git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88128 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Anders Carlsson.

        [Mac WebKit2] REGRESSION (r86692): Synchronous XMLHttpRequest hangs in credential shim (affects Netgear ReadyNAS admin page)
        https://bugs.webkit.org/show_bug.cgi?id=62094
        rdar://problem/9539204

        * WebCore.exp.in: Export ResourceHandle::synchronousLoadRunLoopMode.
        * platform/network/ResourceHandle.h: Add synchronousLoadRunLoopMode.
        * platform/network/cf/ResourceHandleCFNet.cpp:
        (WebCore::ResourceHandle::synchronousLoadRunLoopMode): Added.
        (WebCore::ResourceHandle::loadResourceSynchronously): Call synchronousLoadRunLoopMode.
        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::synchronousLoadRunLoopMode): Added.
        (WebCore::ResourceHandle::loadResourceSynchronously): Call synchronousLoadRunLoopMode.
2011-06-04  Darin Adler  <darin@apple.com>

        Reviewed by Anders Carlsson.

        [Mac WebKit2] REGRESSION (r86692): Synchronous XMLHttpRequest hangs in credential shim (affects Netgear ReadyNAS admin page)
        https://bugs.webkit.org/show_bug.cgi?id=62094
        rdar://problem/9539204

        * WebKit2.xcodeproj/project.pbxproj: Added new source files.
        * WebProcess/mac/CoreIPCClientRunLoop.h: Added.
        * WebProcess/mac/CoreIPCClientRunLoop.mm: Added.
        (-[WKFunctionAdapter perform]): Added.
        (WebKit::createCoreIPCRunLoopModesArray): Added.
        (WebKit::coreIPCRunLoopModesArray): Added.
        (WebKit::callOnCoreIPCClientRunLoopAndWait): Added.

        * WebProcess/mac/KeychainItemShimMethods.mm:
        (WebKit::webFreeAttributeListContent): Use callOnCoreIPCClientRunLoopAndWait.
        (WebKit::webFreeKeychainItemContent): Ditto.
        (WebKit::webSecKeychainItemCopyContent): Ditto.
        (WebKit::webSecKeychainItemCreateFromContent): Ditto.
        (WebKit::webSecKeychainItemModifyContent): Ditto.
        * WebProcess/mac/SecItemShimMethods.mm:
        (WebKit::webSecItemCopyMatching): Ditto.
        (WebKit::webSecItemAdd): Ditto.
        (WebKit::webSecItemUpdate): Ditto.
        (WebKit::webSecItemDelete): Ditto.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88123 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Adam Barth.

        Add InlineWalker class to hold state for repeated calls to bidiNext
        https://bugs.webkit.org/show_bug.cgi?id=60724

        This is one more little step towards removing (naked) bidiNext usage.
        More refactoring is required before all callers of bidiNext can move
        onto using an InlineWalker instead of bidiNext directly.

        No change in behavior, thus no tests.

        * rendering/InlineIterator.h:
        (WebCore::InlineWalker::InlineWalker):
        (WebCore::InlineWalker::root):
        (WebCore::InlineWalker::current):
        (WebCore::InlineWalker::atEndOfInline):
        (WebCore::InlineWalker::atEnd):
        (WebCore::InlineWalker::advance):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::simplifiedNormalFlowLayout):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::layoutInlineChildren):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88122 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Anders Carlsson.

        WebKit2 needs to know when a scroll is happening due to the ScrollAnimator
        https://bugs.webkit.org/show_bug.cgi?id=62093

        Add additional ChromeClient functions to indicate the beginning and end of
        the various ScrollAnimator animations. Change existing notification that a
        rubber-band has completed for the main frame to be triggered for all frames.

        * page/ChromeClient.h:
        (WebCore::ChromeClient::didStartRubberBandForFrame):
        (WebCore::ChromeClient::didCompleteRubberBandForFrame):
        (WebCore::ChromeClient::didStartAnimatedScroll):
        (WebCore::ChromeClient::didCompleteAnimatedScroll):
        * page/FrameView.cpp:
        (WebCore::FrameView::didStartRubberBand):
        (WebCore::FrameView::didCompleteRubberBand):
        (WebCore::FrameView::didStartAnimatedScroll):
        (WebCore::FrameView::didCompleteAnimatedScroll):
        * page/FrameView.h:
        * platform/ScrollableArea.h:
        (WebCore::ScrollableArea::didStartRubberBand):
        (WebCore::ScrollableArea::didStartAnimatedScroll):
        (WebCore::ScrollableArea::didCompleteAnimatedScroll):
        * platform/mac/ScrollAnimatorMac.h:
        * platform/mac/ScrollAnimatorMac.mm:
        (-[ScrollAnimationHelperDelegate _immediateScrollToPoint:]):
        (WebCore::ScrollAnimatorMac::scroll):
        (WebCore::ScrollAnimatorMac::immediateScrollToPointForScrollAnimation):
        (WebCore::ScrollAnimatorMac::snapRubberBandTimerFired):
2011-06-04  Sam Weinig  <sam@webkit.org>

        Reviewed by Anders Carlsson.

        WebKit2 needs to know when a scroll is happening due to the ScrollAnimator
        https://bugs.webkit.org/show_bug.cgi?id=62093

        Stub out new ChromeClient functions regarding the start and end of ScrollAnimator
        animated scrolls, and update logic for rubber-band ending to check for main frame
        now that it is called for all frames.

        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
        (WebKit::WebChromeClient::didStartRubberBandForFrame):
        (WebKit::WebChromeClient::didCompleteRubberBandForFrame):
        (WebKit::WebChromeClient::didStartAnimatedScroll):
        (WebKit::WebChromeClient::didCompleteAnimatedScroll):
        * WebProcess/WebCoreSupport/WebChromeClient.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88121 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Touch a file to try to fix the GTK+ build on the 32-bit bot.

        * testing/Internals.idl: Touch this IDL file in an effort to fix the build.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88120 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Fix the GTK+ build.

        * bindings/gobject/GNUmakefile.am: Make the GObject build less noisy.
2011-06-04  Martin Robinson  <mrobinson@igalia.com>

        Fix the GTK+ build.

        * GNUmakefile.am: Add some missing newline escape.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88116 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin Adler.

        Convert file <input> to use the new shadow DOM model
        https://bugs.webkit.org/show_bug.cgi?id=59005

        Refactoring, covered by existing tests.

        * css/CSSSelector.cpp:
        (WebCore::CSSSelector::pseudoId): Removed FILE_UPLOAD_BUTTON pseudoId and all references to it.
        (WebCore::nameToPseudoTypeMap): Ditto.
        (WebCore::CSSSelector::extractPseudoType): Ditto.
        * css/CSSSelector.h: Ditto.
        * css/html.css:
        (input[type="button"], input[type="submit"], input[type="reset"]): Moved -webkit-file-upload-button to its own rule.
        (input[type="file"]::-webkit-file-upload-button): Added and moved all previously hard-coded properties there.
        * html/FileInputType.cpp:
        (WebCore::UploadButtonElement::create): Added.
        (WebCore::UploadButtonElement::UploadButtonElement): Added.
        (WebCore::UploadButtonElement::shadowPseudoId): Added.
        (WebCore::FileInputType::createShadowSubtree): Added.
        * html/FileInputType.h: Added createShadowSubtree decl.
        * page/DragController.cpp:
        (WebCore::asFileInput): Changed the logic to use new shadow DOM.
        * rendering/RenderFileUploadControl.cpp: Removed UploadButton class.
        (WebCore::RenderFileUploadControl::~RenderFileUploadControl): Removed initializer for m_button.
        (WebCore::RenderFileUploadControl::updateFromElement): Removed attachment logic that's no longer necessary.
        (WebCore::nodeWidth): Added a helper.
        (WebCore::RenderFileUploadControl::maxFilenameWidth): Changed to use uploadButton and nodeWidth.
        (WebCore::RenderFileUploadControl::paintObject): Ditto.
        (WebCore::RenderFileUploadControl::uploadButton): Added a helper to retrieve the button.
        (WebCore::RenderFileUploadControl::buttonValue): Changed to use uploadButton.
        * rendering/RenderFileUploadControl.h: Changed decls.
        * rendering/style/RenderStyleConstants.h: Removed FILE_UPLOAD_BUTTON decls.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88115 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin Adler.

        Input value sanitization for text fields is incorrect
        https://bugs.webkit.org/show_bug.cgi?id=62061
        <rdar://problem/9553273>

        * fast/forms/input-value-sanitization-expected.txt:
        * fast/forms/input-value-sanitization.html:
        * fast/forms/paste-multiline-text-input.html:
        * fast/forms/script-tests/input-value-sanitization.js: Removed.
2011-06-04  Alexey Proskuryakov  <ap@apple.com>

        Reviewed by Darin Adler.

        Input value sanitization for text fields is incorrect
        https://bugs.webkit.org/show_bug.cgi?id=62061
        <rdar://problem/9553273>

        Newline characters should be removed according to HTML5, not replaced with spaces.
        This also matches Safari 5 behavior.

        * html/TextFieldInputType.cpp:
        (WebCore::isASCIILineBreak): A functor for removeCharacters().
        (WebCore::limitLength): Do one thing at once.
        (WebCore::TextFieldInputType::sanitizeValue): Sanitization removes newlines.
        (WebCore::TextFieldInputType::handleBeforeTextInsertedEvent): Moved (somewhat surprising)
        code that replaces newlines with spaces here.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88110 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Beth Dakin.

        Crash in WebCore::RenderMathMLSubSup::baselinePosition()
        https://bugs.webkit.org/show_bug.cgi?id=57897

        Added simple test that hits the relevant code.

        * mathml/msubsup-remove-children-expected.txt: Added.
        * mathml/msubsup-remove-children.xhtml: Added.
2011-06-04  Jeffrey Pfau  <jpfau@apple.com>

        Reviewed by Beth Dakin.

        Crash in WebCore::RenderMathMLSubSup::baselinePosition()
        https://bugs.webkit.org/show_bug.cgi?id=57897

        Simple patch adding NULL checks in each function.
        Test: mathml/msubsup-remove-children.xhtml

        * rendering/mathml/RenderMathMLSubSup.cpp:
        (WebCore::RenderMathMLSubSup::stretchToHeight):
        (WebCore::RenderMathMLSubSup::baselinePosition):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88104 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by James Robinson.

        Give IDBBackingStore::Transaction a virtual destructor
        https://bugs.webkit.org/show_bug.cgi?id=62063

        IDBLevelDBBackingStore::createTransaction() hands out a
        PassRefPtr<IDBBackingStore::Transaction>, which means the missing
        virtual destructor is a real bug.

        * storage/IDBBackingStore.h:
        (WebCore::IDBBackingStore::Transaction::~Transaction):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88103 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Eric Seidel.

        Convert RenderBox::overflowClipRect to IntPoint
        https://bugs.webkit.org/show_bug.cgi?id=62032

        Covered by existing tests.

        * editing/Editor.cpp:
        (WebCore::Editor::insideVisibleArea):
        * platform/graphics/IntRect.h:
        (WebCore::IntRect::contract):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::nodeAtPoint):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::pushContentsClip):
        (WebCore::RenderBox::overflowClipRect):
        * rendering/RenderBox.h:
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::calculateClipRects):
        (WebCore::RenderLayer::calculateRects):
        (WebCore::RenderLayer::repaintBlockSelectionGaps):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::clipBox):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::overflowClipRect):
        (WebCore::RenderTable::nodeAtPoint):
        * rendering/RenderTable.h:
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::nodeAtPoint):
        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::paint):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88102 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Eric Seidel.

        V8Proxy::disconnectFrame doesn't do anything
        https://bugs.webkit.org/show_bug.cgi?id=62051

        Dead code should die.

        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::~ScriptController):
        * bindings/v8/V8Proxy.cpp:
        * bindings/v8/V8Proxy.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88100 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by James Robinson.

        Make the destructors of DataTransferItem and DataTransferItems virtual
        https://bugs.webkit.org/show_bug.cgi?id=62052

        Clang has grown a new warning that warns on |delete ptr| if ptr's
        class is non-final, has virtual methods, but no virtual destructor.
        This warning finds real bugs, so we want to keep it enabled. However,
        it also warns about DataTransferItem[s]. Since these are subclassed,
        they can't be made final, so make their destructors virtual. (Maybe
        clang's warning even points out an actual bug here.)

        * dom/DataTransferItem.h:
        (WebCore::DataTransferItem::~DataTransferItem):
        * dom/DataTransferItems.h:
        (WebCore::DataTransferItems::~DataTransferItems):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88099 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by James Robinson.

        [chromium] Make LayerPainterChromium destructor virtual
        https://bugs.webkit.org/show_bug.cgi?id=62056

        LayerTextureUpdaterCanvas has an OwnPtr<LayerPainterChromium>, which
        means that without this patch, the destructor of classes implementing
        LayerPainterChromium wasn't called correctly in that case.

        * platform/graphics/chromium/LayerPainterChromium.h:
        (WebCore::LayerPainterChromium::~LayerPainterChromium):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88098 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Andreas Kling.

        Fix IntRect::expand(const IntSize& size)
        https://bugs.webkit.org/show_bug.cgi?id=62042

        No new tests.

        * platform/graphics/IntRect.h:
        (WebCore::IntRect::expand):
        Fix IntRect::expand to expand the size rather than move the location.
        Currently unused.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88096 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin Adler.

        ResourceHandleMac should always respond to an authentication challenge
        https://bugs.webkit.org/show_bug.cgi?id=61667

        I don't know if this can actually happen in practice, so no new tests.

        * platform/network/mac/ResourceHandleMac.mm:
        (-[WebCoreResourceHandleAsDelegate connection:didReceiveAuthenticationChallenge:]):
        Cancel authentication challenge if we don't have a client. We must always respond to the
        challenge to release the connection, and there is nothing else to do in this state anyway.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88091 268f45cc-cd09-0410-ab3c-d52691b4dbfc

* rendering/RenderTableCell.cpp:
(WebCore::RenderTableCell::paintMask):
* rendering/RenderTableCell.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88090 268f45cc-cd09-0410-ab3c-d52691b4dbfc

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88089 268f45cc-cd09-0410-ab3c-d52691b4dbfc

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88088 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Eric Seidel.

        Switch paintMask and paintObject to use IntPoint
        https://bugs.webkit.org/show_bug.cgi?id=62077

        Switching paintMask and paintObject to use IntPoint for their paint offset instead of
        a pair of ints. paintObject is still on tx/ty, but paintMask was converted to IntSize
        passed by value -- bringing it in-line with the agreed-upon convention of a const IntPoint&.

        No new tests since this is simple refactoring.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::paint):
        (WebCore::RenderBlock::paintObject):
        * rendering/RenderBlock.h:
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::paintMask):
        (WebCore::RenderBox::pushContentsClip):
        (WebCore::RenderBox::popContentsClip):
        * rendering/RenderBox.h:
        (WebCore::RenderBox::paintObject):
        * rendering/RenderFieldset.cpp:
        (WebCore::RenderFieldset::paintMask):
        * rendering/RenderFieldset.h:
        * rendering/RenderFileUploadControl.cpp:
        (WebCore::RenderFileUploadControl::paintObject):
        * rendering/RenderFileUploadControl.h:
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::paintObject):
        * rendering/RenderListBox.h:
        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::paint):
        * rendering/RenderReplica.cpp:
        (WebCore::RenderReplica::paint):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::paint):
        (WebCore::RenderTable::paintObject):
        (WebCore::RenderTable::paintMask):
        * rendering/RenderTable.h:
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::paint):
        (WebCore::RenderTableSection::paintObject):
        * rendering/RenderTableSection.h:
        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::paintPlaceholder):
        (WebCore::RenderTextControl::paintObject):
        * rendering/RenderTextControl.h:
        * rendering/RenderView.cpp:
        (WebCore::RenderView::paint):
        * rendering/RenderWidget.cpp:
        (WebCore::RenderWidget::paint):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88087 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Eric Seidel.

        Support FontCustomPlatformData on Skia-Mac-Chrome variant
        https://bugs.webkit.org/show_bug.cgi?id=62040

        Canvas text is only recognized by Skia if it is registered
        by creating a new SkTypeface. Skia uses CGFont to measure
        and render the glyphs, then takes care of managing the glyph
        cache.

        Skia on Mac Chrome is not yet enabled, so this change
        does not affect existing code, and requires no new tests.

        * platform/graphics/mac/FontCustomPlatformData.cpp:
        (WebCore::RemoteFontStream::RemoteFontStream):
        (WebCore::RemoteFontStream::~RemoteFontStream):
        (WebCore::RemoteFontStream::rewind):
        (WebCore::RemoteFontStream::read):
        Turn the buffer into a stream. This is identical to
        the implementation in skia/FontCustomPlatformData.cpp.
        While that file could be modified instead of this one,
        it was simpler to add SkTypeface streaming to this instead
        of adding all CGFont support to the skia platform file.

        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
        Release the SkTypeface reference.

        (WebCore::createFontCustomPlatformData):
        Associate the buffer stream with a SkTypeface so Skia
        can find the custom font data.

        * platform/graphics/mac/FontCustomPlatformData.h:
        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
        Add a slot to hold the SkTypeface.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88081 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Brian Weinstein.

        HistoryItem children persist across page loads
        https://bugs.webkit.org/show_bug.cgi?id=62071
        <rdar://problem/9552129>
        
        Not testable since there's no way to check for the presence/absence
        of children for a HistoryItem.

        * history/HistoryItem.cpp:
        (WebCore::HistoryItem::reset): Call clearChildren when we're reusing a HistoryItem.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88080 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Kenneth Russell.

        Allow existing AudioParams to use scheduled parameter changes
        https://bugs.webkit.org/show_bug.cgi?id=62046

        No new tests since audio API is not yet implemented.

        * platform/audio/AudioBus.cpp:
        (WebCore::AudioBus::processWithGainFrom):
        (WebCore::AudioBus::copyWithSampleAccurateGainValuesFrom):
        * platform/audio/AudioBus.h:
        * webaudio/AudioBufferSourceNode.cpp:
        (WebCore::AudioBufferSourceNode::AudioBufferSourceNode):
        * webaudio/AudioGainNode.cpp:
        (WebCore::AudioGainNode::AudioGainNode):
        (WebCore::AudioGainNode::process):
        * webaudio/AudioGainNode.h:
        * webaudio/HighPass2FilterNode.cpp:
        (WebCore::HighPass2FilterNode::HighPass2FilterNode):
        * webaudio/LowPass2FilterNode.cpp:
        (WebCore::LowPass2FilterNode::LowPass2FilterNode):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88074 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Kenneth Russell.

        Biquad filter coefficient naming is incorrect
        https://bugs.webkit.org/show_bug.cgi?id=62053

        No new tests since audio API is not yet implemented.

        * platform/audio/Biquad.cpp:
        (WebCore::Biquad::Biquad):
        (WebCore::Biquad::process):
        (WebCore::Biquad::processFast):
        (WebCore::Biquad::setLowpassParams):
        (WebCore::Biquad::setHighpassParams):
        (WebCore::Biquad::setLowShelfParams):
        (WebCore::Biquad::setZeroPolePairs):
        * platform/audio/Biquad.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88072 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Eric Seidel.

        DOMWindow::setLocation doesn't understand that DOMWindow can be inactive
        https://bugs.webkit.org/show_bug.cgi?id=62057

        Test that some esoteric combination of eval, load, and Location don't
        do something goofy.

        * http/tests/security/xss-DENIED-contentWindow-eval-expected.txt: Added.
        * http/tests/security/xss-DENIED-contentWindow-eval.html: Added.
2011-06-03  Adam Barth  <abarth@webkit.org>

        Reviewed by Eric Seidel.

        DOMWindow::setLocation doesn't understand that DOMWindow can be inactive
        https://bugs.webkit.org/show_bug.cgi?id=62057

        This code gets confused when dealing with inactive DOMWindows.  We
        should just block inactive DOMWindows because there's no compatibility
        reason to support them in this code path.

        Test: http/tests/security/xss-DENIED-contentWindow-eval.html

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::isInsecureScriptAccess):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88071 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Ryosuke Niwa.

        [GTK] Support smart replace for the pasteboard
        https://bugs.webkit.org/show_bug.cgi?id=61734

        Unskip tests which are now passing and update results for other tests
        which vary depending on smart replace support.

        * platform/gtk/Skipped: Unskip tests which are now passing.
        * platform/gtk/editing/deleting/smart-delete-003-expected.txt:
        * platform/gtk/editing/deleting/smart-delete-004-expected.txt:
        * platform/gtk/editing/pasteboard/4944770-2-expected.txt:
        * platform/gtk/editing/pasteboard/drag-drop-modifies-page-expected.txt:
        * platform/gtk/editing/pasteboard/smart-paste-007-expected.txt:
        * platform/gtk/editing/pasteboard/smart-paste-008-expected.txt:
        * platform/gtk/editing/pasteboard/subframe-dragndrop-1-expected.txt:
        * platform/gtk/fast/lists/drag-into-marker-expected.txt:
2011-05-31  Martin Robinson  <mrobinson@igalia.com>

        Reviewed by Ryosuke Niwa.

        [GTK] Support smart replace for the pasteboard
        https://bugs.webkit.org/show_bug.cgi?id=61734

        Add smart replace support to WebCore and add hooks for it in WebKit
        via DumpRenderTreeSupportGtk. When a platform supports smart replace,
        WebCore will remove extra spaces that appear when pasting text. Eventually
        WebKitGTK+ may want to expose this in the public API.

        * platform/gtk/PasteboardGtk.cpp:
        (WebCore::Pasteboard::writeSelection): Now pass whether or not to use smart replace
        when calling writeSelection.
        (WebCore::Pasteboard::canSmartReplace): Added an implementation that checks the clipboard
        for whether or not it supports smart paste.
        * platform/gtk/PasteboardHelper.cpp:
        (WebCore::initGdkAtoms): Added initialization for smart replace atom.
        (WebCore::PasteboardHelper::fillSelectionData): Added no-op handler for smart replace atom.
        (WebCore::PasteboardHelper::targetListForDataObject): Properly handle new smart replace parameter.
        (WebCore::PasteboardHelper::writeClipboardContents): Properly handle new smart replace parameter.
        (WebCore::PasteboardHelper::clipboardContentSupportsSmartReplace): Added helper for Pasteboard.
        * platform/gtk/PasteboardHelper.h: Add new method definition.
2011-05-31  Martin Robinson  <mrobinson@igalia.com>

        Reviewed by Ryosuke Niwa.

        [GTK] Support smart replace for the pasteboard
        https://bugs.webkit.org/show_bug.cgi?id=61734

        Add the EditorClient and DumpRenderTreeSupportGtk hooks for enabling
        smart replace in the tests.

        * WebCoreSupport/DragClientGtk.cpp:
        (WebKit::DragClient::startDrag): targeListForDataObject now takes another
        parameter determining whether or not to add smart paste support. Add it here.
        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
        (DumpRenderTreeSupportGtk::setSmartInsertDeleteEnabled): Added.
        * WebCoreSupport/DumpRenderTreeSupportGtk.h: Add new method definition.
        * WebCoreSupport/EditorClientGtk.cpp:
        (WebKit::EditorClient::toggleSmartInsertDelete): Added implementation.
        (WebKit::EditorClient::smartInsertDeleteEnabled): Added.
        (WebKit::EditorClient::EditorClient):
        * WebCoreSupport/EditorClientGtk.h: Add new method definition.
2011-05-31  Martin Robinson  <mrobinson@igalia.com>

        Reviewed by Ryosuke Niwa.

        [GTK] Support smart replace for the pasteboard
        https://bugs.webkit.org/show_bug.cgi?id=61734

        Call into the DumpRenderTreeSupportGtk hooks to toggle smart replace.
        This is required to produce consistent test results.

        * DumpRenderTree/gtk/DumpRenderTree.cpp:
        (resetDefaultsToConsistentValues): Set the smart replace setting to on by default.
        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
        (LayoutTestController::setSmartInsertDeleteEnabled): Added an implementation of this
        methods which calls into DumpRenderTreeSupportGtk.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88066 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Eric Seidel.

        Switch paintCell to use IntPoint
        https://bugs.webkit.org/show_bug.cgi?id=62033

        Switching paintCell to take an IntPoint representing the paint offset
        instead of a pair of ints.

        No new tests since this is simple refactoring.

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::paintCell):
        (WebCore::RenderTableSection::paintObject):
        * rendering/RenderTableSection.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88063 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Dimitri Glazkov.

        Teach Gtk build about window.internals
        https://bugs.webkit.org/show_bug.cgi?id=61071

        * Source/autotools/symbols.filter: Added some symbols necessary for
        window.internals to function to the global symbol list.
2011-06-03  Martin Robinson  <mrobinson@igalia.com>

        Reviewed by Dimitri Glazkov.

        Teach Gtk build about window.internals
        https://bugs.webkit.org/show_bug.cgi?id=61071

        * platform/gtk/Skipped: Unskip the one new window.internals test.
2011-06-03  Martin Robinson  <mrobinson@igalia.com>

        Reviewed by Dimitri Glazkov.

        Teach Gtk build about window.internals
        https://bugs.webkit.org/show_bug.cgi?id=61071

        * GNUmakefile.am: Add new internals directories to the VPATH
        (for idl processing) and the include list.
2011-06-03  Martin Robinson  <mrobinson@igalia.com>

        Reviewed by Dimitri Glazkov.

        Teach Gtk build about window.internals
        https://bugs.webkit.org/show_bug.cgi?id=61071

        * DumpRenderTree/gtk/DumpRenderTree.cpp:
        (webViewWindowObjectCleared): Inject the new internals object when the
        window object clears.
        * GNUmakefile.am: Add new source files and includes necessary for window.internals.
        Also do a little bit of cleanup.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88062 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Eric Seidel.

        Switch paintBackgroundsBehindCell to use IntPoint
        https://bugs.webkit.org/show_bug.cgi?id=62031

        Switching paintBackgroundsBehindCell to take an IntPoint representing
        the paint offset instead of a pair of ints.

        No new tests as this is simple refactoring.

        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
        (WebCore::RenderTableCell::paintBoxDecorations):
        * rendering/RenderTableCell.h:
        * rendering/RenderTableRow.cpp:
        (WebCore::RenderTableRow::paint):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::paintCell):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88051 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Eric Seidel.

        Switch paintCaret and paintDragCaret to use IntPoint
        https://bugs.webkit.org/show_bug.cgi?id=62037

        Switching paintCaret and paintDragCaret to use an IntPoint representing
        the paint offset instead of a pair of ints.

        No new tests since this is simple refactoring.

        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::paintCaret):
        (WebCore::CaretBase::paintCaret):
        (WebCore::DragCaretController::paintDragCaret):
        * editing/FrameSelection.h:
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::paintCaret):
        (WebCore::RenderBlock::paintObject):
        (WebCore::RenderBlock::positionForPoint):
        (WebCore::RenderBlock::offsetForContents):
        * rendering/RenderBlock.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88050 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Eric Seidel.

        Switch paintItemForeground and paintItemForeground to use IntPoint
        https://bugs.webkit.org/show_bug.cgi?id=62035

        Switching paintItemFore/Background to use IntPoint instead of a pair of ints.

        No new tests since this is simple refactoring.

        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::paintObject):
        (WebCore::RenderListBox::paintItemForeground):
        (WebCore::RenderListBox::paintItemBackground):
        * rendering/RenderListBox.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88049 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Andreas Kling.

        To support building namespaced Qt, we require that forward-declarations
        of Qt classes be wrapped in QT_BEGIN_NAMESPACE and QT_END_NAMESPACE.

        * WebCoreSupport/FrameLoaderClientQt.h:
2011-06-03  Alexis Menard  <alexis.menard@openbossa.org>

        Reviewed by Andreas Kling.

        To support building namespaced Qt, we require that forward-declarations
        of Qt classes be wrapped in QT_BEGIN_NAMESPACE and QT_END_NAMESPACE.

        * platform/network/qt/QtMIMETypeSniffer.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88045 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Nikolas Zimmermann.

        Cleanup member variable usage in svg/animation classes
        https://bugs.webkit.org/show_bug.cgi?id=62029

        Cleanup member variables.

        * svg/animation/SMILTimeContainer.cpp:
        (WebCore::SMILTimeContainer::SMILTimeContainer):
        (WebCore::SMILTimeContainer::sampleAnimationAtTime):
        (WebCore::SMILTimeContainer::updateAnimations):
        * svg/animation/SMILTimeContainer.h:
        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::SVGSMILElement):
        * svg/animation/SVGSMILElement.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88039 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Kenneth Russell.

        Add AudioParam parameter scheduling implementation
        https://bugs.webkit.org/show_bug.cgi?id=61830

        No new tests since audio API is not yet implemented.

        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:
        * webaudio/AudioParam.cpp:
        (WebCore::AudioParam::value):
        (WebCore::AudioParam::smoothedValue):
        (WebCore::AudioParam::smooth):
        (WebCore::AudioParam::calculateSampleAccurateValues):
        * webaudio/AudioParam.h:
        (WebCore::AudioParam::setContext):
        (WebCore::AudioParam::context):
        (WebCore::AudioParam::setValueAtTime):
        (WebCore::AudioParam::linearRampToValueAtTime):
        (WebCore::AudioParam::exponentialRampToValueAtTime):
        (WebCore::AudioParam::setTargetValueAtTime):
        (WebCore::AudioParam::setValueCurveAtTime):
        (WebCore::AudioParam::cancelScheduledValues):
        (WebCore::AudioParam::hasTimelineValues):
        * webaudio/AudioParam.idl:
        * webaudio/AudioParamTimeline.cpp: Added.
        (WebCore::AudioParamTimeline::setValueAtTime):
        (WebCore::AudioParamTimeline::linearRampToValueAtTime):
        (WebCore::AudioParamTimeline::exponentialRampToValueAtTime):
        (WebCore::AudioParamTimeline::setTargetValueAtTime):
        (WebCore::AudioParamTimeline::setValueCurveAtTime):
        (WebCore::isValidNumber):
        (WebCore::AudioParamTimeline::insertEvent):
        (WebCore::AudioParamTimeline::cancelScheduledValues):
        (WebCore::AudioParamTimeline::valueForContextTime):
        (WebCore::AudioParamTimeline::valuesForTimeRange):
        (WebCore::timeToSampleFrame):
        (WebCore::AudioParamTimeline::valuesForTimeRangeImpl):
        * webaudio/AudioParamTimeline.h: Added.
        (WebCore::AudioParamTimeline::AudioParamTimeline):
        (WebCore::AudioParamTimeline::hasValues):
        (WebCore::AudioParamTimeline::ParamEvent::ParamEvent):
        (WebCore::AudioParamTimeline::ParamEvent::type):
        (WebCore::AudioParamTimeline::ParamEvent::value):
        (WebCore::AudioParamTimeline::ParamEvent::time):
        (WebCore::AudioParamTimeline::ParamEvent::timeConstant):
        (WebCore::AudioParamTimeline::ParamEvent::duration):
        (WebCore::AudioParamTimeline::ParamEvent::curve):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88037 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Simon Fraser.

        Flash of broken page when exiting full screen at jerryseinfeld.com
        https://bugs.webkit.org/show_bug.cgi?id=61897
        <rdar://problem/9522985>

        * fullscreen/full-screen-placeholder-expected.txt: Added.
        * fullscreen/full-screen-placeholder.html: Added.
2011-06-01  Jer Noble  <jer.noble@apple.com>

        Reviewed by Simon Fraser.

        Flash of broken page when exiting full screen at jerryseinfeld.com
        https://bugs.webkit.org/show_bug.cgi?id=61897
        <rdar://problem/9522985>

        Test: fullscreen/full-screen-placeholder.html

        Entering full-screen mode is causing the page layout to change because the full-screen
        element is taken out of the normal flow.  To counteract this effect, insert a placeholder
        block as a parent of the full-screen renderer with the same size and style as the full-screen
        element pre-full-screen.

        Only create a placeholder for block-level elements; the technique required for inline elements
        would be vastly more complicated.

        * dom/Document.cpp:
        (WebCore::Document::webkitWillEnterFullScreenForElement): Create a placeholder
            based on the size and style of the full-screen element.
        (WebCore::Document::setFullScreenRenderer): Persist the placeholder size and
            style across new renderers.
        * rendering/RenderFullScreen.cpp:
        (RenderFullScreen::RenderFullScreen): Added ivar.
        (RenderFullScreen::destroy): Make sure to safely destroy our placeholder.
        (RenderFullScreen::createPlaceholder): Added.
        * rendering/RenderFullScreen.h:
        (WebCore::RenderFullScreen::placeholder): Ivar accessor.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88034 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Eric Seidel.

        Switch paintBoxDecorations to IntPoint
        https://bugs.webkit.org/show_bug.cgi?id=61968

        Switching paintBoxDecorations to take an IntPoint representing
        the paint offset instead of a pair of ints. Also cleaning up
        some duplicated code in InlineFlowBox related to constraining
        the paint rect to the linetop and linebottom.

        No new tests since this is just refactoring.

        * rendering/InlineFlowBox.cpp:
        (WebCore::InlineFlowBox::paint):
        (WebCore::InlineFlowBox::constrainToLineTopAndBottomIfNeeded): Added
        to remove duplicate code in paintBoxDecorations and paintMask.
        (WebCore::InlineFlowBox::paintBoxDecorations):
        (WebCore::InlineFlowBox::paintMask):
        * rendering/InlineFlowBox.h:
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::paintObject):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::paintBoxDecorations):
        * rendering/RenderBox.h:
        * rendering/RenderFieldset.cpp:
        (WebCore::RenderFieldset::paintBoxDecorations):
        * rendering/RenderFieldset.h:
        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::paint):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::paintObject):
        (WebCore::RenderTable::paintBoxDecorations):
        * rendering/RenderTable.h:
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::paintBoxDecorations):
        * rendering/RenderTableCell.h:
        * rendering/RenderView.cpp:
        (WebCore::RenderView::paintBoxDecorations):
        * rendering/RenderView.h:
        * rendering/RenderWidget.cpp:
        (WebCore::RenderWidget::paint):
        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::paint):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88033 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Benjamin Poulain.

        [Qt]The minimum size of the select menu list is incorrect for qtwebkit
        https://bugs.webkit.org/show_bug.cgi?id=56752

        The test is to get the render tree of select menu lists with varying widths based on content.
        Some select list based tests are rebaselined because minimum width of RenderMenuList changes
        based on the content with this fix.

        * fast/forms/selectlist-minsize.html: Added.
        * platform/mac/fast/forms/selectlist-minsize-expected.txt: Added.
        * platform/qt/editing/pasteboard/4641033-expected.txt:
        * platform/qt/editing/pasteboard/4944770-1-expected.txt:
        * platform/qt/editing/pasteboard/4944770-2-expected.txt:
        * platform/qt/editing/selection/caret-before-select-expected.txt:
        * platform/qt/fast/forms/003-expected.txt:
        * platform/qt/fast/forms/004-expected.txt:
        * platform/qt/fast/forms/HTMLOptionElement_label06-expected.txt:
        * platform/qt/fast/forms/HTMLOptionElement_label07-expected.txt:
        * platform/qt/fast/forms/basic-selects-expected.txt:
        * platform/qt/fast/forms/menulist-deselect-update-expected.txt:
        * platform/qt/fast/forms/menulist-separator-painting-expected.txt:
        * platform/qt/fast/forms/menulist-style-color-expected.txt:
        * platform/qt/fast/forms/option-script-expected.txt:
        * platform/qt/fast/forms/select-background-none-expected.txt:
        * platform/qt/fast/forms/select-baseline-expected.txt:
        * platform/qt/fast/forms/select-dirty-parent-pref-widths-expected.txt:
        * platform/qt/fast/forms/select-empty-option-height-expected.txt:
        * platform/qt/fast/forms/select-size-expected.txt:
        * platform/qt/fast/forms/select-style-expected.txt:
        * platform/qt/fast/forms/selectlist-minsize-expected.txt: Added.
        * platform/qt/fast/invalid/014-expected.txt:
        * platform/qt/fast/replaced/replaced-breaking-expected.txt:
        * platform/qt/fast/replaced/replaced-breaking-mixture-expected.txt:
        * platform/qt/fast/replaced/three-selects-break-expected.txt:
        * platform/qt/tables/mozilla/bugs/bug29326-expected.txt:
        * platform/qt/tables/mozilla/core/margins-expected.txt:
2011-06-03  Doreen Jiang  <doreen.jiang@nokia.com>

        Reviewed by Benjamin Poulain.

        [Qt]The minimum size of the select menu list is incorrect for qtwebkit
        https://bugs.webkit.org/show_bug.cgi?id=56752

        The minimum width of the select-box is calculated to be as small as possible
        instead of hardcoded value (width of 7 characters) in minimumMenuListSize() function
        This will avoid overapping the select lists in popular websites.

        Test: fast/forms/selectlist-minsize.html

        * platform/qt/RenderThemeQt.cpp:
        (WebCore::RenderThemeQt::minimumMenuListSize):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88029 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Darin Adler.

        Prevent event dispatch for events with related target when host is the target.
        https://bugs.webkit.org/show_bug.cgi?id=61979

        * fast/events/shadow-boundary-crossing-expected.txt: Added test.
        * fast/events/shadow-boundary-crossing.html: Added expectations.
2011-06-02  Dimitri Glazkov  <dglazkov@chromium.org>

        Reviewed by Darin Adler.

        Prevent event dispatch for events with related target when host is the target.
        https://bugs.webkit.org/show_bug.cgi?id=61979

        Turns out, even if we trim the ancestor chain to 0, the event is still dispatched during AT_TARGET.
        So might as well be explicit about what we are trying to do and add a flag to prevent dispatch in these cases.

        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::adjustToShadowBoundaries): Added preventing dispatch when the ancestor chain is trimmed to nothing.
        (WebCore::EventDispatcher::EventDispatcher): Added initializer.
        (WebCore::EventDispatcher::dispatchEvent): Added a check to prevent dispatch.
        * dom/EventDispatcher.h: Added a def.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88026 268f45cc-cd09-0410-ab3c-d52691b4dbfc

* WebCore.xcodeproj/project.pbxproj:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88023 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Eric Seidel.

        [Chromium] Call setToolTipText() in WebPopupMenuImpl mouse move handler to show tool tip in select popup window.
        https://bugs.webkit.org/show_bug.cgi?id=61260
        http://code.google.com/p/chromium/issues/detail?id=12721

        Manual test: select-popup-tooltip-test.html

        * manual-tests/select-popup-tooltip-test.html: Added.
        * platform/chromium/PopupMenuChromium.cpp:
        (WebCore::PopupContainer::getSelectedItemToolTip): Get selected item tooltip string according to hovering mouse position.
        * platform/chromium/PopupMenuChromium.h: Add getSelectedItemToolTip() declaration.
2011-06-03  Naoki Takano  <takano.naoki@gmail.com>

        Reviewed by Eric Seidel.

        [Chromium] Call setToolTipText() in WebPopupMenuImpl mouse move handler to show tool tip in select popup window.
        https://bugs.webkit.org/show_bug.cgi?id=61260
        http://code.google.com/p/chromium/issues/detail?id=12721

        * public/WebMenuItemInfo.h: Add toolTip.
        * public/WebViewClient.h: Remove setToolTipText().
        * public/WebWidgetClient.h: Add setTooTipText().
        (WebKit::WebWidgetClient::setToolTipText):
        * src/ExternalPopupMenu.cpp:
        (WebKit::ExternalPopupMenu::getPopupMenuInfo): Add popupItem.toolTip set.
        * src/WebPopupMenuImpl.cpp:
        (WebKit::WebPopupMenuImpl::MouseMove): Call setToolTipText().

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88021 268f45cc-cd09-0410-ab3c-d52691b4dbfc