-branch soon (js-svg-constructors.svg).


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24165 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Disabled Arena recycling in RenderArena. PLT shows no regression 
        (possibly a small speedup), and this can reduce allocated memory in 
        WebKit clients by about 120K (4K per Arena * 30 Arenas).
        
        I happened upon this optimization while investigating 
        <rdar://problem/5314463> WebKit hangs on to 40MB RAM after closing 
        large email in Mail (appears to be render tree arena allocator), 
        although I don't think it will come close to fixing that bug 
        completely.

        * rendering/RenderArena.cpp:
        (WebCore::RenderArena::~RenderArena): Use FinishArenaPool, which frees
        the ArenaPool's Arenas immediately.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24164 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Hyatt.

        - test for http://bugs.webkit.org/show_bug.cgi?id=14449
          REGRESSION (r14345-r14375): Absolutely positioned image does not scale to containing element's height

        * fast/replaced/absolute-position-percentage-height-expected.checksum: Added.
        * fast/replaced/absolute-position-percentage-height-expected.png: Added.
        * fast/replaced/absolute-position-percentage-height-expected.txt: Added.
        * fast/replaced/absolute-position-percentage-height.html: Added.

WebCore:

        Reviewed by Hyatt.

        - fix http://bugs.webkit.org/show_bug.cgi?id=14449
          REGRESSION (r14345-r14375): Absolutely positioned image does not scale to containing element's height

        Test: fast/replaced/absolute-position-percentage-height.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::calcReplacedHeightUsing): For positioned elements, evaluate
        the percentage with respect to the container's final height.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24163 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Add 64-bit integer converters to our string classes for future work

        * platform/DeprecatedString.cpp:
        (WebCore::DeprecatedString::toInt64):
        (WebCore::DeprecatedString::toUInt64):
        * platform/DeprecatedString.h:

        * platform/PlatformString.h:
        * platform/String.cpp:
        (WebCore::String::toInt64):
        (WebCore::String::toUInt64):

        * platform/StringImpl.cpp:
        (WebCore::StringImpl::toInt64):
        (WebCore::StringImpl::toUInt64):
        * platform/StringImpl.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24158 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        - fix <rdar://problem/5318732> REGRESSION: In Mail, a crash occurs when attempting to send
          a HTML based message (nytimes.com, washingtonpost.com, latimes.com)

        Did an audit of calls to get the inspector and most other uses of Page* and added null
        checks since Frame* can outlast its Page*.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::createWindow): Added null check.
        (WebCore::FrameLoader::loadSubframe): Ditto.
        (WebCore::FrameLoader::load): Ditto.
        (WebCore::FrameLoader::transitionToCommitted): Ditto.
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame): Ditto.
        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm): Ditto.
        (WebCore::FrameLoader::addExtraFieldsToRequest): Ditto.
        (WebCore::FrameLoader::loadResourceSynchronously): Ditto.
        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy): Ditto.
        (WebCore::FrameLoader::requestFromDelegate): Ditto.
        (WebCore::FrameLoader::canGoBackOrForward): Ditto.
        (WebCore::FrameLoader::getHistoryLength): Ditto.
        (WebCore::FrameLoader::historyURL): Ditto.
        (WebCore::FrameLoader::cachePageForHistoryItem): Ditto.
        (WebCore::FrameLoader::addBackForwardItemClippedAtTarget): Ditto.
        (WebCore::FrameLoader::goToItem): Ditto.
        (WebCore::FrameLoader::dispatchWindowObjectAvailable): Ditto.
        (WebCore::FrameLoader::dispatchDidCommitLoad): Ditto.
        (WebCore::FrameLoader::dispatchAssignIdentifierToInitialRequest): Ditto.
        (WebCore::FrameLoader::dispatchWillSendRequest): Ditto.
        (WebCore::FrameLoader::dispatchDidReceiveResponse): Ditto.
        (WebCore::FrameLoader::dispatchDidReceiveContentLength): Ditto.
        (WebCore::FrameLoader::dispatchDidFinishLoading): Ditto.
        (WebCore::FrameLoader::dispatchDidLoadResourceFromMemoryCache): Ditto.

        * page/ContextMenuController.h:
        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::ContextMenuController): Removed unneeded and
        unused Page* parameter.
        (WebCore::openNewWindow): Added null check.
        (WebCore::ContextMenuController::contextMenuItemSelected): Ditto.

        * page/InspectorController.h:
        (WebCore::InspectorController::pageDestroyed): Added. Since this object is
        owned by the Page and has a back-pointer to it, it needs an explicit disconnect.
        There's already a higher-level one, but this is more reliable than that.
        * page/InspectorController.cpp:
        (WebCore::InspectorController::windowScriptObjectAvailable): Added null check.
        (WebCore::InspectorController::windowUnloading): Ditto.

        * page/Page.cpp:
        (WebCore::Page::Page): Updated for change in parameters of ContextMenuController 
        constructor.
        (WebCore::Page::~Page): Added call to InspectorController pageDestroyed().

        * page/Chrome.cpp: Updated includes.
        * page/DragController.cpp: Ditto.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24156 268f45cc-cd09-0410-ab3c-d52691b4dbfc

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24149 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Maciej Stachowiak.

        * fast/events/onload-after-document-close-no-subresource-expected.txt: Added.
        * fast/events/onload-after-document-close-no-subresource.html: Added.
        * fast/events/onload-after-document-close-with-subresource-expected.txt: Added.
        * fast/events/onload-after-document-close-with-subresource.html: Added.
        * fast/events/resources/onload-image.png: Added.

WebCore:

        Reviewed by Maciej Stachowiak.

        Fixed http://bugs.webkit.org/show_bug.cgi?id=13241 | <rdar://problem/5126396>
        onload fires before content is finished loading (woot.com)
        
        * dom/Document.cpp:
        (WebCore::Document::close): Try to go through the normal "Am I done loading?"
        machinery before dispatching the load event. As the comment indicates, 
        we can't do this in all cases, so the fix isn't perfect. However, a perfect 
        solution would require much riskier sweeping changes to the loader, which 
        are best left for later, I think.

        * xml/XSLTProcessor.cpp:
        (WebCore::XSLTProcessor::createDocumentFromSource): Removed a slightly
        worse solution to the same problem.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@24148 268f45cc-cd09-0410-ab3c-d52691b4dbfc