Reviewed by Darin.

Fix for <rdar://problem/5585334> numfuzz: integer overflows opening
malformed SVG file in WebCore::ImageBuffer::create. Add protection
against a potential overflow.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27704 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Build fix.  Use the correct filename case.

        * kjs/nodes.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27703 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        
        Fixed http://bugs.webkit.org/show_bug.cgi?id=15902
        15% of string-validate-input.js is spent compiling the same regular expression
        
        Store a compiled representation of the regular expression in the AST.
        
        Only a .2% SunSpider speedup overall, but a 10.6% speedup on 
        string-validate-input.js.

        * kjs/nodes.cpp:
        (KJS::RegExpNode::evaluate):
        * kjs/nodes.h:
        (KJS::RegExpNode::):
        * kjs/nodes2string.cpp:
        (KJS::RegExpNode::streamTo):
        * kjs/regexp.cpp:
        (KJS::RegExp::flags):
        * kjs/regexp.h:
        (KJS::RegExp::pattern):
        * kjs/regexp_object.cpp:
        (KJS::RegExpObjectImp::construct):
        (KJS::RegExpObjectImp::createRegExpImp):
        * kjs/regexp_object.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27702 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Fix a bunch of cases where the exception code is checked by the function but is not zeroed first.

        * bindings/js/kjs_binding.cpp:
        (KJS::setDOMException):
        * dom/Attr.cpp:
        (WebCore::Attr::setPrefix):
        * dom/Document.cpp:
        (WebCore::Document::createElement):
        * dom/Element.cpp:
        (WebCore::Element::setPrefix):
        * dom/Range.cpp:
        (WebCore::Range::setStart):
        (WebCore::Range::setEnd):
        (WebCore::Range::isPointInRange):
        (WebCore::Range::comparePoint):
        (WebCore::Range::compareBoundaryPoints):
        (WebCore::Range::deleteContents):
        (WebCore::Range::processContents):
        (WebCore::Range::extractContents):
        (WebCore::Range::insertNode):
        (WebCore::Range::setStartAfter):
        (WebCore::Range::setEndBefore):
        (WebCore::Range::setEndAfter):
        (WebCore::Range::selectNode):
        (WebCore::Range::surroundContents):
        (WebCore::Range::setStartBefore):
        * editing/TextIterator.cpp:
        (WebCore::TextIterator::TextIterator):
        * html/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::createPattern):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::play):
        (WebCore::HTMLMediaElement::pause):
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::add):
        (WebCore::HTMLSelectElement::setOption):
        * xml/XPathEvaluator.cpp:
        (WebCore::XPathEvaluator::evaluate):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27701 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        - http://bugs.webkit.org/show_bug.cgi?id=15945
          speed up GraphicsContextCG typical case by skipping roundToDevicePixels

        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::restorePlatformState): Clear the flag since we no
        longer know if the transform is identity or not.
        (WebCore::GraphicsContext::strokeArc): Removed an extra set of redundant
        CGContextSave/RestoreGState.
        (WebCore::GraphicsContext::beginTransparencyLayer): Clear the flag since we no
        longer know if the transform is identity or not.
        (WebCore::GraphicsContext::endTransparencyLayer): Ditto.
        (WebCore::GraphicsContext::scale): Ditto.
        (WebCore::GraphicsContext::rotate): Ditto.
        (WebCore::GraphicsContext::translate): Ditto.
        (WebCore::GraphicsContext::concatCTM): Ditto.
        (WebCore::GraphicsContext::roundToDevicePixels): Return quickly if the transform
        is known to be identity, and record that fact when we discover it otherwise.

        * platform/graphics/cg/GraphicsContextPlatformPrivate.h:
        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
        Added a m_userToDeviceTransformKnownToBeIdentity flag, initialized to false.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27700 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        - http://bugs.webkit.org/show_bug.cgi?id=15944
          streamline SegmentedString to speed up parsing

        I measured a speed-up of the page load test while developing this patch. I don't
        have a precise figure, though.

        * html/HTMLTokenizer.h: Removed unneeded lineNumberPtr() function. Also renamed
        lineno to m_lineNumber.
        * html/HTMLTokenizer.cpp:
        (WebCore::HTMLTokenizer::processListing): Don't pass 0 to the advance function
        since we don't want to update a line number.
        (WebCore::HTMLTokenizer::parseSpecial): Ditto.
        (WebCore::HTMLTokenizer::parseComment): Pass the line number data member directly
        instead of lineNumberPtr() since the advance function now takes a reference.
        (WebCore::HTMLTokenizer::parseServer): Ditto.
        (WebCore::HTMLTokenizer::parseProcessingInstruction): Ditto.
        (WebCore::HTMLTokenizer::parseText): Ditto.
        (WebCore::HTMLTokenizer::parseEntity): Ditto.
        (WebCore::HTMLTokenizer::parseTag): Ditto.
        (WebCore::HTMLTokenizer::write): Ditto.

        * loader/FTPDirectoryDocument.cpp: (WebCore::FTPDirectoryTokenizer::write):
        * loader/TextDocument.cpp: (WebCore::TextTokenizer::write):
        Don't pass 0 to the advance function.

        * platform/SegmentedString.h: (WebCore::SegmentedString::advance): Streamlined
        the most common case, and pushed less common cases into a separate function
        that is not inlined. Also got rid of a branch by separating the case with a
        line number from the case without one.

        * platform/SegmentedString.cpp: (WebCore::SegmentedString::advanceSlowCase):
        Added. The aforementioned less common cases are here.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27699 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Partial fix for <rdar://problem/5585334> numfuzz: integer overflows opening malformed SVG file in WebCore::ImageBuffer::create

Reviewed By Eric.

Unfortunately this is a very slight regression, but is unavoidable.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27698 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::play):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27697 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin.
        
        - Update play() and pause() to match current HTML5 draft
            - send events asynchronously
            - add timeupdate event to pause
            - rethrow load() exception, not others
        - Use list for async events to get ordering right

        Tests: media/video-pause-empty-events.html
               media/video-play-empty-events.html
               media/video-play-pause-events.html
               media/video-play-pause-exception.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::dispatchEventAsync): 
        (WebCore::HTMLMediaElement::asyncEventTimerFired):
        (WebCore::HTMLMediaElement::play):
        (WebCore::HTMLMediaElement::pause):
        * html/HTMLMediaElement.h:

LayoutTests:

        Reviewed by Darin.
        
        Add tests for play() and pause() events. 
        Update one test to match new behavior.

        * media/video-currentTime-expected.txt:
        * media/video-currentTime.html:
        * media/video-pause-empty-events-expected.txt: Added.
        * media/video-pause-empty-events.html: Added.
        * media/video-play-empty-events-expected.txt: Added.
        * media/video-play-empty-events.html: Added.
        * media/video-play-pause-events-expected.txt: Added.
        * media/video-play-pause-events.html: Added.
        * media/video-play-pause-exception-expected.txt: Added
        * media/video-play-pause-exception.html: Added
        * media/video-test.js:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27696 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by darin.

        Add simple type inferencing to the parser, and create custom
        AddNode and LessNode subclasses based on inferred types.
        http://bugs.webkit.org/show_bug.cgi?id=15884

        SunSpider claims this is at least a 0.5% speedup.

        * JavaScriptCore.exp:
        * kjs/grammar.y:
        * kjs/internal.cpp:
        (KJS::NumberImp::getPrimitiveNumber):
        (KJS::GetterSetterImp::getPrimitiveNumber):
        * kjs/internal.h:
        * kjs/lexer.cpp:
        (KJS::Lexer::lex):
        * kjs/nodes.cpp:
        (KJS::Node::Node):
        (KJS::StringNode::evaluate):
        (KJS::StringNode::evaluateToNumber):
        (KJS::StringNode::evaluateToBoolean):
        (KJS::RegExpNode::evaluate):
        (KJS::UnaryPlusNode::optimizeVariableAccess):
        (KJS::AddNode::evaluate):
        (KJS::AddNode::evaluateToNumber):
        (KJS::AddNumbersNode::inlineEvaluateToNumber):
        (KJS::AddNumbersNode::evaluate):
        (KJS::AddNumbersNode::evaluateToNumber):
        (KJS::AddStringsNode::evaluate):
        (KJS::AddStringLeftNode::evaluate):
        (KJS::AddStringRightNode::evaluate):
        (KJS::lessThan):
        (KJS::lessThanEq):
        (KJS::LessNumbersNode::evaluate):
        (KJS::LessStringsNode::evaluate):
        * kjs/nodes.h:
        (KJS::ExpressionNode::):
        (KJS::RegExpNode::):
        (KJS::RegExpNode::precedence):
        (KJS::TypeOfResolveNode::):
        (KJS::LocalVarTypeOfNode::):
        (KJS::UnaryPlusNode::):
        (KJS::UnaryPlusNode::precedence):
        (KJS::AddNode::):
        (KJS::AddNode::precedence):
        (KJS::AddNumbersNode::):
        (KJS::AddStringLeftNode::):
        (KJS::AddStringRightNode::):
        (KJS::AddStringsNode::):
        (KJS::LessNode::):
        (KJS::LessNode::precedence):
        (KJS::LessNumbersNode::):
        (KJS::LessStringsNode::):
        * kjs/nodes2string.cpp:
        (KJS::StringNode::streamTo):
        * kjs/object.cpp:
        * kjs/object.h:
        * kjs/value.h:
        (KJS::JSValue::getPrimitiveNumber):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27695 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Anders.

        Initialize m_userAgent.

        Fix typos in GDK_WINDOWING conditionals.

        * WebCoreSupport/FrameLoaderClientGtk.cpp:
        (WebKit::FrameLoaderClient::FrameLoaderClient):
        (WebKit::agentPlatform):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27694 268f45cc-cd09-0410-ab3c-d52691b4dbfc

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27693 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fixes: http://bugs.webkit.org/show_bug.cgi?id=6424 (<text>, <tspan> dominant-baseline attribute is not respected)

Add (basic) support for dominant-baseline / alignment-baseline text properties.
Note: there are no official testcases, and no-one implemented it before. Only ASV3
      supported dominant-baseline, but not correct it seems.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27692 268f45cc-cd09-0410-ab3c-d52691b4dbfc

 WebCore:

         Add wrappers around CoCreateInstance to COMPtr

         I followed the example of the Query constructor and query method by
         adding a Create constructor and create method.

         Reviewed by Darin.

         * platform/win/COMPtr.h:
         (COMPtr::COMPtr): Added a new constructor that calls
         CoCreateInstance.
         (COMPtr::create): Added.
         (COMPtr::createInstance): Added.

 WebKitTools:

         Fix <rdar://5133816> keepWebHistory is not implemented

         Fixes fast/history/clicked-link-is-visited.html.

         Reviewed by Darin.

         * DumpRenderTree/win/DumpRenderTree.cpp:
         (runTest): Clear the optionalSharedHistory.
         * DumpRenderTree/win/LayoutTestControllerWin.cpp:
         (LayoutTestController::keepWebHistory): Set the optionalSharedHistory.

 LayoutTests:

         Remove a now-passing test from the Windows Skipped file

         Reviewed by Darin.

         * platform/win/Skipped:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27691 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        http://bugs.webkit.org/show_bug.cgi?id=15896
        More editing cleanup

        No functionality changes.

        * dom/Node.h: Moved several editing-related methods elsewhere.
        * dom/Node.cpp: (WebCore::Node::maxCharacterOffset): Renamed from maxOffset()
        to highlight that it is a match to offsetInCharacters(), and much different from other
        offset-related methods. Added ASSERT_NOT_REACHED(), as callers are supposed to check
        offsetInCharacters() before calling this.

        * dom/CharacterData.cpp: (WebCore::CharacterData::maxCharacterOffset):
        * dom/CharacterData.h: (WebCore::CharacterData::isCharacterDataNode):
        Updated for above renamings.

        * dom/Comment.{h,cpp}: Removed an override for offsetInCharacters(), which is already present in CharacterData.

        * dom/Document.{h,cpp}: Folded updateSelection() into Frame::selectionLayoutChanged().

        * dom/Position.h:
        * dom/Position.cpp:
        (WebCore::Position::uncheckedPreviousOffset): Moved from Node::previousOffset().
        (WebCore::Position::uncheckedNextOffset): Moved from Node::NextOffset().
        (WebCore::Position::previous): Adapted to the above move.
        (WebCore::Position::next): Ditto.
        (WebCore::Position::upstream): Removed an isBR() check, since a non-BR element cannot have a BR renderer (I think),
        and BR elements are covered by editingIgnoresContent().
        (WebCore::Position::downstream): Ditto.
        (WebCore::caretMaxRenderedOffset): Moved from Node::caretMaxRenderedOffset().
        (WebCore::Position::rendersInDifferentPosition): Updated for the above moves.

        * dom/PositionIterator.h: Added a comment describing this class from the original check-in.
        * dom/PositionIterator.cpp:
        (WebCore::PositionIterator::increment): Updated for the above moves.
        (WebCore::PositionIterator::decrement): Ditto.

        * dom/ProcessingInstruction.h:
        * dom/ProcessingInstruction.cpp: (WebCore::ProcessingInstruction::maxCharacterOffset):
        ProcessingInstruction was already returning true from offsetInCharacters(), but didn't override maxCharacterOffset().
        I think that implementing it has no actual effect, as PIs are not rendered, but it looks cleaner this way.

        * dom/Range.cpp:
        (WebCore::Range::selectNodeContents):
        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
        (WebCore::ApplyStyleCommand::applyInlineStyle):
        (WebCore::maxRangeOffset):
        (WebCore::ApplyStyleCommand::removeInlineStyle):
        (WebCore::ApplyStyleCommand::splitTextAtStartIfNeeded):
        (WebCore::ApplyStyleCommand::splitTextAtEndIfNeeded):
        (WebCore::ApplyStyleCommand::splitTextElementAtStartIfNeeded):
        (WebCore::ApplyStyleCommand::splitTextElementAtEndIfNeeded):
        (WebCore::ApplyStyleCommand::mergeEndWithNextIfIdentical):
        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::insertNodeAt):
        (WebCore::CompositeEditCommand::positionOutsideTabSpan):
        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
        * editing/InsertLineBreakCommand.cpp:
        (WebCore::InsertLineBreakCommand::doApply):
        * editing/InsertParagraphSeparatorCommand.cpp:
        (WebCore::InsertParagraphSeparatorCommand::doApply):
        * editing/InsertTextCommand.cpp:
        (WebCore::InsertTextCommand::insertTab):
        * editing/visible_units.cpp:
        (WebCore::previousLinePosition):
        (WebCore::nextLinePosition):
        Updated for the above moves.

        * editing/Editor.cpp:
        (WebCore::Editor::advanceToNextMisspelling): Added a missing rangeCompliantEquivalent() call.

        * editing/TextIterator.cpp:
        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator): Changed the condition to obviously
        match a maxCharacterOffset() call made after it; hopefully, this doesn't break any border cases.
        (WebCore::SimplifiedBackwardsTextIterator::advance): Updated for the above moves.

        * editing/htmlediting.h:
        * editing/htmlediting.cpp:
        (WebCore::canHaveChildrenForEditing): Removed a bogus comment: I don't thin BRs have a special ability to accept
        child nodes, other than via DOM manipulation, which is not specific to BRs.
        (WebCore::rangeCompliantEquivalent): Removed a check for BR, which is already covered by editingIgnoresContent().
        (WebCore::maxDeepOffset): Ditto.
        (WebCore::caretMinOffset): Moved from Node. Changed some runtime checks that seemingly cannot fail into assertions.
        (WebCore::caretMaxOffset): Ditto.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMousePressEventSingleClick): Pass 0 to VisiblePosition constructor instead of
        caretMinOffset. I didn't want to include htmlediting.h here, and I think that VisiblePosition constructor
        will take care of adjusting the offset.

        * page/Frame.cpp: (WebCore::Frame::selectionLayoutChanged): Folded Document::updateSelection() here.
        * page/mac/WebCoreFrameBridge.mm:
        (-[WebCoreFrameBridge smartDeleteRangeForProposedRange:]): Added missing rangeCompliantEquivalent() calls.
        * rendering/RenderBlock.cpp: (WebCore::RenderBlock::positionForRenderer): Changed to not round-trip via editing.
        Changed some runtime checks that seemingly cannot fail into assertions.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27690 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        * pcre/pcre_internal.h: Make most of this header do nothing when DFTABLES is set.
        Later we can break it into two files.

        * JavaScriptCore.vcproj/dftables/dftables.vcproj: Take out now-unneeded include paths.
        * pcre/dftables.cpp: Set DFTABLES. Use delete instead of free.
        * pcre/dftables.pro: Take out now-unneeded include paths.
        * pcre/pcre_maketables.cpp: Use new instead of malloc.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27689 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        another include path.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27688 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        by adding another include path.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27687 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Sam.

        - http://bugs.webkit.org/show_bug.cgi?id=15924
          next round of changes to JSRegExp (formerly PCRE)

        This is a combination of converting to C++, tweaking the API, and adding
        some additional optimizations.

        Future steps will involve getting rid of the use of UTF-8 completely
        (we'll use UTF-16 exclusively instead), eliminating more source files,
        and some more speed-ups.

        SunSpider says the current round is an 0.9% speed-up overall, and a
        5.3% speed-up for regexp.

        * JavaScriptCore.exp: Updated for new entry points.

        * JavaScriptCore.pri:
        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
        * JavaScriptCore.vcproj/dftables/dftables.vcproj:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * JavaScriptCoreSources.bkl:
        * jscore.bkl:
        Updated for new source file names and ForwardingHeaders.

        * kjs/regexp.cpp:
        (KJS::RegExp::RegExp): Changed to use the error message without calling
        strdup on it and to pass the new types and options.
        (KJS::RegExp::~RegExp): Removed the now-unneeded free of the error message.
        (KJS::RegExp::match): Pass the new types and options.
        * kjs/regexp.h: Update type of m_constructionError.

        * pcre/AUTHORS: Update to reflect the status of the project -- we don't include
        the Google parts, and this isn't the PCRE library, per se.
        * pcre/COPYING: Ditto.

        * pcre/dftables.cpp: Copied from JavaScriptCore/pcre/dftables.c.
        (main): Removed unneeded ctype_digit.

        * pcre/pcre.h: Convert to C++, tweak API a bit. Use UChar instead of JSRegExpChar.

        * pcre/pcre_compile.cpp: Copied from JavaScriptCore/pcre/pcre_compile.c.
        Moved a lot of private stuff used only within this file here from pcre_internal.h.
        Renumbered the error codes.
        (error_text): Use a single string with embedded nulls for the error text (I got
        this idea from newer versions of PCRE).
        (check_escape): Changed return type to be enum instead of int. Replaced ctype_digit
        uses with isASCIIDigit.
        (is_counted_repeat): Ditto.
        (read_repeat_counts): Ditto.
        (first_significant_code): Ditto.
        (find_fixedlength): Ditto.
        (could_be_empty_branch): Ditto.
        (compile_branch): Ditto. Also removed some code that handles changing options.
        JavaScript doesn't have any of the features that allow options to change.
        (compile_regex): Updated for change to options parameter.
        (is_anchored): Ditto.
        (find_firstassertedchar): Ditto.
        (jsRegExpCompile): Changed to take separate flags instead of an options int.
        Also changed to call new/delete instead of pcre_malloc/free.
        (jsRegExpFree): Ditto.

        * pcre/pcre_exec.cpp: Copied from JavaScriptCore/pcre/pcre_exec.c.
        Added a case that uses computed goto for the opcode loop, but did not turn it on.
        Changed the RMATCH macro to handle returns more efficiently by putting the where
        pointer in the new frame instead of the old one, allowing us to branch to the
        return with a single statement. Switched to new/delete from pcre_malloc/free.
        Changed many RRETURN callers to not set the return value since it's already
        set correctly. Replaced the rrc variable with an is_match variable. Values other
        than "match" and "no match" are now handled differently. This allows us to remove
        the code to check for those cases in various rules.
        (match): All the case statements use a macro BEGIN_OPCODE instead. And all the
        continue statements, or break statements that break out of the outer case use
        a macro NEXT_OPCODE instead. Replaced a few if statements with assertions.
        (jsRegExpExecute): Use new/delete instead of pcre_malloc/free. Removed unused
        start_match field from the match block.

        * pcre/pcre_internal.h: Moved the last few configuration macros from pcre-config.h
        in here. Removed various unused types. Converted from JSRegExpChar to UChar.
        Eliminated pcre_malloc/free. Replaced the opcode enum with a macro that can be
        used in multiple places. Unfortunately we lose the comments for each opcode; we
        should find a place to put those back. Removed ctype_digit.

        * pcre/pcre_maketables.cpp: Copied from JavaScriptCore/pcre/pcre_maketables.c.
        (pcre_maketables): Got rid of the conditional code that allows this to be compiled
        in -- it's only used for dftables now (and soon may be obsolete entirely).
        Changed code for cbit_digit to not use isdigit, and took the "_" case out of the
        loop. Removed ctype_digit.

        * pcre/pcre_ord2utf8.cpp: Copied from JavaScriptCore/pcre/pcre_ord2utf8.c.

        * pcre/pcre_tables.cpp: Copied from JavaScriptCore/pcre/pcre_tables.c.
        Moved _pcre_OP_lengths out of here into pcre_exec.cpp.

        * pcre/pcre_ucp_searchfuncs.cpp: Copied from JavaScriptCore/pcre/pcre_ucp_searchfuncs.c.
        Updated for other file name changes.

        * pcre/pcre_xclass.cpp: Copied from JavaScriptCore/pcre/pcre_xclass.c.

        * pcre/ucpinternal.h: Updated header.

        * pcre/ucptable.cpp: Copied from JavaScriptCore/pcre/ucptable.c.

        * wtf/ASCIICType.h: (WTF::isASCIIDigit): Removed a branch by changing from && to
        & for this operation. Also added an overload that takes an int because that's
        useful for PCRE. Later we could optimize for int and overload other functions in
        this file; stuck to this simple one for now.

        * wtf/unicode/icu/UnicodeIcu.h: Removed unused isUpper.
        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.

        * pcre/LICENCE: Removed.
        * pcre/pcre-config.h: Removed.
        * wtf/FastMallocPCRE.cpp: Removed.

        * pcre/dftables.c: Renamed to cpp.
        * pcre/pcre_compile.c: Ditto.
        * pcre/pcre_exec.c: Ditto.
        * pcre/pcre_maketables.c: Ditto.
        * pcre/pcre_ord2utf8.c: Ditto.
        * pcre/pcre_tables.c: Ditto.
        * pcre/pcre_ucp_searchfuncs.c: Ditto.
        * pcre/pcre_xclass.c: Ditto.
        * pcre/ucptable.c: Ditto.

WebCore:

        Reviewed by Sam.

        - updated for JSRegExp function changes

        * platform/RegularExpression.cpp:
        (WebCore::RegularExpression::Private::compile):
        (WebCore::RegularExpression::match):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27686 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Mark Rowe.

        Mention Safari in the UserAgent string to improve site compatibility.

        Also bump the hard-coded AppleWebKit version number.

        * WebCoreSupport/FrameLoaderClientGtk.cpp:
        (WebKit::composeUserAgent):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27685 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Oliver.

        Add KJS_CHECKEXCEPTIONBOOLEAN to match rest of nodes.cpp

        * kjs/nodes.cpp:
        (KJS::ExpressionNode::evaluateToBoolean):
        (KJS::LessNode::evaluateToBoolean):
        (KJS::GreaterNode::evaluateToBoolean):
        (KJS::LessEqNode::evaluateToBoolean):
        (KJS::GreaterEqNode::evaluateToBoolean):
        (KJS::InstanceOfNode::evaluateToBoolean):
        (KJS::InNode::evaluateToBoolean):
        (KJS::EqualNode::evaluateToBoolean):
        (KJS::NotEqualNode::evaluateToBoolean):
        (KJS::StrictEqualNode::evaluateToBoolean):
        (KJS::NotStrictEqualNode::evaluateToBoolean):
        (KJS::LogicalAndNode::evaluateToBoolean):
        (KJS::LogicalOrNode::evaluateToBoolean):
        (KJS::ConditionalNode::evaluateToBoolean):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27684 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Qt Linux build fix.

        * platform/UnicodeRange.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27683 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Qt Windows build fix.

        * platform/UnicodeRange.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27682 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        fix for http://bugs.webkit.org/show_bug.cgi?id=15922.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27681 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fixes: http://bugs.webkit.org/show_bug.cgi?id=15937 (Add glyph-orientation-horizontal/vertical support)
Fixes: http://bugs.webkit.org/show_bug.cgi?id=13971 (text-anchor support on vertical text seems slightly off)

Add glyph-orientation-* support for text & textPath. (90/180/270 and 'auto')
Also fix all vertical text handling - for text & textPath! (especially latin1 characters auto orientation in vertical writing modes)


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27680 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Update some SVG pixel test results - which show changes lately -> repainting fixes.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27679 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Sam.

        - fix http://bugs.webkit.org/show_bug.cgi?id=15927
          REGRESSION(r27487): delete a.c followed by __defineGetter__("c", ...) incorrectly deletes another property
          and <rdar://problem/5586384> REGRESSION (r27487): Can't switch out of Edit HTML Source mode on Leopard Wiki

        Test: fast/js/delete-then-put.html

        * kjs/property_map.cpp:
        (KJS::PropertyMap::put): Added a missing "- 1"; code to find an empty slot was not working.
        (KJS::PropertyMap::checkConsistency): Added a missing range check that would have caught this
        problem before.

        - roll out a last-minute change to my evaluateToBoolean patch that was incorrect.

        * kjs/nodes.h: (KJS::ExprStatementNode::ExprStatementNode): Take out call to
        optimizeForUnnecessaryResult, since the result is used in some cases.

LayoutTests:

        Reviewed by Sam.

        - test for http://bugs.webkit.org/show_bug.cgi?id=15927
          delete a.c followed by __defineGetter__("c", ...) incorrectly deletes another property

        * fast/js/delete-then-put-expected.txt: Added.
        * fast/js/delete-then-put.html: Added.
        * fast/js/resources/delete-then-put.js: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27678 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        * page/inspector/StylesSidebarPane.js: Fix the wording of a comment
          and switch over to use getUniqueProperties in another place.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27677 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Tim Hatcher.

        Follow up to <rdar://problem/5394877> Safari should not log unsafe JavaScript 
        attempts when in private browsing mode (only an issue if Log JavaScript Exceptions 
        is turned on)

        - Add LayoutTestController.setPrivateBrowsingEnabled(bool) (stub out implementation for windows)

        Added test: http/tests/security/cross-frame-access-private-browsing.html

        * DumpRenderTree/LayoutTestController.cpp:
        (setPrivateBrowsingEnabledCallback):
        (LayoutTestController::staticFunctions):
        * DumpRenderTree/LayoutTestController.h:
        * DumpRenderTree/mac/DumpRenderTree.mm:
        (runTest): Default to private browsing disabled.
        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
        (LayoutTestController::setPrivateBrowsingEnabled):
        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
        (LayoutTestController::setPrivateBrowsingEnabled):

LayoutTests:

        Reviewed by Tim Hatcher.

        Follow up to <rdar://problem/5394877> Safari should not log unsafe JavaScript 
        attempts when in private browsing mode (only an issue if Log JavaScript Exceptions 
        is turned on)

        Test using the new LayoutTestController.setPrivateBrowsingEnabled(bool)

        * http/tests/security/cross-frame-access-private-browsing-expected.txt: Added.
        * http/tests/security/cross-frame-access-private-browsing.html: Added.
        * platform/win/Skipped: Add new test to windows skip list until we have an
        implementation of LayoutTestController.setPrivateBrowsingEnabled(bool) for it.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27676 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Rest of fix for 5394877

        * bindings/js/kjs_window.cpp:
        (KJS::Window::isSafeScript):
        Don't log unsafe JavaScript attempts in the other version of isSafeScript() if in
        private browsing mode either.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27675 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix function name difference - header said 'unicodeRangeForCharacter', actually
implemented function is 'findCharUnicodeRange'. They are not compiled yet.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27674 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Signed-off-by: Nikolas


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27673 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Signed-off-by: Nikolas


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27672 268f45cc-cd09-0410-ab3c-d52691b4dbfc

to update the enable/checked state correctly.

Signed-off-by: Nikolas


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27671 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Signed-off-by: Nikolas


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27670 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Roll out some changes that were (seemingly accidentally) checked in
        with r27664.

        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27669 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        - fix <rdar://problem/5450655> Control-clicking text in a link can surprisingly select only part of the link, should select entire link

        No test because context menu events cannot be tested in DumpRenderTree.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::selectClosestWordOrLinkFromMouseEvent): Added.
        If the click occurred in an active link, selects the entire link
        element. Otherwise selects the closest word.
        (WebCore::EventHandler::sendContextMenuEvent): Call
        selectClosestWordOrLinkFromMouseEvent().
        * page/EventHandler.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27668 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        - fixed <rdar://problem/5394877> Safari should not log unsafe JavaScript attempts when 
          in private browsing mode (only an issue if Log JavaScript Exceptions is turned on)

        * bindings/js/kjs_window.cpp:
        (KJS::Window::isSafeScript):
        Don't log unsafe JavaScript attempts to console or chromeClient if in private browsing mode



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27667 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        http://bugs.webkit.org/show_bug.cgi?id=15922
        Implement more of Mozilla Selection API

        Tests: editing/selection/containsNode.html
               editing/selection/deleteFromDocument.html
               editing/selection/extend.html
               editing/selection/selectAllChildren.html

        * editing/SelectionController.cpp:
        (WebCore::SelectionController::deleteFromDocument):
        (WebCore::SelectionController::containsNode):
        (WebCore::SelectionController::selectAllChildren):
        (WebCore::SelectionController::extend):
        * editing/SelectionController.h:
        Added deleteFromDocument(), containsNode(), and selectAllChildren(). Reimplemented extend(),
        which existed, but didn't match Firefox behavior and wasn't exposed via bindings.
        Removed a comment mentioning removeRange(), as this method makes no sense without multiple
        selection range support.

        * page/DOMSelection.cpp:
        (WebCore::DOMSelection::extend):
        (WebCore::DOMSelection::deleteFromDocument):
        (WebCore::DOMSelection::containsNode):
        (WebCore::DOMSelection::selectAllChildren):
        * page/DOMSelection.h:
        * page/DOMSelection.idl:
        Exposed the new methods.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27666 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        http://bugs.webkit.org/show_bug.cgi?id=15892
        DOM Range operations are not implemented for ProcessingInstruction nodes

        Test: fast/dom/Range/range-processing-instructions.html

        * dom/Range.cpp:
        (WebCore::Range::processContents): Implemented ProcessingInstruction cases.
        (WebCore::Range::checkNodeWOffset): Removed a FIXME - yes, I think that we are supposed
        to use ProcessingInstruction.data.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@27665 268f45cc-cd09-0410-ab3c-d52691b4dbfc