[webkit-changes] [WebKit/WebKit] 1d77e9: Branch WebKitGTK+ for 2.6

Carlos Garcia Campos noreply at github.com
Wed Sep 28 09:03:19 PDT 2022


  Branch: refs/heads/webkitgtk/2.6
  Home:   https://github.com/WebKit/WebKit
  Commit: 1d77e9300ed3bb81f21015fca048092d54cd5eda
      https://github.com/WebKit/WebKit/commit/1d77e9300ed3bb81f21015fca048092d54cd5eda
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2014-09-19 (Fri, 19 Sep 2014)

  Changed paths:

  Log Message:
  -----------
  Branch WebKitGTK+ for 2.6

Canonical link: https://commits.webkit.org/154760.1@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173752 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 4e4b48a5b7ec64db99d573bd02dbdd4b717afde6
      https://github.com/WebKit/WebKit/commit/4e4b48a5b7ec64db99d573bd02dbdd4b717afde6
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-09-19 (Fri, 19 Sep 2014)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    A Source/WebInspectorUI/UserInterface/Images/gtk/AUTHORS
    A Source/WebInspectorUI/UserInterface/Images/gtk/BackArrow.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/BreakpointActionAdd.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/BreakpointActionRemove.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/BreakpointButton.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/BreakpointInactiveButton.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Breakpoints.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/COPYING
    A Source/WebInspectorUI/UserInterface/Images/gtk/Close.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/CloseWhite.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/ContentFlow.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Crosshair.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/DOMCharacterData.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/DOMComment.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/DOMDocument.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/DOMDocumentType.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/DOMElement.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/DOMNode.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/DOMTextNode.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/DOMTree.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/DisclosureTriangleSmallClosed.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/DisclosureTriangleSmallOpen.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/DisclosureTriangleTinyClosed.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/DisclosureTriangleTinyOpen.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/DockBottom.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/DockRight.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/DocumentCSS.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/DocumentCSS at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/DocumentFont.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/DocumentFont at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/DocumentGeneric.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/DocumentGeneric at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/DocumentImage.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/DocumentImage at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/DocumentJS.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/DocumentJS at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/DocumentMarkup.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/DocumentMarkup at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/DownloadArrow.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Error.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Errors.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/ErrorsEnabled.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/EventListener.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Exception.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/FilterFieldGlyph.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/FolderGeneric.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/FolderGeneric at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/ForwardArrow.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Function.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/GoToArrow.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Resources.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/SortIndicatorDownArrow.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/SortIndicatorUpArrow.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/UpDownArrows.svg
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/PlatformGTK.cmake
    M Tools/ChangeLog
    M Tools/gtk/generate-inspector-gresource-manifest.py
    M Tools/gtk/manifest.txt

  Log Message:
  -----------
  Merge r173753 - Webkitgtk 2.5.3: tarball contains APPLE LICENSE file - stating not distributable
https://bugs.webkit.org/show_bug.cgi?id=136632

Reviewed by Gustavo Noronha Silva.

Source/WebInspectorUI:

Add free icons for the GTK port. These icons are from the GNOME
project, some of them adapted by Andres Gomez for the inspector.
This is only a subset of the icons, since we still don't have a
free replacement for all of them, but at least it makes the
inspector kind of usable.

* UserInterface/Images/gtk/AUTHORS: Added.
* UserInterface/Images/gtk/BackArrow.svg: Added.
* UserInterface/Images/gtk/BreakpointActionAdd.svg: Added.
* UserInterface/Images/gtk/BreakpointActionRemove.svg: Added.
* UserInterface/Images/gtk/BreakpointButton.svg: Added.
* UserInterface/Images/gtk/BreakpointInactiveButton.svg: Added.
* UserInterface/Images/gtk/Breakpoints.svg: Added.
* UserInterface/Images/gtk/COPYING: Added.
* UserInterface/Images/gtk/Close.svg: Added.
* UserInterface/Images/gtk/CloseWhite.svg: Added.
* UserInterface/Images/gtk/ContentFlow.svg: Added.
* UserInterface/Images/gtk/Crosshair.svg: Added.
* UserInterface/Images/gtk/DOMCharacterData.svg: Added.
* UserInterface/Images/gtk/DOMComment.svg: Added.
* UserInterface/Images/gtk/DOMDocument.svg: Added.
* UserInterface/Images/gtk/DOMDocumentType.svg: Added.
* UserInterface/Images/gtk/DOMElement.svg: Added.
* UserInterface/Images/gtk/DOMNode.svg: Added.
* UserInterface/Images/gtk/DOMTextNode.svg: Added.
* UserInterface/Images/gtk/DOMTree.svg: Added.
* UserInterface/Images/gtk/DisclosureTriangleSmallClosed.svg: Added.
* UserInterface/Images/gtk/DisclosureTriangleSmallOpen.svg: Added.
* UserInterface/Images/gtk/DisclosureTriangleTinyClosed.svg: Added.
* UserInterface/Images/gtk/DisclosureTriangleTinyOpen.svg: Added.
* UserInterface/Images/gtk/DockBottom.svg: Added.
* UserInterface/Images/gtk/DockRight.svg: Added.
* UserInterface/Images/gtk/DocumentCSS.png: Added.
* UserInterface/Images/gtk/DocumentCSS at 2x.png: Added.
* UserInterface/Images/gtk/DocumentFont.png: Added.
* UserInterface/Images/gtk/DocumentFont at 2x.png: Added.
* UserInterface/Images/gtk/DocumentGeneric.png: Added.
* UserInterface/Images/gtk/DocumentGeneric at 2x.png: Added.
* UserInterface/Images/gtk/DocumentImage.png: Added.
* UserInterface/Images/gtk/DocumentImage at 2x.png: Added.
* UserInterface/Images/gtk/DocumentJS.png: Added.
* UserInterface/Images/gtk/DocumentJS at 2x.png: Added.
* UserInterface/Images/gtk/DocumentMarkup.png: Added.
* UserInterface/Images/gtk/DocumentMarkup at 2x.png: Added.
* UserInterface/Images/gtk/DownloadArrow.svg: Added.
* UserInterface/Images/gtk/Error.svg: Added.
* UserInterface/Images/gtk/Errors.svg: Added.
* UserInterface/Images/gtk/ErrorsEnabled.svg: Added.
* UserInterface/Images/gtk/EventListener.svg: Added.
* UserInterface/Images/gtk/Exception.svg: Added.
* UserInterface/Images/gtk/FilterFieldGlyph.svg: Added.
* UserInterface/Images/gtk/FolderGeneric.png: Added.
* UserInterface/Images/gtk/FolderGeneric at 2x.png: Added.
* UserInterface/Images/gtk/ForwardArrow.svg: Added.
* UserInterface/Images/gtk/Function.svg: Added.
* UserInterface/Images/gtk/GoToArrow.svg: Added.
* UserInterface/Images/gtk/Resources.svg: Added.
* UserInterface/Images/gtk/SortIndicatorDownArrow.svg: Added.
* UserInterface/Images/gtk/SortIndicatorUpArrow.svg: Added.
* UserInterface/Images/gtk/UpDownArrows.svg: Added.

Source/WebKit2:

* PlatformGTK.cmake: Use only the icons from the gtk directory since they are free.

Tools:

* gtk/generate-inspector-gresource-manifest.py: Use an alias for
the gtk icons.
* gtk/manifest.txt: Only include the free icons in the tarball.

Canonical link: https://commits.webkit.org/154760.2@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173756 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: c820566f82cebf4b546e6fca458841d28508cd14
      https://github.com/WebKit/WebKit/commit/c820566f82cebf4b546e6fca458841d28508cd14
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-09-19 (Fri, 19 Sep 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/PlatformGTK.cmake
    M Tools/ChangeLog
    M Tools/gtk/manifest.txt

  Log Message:
  -----------
  Merge r173755 - [GTK] Missing inspector files in the tarball
https://bugs.webkit.org/show_bug.cgi?id=136952

Reviewed by Gustavo Noronha Silva.

Source/WebKit2:

* PlatformGTK.cmake: Use APPEND instead of GLOB to add individual
and generated files to the list of inspector files.

Tools:

* gtk/manifest.txt: Add
Source/WebInspectorUI/Localizations/en.lproj/localizedStrings.js
to the tarball.

Canonical link: https://commits.webkit.org/154760.3@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173757 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: ffe5cf7ebbe7e7d7fc5d7691a0d29dbdca3a8f39
      https://github.com/WebKit/WebKit/commit/ffe5cf7ebbe7e7d7fc5d7691a0d29dbdca3a8f39
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2014-09-19 (Fri, 19 Sep 2014)

  Changed paths:
    M ChangeLog
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.5.90 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit2:

* gtk/NEWS: Add release notes for 2.5.90.

Canonical link: https://commits.webkit.org/154760.4@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173758 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f4bc9ac864867c5a474f6bf51b7ef9ca5cd6dfd2
      https://github.com/WebKit/WebKit/commit/f4bc9ac864867c5a474f6bf51b7ef9ca5cd6dfd2
  Author: Sweta Kothari <swkothar at redhat.com>
  Date:   2014-09-22 (Mon, 22 Sep 2014)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/gu.po

  Log Message:
  -----------
  Merge r173810 - Webkit Gujarati Translations
https://bugs.webkit.org/show_bug.cgi?id=136525

Patch by Sweta Kothari <swkothar at redhat.com> on 2014-09-22
Reviewed by Philippe Normand.

* gu.po:

Canonical link: https://commits.webkit.org/154760.5@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173817 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: b3d2f3858ad1db9d5a82d3df8d0eaff9ae91f70a
      https://github.com/WebKit/WebKit/commit/b3d2f3858ad1db9d5a82d3df8d0eaff9ae91f70a
  Author: Manoj Kumar Giri <mgiri at redhat.com>
  Date:   2014-09-22 (Mon, 22 Sep 2014)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/or.po

  Log Message:
  -----------
  Merge r173811 - Odia (or_IN) translation for webkit
https://bugs.webkit.org/show_bug.cgi?id=136920

Patch by Manoj Kumar Giri <mgiri at redhat.com> on 2014-09-22
Reviewed by Philippe Normand.

* or.po:

Canonical link: https://commits.webkit.org/154760.6@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173818 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 3fe09046a2ce22a947b20b72d217b1c41e546937
      https://github.com/WebKit/WebKit/commit/3fe09046a2ce22a947b20b72d217b1c41e546937
  Author: Nilamdyuti Goswami <ngoswami at redhat.com>
  Date:   2014-09-22 (Mon, 22 Sep 2014)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/as.po

  Log Message:
  -----------
  Merge r173812 - [as] Updated Assamese translations of WebKitGtk+
https://bugs.webkit.org/show_bug.cgi?id=136908

Patch by Nilamdyuti Goswami <ngoswami at redhat.com> on 2014-09-22
Reviewed by Philippe Normand.

* as.po:

Canonical link: https://commits.webkit.org/154760.7@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173819 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 693c374da8362764bda40c04026de7fa2a22957a
      https://github.com/WebKit/WebKit/commit/693c374da8362764bda40c04026de7fa2a22957a
  Author: Shantha kumar <shantha.thamizh at gmail.com>
  Date:   2014-09-22 (Mon, 22 Sep 2014)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/ta.po

  Log Message:
  -----------
  Merge r173813 - Webkit Tamil translations updated
https://bugs.webkit.org/show_bug.cgi?id=136816

Patch by Shantha kumar <shantha.thamizh at gmail.com> on 2014-09-22
Reviewed by Philippe Normand.

* ta.po:

Canonical link: https://commits.webkit.org/154760.8@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173820 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 19ea5a10d7c830459b696a9b9e9a51865cd35f4b
      https://github.com/WebKit/WebKit/commit/19ea5a10d7c830459b696a9b9e9a51865cd35f4b
  Author: Yosef Or Boczko <yoseforb at gnome.org>
  Date:   2014-09-22 (Mon, 22 Sep 2014)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/he.po

  Log Message:
  -----------
  Merge r173814 - [l10n] Updated Hebrew translation of WebKitGTK+
https://bugs.webkit.org/show_bug.cgi?id=136678

Patch by Yosef Or Boczko <yoseforb at gnome.org> on 2014-09-22
Reviewed by Philippe Normand.

* he.po:

Canonical link: https://commits.webkit.org/154760.9@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173821 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 3d9a42e0a29fa4c0656ab3fc9126e3d3838860a2
      https://github.com/WebKit/WebKit/commit/3d9a42e0a29fa4c0656ab3fc9126e3d3838860a2
  Author: Piotr Drąg <piotrdrag at gmail.com>
  Date:   2014-09-22 (Mon, 22 Sep 2014)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/pl.po

  Log Message:
  -----------
  Merge r173815 - [l10n] Updated Polish translation of WebKitGTK+
https://bugs.webkit.org/show_bug.cgi?id=136976

Patch by Piotr Drąg <piotrdrag at gmail.com> on 2014-09-22
Reviewed by Philippe Normand.

* pl.po:

Canonical link: https://commits.webkit.org/154760.10@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173822 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 6aa7d90fb5e70f3da53ddd52673cf45279f3a3d9
      https://github.com/WebKit/WebKit/commit/6aa7d90fb5e70f3da53ddd52673cf45279f3a3d9
  Author: Philippe Normand <philn at igalia.com>
  Date:   2014-09-22 (Mon, 22 Sep 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/media/hls/video-cookie-expected.txt
    A LayoutTests/http/tests/media/hls/video-cookie.html
    A LayoutTests/http/tests/media/resources/hls/playlist-with-cookie.m3u8
    A LayoutTests/http/tests/media/resources/hls/sub-playlist-with-cookie.php
    M LayoutTests/http/tests/media/resources/video-cookie-check-cookie.php
    M LayoutTests/platform/gtk/TestExpectations
    M LayoutTests/platform/mac/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp

  Log Message:
  -----------
  Merge r173809 - [GStreamer] Cannot play Vimeo video
https://bugs.webkit.org/show_bug.cgi?id=134969

Reviewed by Sergio Villar Senin.

Source/WebCore:

Ensure the GStreamer HTTP source element also sends cookies when
it's sending its requests. Some streaming platforms such as Vimeo
do server-side cookie checks on incoming requests before serving
media data.

Test: http/tests/media/hls/video-cookie.html

* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(webKitWebSrcStart): Set first-party cookie URL to the request so
the ResourceLoader properly sets cookies in the HTTP request.

LayoutTests:

New test for a HLS stream enforcing a specific cookie before
serving its fragments, like Vimeo does.

* http/tests/media/hls/video-cookie-expected.txt: Added.
* http/tests/media/hls/video-cookie.html: Added.
* http/tests/media/resources/hls/playlist-with-cookie.m3u8: Added.
* http/tests/media/resources/hls/sub-playlist-with-cookie.php: Added.
* http/tests/media/resources/video-cookie-check-cookie.php:
* platform/gtk/TestExpectations: Marked test as slow, as the other
HLS test.

Canonical link: https://commits.webkit.org/154760.11@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173823 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: b7d69c1b71b1a9808096649753134cb57ea5f627
      https://github.com/WebKit/WebKit/commit/b7d69c1b71b1a9808096649753134cb57ea5f627
  Author: Sandeep Shedmake <sandeep.shedmake at gmail.com>
  Date:   2014-09-22 (Mon, 22 Sep 2014)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/mr.po

  Log Message:
  -----------
  Merge r173824 - [l10n] [mr] WebKitGTK+ Marathi Translations
https://bugs.webkit.org/show_bug.cgi?id=136979

Patch by Sandeep Shedmake <sandeep.shedmake at gmail.com> on 2014-09-22
Reviewed by Philippe Normand.

* mr.po:

Canonical link: https://commits.webkit.org/154760.12@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173826 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e6ae4ea56363a843be5cead729e8a518bcff550d
      https://github.com/WebKit/WebKit/commit/e6ae4ea56363a843be5cead729e8a518bcff550d
  Author: Eva Balazsfalvi <evab.u-szeged at partner.samsung.com>
  Date:   2014-09-22 (Mon, 22 Sep 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/HTMLImageElement.cpp

  Log Message:
  -----------
  Merge r173767 - REGRESSION(r173464): It broke the !ENABLE(PICTURE_SIZES) build
https://bugs.webkit.org/show_bug.cgi?id=136942

Reviewed by Simon Fraser.

* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::parseAttribute):

Canonical link: https://commits.webkit.org/154760.13@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173827 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 26dec3faf510f51459888fa6276ae94dc7e2e0b8
      https://github.com/WebKit/WebKit/commit/26dec3faf510f51459888fa6276ae94dc7e2e0b8
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2014-09-22 (Mon, 22 Sep 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/StructureSet.cpp

  Log Message:
  -----------
  Merge r173787 - Leak of mallocs under StructureSet::OutOfLineList::create
https://bugs.webkit.org/show_bug.cgi?id=136970

Reviewed by Filip Pizlo.

addOutOfLine should free the old list when expanding the capacity.

* bytecode/StructureSet.cpp:
(JSC::StructureSet::addOutOfLine):

Canonical link: https://commits.webkit.org/154760.14@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173828 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f38419f4c0614c229e7dc77b99d6389a2dbf6ff9
      https://github.com/WebKit/WebKit/commit/f38419f4c0614c229e7dc77b99d6389a2dbf6ff9
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2014-09-22 (Mon, 22 Sep 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/editing/EditingStyle.cpp
    M Source/WebCore/editing/SplitElementCommand.cpp
    M Source/WebCore/rendering/RenderTableCell.cpp

  Log Message:
  -----------
  Merge r173800 - Fix post-mortem nits for r173724
https://bugs.webkit.org/show_bug.cgi?id=136986

Reviewed by Darin Adler.

Fix post-mortem nits for r173724.

No new tests, no behavior change.

* editing/EditingStyle.cpp:
(WebCore::HTMLAttributeEquivalent::attributeValueAsCSSValue):
(WebCore::HTMLFontSizeEquivalent::attributeValueAsCSSValue):
Use nullptr instead of 0.

* editing/SplitElementCommand.cpp:
(WebCore::SplitElementCommand::doUnapply):
Use getIdAttribute() / setIdAttribute().

* rendering/RenderTableCell.cpp:
(WebCore::RenderTableCell::computePreferredLogicalWidths):
Use fastHasAttribute() for nowrap and do an early return to avoid
calling styleOrColLogicalWidth() if the nowrap attribute is missing.

Canonical link: https://commits.webkit.org/154760.15@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173829 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: d7e6318b9fc02a896d1abb5b9df94f4af411aa3a
      https://github.com/WebKit/WebKit/commit/d7e6318b9fc02a896d1abb5b9df94f4af411aa3a
  Author: Mihnea Ovidenie <mihnea at adobe.com>
  Date:   2014-09-22 (Mon, 22 Sep 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/regions/animated-image-in-region-expected.txt
    A LayoutTests/fast/regions/animated-image-in-region.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderFlowThread.cpp
    M Source/WebCore/rendering/RenderLayer.cpp
    M Source/WebCore/rendering/RenderLayerBacking.cpp
    M Source/WebCore/rendering/RenderLayerBacking.h
    M Source/WebCore/rendering/RenderLayerCompositor.cpp

  Log Message:
  -----------
  Merge r173806 - [CSS Regions] Assertion failure and null dereference crash when using animations and regions
https://bugs.webkit.org/show_bug.cgi?id=136918

Reviewed by Andrei Bucur.

Source/WebCore:

In some situations, for instance when an image has an attached animation, the style change caused by the animation
triggers a geometry update for the backing store associated with the image's layer. This may occur before
the layout for the image has finished.

Moreover, if the image in such situation - having a composited layer - is displayed in a region,
sicne the layout did not finish yet, the mappings between the layers of the elements collected in the named flow
and the regions associated with the named flow are not updated and cannot be used.

Therefore in those situations, we have to bail out early and use these mappings only after the layout has finished.

This patch also changes RenderLayerBacking method updateAfterDescendents -> updateAfterDescendants.

Test: fast/regions/animated-image-in-region.html

* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::cachedRegionForCompositedLayer):
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::calculateClipRects):
* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::updateAfterDescendants):
* rendering/RenderLayerBacking.h:
* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
(WebCore::RenderLayerCompositor::updateLayerTreeGeometry):
(WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry):

LayoutTests:

* fast/regions/animated-image-in-region-expected.txt: Added.
* fast/regions/animated-image-in-region.html: Added.

Canonical link: https://commits.webkit.org/154760.16@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173830 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: d7ce0da66d9ced8a9938aa75148e2ef6fb23609a
      https://github.com/WebKit/WebKit/commit/d7ce0da66d9ced8a9938aa75148e2ef6fb23609a
  Author: Shankar Prasad <svenkate at redhat.com>
  Date:   2014-09-22 (Mon, 22 Sep 2014)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/kn.po

  Log Message:
  -----------
  Merge r173831 - [kn] Kannada Translation for webkit - Updated
https://bugs.webkit.org/show_bug.cgi?id=116941

Patch by Shankar Prasad <svenkate at redhat.com> on 2014-09-22
Reviewed by Philippe Normand.

* kn.po:

Canonical link: https://commits.webkit.org/154760.17@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173833 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 6275a3303009c076bb7154e2d927bb20f61c663d
      https://github.com/WebKit/WebKit/commit/6275a3303009c076bb7154e2d927bb20f61c663d
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-09-22 (Mon, 22 Sep 2014)

  Changed paths:
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestWebKitWebView.cpp

  Log Message:
  -----------
  Merge r173832 - [GTK] Test /webkit2/WebKitWebView/can-show-mime-type fails if evince browser plugin is installed
https://bugs.webkit.org/show_bug.cgi?id=136998

Reviewed by Philippe Normand.

* TestWebKitAPI/Tests/WebKit2Gtk/TestWebKitWebView.cpp:
(testWebViewCanShowMIMEType): Remove the check of PDF as
unsupported MIME type.

Canonical link: https://commits.webkit.org/154760.18@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173834 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 0702bee29ec02e0fa2a6ac4974c9f7f16d77a86c
      https://github.com/WebKit/WebKit/commit/0702bee29ec02e0fa2a6ac4974c9f7f16d77a86c
  Author: Andres Gomez <agomez at igalia.com>
  Date:   2014-09-24 (Wed, 24 Sep 2014)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Images/gtk/AUTHORS
    A Source/WebInspectorUI/UserInterface/Images/gtk/ApplicationCache.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/ApplicationCache at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/BottomUpTree.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Breakpoint.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Breakpoint at 2x.png
    M Source/WebInspectorUI/UserInterface/Images/gtk/BreakpointButton.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/BreakpointInactive.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/BreakpointInactive at 2x.png
    M Source/WebInspectorUI/UserInterface/Images/gtk/BreakpointInactiveButton.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/COPYING
    A Source/WebInspectorUI/UserInterface/Images/gtk/COPYING_CCBYSA3
    A Source/WebInspectorUI/UserInterface/Images/gtk/ClippingCSS.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/ClippingCSS at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/ClippingGeneric.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/ClippingGeneric at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/ClippingJS.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/ClippingJS at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/CloseTimeline.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/CloseTimeline at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/ColorIcon.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/ColorIcon at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Colors.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Colors at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/ColorsLarge.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/ColorsLarge at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Database.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Database at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/DatabaseTable.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/DatabaseTable at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/HierarchicalNavigationItemChevron.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/IndeterminateProgressSpinner1.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/IndeterminateProgressSpinner10.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/IndeterminateProgressSpinner11.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/IndeterminateProgressSpinner12.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/IndeterminateProgressSpinner2.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/IndeterminateProgressSpinner3.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/IndeterminateProgressSpinner4.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/IndeterminateProgressSpinner5.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/IndeterminateProgressSpinner6.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/IndeterminateProgressSpinner7.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/IndeterminateProgressSpinner8.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/IndeterminateProgressSpinner9.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Issues.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/IssuesEnabled.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/LayerBorders.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/LessColumns.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/LocalStorage.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/LocalStorage at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Locked.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Logs.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Memory.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/MoreColumns.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Native.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemAngleBrackets.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemBrushAndRuler.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemBug.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemCurleyBraces.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemFile.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemLayers.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemLog.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemMagnifyingGlass.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemStopwatch.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemStorage.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemTrash.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemVariable.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Network.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Network at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/NetworkLarge.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/NetworkLarge at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Pause.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Percent.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Plus.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/PseudoElement.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Reflection.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Reload.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Request.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Response.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/ResultLine.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Resume.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/SessionStorage.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/SessionStorage at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/ShadowDOM.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/SourceCode.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/SplitToggleDown.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/SplitToggleUp.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/StepInto.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/StepOut.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/StepOver.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/StyleRuleAuthor.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/StyleRuleInherited.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/StyleRuleInheritedElement.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/StyleRuleInspector.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/StyleRuleUser.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/StyleRuleUserAgent.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Time.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/TimelineRecordAnimation.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/TimelineRecordEvent.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/TimelineRecordLayout.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/TimelineRecordPaint.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/TimelineRecordScriptEvaluated.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/TimelineRecordStyle.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/TimelineRecordTimer.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Undock.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/UserInputPrompt.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/UserInputPromptPrevious.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/UserInputResult.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Warning.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Weight.svg

  Log Message:
  -----------
  Merge r173912 - Unreviewed. Add more free icons for the Web Inspector in GTK+

Patch by Andres Gomez <agomez at igalia.com> on 2014-09-24

* UserInterface/Images/gtk/AUTHORS:
* UserInterface/Images/gtk/ApplicationCache.png: Added.
* UserInterface/Images/gtk/ApplicationCache at 2x.png: Added.
* UserInterface/Images/gtk/BottomUpTree.svg: Added.
* UserInterface/Images/gtk/Breakpoint.png: Added.
* UserInterface/Images/gtk/Breakpoint at 2x.png: Added.
* UserInterface/Images/gtk/BreakpointButton.svg:
* UserInterface/Images/gtk/BreakpointInactive.png: Added.
* UserInterface/Images/gtk/BreakpointInactive at 2x.png: Added.
* UserInterface/Images/gtk/BreakpointInactiveButton.svg:
* UserInterface/Images/gtk/COPYING:
* UserInterface/Images/gtk/COPYING_CCBYSA3: Copied from Source/WebInspectorUI/UserInterface/Images/gtk/COPYING.
* UserInterface/Images/gtk/ClippingCSS.png: Added.
* UserInterface/Images/gtk/ClippingCSS at 2x.png: Added.
* UserInterface/Images/gtk/ClippingGeneric.png: Added.
* UserInterface/Images/gtk/ClippingGeneric at 2x.png: Added.
* UserInterface/Images/gtk/ClippingJS.png: Added.
* UserInterface/Images/gtk/ClippingJS at 2x.png: Added.
* UserInterface/Images/gtk/CloseTimeline.png: Added.
* UserInterface/Images/gtk/CloseTimeline at 2x.png: Added.
* UserInterface/Images/gtk/ColorIcon.png: Added.
* UserInterface/Images/gtk/ColorIcon at 2x.png: Added.
* UserInterface/Images/gtk/Colors.png: Added.
* UserInterface/Images/gtk/Colors at 2x.png: Added.
* UserInterface/Images/gtk/ColorsLarge.png: Added.
* UserInterface/Images/gtk/ColorsLarge at 2x.png: Added.
* UserInterface/Images/gtk/Database.png: Added.
* UserInterface/Images/gtk/Database at 2x.png: Added.
* UserInterface/Images/gtk/DatabaseTable.png: Added.
* UserInterface/Images/gtk/DatabaseTable at 2x.png: Added.
* UserInterface/Images/gtk/HierarchicalNavigationItemChevron.svg: Added.
* UserInterface/Images/gtk/IndeterminateProgressSpinner1.svg: Added.
* UserInterface/Images/gtk/IndeterminateProgressSpinner10.svg: Added.
* UserInterface/Images/gtk/IndeterminateProgressSpinner11.svg: Added.
* UserInterface/Images/gtk/IndeterminateProgressSpinner12.svg: Added.
* UserInterface/Images/gtk/IndeterminateProgressSpinner2.svg: Added.
* UserInterface/Images/gtk/IndeterminateProgressSpinner3.svg: Added.
* UserInterface/Images/gtk/IndeterminateProgressSpinner4.svg: Added.
* UserInterface/Images/gtk/IndeterminateProgressSpinner5.svg: Added.
* UserInterface/Images/gtk/IndeterminateProgressSpinner6.svg: Added.
* UserInterface/Images/gtk/IndeterminateProgressSpinner7.svg: Added.
* UserInterface/Images/gtk/IndeterminateProgressSpinner8.svg: Added.
* UserInterface/Images/gtk/IndeterminateProgressSpinner9.svg: Added.
* UserInterface/Images/gtk/Issues.svg: Added.
* UserInterface/Images/gtk/IssuesEnabled.svg: Added.
* UserInterface/Images/gtk/LayerBorders.svg: Added.
* UserInterface/Images/gtk/LessColumns.svg: Added.
* UserInterface/Images/gtk/LocalStorage.png: Added.
* UserInterface/Images/gtk/LocalStorage at 2x.png: Added.
* UserInterface/Images/gtk/Locked.svg: Added.
* UserInterface/Images/gtk/Logs.svg: Added.
* UserInterface/Images/gtk/Memory.svg: Added.
* UserInterface/Images/gtk/MoreColumns.svg: Added.
* UserInterface/Images/gtk/Native.svg: Added.
* UserInterface/Images/gtk/NavigationItemAngleBrackets.svg: Added.
* UserInterface/Images/gtk/NavigationItemBrushAndRuler.svg: Added.
* UserInterface/Images/gtk/NavigationItemBug.svg: Added.
* UserInterface/Images/gtk/NavigationItemCurleyBraces.svg: Added.
* UserInterface/Images/gtk/NavigationItemFile.svg: Added.
* UserInterface/Images/gtk/NavigationItemLayers.svg: Added.
* UserInterface/Images/gtk/NavigationItemLog.svg: Added.
* UserInterface/Images/gtk/NavigationItemMagnifyingGlass.svg: Added.
* UserInterface/Images/gtk/NavigationItemStopwatch.svg: Added.
* UserInterface/Images/gtk/NavigationItemStorage.svg: Added.
* UserInterface/Images/gtk/NavigationItemTrash.svg: Added.
* UserInterface/Images/gtk/NavigationItemVariable.svg: Added.
* UserInterface/Images/gtk/Network.png: Added.
* UserInterface/Images/gtk/Network at 2x.png: Added.
* UserInterface/Images/gtk/NetworkLarge.png: Added.
* UserInterface/Images/gtk/NetworkLarge at 2x.png: Added.
* UserInterface/Images/gtk/Pause.svg: Added.
* UserInterface/Images/gtk/Percent.svg: Added.
* UserInterface/Images/gtk/Plus.svg: Added.
* UserInterface/Images/gtk/PseudoElement.svg: Added.
* UserInterface/Images/gtk/Reflection.svg: Added.
* UserInterface/Images/gtk/Reload.svg: Added.
* UserInterface/Images/gtk/Request.svg: Added.
* UserInterface/Images/gtk/Response.svg: Added.
* UserInterface/Images/gtk/ResultLine.svg: Added.
* UserInterface/Images/gtk/Resume.svg: Added.
* UserInterface/Images/gtk/SessionStorage.png: Added.
* UserInterface/Images/gtk/SessionStorage at 2x.png: Added.
* UserInterface/Images/gtk/ShadowDOM.svg: Added.
* UserInterface/Images/gtk/SourceCode.svg: Added.
* UserInterface/Images/gtk/SplitToggleDown.svg: Added.
* UserInterface/Images/gtk/SplitToggleUp.svg: Added.
* UserInterface/Images/gtk/StepInto.svg: Added.
* UserInterface/Images/gtk/StepOut.svg: Added.
* UserInterface/Images/gtk/StepOver.svg: Added.
* UserInterface/Images/gtk/StyleRuleAuthor.svg: Added.
* UserInterface/Images/gtk/StyleRuleInherited.svg: Added.
* UserInterface/Images/gtk/StyleRuleInheritedElement.svg: Added.
* UserInterface/Images/gtk/StyleRuleInspector.svg: Added.
* UserInterface/Images/gtk/StyleRuleUser.svg: Added.
* UserInterface/Images/gtk/StyleRuleUserAgent.svg: Added.
* UserInterface/Images/gtk/Time.svg: Added.
* UserInterface/Images/gtk/TimelineRecordAnimation.svg: Added.
* UserInterface/Images/gtk/TimelineRecordEvent.svg: Added.
* UserInterface/Images/gtk/TimelineRecordLayout.svg: Added.
* UserInterface/Images/gtk/TimelineRecordPaint.svg: Added.
* UserInterface/Images/gtk/TimelineRecordScriptEvaluated.svg: Added.
* UserInterface/Images/gtk/TimelineRecordStyle.svg: Added.
* UserInterface/Images/gtk/TimelineRecordTimer.svg: Added.
* UserInterface/Images/gtk/Undock.svg: Added.
* UserInterface/Images/gtk/UserInputPrompt.svg: Added.
* UserInterface/Images/gtk/UserInputPromptPrevious.svg: Added.
* UserInterface/Images/gtk/UserInputResult.svg: Added.
* UserInterface/Images/gtk/Warning.svg: Added.
* UserInterface/Images/gtk/Weight.svg: Added.

Canonical link: https://commits.webkit.org/154760.19@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173913 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 02c6e6bc29d5561c437cc9b123f66eec69678290
      https://github.com/WebKit/WebKit/commit/02c6e6bc29d5561c437cc9b123f66eec69678290
  Author: Eva Balazsfalvi <evab.u-szeged at partner.samsung.com>
  Date:   2014-09-24 (Wed, 24 Sep 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/DragController.cpp

  Log Message:
  -----------
  Merge r173836 - REGRESSION(r173631): It broke the !ENABLE(VIDEO) build
https://bugs.webkit.org/show_bug.cgi?id=136946

Reviewed by Jer Noble.

No new tests required, no new functionality.

* page/DragController.cpp:
(WebCore::DragController::startDrag):

Canonical link: https://commits.webkit.org/154760.20@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173914 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: cea3b103d01a959938a866365458083f9abf5ec9
      https://github.com/WebKit/WebKit/commit/cea3b103d01a959938a866365458083f9abf5ec9
  Author: David Hyatt <hyatt at apple.com>
  Date:   2014-09-24 (Wed, 24 Sep 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/multicol/multicol-selection-expected.txt
    A LayoutTests/fast/multicol/multicol-selection.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp

  Log Message:
  -----------
  Merge r173843 - ASSERT in RenderMultiColumnSet::requiresBalancing.
https://bugs.webkit.org/show_bug.cgi?id=136376.

Reviewed by David Kilzer.

Source/WebCore:

Added fast/multicol/multicol-selection.html.

* rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::isValidColumnSpanner):
Don't allow an object to become a spanner if it does not have the flow
thread as its containing block. Otherwise the flow thread won't get notified
of spanner placeholder insertions, and so the spanner ends up orphaned.

LayoutTests:

* fast/multicol/multicol-selection-expected.txt: Added.
* fast/multicol/multicol-selection.html: Added.

Canonical link: https://commits.webkit.org/154760.21@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173915 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 0639290d4ff5541d9d22985e2d9cfa5fcecc3c5a
      https://github.com/WebKit/WebKit/commit/0639290d4ff5541d9d22985e2d9cfa5fcecc3c5a
  Author: David Hyatt <hyatt at apple.com>
  Date:   2014-09-24 (Wed, 24 Sep 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/multicol/multicol-crazy-nesting-expected.txt
    A LayoutTests/fast/multicol/multicol-crazy-nesting.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp

  Log Message:
  -----------
  Merge r173845 - Bad cast in isValidColumnSpanner.
https://bugs.webkit.org/show_bug.cgi?id=133380.

Reviewed by Simon Fraser.

Source/WebCore:

Added fast/multicol/multicol-crazy-nesting.html

* rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::isValidColumnSpanner):
The crawl up the chain looking for unsplittable objects should use containing blocks
and not be casting to parent boxes. You can have an inline in the parent chain, so
this was not the right way to walk up the tree.

LayoutTests:

* fast/multicol/multicol-crazy-nesting-expected.txt: Added.
* fast/multicol/multicol-crazy-nesting.html: Added.

Canonical link: https://commits.webkit.org/154760.22@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173916 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: ab57f23858f880c88e519621a989925b0a96d7ee
      https://github.com/WebKit/WebKit/commit/ab57f23858f880c88e519621a989925b0a96d7ee
  Author: Alexey Proskuryakov <ap at apple.com>
  Date:   2014-09-24 (Wed, 24 Sep 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/websockets/WebSocketChannel.cpp

  Log Message:
  -----------
  Merge r173848 - WebSocket crash when a connection is closed from server side
https://bugs.webkit.org/show_bug.cgi?id=137009
rdar://problem/18333977
rdar://problem/12708225

Reviewed by Brady Eidson.

I don't think that this can be tested with our test server.

* Modules/websockets/WebSocketChannel.cpp:
(WebCore::WebSocketChannel::WebSocketChannel): Added logging.
(WebCore::WebSocketChannel::~WebSocketChannel): Ditto.
(WebCore::WebSocketChannel::close): Protect self, because startClosingHandshake
can release the last reference.
(WebCore::WebSocketChannel::fail): Added an assertion that the channel is always
closed after this function.
(WebCore::WebSocketChannel::startClosingHandshake): Protect self, and don't change
the stack from closed back to closing if after failing to send closing handshake.
(WebCore::WebSocketChannel::processOutgoingFrameQueue): Protect self.

Canonical link: https://commits.webkit.org/154760.23@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173917 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: ec3c53cab467f6fd8752e2963316440dc65c7351
      https://github.com/WebKit/WebKit/commit/ec3c53cab467f6fd8752e2963316440dc65c7351
  Author: Tomáš Popela <tpopela at redhat.com>
  Date:   2014-09-24 (Wed, 24 Sep 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/llint/LowLevelInterpreter.asm
    M Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

  Log Message:
  -----------
  Merge r173886 - [CLoop] - Fix CLoop on the 32-bit Big-Endians
https://bugs.webkit.org/show_bug.cgi?id=137020

Patch by Tomas Popela <tpopela at redhat.com> on 2014-09-23
Reviewed by Mark Lam.

* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:

Canonical link: https://commits.webkit.org/154760.24@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173918 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: a83d616594f758c4658d3977ff14c90a7ad8084f
      https://github.com/WebKit/WebKit/commit/a83d616594f758c4658d3977ff14c90a7ad8084f
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2014-09-24 (Wed, 24 Sep 2014)

  Changed paths:
    M ChangeLog
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.6.0 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit2:

* gtk/NEWS: Add release notes for 2.6.0.

Canonical link: https://commits.webkit.org/154760.25@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173919 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 26515d7a8b200ef42f121468b2d782d938f74f44
      https://github.com/WebKit/WebKit/commit/26515d7a8b200ef42f121468b2d782d938f74f44
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-01 (Wed, 01 Oct 2014)

  Changed paths:
    M ChangeLog
    M Source/cmake/OptionsGTK.cmake
    M Tools/ChangeLog
    M Tools/Scripts/webkitdirs.pm

  Log Message:
  -----------
  Merge r173964 - [Gtk] build.sh needs a -- before make options when the build command is cmake --build
https://bugs.webkit.org/show_bug.cgi?id=136377

Patch by Carlos Garcia Campos <cgarcia at igalia.com> on 2014-09-25
Reviewed by Philippe Normand.

.:

* Source/cmake/OptionsGTK.cmake: Only create the build.sh script
for CMake versions less than 3.

Tools:

* Scripts/webkitdirs.pm:
(buildCMakeGeneratedProject): Only use the build.sh script if it exists.

Canonical link: https://commits.webkit.org/154760.26@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174159 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: ae8ea5287913eb45ce1a946f0dd82ceb9a4db031
      https://github.com/WebKit/WebKit/commit/ae8ea5287913eb45ce1a946f0dd82ceb9a4db031
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-02 (Thu, 02 Oct 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/InspectorServer/gtk/WebInspectorServerGtk.cpp

  Log Message:
  -----------
  Merge r174104 - [GTK] The remote web inspector shows the HTML content as plain text
https://bugs.webkit.org/show_bug.cgi?id=137250

Reviewed by Gustavo Noronha Silva.

Use GResource API directly to get the resource data, instead of
using the GFile API, and use g_content_type_guess() to get the
MIME Type.

* UIProcess/InspectorServer/gtk/WebInspectorServerGtk.cpp:
(WebKit::WebInspectorServer::platformResourceForPath):

Canonical link: https://commits.webkit.org/154760.27@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174210 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: c518b47e1c0d1c06b975c85745d59f3530128341
      https://github.com/WebKit/WebKit/commit/c518b47e1c0d1c06b975c85745d59f3530128341
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2014-10-02 (Thu, 02 Oct 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/API/gtk/WebKitEnumTypes.h.template

  Log Message:
  -----------
  Merge r174008 - [GTK] Don't include full path names in WebKitEnumTypes.h
https://bugs.webkit.org/show_bug.cgi?id=137148

Reviewed by Carlos Garcia Campos.

Replace @filename@ with @basename@ in the template, since we don't
want to include the full path name in the generated header.

* UIProcess/API/gtk/WebKitEnumTypes.h.template:

Canonical link: https://commits.webkit.org/154760.28@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174211 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 589b76ca25e71edb74a6dfefb44f6a69a5803b15
      https://github.com/WebKit/WebKit/commit/589b76ca25e71edb74a6dfefb44f6a69a5803b15
  Author: Krishnababu Krothapalli <kkrothap at redhat.com>
  Date:   2014-10-02 (Thu, 02 Oct 2014)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/te.po

  Log Message:
  -----------
  Merge r174099 - Updated Telugu Translation for WebKitGTK+
https://bugs.webkit.org/show_bug.cgi?id=137027

Patch by Krishnababu Krothapalli <kkrothap at redhat.com> on 2014-09-30
Reviewed by Philippe Normand.

* te.po:

Canonical link: https://commits.webkit.org/154760.29@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174212 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: fcca9e85b1337405dba66ff89a9cbb73a3a08543
      https://github.com/WebKit/WebKit/commit/fcca9e85b1337405dba66ff89a9cbb73a3a08543
  Author: Rajesh Ranjan <rajeshkajha at yahoo.com>
  Date:   2014-10-02 (Thu, 02 Oct 2014)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/hi.po

  Log Message:
  -----------
  Merge r174100 - Hindi translation updated
https://bugs.webkit.org/show_bug.cgi?id=137021

Patch by Rajesh Ranjan <rajeshkajha at yahoo.com> on 2014-09-30
Reviewed by Philippe Normand.

* hi.po:

Canonical link: https://commits.webkit.org/154760.30@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174213 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: bbe2b1a5b240197871b08d3703cb90324acab7cf
      https://github.com/WebKit/WebKit/commit/bbe2b1a5b240197871b08d3703cb90324acab7cf
  Author: Andres Gomez <agomez at igalia.com>
  Date:   2014-10-02 (Thu, 02 Oct 2014)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Images/gtk/AUTHORS
    A Source/WebInspectorUI/UserInterface/Images/gtk/ApplicationCacheManifest.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/ApplicationCacheManifest at 2x.png
    M Source/WebInspectorUI/UserInterface/Images/gtk/COPYING
    A Source/WebInspectorUI/UserInterface/Images/gtk/COPYING_LGPL2
    A Source/WebInspectorUI/UserInterface/Images/gtk/Cookie.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Cookie at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/HoverMenuButton.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/HoverMenuButton at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/InstructionPointer.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/InstructionPointer at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Log.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Log at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Profile.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Profile at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Recording.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Recording at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/RecordingHovered.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/RecordingHovered at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/RecordingStopped.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/RecordingStopped at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Script.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Script at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/ScriptLarge.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/ScriptLarge at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/SliderThumb.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/SliderThumb at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/SliderThumbPressed.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/SliderThumbPressed at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Stopwatch.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/Stopwatch at 2x.png

  Log Message:
  -----------
  Merge r173952 - Unreviewed. Add more free icons for the Web Inspector in GTK+.

Patch by Andres Gomez <agomez at igalia.com> on 2014-09-25

* UserInterface/Images/gtk/AUTHORS:
* UserInterface/Images/gtk/ApplicationCacheManifest.png: Added.
* UserInterface/Images/gtk/ApplicationCacheManifest at 2x.png: Added.
* UserInterface/Images/gtk/COPYING:
* UserInterface/Images/gtk/COPYING_LGPL2: Added.
* UserInterface/Images/gtk/Cookie.png: Added.
* UserInterface/Images/gtk/Cookie at 2x.png: Added.
* UserInterface/Images/gtk/HoverMenuButton.png: Added.
* UserInterface/Images/gtk/HoverMenuButton at 2x.png: Added.
* UserInterface/Images/gtk/InstructionPointer.png: Added.
* UserInterface/Images/gtk/InstructionPointer at 2x.png: Added.
* UserInterface/Images/gtk/Log.png: Added.
* UserInterface/Images/gtk/Log at 2x.png: Added.
* UserInterface/Images/gtk/Profile.png: Added.
* UserInterface/Images/gtk/Profile at 2x.png: Added.
* UserInterface/Images/gtk/Recording.png: Added.
* UserInterface/Images/gtk/Recording at 2x.png: Added.
* UserInterface/Images/gtk/RecordingHovered.png: Added.
* UserInterface/Images/gtk/RecordingHovered at 2x.png: Added.
* UserInterface/Images/gtk/RecordingStopped.png: Added.
* UserInterface/Images/gtk/RecordingStopped at 2x.png: Added.
* UserInterface/Images/gtk/Script.png: Added.
* UserInterface/Images/gtk/Script at 2x.png: Added.
* UserInterface/Images/gtk/ScriptLarge.png: Added.
* UserInterface/Images/gtk/ScriptLarge at 2x.png: Added.
* UserInterface/Images/gtk/SliderThumb.png: Added.
* UserInterface/Images/gtk/SliderThumb at 2x.png: Added.
* UserInterface/Images/gtk/SliderThumbPressed.png: Added.
* UserInterface/Images/gtk/SliderThumbPressed at 2x.png: Added.
* UserInterface/Images/gtk/Stopwatch.png: Added.
* UserInterface/Images/gtk/Stopwatch at 2x.png: Added.

Canonical link: https://commits.webkit.org/154760.31@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174214 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 7e371c1848b0cfcff29d5c91b72c9d05ce9020ef
      https://github.com/WebKit/WebKit/commit/7e371c1848b0cfcff29d5c91b72c9d05ce9020ef
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-02 (Thu, 02 Oct 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp
    M Source/WebKit2/UIProcess/Plugins/unix/PluginProcessProxyUnix.cpp

  Log Message:
  -----------
  Merge r174054 - REGRESSION(r172919): WebKitPluginProcess fails to scan GTK+2 plugins after r172919.
https://bugs.webkit.org/show_bug.cgi?id=137191

Reviewed by Philippe Normand.

In r172919 I moved the GTK+ symbols mix check earlier, before the
plugin is loaded and initialized. That made impossible to use the
GTK3 plugin process to scan gtk2 plugins, because we need to load
the plugin to get its metadata. But we don't need to initialize
the plugin to check if it requires GTK2, so we can do that check
in the UI process to decide which plugin process to use.

* Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp:
(WebKit::NetscapePluginModule::getPluginInfoForLoadedPlugin):
Remove the requires GTK2 check.
(WebKit::NetscapePluginModule::scanPlugin): Don't write
requires-gtk2 to stdout.
* UIProcess/Plugins/unix/PluginProcessProxyUnix.cpp:
(WebKit::pluginRequiresGtk2): Helper function to check if the
given plugin path requires GTK2.
(WebKit::PluginProcessProxy::scanPlugin): Check if the plugin path
requires GTK2 and use WebKitPluginProcess2 in such case, or return
early if GTK2 plugins are not enabled. Log error messages when
something fails scanning the plugin to make it easiert to debug
problems in the future.

Canonical link: https://commits.webkit.org/154760.32@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174215 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 4490ed476be44a9a28ac16d6431b50a5862e9710
      https://github.com/WebKit/WebKit/commit/4490ed476be44a9a28ac16d6431b50a5862e9710
  Author: Andres Gomez <agomez at igalia.com>
  Date:   2014-10-07 (Tue, 07 Oct 2014)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Images/gtk/AUTHORS
    M Source/WebInspectorUI/UserInterface/Images/gtk/COPYING
    A Source/WebInspectorUI/UserInterface/Images/gtk/Checkers.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Circle.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/CloseLarge.svg
    R Source/WebInspectorUI/UserInterface/Images/gtk/CloseTimeline.png
    R Source/WebInspectorUI/UserInterface/Images/gtk/CloseTimeline at 2x.png
    M Source/WebInspectorUI/UserInterface/Images/gtk/Crosshair.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/DOMCharacterData.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/DOMComment.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/DOMDocument.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/DOMDocumentType.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/DOMElement.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/DOMNode.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/DOMTextNode.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/DOMTree.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/EventListener.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/Exception.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/Function.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/GradientStop.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/GradientStop at 2x.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/GradientStopSelected.png
    A Source/WebInspectorUI/UserInterface/Images/gtk/GradientStopSelected at 2x.png
    M Source/WebInspectorUI/UserInterface/Images/gtk/Issues.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/IssuesEnabled.svg
    R Source/WebInspectorUI/UserInterface/Images/gtk/LessColumns.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/Logs.svg
    R Source/WebInspectorUI/UserInterface/Images/gtk/Memory.svg
    R Source/WebInspectorUI/UserInterface/Images/gtk/MoreColumns.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/Native.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemAngleBrackets.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemBrushAndRuler.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemBug.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemFile.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemLayers.svg
    R Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemMagnifyingGlass.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemStopwatch.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemTypes.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/PaintFlashing.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/PseudoElement.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Record.svg
    R Source/WebInspectorUI/UserInterface/Images/gtk/Recording.png
    R Source/WebInspectorUI/UserInterface/Images/gtk/Recording at 2x.png
    R Source/WebInspectorUI/UserInterface/Images/gtk/RecordingHovered.png
    R Source/WebInspectorUI/UserInterface/Images/gtk/RecordingHovered at 2x.png
    R Source/WebInspectorUI/UserInterface/Images/gtk/RecordingStopped.png
    R Source/WebInspectorUI/UserInterface/Images/gtk/RecordingStopped at 2x.png
    M Source/WebInspectorUI/UserInterface/Images/gtk/Reflection.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/ReplayPauseButton.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/ReplayPlayButton.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/ReplayRecordingButton.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/Request.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/Resources.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/Response.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/ResultLine.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/SourceCode.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/Stop.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/StyleRuleAuthor.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/StyleRuleInherited.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/StyleRuleInheritedElement.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/StyleRuleInspector.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/StyleRuleUser.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/StyleRuleUserAgent.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/Time.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/TimelineRecordAnimation.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/TimelineRecordConsoleProfile.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/TimelineRecordEvent.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/TimelineRecordLayout.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/TimelineRecordPaint.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/TimelineRecordProbeSampled.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/TimelineRecordScriptEvaluated.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/TimelineRecordStyle.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/TimelineRecordTimer.svg
    M Source/WebInspectorUI/UserInterface/Images/gtk/Weight.svg

  Log Message:
  -----------
  Merge r174207 - Web Inspector: [GTK] Missing icons and enhancing the proportion and visibility of some icons
https://bugs.webkit.org/show_bug.cgi?id=137248

Reviewed by Carlos Garcia Campos.

Add more free icons and removed some unused ones for the Web
Inspector in GTK+.
Also, enhanced the visibility and/or proportion of several of the
icons.

* UserInterface/Images/gtk/AUTHORS:
* UserInterface/Images/gtk/COPYING:
* UserInterface/Images/gtk/Checkers.svg: Added.
* UserInterface/Images/gtk/Circle.svg: Added.
* UserInterface/Images/gtk/CloseLarge.svg: Added.
* UserInterface/Images/gtk/CloseTimeline.png: Removed.
* UserInterface/Images/gtk/CloseTimeline at 2x.png: Removed.
* UserInterface/Images/gtk/Crosshair.svg:
* UserInterface/Images/gtk/DOMCharacterData.svg:
* UserInterface/Images/gtk/DOMComment.svg:
* UserInterface/Images/gtk/DOMDocument.svg:
* UserInterface/Images/gtk/DOMDocumentType.svg:
* UserInterface/Images/gtk/DOMElement.svg:
* UserInterface/Images/gtk/DOMNode.svg:
* UserInterface/Images/gtk/DOMTextNode.svg:
* UserInterface/Images/gtk/DOMTree.svg:
* UserInterface/Images/gtk/EventListener.svg:
* UserInterface/Images/gtk/Exception.svg:
* UserInterface/Images/gtk/Function.svg:
* UserInterface/Images/gtk/GradientStop.png: Added.
* UserInterface/Images/gtk/GradientStop at 2x.png: Added.
* UserInterface/Images/gtk/GradientStopSelected.png: Added.
* UserInterface/Images/gtk/GradientStopSelected at 2x.png: Added.
* UserInterface/Images/gtk/Issues.svg:
* UserInterface/Images/gtk/IssuesEnabled.svg:
* UserInterface/Images/gtk/LessColumns.svg: Removed.
* UserInterface/Images/gtk/Logs.svg:
* UserInterface/Images/gtk/Memory.svg: Removed.
* UserInterface/Images/gtk/MoreColumns.svg: Removed.
* UserInterface/Images/gtk/Native.svg:
* UserInterface/Images/gtk/NavigationItemAngleBrackets.svg:
* UserInterface/Images/gtk/NavigationItemBrushAndRuler.svg:
* UserInterface/Images/gtk/NavigationItemBug.svg:
* UserInterface/Images/gtk/NavigationItemFile.svg:
* UserInterface/Images/gtk/NavigationItemLayers.svg:
* UserInterface/Images/gtk/NavigationItemMagnifyingGlass.svg: Removed.
* UserInterface/Images/gtk/NavigationItemProbes.pdf: Added.
* UserInterface/Images/gtk/NavigationItemStopwatch.svg:
* UserInterface/Images/gtk/NavigationItemTypes.svg: Added.
* UserInterface/Images/gtk/PaintFlashing.svg: Added.
* UserInterface/Images/gtk/PseudoElement.svg:
* UserInterface/Images/gtk/Record.svg: Added.
* UserInterface/Images/gtk/Recording.png: Removed.
* UserInterface/Images/gtk/Recording at 2x.png: Removed.
* UserInterface/Images/gtk/RecordingHovered.png: Removed.
* UserInterface/Images/gtk/RecordingHovered at 2x.png: Removed.
* UserInterface/Images/gtk/RecordingStopped.png: Removed.
* UserInterface/Images/gtk/RecordingStopped at 2x.png: Removed.
* UserInterface/Images/gtk/Reflection.svg:
* UserInterface/Images/gtk/ReplayPauseButton.svg: Added.
* UserInterface/Images/gtk/ReplayPlayButton.svg: Added.
* UserInterface/Images/gtk/ReplayRecordingButton.svg: Added.
* UserInterface/Images/gtk/Request.svg:
* UserInterface/Images/gtk/Resources.svg:
* UserInterface/Images/gtk/Response.svg:
* UserInterface/Images/gtk/ResultLine.svg:
* UserInterface/Images/gtk/SourceCode.svg:
* UserInterface/Images/gtk/Stop.svg: Added.
* UserInterface/Images/gtk/StyleRuleAuthor.svg:
* UserInterface/Images/gtk/StyleRuleInherited.svg:
* UserInterface/Images/gtk/StyleRuleInheritedElement.svg:
* UserInterface/Images/gtk/StyleRuleInspector.svg:
* UserInterface/Images/gtk/StyleRuleUser.svg:
* UserInterface/Images/gtk/StyleRuleUserAgent.svg:
* UserInterface/Images/gtk/Time.svg:
* UserInterface/Images/gtk/TimelineRecordAnimation.svg:
* UserInterface/Images/gtk/TimelineRecordConsoleProfile.svg: Added.
* UserInterface/Images/gtk/TimelineRecordEvent.svg:
* UserInterface/Images/gtk/TimelineRecordLayout.svg:
* UserInterface/Images/gtk/TimelineRecordPaint.svg:
* UserInterface/Images/gtk/TimelineRecordProbeSampled.svg: Added.
* UserInterface/Images/gtk/TimelineRecordScriptEvaluated.svg:
* UserInterface/Images/gtk/TimelineRecordStyle.svg:
* UserInterface/Images/gtk/TimelineRecordTimer.svg:
* UserInterface/Images/gtk/Weight.svg:

Canonical link: https://commits.webkit.org/154760.33@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174390 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: a7378022bc8d30bfadec4173066ba5384c6dea6e
      https://github.com/WebKit/WebKit/commit/a7378022bc8d30bfadec4173066ba5384c6dea6e
  Author: Lorenzo Tilve <ltilve at igalia.com>
  Date:   2014-10-07 (Tue, 07 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/platform/gtk/fast/css-generated-content/initial-letter-basic-expected.txt
    A LayoutTests/platform/gtk/fast/css-generated-content/initial-letter-border-padding-expected.txt
    A LayoutTests/platform/gtk/fast/css-generated-content/initial-letter-clearance-expected.txt
    A LayoutTests/platform/gtk/fast/css-generated-content/initial-letter-descender-expected.txt
    A LayoutTests/platform/gtk/fast/css-generated-content/initial-letter-raised-expected.txt
    A LayoutTests/platform/gtk/fast/css-generated-content/initial-letter-sunken-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/freetype/SimpleFontDataFreeType.cpp

  Log Message:
  -----------
  Merge r174002 - [GTK] Fix support for the initial-letter CSS property to first-letter
https://bugs.webkit.org/show_bug.cgi?id=137108

Patch by Lorenzo Tilve <ltilve at igalia.com> on 2014-09-26
Reviewed by Alejandro G. Castro.

Source/WebCore:

Add support for cap-height to the font system.

* platform/graphics/freetype/SimpleFontDataFreeType.cpp:
(WebCore::SimpleFontData::platformInit):

LayoutTests:

Add missing GTK test expectation files after http://webkit.org/b/136484

* platform/gtk/fast/css-generated-content/initial-letter-basic-expected.txt: Added.
* platform/gtk/fast/css-generated-content/initial-letter-border-padding-expected.txt: Added.
* platform/gtk/fast/css-generated-content/initial-letter-clearance-expected.txt: Added.
* platform/gtk/fast/css-generated-content/initial-letter-descender-expected.txt: Added.
* platform/gtk/fast/css-generated-content/initial-letter-raised-expected.txt: Added.
* platform/gtk/fast/css-generated-content/initial-letter-sunken-expected.txt: Added.

Canonical link: https://commits.webkit.org/154760.34@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174391 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: a8f6d9e3ebbfcdffac050fa52e068001e2317377
      https://github.com/WebKit/WebKit/commit/a8f6d9e3ebbfcdffac050fa52e068001e2317377
  Author: Dean Jackson <dino at apple.com>
  Date:   2014-10-07 (Tue, 07 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/canvas/WebGLRenderingContext.cpp
    M Source/WebCore/page/Settings.in
    M Source/WebCore/platform/graphics/GraphicsContext3D.h
    M Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
    M Source/WebKit/mac/ChangeLog
    M Source/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
    M Source/WebKit/mac/WebView/WebPreferences.mm
    M Source/WebKit/mac/WebView/WebPreferencesPrivate.h
    M Source/WebKit/mac/WebView/WebView.mm
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/Shared/WebPreferencesDefinitions.h
    M Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
    M Source/WebKit2/UIProcess/API/C/WKPreferencesRefPrivate.h
    M Source/WebKit2/WebProcess/WebPage/WebPage.cpp

  Log Message:
  -----------
  Merge r173776 - Multithreaded WebGL is a bad idea - remove it
https://bugs.webkit.org/show_bug.cgi?id=136964
<rdar://problem/18399858>

Reviewed by Brent Fulgham.

Source/WebCore:

We should not allow multithreaded GL access. Remove the
feature.

* html/canvas/WebGLRenderingContext.cpp:
(WebCore::WebGLRenderingContext::create):
* page/Settings.in:
* platform/graphics/GraphicsContext3D.h:
(WebCore::GraphicsContext3D::Attributes::Attributes):
* platform/graphics/mac/GraphicsContext3DMac.mm:
(WebCore::GraphicsContext3D::GraphicsContext3D):

Source/WebKit/mac:

Remove the setting to allow multithreaded WebGL.

* WebView/WebPreferenceKeysPrivate.h:
* WebView/WebPreferences.mm:
(+[WebPreferences initialize]):
(-[WebPreferences multithreadedWebGLEnabled]): Deleted.
(-[WebPreferences setMultithreadedWebGLEnabled:]): Deleted.
* WebView/WebPreferencesPrivate.h:
* WebView/WebView.mm:
(-[WebView _preferencesChanged:]):

Source/WebKit2:

Remove the setting to allow multithreaded WebGL.

* Shared/WebPreferencesDefinitions.h:
* UIProcess/API/C/WKPreferences.cpp:
(WKPreferencesSetMultithreadedWebGLEnabled): Deleted.
(WKPreferencesGetMultithreadedWebGLEnabled): Deleted.
* UIProcess/API/C/WKPreferencesRefPrivate.h:
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::updatePreferences):

Canonical link: https://commits.webkit.org/154760.35@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174392 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 56109fda2c630651f1bb66f8f36c3e98611bfbbd
      https://github.com/WebKit/WebKit/commit/56109fda2c630651f1bb66f8f36c3e98611bfbbd
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestSSL.cpp

  Log Message:
  -----------
  Merge r174394 - [SOUP] TLS errors should take precedence over HTTP authentication
https://bugs.webkit.org/show_bug.cgi?id=137300

Reviewed by Sergio Villar Senin.

Source/WebCore:

Handle TLS errors in got-headers callback to make sure it happens
before starting the authentication process.

* platform/network/soup/ResourceHandleSoup.cpp:
(WebCore::handleUnignoredTLSErrors): Refactored to receive the
soup message.
(WebCore::gotHeadersCallback): Return early and cancel the request in case of TLS errors.
(WebCore::sendRequestCallback): Do not handle TLS errors here, the request should have already been
cancelled at this point in case of TLS errors.

Tools:

Add a test case to check that authenticate signal is not emitted
in case of TLS errors, and the load fails instead.

* TestWebKitAPI/Tests/WebKit2Gtk/TestSSL.cpp:
(webViewAuthenticationCallback):
(testTLSErrorsHTTPAuth):
(httpsServerCallback):
(beforeAll):

Canonical link: https://commits.webkit.org/154760.36@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174420 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 3e83e58489be22a4aa8191ef7f264927c1049f03
      https://github.com/WebKit/WebKit/commit/3e83e58489be22a4aa8191ef7f264927c1049f03
  Author: Carlos Alberto Lopez Perez <clopez at igalia.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Tools/ChangeLog
    M Tools/DumpRenderTree/TestNetscapePlugIn/CMakeLists.txt
    M Tools/Scripts/webkitpy/port/efl.py
    M Tools/Scripts/webkitpy/port/gtk.py
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/CMakeLists.txt

  Log Message:
  -----------
  Merge r174093 - [GTK] [EFL] Install TestNetscapePlugin apart from the other libs.
https://bugs.webkit.org/show_bug.cgi?id=137212

This moves TestNetscapePlugin to a new folder (lib/plugins).
We should not use the same directory for TestNetscapePlugin and
the other libraries, because we end up scanning all the .so in the
lib dir for every test.

Reviewed by Carlos Garcia Campos.

* DumpRenderTree/TestNetscapePlugIn/CMakeLists.txt: Set LIBRARY_OUTPUT_DIRECTORY to lib/plugins.
* Scripts/webkitpy/port/efl.py:
(EflPort.setup_environ_for_server): Update plugin path.
* Scripts/webkitpy/port/gtk.py:
(GtkPort.setup_environ_for_server): Update plugin path.
* TestWebKitAPI/Tests/WebKit2Gtk/CMakeLists.txt: Update plugin path.

Canonical link: https://commits.webkit.org/154760.37@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174421 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 76b7a9c59ce05e4c38972e58dcdc21583a484ab2
      https://github.com/WebKit/WebKit/commit/76b7a9c59ce05e4c38972e58dcdc21583a484ab2
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/PlatformGTK.cmake

  Log Message:
  -----------
  Merge r174316 - Unreviewed. Add missing inspector files to compilation.

* PlatformGTK.cmake: Add javascript sources in
WebInspectorUI/UserInterface/External/Esprima to the list of
inspector files.

Canonical link: https://commits.webkit.org/154760.38@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174424 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 29ee73e5dff2cbf24b605bc21158e62508a4b7fb
      https://github.com/WebKit/WebKit/commit/29ee73e5dff2cbf24b605bc21158e62508a4b7fb
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/WebInspectorProxy.cpp
    M Source/WebKit2/UIProcess/WebInspectorProxy.h
    M Source/WebKit2/UIProcess/gtk/WebInspectorProxyGtk.cpp

  Log Message:
  -----------
  Merge r174327 - [GTK] The new web inspector can't be docked again once undocked
https://bugs.webkit.org/show_bug.cgi?id=121544

Reviewed by Martin Robinson.

Use a GtkHeaderBar for the inspector window to add dock buttons
when building with GTK+ >= 3.10.

* UIProcess/WebInspectorProxy.cpp:
(WebKit::WebInspectorProxy::WebInspectorProxy):
* UIProcess/WebInspectorProxy.h:
* UIProcess/gtk/WebInspectorProxyGtk.cpp:
(WebKit::WebInspectorProxy::dockButtonClicked):
(WebKit::WebInspectorProxy::createInspectorWindow):
(WebKit::WebInspectorProxy::updateInspectorWindowTitle):
(WebKit::WebInspectorProxy::platformInspectedURLChanged):
(WebKit::WebInspectorProxy::platformAttachAvailabilityChanged):

Canonical link: https://commits.webkit.org/154760.39@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174425 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f414c50f2753ce1cb2c1e5fde0fbda63b2c3896b
      https://github.com/WebKit/WebKit/commit/f414c50f2753ce1cb2c1e5fde0fbda63b2c3896b
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Tools/ChangeLog
    M Tools/gtk/gtkdoc.py

  Log Message:
  -----------
  Merge r174309 - [GTK] generate-gtkdoc crashes when generating HTML due to encoding issues
https://bugs.webkit.org/show_bug.cgi?id=135502

Reviewed by Martin Robinson.

When writing to stdout/stderr fails due to a UnicodeDecodeError
exception, try again without encoding the output.

* gtk/gtkdoc.py:
(GTKDoc._run_command):

Canonical link: https://commits.webkit.org/154760.40@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174426 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: c94a83efd37d59bfaa65cee973332cd923c9b36a
      https://github.com/WebKit/WebKit/commit/c94a83efd37d59bfaa65cee973332cd923c9b36a
  Author: Benjamin Poulain <bpoulain at apple.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSSelector.cpp
    M Source/WebCore/css/CSSSelector.h

  Log Message:
  -----------
  Merge r173769 - Add a size check for CSSSelector
https://bugs.webkit.org/show_bug.cgi?id=136882

Patch by Benjamin Poulain <bpoulain at apple.com> on 2014-09-19
Reviewed by Christophe Dumez.

* css/CSSSelector.cpp:

Canonical link: https://commits.webkit.org/154760.41@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174427 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: ff80fcf6a486de28174a002edb7f0da6f1bc839b
      https://github.com/WebKit/WebKit/commit/ff80fcf6a486de28174a002edb7f0da6f1bc839b
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/editing/MarkupAccumulator.cpp
    M Source/WebCore/editing/MarkupAccumulator.h
    M Source/WebCore/page/PageSerializer.cpp

  Log Message:
  -----------
  Merge r173783 - Minimize virtual function calls in MarkupAccumulator
https://bugs.webkit.org/show_bug.cgi?id=136957

Reviewed by Benjamin Poulain.

This patch minimizes the number of virtual function calls in
MarkupAccumulator by:
- De-virtualizing MarkupAccumulator::appendString(), which is never
  overridden
- Having MarkupAccumulator::appendEndTag() virtual function take an
  Element in argument instead of a Node, as it only applies to Element.
  Also add a non-virtual overload that takes a Node in argument and
  that does the isElementNode() check so that we don't need to explicitly
  do the check at each call site.

No new tests, no behavior change.

* editing/MarkupAccumulator.cpp:
(WebCore::MarkupAccumulator::appendEndTag):
(WebCore::MarkupAccumulator::shouldSelfClose):
(WebCore::MarkupAccumulator::appendEndMarkup):
* editing/MarkupAccumulator.h:
(WebCore::MarkupAccumulator::appendEndTag):
* page/PageSerializer.cpp:
(WebCore::SerializerMarkupAccumulator::appendEndTag):

Canonical link: https://commits.webkit.org/154760.42@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174428 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 473e1ed0edefe368463cb7da13d6298adf2152ab
      https://github.com/WebKit/WebKit/commit/473e1ed0edefe368463cb7da13d6298adf2152ab
  Author: Simon Fraser <simon.fraser at apple.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/TreeScope.cpp
    M Source/WebCore/editing/FrameSelection.cpp
    M Source/WebCore/page/DragController.cpp
    M Source/WebCore/page/EventHandler.cpp
    M Source/WebCore/rendering/HitTestRequest.h
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/WebProcess/WebPage/ViewGestureGeometryCollector.cpp
    M Source/WebKit2/WebProcess/WebPage/ios/WebPageIOS.mm

  Log Message:
  -----------
  Merge r173766 - Provide a default argument for the most commonly used HitTestRequest variant
https://bugs.webkit.org/show_bug.cgi?id=136653

Reviewed by Darin Adler.

Make the default HitTestRequest flags be ReadOnly | Active | DisallowShadowContent
and change call sites using the default flags to use a HitTestRequest temporary.

Source/WebCore:

* dom/TreeScope.cpp:
(WebCore::nodeFromPoint):
* editing/FrameSelection.cpp:
(WebCore::FrameSelection::contains):
* page/DragController.cpp:
(WebCore::elementUnderMouse):
* page/EventHandler.cpp:
(WebCore::EventHandler::handleMouseDraggedEvent):
(WebCore::EventHandler::handleMousePressEvent):
* rendering/HitTestRequest.h:
(WebCore::HitTestRequest::HitTestRequest):

Source/WebKit2:

* WebProcess/WebPage/ViewGestureGeometryCollector.cpp:
(WebKit::ViewGestureGeometryCollector::collectGeometryForSmartMagnificationGesture):
* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::dynamicViewportSizeUpdate):

Canonical link: https://commits.webkit.org/154760.43@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174429 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e427ed1a83b68cad59532880e7ab6fae8d1e752f
      https://github.com/WebKit/WebKit/commit/e427ed1a83b68cad59532880e7ab6fae8d1e752f
  Author: Brent Fulgham <bfulgham at apple.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/platform/mac/fast/scrolling/scroll-iframe-webkit1-latching-bug-expected.txt
    A LayoutTests/platform/mac/fast/scrolling/scroll-iframe-webkit1-latching-bug.html
    M Source/WebCore/CMakeLists.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/WebCore.vcxproj/WebCore.vcxproj
    M Source/WebCore/WebCore.vcxproj/WebCore.vcxproj.filters
    M Source/WebCore/WebCore.xcodeproj/project.pbxproj
    M Source/WebCore/page/EventHandler.cpp
    M Source/WebCore/page/EventHandler.h
    M Source/WebCore/page/MainFrame.cpp
    M Source/WebCore/page/MainFrame.h
    M Source/WebCore/page/mac/EventHandlerMac.mm
    A Source/WebCore/page/scrolling/ScrollLatchingState.cpp
    A Source/WebCore/page/scrolling/ScrollLatchingState.h

  Log Message:
  -----------
  Merge r173784 - Latching in iframes is not working as expected
https://bugs.webkit.org/show_bug.cgi?id=136729
<rdar://problem/18370549>

Reviewed by Simon Fraser.

Source/WebCore:

Test: platform/mac/fast/scrolling/scrolling-iframe-100pct.html

Correct latching behavior by moving the concept of latching from the event handler to the main frame.
The event handlers are per-document, and can improperly latch to the iframe element (rather than the
scrollable content of the iframe) resulting in incorrect behavior.

Also move the wheel event delta tracking to the main frame, as this is similarly "top-level" in nature.

* WebCore.vcxproj/WebCore.vcxproj: Add new LatchedState class.
* WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
* WebCore.xcodeproj/project.pbxproj: Ditto.
* page/EventHandler.cpp:
(WebCore::EventHandler::EventHandler): Update constructor after moving some members to the new
LatchedState object.
(WebCore::EventHandler::clear): Call 'clear' on the LatchedState class.
(WebCore::EventHandler::platformRecordWheelEvent):  Update for new LatchedState class.
(WebCore::EventHandler::handleWheelEvent): Ditto.
(WebCore::EventHandler::clearLatchedState): Ditto.
(WebCore::EventHandler::defaultWheelEventHandler): Ditto.
* page/EventHandler.h:
* page/LatchedState.cpp: Added.
(WebCore::LatchedState::LatchedState):
(WebCore::LatchedState::~LatchedState):
(WebCore::LatchedState::clear):
(WebCore::LatchedState::setWheelEventElement):
(WebCore::LatchedState::setWidgetIsLatched):
(WebCore::LatchedState::setPreviousWheelScrolledElement):
(WebCore::LatchedState::setScrollableContainer):
* page/LatchedState.h: Added.
(WebCore::LatchedState::wheelEventElement):
(WebCore::LatchedState::frame):
(WebCore::LatchedState::setFrame):
(WebCore::LatchedState::widgetIsLatched):
(WebCore::LatchedState::previousWheelScrolledElement):
(WebCore::LatchedState::scrollableContainer):
(WebCore::LatchedState::startedGestureAtScrollLimit):
(WebCore::LatchedState::setStartedGestureAtScrollLimit):
* page/MainFrame.cpp:
(WebCore::MainFrame::MainFrame): Update for new members (LatchedState and WheelEventDeltaTracker)
* page/MainFrame.h:
* page/mac/EventHandlerMac.mm:
(WebCore::EventHandler::platformPrepareForWheelEvents): Use mainFrame-located latching information.
(WebCore::EventHandler::platformRecordWheelEvent): Use mainFrame-located wheel event delta tracking.
(WebCore::EventHandler::platformCompleteWheelEvent): Make sure to use the latched frame as well as
the latched element so that events get routed properly.
(WebCore::EventHandler::platformCompletePlatformWidgetWheelEvent): Update for new mainFrame
location for latched state information.

LayoutTests:

* platform/mac/fast/scrolling/scroll-iframe-webkit1-latching-bug-expected.txt: Added.
* platform/mac/fast/scrolling/scroll-iframe-webkit1-latching-bug.html: Added.

Canonical link: https://commits.webkit.org/154760.44@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174430 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 35cba503e5063e8bb5ae5b1ef03fdac13ffa6e12
      https://github.com/WebKit/WebKit/commit/35cba503e5063e8bb5ae5b1ef03fdac13ffa6e12
  Author: Simon Fraser <simon.fraser at apple.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AccessibilityObject.cpp
    M Source/WebCore/accessibility/AccessibilityRenderObject.cpp
    M Source/WebCore/editing/FrameSelection.cpp
    M Source/WebCore/page/EventHandler.cpp
    M Source/WebCore/page/Frame.cpp
    M Source/WebCore/rendering/RenderLayer.cpp
    M Source/WebCore/rendering/RenderView.cpp

  Log Message:
  -----------
  Merge r173865 - Ensure that layout is up-to-date before hit-testing via RenderView
https://bugs.webkit.org/show_bug.cgi?id=136651

Reviewed by David Hyatt.

Ensure that layout is up-to-date before we do hit-testing via the RenderView.
Previously, RenderLayer::hitTest() called updateLayout(), but it's better
to push that responsibility onto RenderView before entering the RenderLayer
tree.

Make callers a little more consistent in getting the RenderView via
Frame::contentRenderer(), though perhaps we should remove that and just
call Document::renderView() everywhere.

* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::press): Hit test via the RenderView, rather
than doing so on the RenderView's layer, to ensure that we updateLayout().
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::accessibilityHitTest): This code calls
hitTest() on arbitrary layers, so needs to explicitly update layout.
* editing/FrameSelection.cpp:
(WebCore::FrameSelection::contains):
* page/EventHandler.cpp:
(WebCore::EventHandler::eventMayStartDrag):
(WebCore::EventHandler::updateSelectionForMouseDrag):
(WebCore::EventHandler::hitTestResultAtPoint): The explicit updateLayout() is
no longer needed.
(WebCore::EventHandler::updateCursor):
(WebCore::EventHandler::handleWheelEvent):
(WebCore::EventHandler::hoverTimerFired):
(WebCore::hitTestResultInFrame):
* page/Frame.cpp:
(WebCore::Frame::contentRenderer):
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::hitTest):
* rendering/RenderView.cpp:
(WebCore::RenderView::hitTest): Here's where we ensure that layout is up-to-date.

Canonical link: https://commits.webkit.org/154760.45@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174431 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: ae9feedab8a01ebca59ee11aa590d0df3894a2a3
      https://github.com/WebKit/WebKit/commit/ae9feedab8a01ebca59ee11aa590d0df3894a2a3
  Author: Jer Noble <jer.noble at apple.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Tools/ChangeLog
    M Tools/Scripts/commit-log-editor

  Log Message:
  -----------
  Merge r173887 - [Tools] git-commit uses wrong ChangeLog when run from a subdirectory
https://bugs.webkit.org/show_bug.cgi?id=137031

Reviewed by Joseph Pecoraro.

commit-log-editor is run from the top of the Git checkout, even when git-commit is invoked
from a subdirectory, making the parsed locations of ChangeLog files incorrect. Git provides
a mapping prefix in the GIT_PREFIX environment variable, so apply this prefix to the parsed
ChangeLog locations before passing them to createCommitMessage().

* Scripts/commit-log-editor:

Canonical link: https://commits.webkit.org/154760.46@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174432 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 8ffd0fbf580ba71166c63c065f797bf407d0065b
      https://github.com/WebKit/WebKit/commit/8ffd0fbf580ba71166c63c065f797bf407d0065b
  Author: Benjamin Poulain <bpoulain at apple.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/css3/flexbox/flex-flow-2-expected.txt
    A LayoutTests/css3/flexbox/flex-flow-2.html
    A LayoutTests/fast/css/style-resolver-cache-direction-1-expected.html
    A LayoutTests/fast/css/style-resolver-cache-direction-1.html
    A LayoutTests/fast/css/style-resolver-cache-direction-2-expected.html
    A LayoutTests/fast/css/style-resolver-cache-direction-2.html
    A LayoutTests/fast/css/style-resolver-cache-direction-3-expected.html
    A LayoutTests/fast/css/style-resolver-cache-direction-3.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/StyleResolver.cpp

  Log Message:
  -----------
  Merge r173906 - The style resolution cache applies properties incorrectly whenever direction != ltr
https://bugs.webkit.org/show_bug.cgi?id=137052

Patch by Benjamin Poulain <bpoulain at apple.com> on 2014-09-23
Reviewed by Andreas Kling.

Source/WebCore:

The optimization r135021 introduced a bug whenever the direction of subtree is not
uniform in the whole page.

When StyleResolver::applyMatchedProperties() resolves the style, some properties are
resolved differently based on the writing-mode and the direction.

In isCacheableInMatchedPropertiesCache(), the cases for writing-mode are already handled
by not caching any style with anything else than the default.
The direction was ignored, causing the bugs solved here.

Tests: css3/flexbox/flex-flow-2.html
       fast/css/style-resolver-cache-direction-1.html
       fast/css/style-resolver-cache-direction-2.html
       fast/css/style-resolver-cache-direction-3.html

* css/StyleResolver.cpp:
(WebCore::isCacheableInMatchedPropertiesCache):

LayoutTests:

* css3/flexbox/flex-flow-2-expected.txt: Added.
* css3/flexbox/flex-flow-2.html: Added.
The test flex-flow.html should have uncovered the bug. It did not because it uses
:nth-child(), which disable style optimizations.

flex-flow-2.html is a copy of flex-flow.html using classes instead of :nth-child().
This would have caught the bug.

* fast/css/style-resolver-cache-direction-1-expected.html: Added.
* fast/css/style-resolver-cache-direction-1.html: Added.
* fast/css/style-resolver-cache-direction-2-expected.html: Added.
* fast/css/style-resolver-cache-direction-2.html: Added.
* fast/css/style-resolver-cache-direction-3-expected.html: Added.
* fast/css/style-resolver-cache-direction-3.html: Added.
New basic tests for the fix.

Canonical link: https://commits.webkit.org/154760.47@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174433 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: ca0e5a71d0166091b9f355a35bc085edbbc149cb
      https://github.com/WebKit/WebKit/commit/ca0e5a71d0166091b9f355a35bc085edbbc149cb
  Author: Myles C. Maxfield <mmaxfield at apple.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/text/empty-shadow-expected.html
    R LayoutTests/fast/text/empty-shadow-with-color-expected.html
    R LayoutTests/fast/text/empty-shadow-with-color.html
    M LayoutTests/fast/text/empty-shadow.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/InlineTextBox.cpp
    M Source/WebCore/rendering/InlineTextBox.h
    M Source/WebCore/rendering/TextPainter.cpp
    M Source/WebCore/rendering/TextPainter.h
    M Source/WebCore/rendering/svg/SVGInlineTextBox.cpp

  Log Message:
  -----------
  Merge r173941 - REGRESSION: Text with a zero offset, zero blur shadow vanishes
https://bugs.webkit.org/show_bug.cgi?id=136801

Reviewed by Darin Adler.

Source/WebCore:

This patch performs some cleanup regarding TextPainter's shadow logic and handles an
additional case of empty shadows. Previously, there was tight coupling between
applyShadowToGraphicalContext() and paintTextWithShadows(), as they both used a
collection of variables to determine how shadows are to be drawn. This complexity has
been moved into a helper class, ShadowApplier, which performs what
applyShadowToGraphicsContext() used to do, and cleans up correctly in its destructor.
This removes the tight coupling mentioned earlier.

Test: fast/text/empty-shadow.html

* rendering/InlineTextBox.cpp:
(WebCore::InlineTextBox::applyShadowToGraphicsContext): Moved to ShadowApplier.
* rendering/InlineTextBox.h: Deleted applyShadowToGraphicsContext signature.
* rendering/TextPainter.cpp:
(WebCore::ShadowApplier::ShadowApplier): Perform the contents of applyShadowToGraphicsContext()
(WebCore::ShadowApplier::~ShadowApplier): Undo the work done previously
(WebCore::paintTextWithShadows): Create a ShadowApplier to do the relevant shadow work. In addition,
refactor some boolean flags to more meaningful ones with relation to the computation at hand.
(WebCore::isEmptyShadow): Moved to TextPainter.h, named shadowIsCompletelyCoveredByText()
* rendering/TextPainter.h:
(WebCore::ShadowApplier::ShadowApplier): Moved from InlineTextBox::applyShadowToGraphicsContext().
(WebCore::ShadowApplier::extraOffset): Getter.
(WebCore::ShadowApplier::~ShadowApplier): Moved from TextPainter::paintTextWithShadows().
(WebCore::isLastShadowIteration): Helper function.
(WebCore::shadowIsCompletelyCoveredByText): Determines whether or not we should not draw the shadow.
* rendering/svg/SVGInlineTextBox.cpp:
(WebCore::SVGInlineTextBox::paintTextWithShadows): Update to use ShadowApplier.

LayoutTests:

This test should be a comprehensive test of empty shadows. It tests every
combination of one and two shadows being empty, as well as transparent and
opaque text.

After updating fast/text/empty-shadow.html, fast/text/empty-shadow-with-color.html
is no longer necessary.

* fast/text/empty-shadow-expected.html:
* fast/text/empty-shadow-with-color-expected.html: Removed.
* fast/text/empty-shadow-with-color.html: Removed.
* fast/text/empty-shadow.html:

Canonical link: https://commits.webkit.org/154760.48@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174434 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 03f2a8947d2e95e345824608fee0d84fcbf4b696
      https://github.com/WebKit/WebKit/commit/03f2a8947d2e95e345824608fee0d84fcbf4b696
  Author: Darin Adler <darin at apple.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/text/international/old-turkic-direction-expected.html
    A LayoutTests/fast/text/international/old-turkic-direction.html
    M Source/WebCore/CMakeLists.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/WebCore.vcxproj/WebCore.vcxproj
    M Source/WebCore/WebCore.vcxproj/WebCore.vcxproj.filters
    M Source/WebCore/WebCore.xcodeproj/project.pbxproj
    A Source/WebCore/rendering/InlineIterator.cpp
    M Source/WebCore/rendering/InlineIterator.h
    M Source/WebCore/rendering/RenderingAllInOne.cpp

  Log Message:
  -----------
  Merge r173943 - Old Turkic characters behave as left-to-right instead of right-to-left, because they are encoded as surrogate pairs.
https://bugs.webkit.org/show_bug.cgi?id=70029

Reviewed by Dan Bernstein.

Source/WebCore:

Test: fast/text/international/old-turkic-direction.html

* CMakeLists.txt: Added InlineIterator.cpp.
* WebCore.vcxproj/WebCore.vcxproj: Ditto.
* WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
* WebCore.xcodeproj/project.pbxproj: Ditto.
* rendering/RenderingAllInOne.cpp: Ditto.

* rendering/InlineIterator.cpp: Added.
(WebCore::InlineIterator::surrogateTextDirection): New function used to compute the direction
when a surrogate pair is involved.
* rendering/InlineIterator.h: Made the characterAt function private.
(WebCore::InlineIterator::previousInSameNode): Took out unneeded range check. A zero will underflow
and become a large number and the characterAt function will return 0 in that case.
(WebCore::InlineIterator::direction): Added code to check U16_IS_SINGLE before calling
u_charDirection, and call surrogateTextDirection instead.

LayoutTests:

* fast/text/international/old-turkic-direction.html: Added.
* fast/text/international/old-turkic-direction-expected.html: Added.

Canonical link: https://commits.webkit.org/154760.49@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174436 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 1ef4f6d4d525953ee31fb2d356ea7d864591bcc3
      https://github.com/WebKit/WebKit/commit/1ef4f6d4d525953ee31fb2d356ea7d864591bcc3
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderGeometryMap.cpp

  Log Message:
  -----------
  Merge r173945 - Use tighter typing for render objects in RenderGeometryMap
https://bugs.webkit.org/show_bug.cgi?id=137102

Reviewed by Ryosuke Niwa.

Use tighter typing for render objects in RenderGeometryMap for clarity
and efficiency.

In particular, using RenderElement type instead of RenderObject
in canMapBetweenRenderers() allows us to call the faster
RenderElement::style() instead of RenderObject::style().

No new tests, no behavior change.

* rendering/RenderGeometryMap.cpp:
(WebCore::canMapBetweenRenderers):
(WebCore::RenderGeometryMap::pushMappingsToAncestor):

Canonical link: https://commits.webkit.org/154760.50@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174437 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f300ba633c00eb667feb52f74881031c7484e43f
      https://github.com/WebKit/WebKit/commit/f300ba633c00eb667feb52f74881031c7484e43f
  Author: Javier Fernandez <jfernandez at igalia.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/css-grid-layout/grid-template-areas-empty-string-crash-expected.txt
    A LayoutTests/fast/css-grid-layout/grid-template-areas-empty-string-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSParser.cpp

  Log Message:
  -----------
  Merge r173965 - ASSERTION FAILED: columnCount in WebCore::CSSParser::parseGridTemplateAreasRow
https://bugs.webkit.org/show_bug.cgi?id=136945

Reviewed by Sergio Villar Senin.

Source/WebCore:

Checking out whether the grid-template-areas value contains a white-space only
string, which is not valid as it does not produce a cell token.

Test: fast/css-grid-layout/grid-template-areas-empty-string-crash.html

* css/CSSParser.cpp:
(WebCore::CSSParser::parseGridTemplateAreasRow):

LayoutTests:

Testing the different types of white-space only strings for the grid-template-areas
property, which is not valid as it does not produce a cell token.

* fast/css-grid-layout/grid-template-areas-empty-string-crash-expected.txt: Added.
* fast/css-grid-layout/grid-template-areas-empty-string-crash.html: Added.

Canonical link: https://commits.webkit.org/154760.51@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174438 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: a9f0533ca768140e8c34c2155414f002416e487f
      https://github.com/WebKit/WebKit/commit/a9f0533ca768140e8c34c2155414f002416e487f
  Author: Tim Horton <timothy_horton at apple.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/Shared/WebCoreArgumentCoders.cpp

  Log Message:
  -----------
  Merge r173973 - CommitLayerTree decode fails in 32-bit apps on 64-bit devices (TransformationMatrix alignment differs)
https://bugs.webkit.org/show_bug.cgi?id=136444
<rdar://problem/17952526>

Reviewed by Anders Carlsson.

* Shared/WebCoreArgumentCoders.cpp:
(IPC::ArgumentCoder<TransformationMatrix>::encode):
(IPC::ArgumentCoder<TransformationMatrix>::decode):
Stop using SimpleArgumentCoder to encode/decode TransformationMatrix,
because the alignment of TransformationMatrix differs between architectures,
and there's no guarantee that both sides of a connection are the same architecture.

Canonical link: https://commits.webkit.org/154760.52@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174439 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: a4819b08e1f2881f269b8aca022c65c3b3acccb1
      https://github.com/WebKit/WebKit/commit/a4819b08e1f2881f269b8aca022c65c3b3acccb1
  Author: BJ Burg <burg at cs.washington.edu>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/storage/StorageAreaSync.cpp

  Log Message:
  -----------
  Merge r173991 - StorageTracker::deleteOrigin being called off the main thread (ASSERTs in inspector/test-harness-trivially-works.html test)
https://bugs.webkit.org/show_bug.cgi?id=129642

Reviewed by Brady Eidson.

Source/WebCore:

When tearing down the inspector frontend's page, we trigger a threading violation
in StorageAreaSync's final sync code underneath StorageAreaSync::deleteEmptyDatabase().

No new tests. Regression is covered by inspector/test-harness-trivially-works.html.

* storage/StorageAreaSync.cpp:
(WebCore::StorageAreaSync::deleteEmptyDatabase): add a missing callOnMainThread() when
calling StorageTracker::deleteOriginWithIdentifier().

LayoutTests:

Remove the blanket Skip for all tests in inspector/.

* TestExpectations: clean up expectations for inspector/ and add new tracking bugs.

Canonical link: https://commits.webkit.org/154760.53@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174440 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 424b6d646c2f8f23d7fd31a5c07f6ff4d028ff0b
      https://github.com/WebKit/WebKit/commit/424b6d646c2f8f23d7fd31a5c07f6ff4d028ff0b
  Author: Saam Barati <saambarati1 at gmail.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.cpp
    M Source/JavaScriptCore/runtime/TypeSet.h
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Models/TypeSet.js

  Log Message:
  -----------
  Merge r173994 - Web Inspector: console.assert(bitString) TypeSet:50
https://bugs.webkit.org/show_bug.cgi?id=137051

Reviewed by Joseph Pecoraro.

Source/JavaScriptCore:

This patch creates stricter requirements on a TypeDescription
being valid. To be valid, a TypeDescription now ensures that
the TypeSet it describes has non null type information.

* inspector/agents/InspectorRuntimeAgent.cpp:
(Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
* runtime/TypeSet.h:
(JSC::TypeSet::isEmpty):

Source/WebInspectorUI:

This fixes TypeSet's isContainedIn method by ensuring that
the type bit string isn't zero because the test would trivially
pass if the bit string is zero.

* UserInterface/Models/TypeSet.js:
(WebInspector.TypeSet.prototype.isContainedIn):

Canonical link: https://commits.webkit.org/154760.54@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174441 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: a24670a14b83b9ff18787ff95ee2560be7218d90
      https://github.com/WebKit/WebKit/commit/a24670a14b83b9ff18787ff95ee2560be7218d90
  Author: BJ Burg <burg at cs.washington.edu>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/storage/StorageAreaSync.cpp

  Log Message:
  -----------
  Merge r174014 - StorageTracker::deleteOrigin being called off the main thread (ASSERTs in inspector/test-harness-trivially-works.html test)
https://bugs.webkit.org/show_bug.cgi?id=129642

Apply post-review comments from Alexey Proskuryakov.

* storage/StorageAreaSync.cpp:
(WebCore::StorageAreaSync::deleteEmptyDatabase): Make a thread-safe isolated copy of the string.

Canonical link: https://commits.webkit.org/154760.55@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174442 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 38ed8364cd199dca05aed741602e0456c777d999
      https://github.com/WebKit/WebKit/commit/38ed8364cd199dca05aed741602e0456c777d999
  Author: Peter Varga <pvarga at webkit.org>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/yarr/YarrPattern.cpp

  Log Message:
  -----------
  Merge r174012 - Fix typo in YARR at BOL check
https://bugs.webkit.org/show_bug.cgi?id=137144

Reviewed by Darin Adler.

* yarr/YarrPattern.cpp: replace bitwise and operator by logical and
(JSC::Yarr::YarrPatternConstructor::assertionBOL):

Canonical link: https://commits.webkit.org/154760.56@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174443 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: bdbb8fa97693a328cff114d01ea5ca62c7ae4870
      https://github.com/WebKit/WebKit/commit/bdbb8fa97693a328cff114d01ea5ca62c7ae4870
  Author: Saam Barati <saambarati1 at gmail.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Views/TypeTokenView.js

  Log Message:
  -----------
  Merge r174019 - Web Inspector: Type Token View shows type information on hover when it shouldn't
https://bugs.webkit.org/show_bug.cgi?id=137152

Reviewed by Brian J. Burg.

TypeTokenView should only show type information when there is
more than one primitive type or more than zero objects types.
This fixes a bug in checking the length of object types.

* UserInterface/Views/TypeTokenView.js:
(WebInspector.TypeTokenView.prototype._shouldShowPopover):

Canonical link: https://commits.webkit.org/154760.57@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174444 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 55584158d512ea90b7579f685e51cf5ded148812
      https://github.com/WebKit/WebKit/commit/55584158d512ea90b7579f685e51cf5ded148812
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/WebCore.exp.in
    M Source/WebCore/WebCore.order
    M Source/WebCore/html/HTMLAppletElement.cpp
    M Source/WebCore/html/HTMLAppletElement.h
    M Source/WebCore/html/HTMLEmbedElement.cpp
    M Source/WebCore/html/HTMLEmbedElement.h
    M Source/WebCore/html/HTMLObjectElement.cpp
    M Source/WebCore/html/HTMLObjectElement.h
    M Source/WebCore/html/HTMLPlugInElement.cpp
    M Source/WebCore/html/HTMLPlugInElement.h

  Log Message:
  -----------
  Merge r174040 - HTMLPlugInElement::isUserObservable() is causing layout
https://bugs.webkit.org/show_bug.cgi?id=137156

Reviewed by Ryosuke Niwa.

While profiling the page load of nytimes.com, I noticed that we were
spending ~4-5% of cpu time in HTMLPlugInElement::isUserObservable().
The reason is that the function calls pluginWidget(), which causes a
layout update in HTMLObjectElement::renderWidgetForJSBindings(), to
make sure the plugin is loaded and its renderer is created.

HTMLPlugInElement::isUserObservable() shouldn't need to do a layout.
This patch does the following to address the problem:
- Rename renderWidgetForJSBindings() to renderWidgetLoadingPlugin()
  because this function is not always called from the JS Bindings
  nowadays. The new name makes it clearer that this will load the
  plugin if needed (to make sure the renderer is created, and by
  doing a layout).
- Add a PluginLoadingPolicy argument to
  HTMLPlugInElement::pluginWidget() to let the caller control if the
  plugin should be loaded or not.
- Update the call to pluginWidget() in isUserObservable() so that
  we do not attempt to load the plugin (thus not causing a layout).

No new tests, no behavior change.

* WebCore.exp.in:
* WebCore.order:
* html/HTMLAppletElement.cpp:
(WebCore::HTMLAppletElement::renderWidgetLoadingPlugin):
(WebCore::HTMLAppletElement::renderWidgetForJSBindings): Deleted.
* html/HTMLAppletElement.h:
* html/HTMLEmbedElement.cpp:
(WebCore::HTMLEmbedElement::renderWidgetLoadingPlugin):
(WebCore::HTMLEmbedElement::renderWidgetForJSBindings): Deleted.
* html/HTMLEmbedElement.h:
* html/HTMLObjectElement.cpp:
(WebCore::HTMLObjectElement::renderWidgetLoadingPlugin):
(WebCore::HTMLObjectElement::renderWidgetForJSBindings): Deleted.
* html/HTMLObjectElement.h:
* html/HTMLPlugInElement.cpp:
(WebCore::HTMLPlugInElement::pluginWidget):
(WebCore::HTMLPlugInElement::isUserObservable):
* html/HTMLPlugInElement.h:

Canonical link: https://commits.webkit.org/154760.58@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174445 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: c3c05ed72688ff0d36210b2b3eba9c46b65c5f06
      https://github.com/WebKit/WebKit/commit/c3c05ed72688ff0d36210b2b3eba9c46b65c5f06
  Author: Chris Fleizach <cfleizach at apple.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/accessibility/aria-labelledby-with-descendants-expected.txt
    M LayoutTests/accessibility/aria-labelledby-with-descendants.html
    A LayoutTests/accessibility/aria-namefrom-author-expected.txt
    A LayoutTests/accessibility/aria-namefrom-author.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AccessibilityNodeObject.cpp
    M Source/WebCore/accessibility/AccessibilityObject.cpp
    M Source/WebCore/accessibility/AccessibilityObject.h

  Log Message:
  -----------
  Merge r174074 - AX: in an aria-labelledby computation, do not traverse into elements whose nameFrom value does not include 'contents'
https://bugs.webkit.org/show_bug.cgi?id=136714

Reviewed by Darin Adler.

Source/WebCore:

There are certain ARIA elements that tell us we should not query their children when determining the name of the object.
Those ones have the "nameFrom" property set to "author" instead of "contents." WebKit needs to honor that status.

Test: accessibility/aria-namefrom-author.html
      Modified: accessibility/aria-labelledby-with-descendants.html

* accessibility/AccessibilityNodeObject.cpp:
(WebCore::shouldUseAccessiblityObjectInnerText):
(WebCore::shouldAddSpaceBeforeAppendingNextElement):
(WebCore::appendNameToStringBuilder):
(WebCore::AccessibilityNodeObject::textUnderElement):
(WebCore::accessibleNameForNode):
(WebCore::AccessibilityNodeObject::accessibilityDescriptionForElements):
* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::accessibleNameDerivesFromContent):
(WebCore::initializeRoleMap):
* accessibility/AccessibilityObject.h:

LayoutTests:

* accessibility/aria-labelledby-with-descendants-expected.txt:
* accessibility/aria-labelledby-with-descendants.html:
* accessibility/aria-namefrom-author-expected.txt: Added.
* accessibility/aria-namefrom-author.html: Added.

Canonical link: https://commits.webkit.org/154760.59@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174446 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 35e95609cc9c95c97c1ff525300f84c9d3ae2692
      https://github.com/WebKit/WebKit/commit/35e95609cc9c95c97c1ff525300f84c9d3ae2692
  Author: David Hyatt <hyatt at apple.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/multicol/multicol-fieldset-span-changes-expected.txt
    A LayoutTests/fast/multicol/multicol-fieldset-span-changes.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp
    M Source/WebCore/rendering/RenderMultiColumnFlowThread.h

  Log Message:
  -----------
  Merge r174085 - REGRESSION (r168046): Confused column spans when combined with dynamic animations
https://bugs.webkit.org/show_bug.cgi?id=134048.

Reviewed by Dean Jackson.

Source/WebCore:

Added fast/multicol/multicol-fieldset-span-changes.html

* rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::RenderMultiColumnFlowThread::processPossibleSpannerDescendant):
Refactor handling of insertions into the multicolumn flow thread into
a helper function, processPossibleSpannerDescendant. This makes it easier
to call the code from more than one place.

(WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted):
Modify the nested columns span shifting code to avoid problems. The
new code suppresses notifications and does the move of the spanner back
into the original spot *before* removing the placeholder. This ensures that
the placeholder parent still exists.

The stale placeholder is then removed and destroyed after the spanner has been put back
into place.

(WebCore::RenderMultiColumnFlowThread::handleSpannerRemoval):
(WebCore::RenderMultiColumnFlowThread::flowThreadRelativeWillBeRemoved):
Refactor the removal notifications for spanners into a helper function so that it can
be called to do cleanup from the code that cleans up stale placeholders on a shift.

* rendering/RenderMultiColumnFlowThread.h:
Modified to add the new helpers.

LayoutTests:

* fast/multicol/multicol-fieldset-span-changes-expected.txt: Added.
* fast/multicol/multicol-fieldset-span-changes.html: Added.

Canonical link: https://commits.webkit.org/154760.60@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174447 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 864f0f450b7f7a070f6bc59cef808bf393364e05
      https://github.com/WebKit/WebKit/commit/864f0f450b7f7a070f6bc59cef808bf393364e05
  Author: Sergio Villar Senin <svillar at igalia.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/editing/selection/block-cursor-overtype-mode-end-of-line-expected.html
    A LayoutTests/editing/selection/block-cursor-overtype-mode-end-of-line-rtl-expected.html
    A LayoutTests/editing/selection/block-cursor-overtype-mode-end-of-line-rtl.html
    A LayoutTests/editing/selection/block-cursor-overtype-mode-end-of-line.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/editing/FrameSelection.cpp
    M Source/WebCore/editing/VisibleUnits.cpp
    M Source/WebCore/editing/VisibleUnits.h

  Log Message:
  -----------
  Merge r174097 - Caret not shown at the end of line in overtype mode
https://bugs.webkit.org/show_bug.cgi?id=135508

Reviewed by Ryosuke Niwa.

Source/WebCore:

When overtype mode is enabled we usually replace the 'normal'
blinking caret shown in contenteditable elements by a block cursor
that covers the next character to be replaced. The exception is the
end of line where we fallback to the blinking caret even in overtype
mode (as there is no next character to replace).

We were not showing anything at the end of lines in overtype mode
because the detection of the end of line was incorrect and not very
understandable. Replaced the old code with a proper and clean end of
line detection mechanism compatible with bidi text.

Tests: editing/selection/block-cursor-overtype-mode-end-of-line-rtl.html
       editing/selection/block-cursor-overtype-mode-end-of-line.html

* editing/FrameSelection.cpp:
(WebCore::FrameSelection::updateAppearance):
* editing/VisibleUnits.cpp:
(WebCore::isLogicalEndOfLine):
* editing/VisibleUnits.h:

LayoutTests:

* editing/selection/block-cursor-overtype-mode-end-of-line-expected.html: Added.
* editing/selection/block-cursor-overtype-mode-end-of-line-rtl-expected.html: Added.
* editing/selection/block-cursor-overtype-mode-end-of-line-rtl.html: Added.
* editing/selection/block-cursor-overtype-mode-end-of-line.html: Added.

Canonical link: https://commits.webkit.org/154760.61@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174449 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 6b4141ebc7ee33b6e1db3d65c3be2517c6dc216e
      https://github.com/WebKit/WebKit/commit/6b4141ebc7ee33b6e1db3d65c3be2517c6dc216e
  Author: David Hyatt <hyatt at apple.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp

  Log Message:
  -----------
  Merge r174126 - Remove a multicolumn ASSERT and replace with a guard.
https://bugs.webkit.org/show_bug.cgi?id=137272

Reviewed by Alexey Proskuryakov.

* rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::isValidColumnSpanner):
For now remove the assert that is tripping and replace it with a guard
until we can figure out why it's getting hit.

Canonical link: https://commits.webkit.org/154760.62@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174450 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: b458b1bd562f40a4e9cc2d45d596c93dda3fb79e
      https://github.com/WebKit/WebKit/commit/b458b1bd562f40a4e9cc2d45d596c93dda3fb79e
  Author: Said Abou-Hallawa <sabouhallawa at apple.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/svg/filters/svg-deeply-nested-crash-expected.txt
    A LayoutTests/svg/filters/svg-deeply-nested-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/filters/FilterEffect.cpp
    M Source/WebCore/platform/graphics/filters/FilterEffect.h
    M Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp

  Log Message:
  -----------
  Merge r174137 - Stack overflow with enormous SVG filter
https://bugs.webkit.org/show_bug.cgi?id=63290

Prevent building an SVG filter if it has more than 200 FilterEffect nodes in its map
regardless whether they will be connected to its lastEffect or not. Also discard any
filter which has more 100 contributing FilterEffect nodes in its tree.

Patch by Said Abou-Hallawa <sabouhallawa at apple.com> on 2014-09-30
Reviewed by Dean Jackson.

Tests: svg/filters/svg-deeply-nested-crash.html

* platform/graphics/filters/FilterEffect.cpp:
(WebCore::collectEffects):
(WebCore::FilterEffect::totalNumberOfEffectInputs):
* platform/graphics/filters/FilterEffect.h:
-- Add a method to return the total number of input FilterEffect's contributing to a FilterEffect.
* rendering/svg/RenderSVGResourceFilter.cpp:
(WebCore::RenderSVGResourceFilter::buildPrimitives):
-- Do not build a filter if it has more than 200 FilterEffects in its map.
(WebCore::RenderSVGResourceFilter::applyResource):
-- Discard a filter after it was built if it has more than 100 FilterEffects in its tree.

LayoutTests:
Stack overflow with enormous SVG filter.
https://bugs.webkit.org/show_bug.cgi?id=63290.

Patch by Said Abou-Hallawa <sabouhallawa at apple.com> on 2014-09-30
Reviewed by Dean Jackson.

Test if an SVG filter with deeply nested tree of FilterEffects can be loaded
with no crash. Make sure other valid filters can still be referenced by SVG
drawing elements. An SVG Filter will be ignored if the number of effects in
its map is greater than 200 or the total number of effects connected to its
last effect is greater than 100.

* svg/filters/svg-deeply-nested-crash-expected.txt: Added.
* svg/filters/svg-deeply-nested-crash.html: Added.

Canonical link: https://commits.webkit.org/154760.63@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174452 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 6e5cb9e7027f57f54400461f655322c6284dfce1
      https://github.com/WebKit/WebKit/commit/6e5cb9e7027f57f54400461f655322c6284dfce1
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2014-10-08 (Wed, 08 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/http/tests/cookies/resources/cookies-test-pre.js
    A LayoutTests/http/tests/cookies/sync-xhr-set-cookie-invalidates-cache-expected.txt
    A LayoutTests/http/tests/cookies/sync-xhr-set-cookie-invalidates-cache.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/dom/Document.h
    M Source/WebCore/dom/ScriptExecutionContext.cpp
    M Source/WebCore/dom/ScriptExecutionContext.h
    M Source/WebCore/loader/ThreadableLoader.cpp

  Log Message:
  -----------
  Merge r174190 - Add basic caching for Document.cookie API
https://bugs.webkit.org/show_bug.cgi?id=137225

Reviewed by Alexey Proskuryakov.

Source/WebCore:

While profiling the load of nytimes.com, I noticed that the site is
accessing ~250 times document.cookie, just during page load. Accessing
document.cookie is currently slow because we:
- Call WebPlatformStrategies::cookiesForDOM() virtual function
- Send a sync IPC message to the Network process to retrieve the
  cookies
    - The Network process gets the list of cookies from CFNetwork then
      serializes the result to send it back to the WebProcess
- We unserialize the cookies into an NSList of cookies
- We filter-out the cookies that are 'httpOnly' and construct a new
  NSList of cookies
- We create a WTF String out of the cookies NSList

In the case of nytimes.com, it turns out that up to 100 calls to
document.cookie() are made in the same event loop iteration. This patch
thus caches / freezes the cookies until we return to the event
loop so that consecutive calls to document.cookie() are extremely fast.
Doing so seems to be sufficient to achieve a ~87% cache hit for
nytimes.com page load.

The cookies cache is invalidated whenever:
- document.cookie is set
- we return to the event loop
- a network resource is loaded synchronously as it may cause cookies to
  be set before we return to the event loop

Test: http/tests/cookies/sync-xhr-set-cookie-invalidates-cache.html

* dom/Document.cpp:
(WebCore::Document::Document):
(WebCore::Document::open):
(WebCore::Document::cookie):
(WebCore::Document::setCookie):
(WebCore::Document::setCookieURL):
(WebCore::Document::initSecurityContext):
(WebCore::Document::setDOMCookieCache):
(WebCore::Document::invalidateDOMCookieCache):
(WebCore::Document::domCookieCacheExpiryTimerFired):
(WebCore::Document::didLoadResourceSynchronously):
* dom/Document.h:
(WebCore::Document::domCookieCache):
(WebCore::Document::isDOMCookieCacheValid):
(WebCore::Document::setCookieURL): Deleted.
* dom/ScriptExecutionContext.cpp:
(WebCore::ScriptExecutionContext::didLoadResourceSynchronously):
* dom/ScriptExecutionContext.h:
* loader/ThreadableLoader.cpp:
(WebCore::ThreadableLoader::loadResourceSynchronously):

LayoutTests:

Add a layout test to make sure that document.cookie returns updated
results after cookies are set via a sync XHR.

* http/tests/cookies/sync-xhr-set-cookie-invalidates-cache-expected.txt: Added.
* http/tests/cookies/sync-xhr-set-cookie-invalidates-cache.html: Added.

Canonical link: https://commits.webkit.org/154760.64@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174454 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 018af736a87b83992d936aa4c9c5fb49b5c2cf69
      https://github.com/WebKit/WebKit/commit/018af736a87b83992d936aa4c9c5fb49b5c2cf69
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-10 (Fri, 10 Oct 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp
    M Source/WebKit2/Shared/Plugins/PluginQuirks.h
    M Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp

  Log Message:
  -----------
  Merge r174507 - [X11] Plugin process crashes in NetscapePlugin::platformPostInitialize()
https://bugs.webkit.org/show_bug.cgi?id=137426

Reviewed by Darin Adler.

For some reason flash crashes when NPP_GetValue is called with
NPPVpluginCancelSrcStream, but only in windowed mode. Not calling
NPP_GetValue and unconditionally loading the source URL in the
browser fixes the crash and plugins work normally. We can handle
this particular case with a new quirk.

* Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp:
(WebKit::NetscapePluginModule::determineQuirks): Add
DoNotCancelSrcStreamInWindowedMode quirk if it's flash plugin.
* Shared/Plugins/PluginQuirks.h: Add
DoNotCancelSrcStreamInWindowedMode quirk.
* WebProcess/Plugins/Netscape/NetscapePlugin.cpp:
(WebKit::NetscapePlugin::shouldLoadSrcURL): Return early if plugin
is windowed and DoNotCancelSrcStreamInWindowedMode quirk is present.

Canonical link: https://commits.webkit.org/154760.65@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174564 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: eaf54cb722d15efbba03e2c13ad39bb9235f9ea9
      https://github.com/WebKit/WebKit/commit/eaf54cb722d15efbba03e2c13ad39bb9235f9ea9
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-10 (Fri, 10 Oct 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/API/gtk/WebKitLoaderClient.cpp
    M Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
    M Source/WebKit2/UIProcess/API/gtk/WebKitWebViewPrivate.h
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/gtk/WebKit2Gtk/LoadTrackingTest.cpp
    M Tools/TestWebKitAPI/gtk/WebKit2Gtk/WebViewTest.cpp

  Log Message:
  -----------
  Merge r174497 - Race condition with WebKitWebView:is-loading after starting page load
https://bugs.webkit.org/show_bug.cgi?id=136692

Reviewed by Gustavo Noronha Silva.

Source/WebKit2:

Use PageLoadState::Observer to update both is-loading and uri
properties, instead of manually update them. This ensures that our
web view is always in sync with the WebPageProxy so that
webkit_web_view_is_loading() returns true right after requesting
any load. We still need to manually set the is-loading property
only in the case where we delay the emission of the load-changed
signals when waiting for the main resource. The bahaviour is a bit
different but still consistent with what our API documentation says.

* UIProcess/API/gtk/WebKitLoaderClient.cpp:
(attachLoaderClientToView): Remove
didSameDocumentNavigationForFrame implementation, since we are
already notified about the URL change by the PageLoadState::Observer.
(didSameDocumentNavigationForFrame): Deleted.
* UIProcess/API/gtk/WebKitWebView.cpp:
(webkitWebViewSetIsLoading): No longer update the URI when
changing the is-loading property.
(webkitWebViewConstructed): Crate a PageLoadStateObserver and add
it to the PageLoadState.
(webkitWebViewDispose): Remove the PageLoadStateObserver from the PageLoadState.
(webkitWebViewEmitLoadChanged): Add isDelayedEvent parameter to
update the is-loading property accordingly when emitting the
delayed events.
(webkitWebViewEmitDelayedLoadEvents): Pass true as isDelayedEvent
parameter of webkitWebViewEmitLoadChanged().
(webkitWebViewLoadChanged): Pass false as isDelayedEvent parameter
of webkitWebViewEmitLoadChanged().
(webkitWebViewLoadFailed):
(webkitWebViewLoadFailedWithTLSErrors):
(webkitWebViewUpdateURI): Deleted.
* UIProcess/API/gtk/WebKitWebViewPrivate.h:

Tools:

* TestWebKitAPI/gtk/WebKit2Gtk/LoadTrackingTest.cpp:
(loadChangedCallback): Only check is-loading is false when load
has finished if the load didn't fail due to a cancellation.
(loadFailedCallback): Only check is-loading is false if the load
didn't fail due to a cancellation.
* TestWebKitAPI/gtk/WebKit2Gtk/WebViewTest.cpp:
(WebViewTest::loadURI): Check is-loading is true and active URI is
the requested one rigth after requesting the load.
(WebViewTest::loadHtml): Ditto.
(WebViewTest::loadPlainText): Ditto.
(WebViewTest::loadBytes): Ditto.
(WebViewTest::loadRequest): Ditto.
(WebViewTest::loadAlternateHTML): Ditto.
(WebViewTest::goBack): Ditto.
(WebViewTest::goForward): Ditto.
(WebViewTest::goToBackForwardListItem): Ditto.

Canonical link: https://commits.webkit.org/154760.66@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174565 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 8d89e6e9053fd64df401314a2f62461a182ee97d
      https://github.com/WebKit/WebKit/commit/8d89e6e9053fd64df401314a2f62461a182ee97d
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-10 (Fri, 10 Oct 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/API/gtk/WebKitLoaderClient.cpp
    M Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
    M Source/WebKit2/UIProcess/API/gtk/WebKitWebViewPrivate.h

  Log Message:
  -----------
  Merge r174499 - [GTK] Use the PageLoadState observer also to monitor title and estimated load progress
https://bugs.webkit.org/show_bug.cgi?id=136997

Reviewed by Gustavo Noronha Silva.

* UIProcess/API/gtk/WebKitLoaderClient.cpp:
(attachLoaderClientToView): Remove implementation of
didReceiveTitleForFrame, didStartProgress, didChangeProgress and
didFinishProgress.
(didReceiveTitleForFrame): Deleted.
(didChangeProgress): Deleted.
* UIProcess/API/gtk/WebKitWebView.cpp:
(webkit_web_view_get_estimated_load_progress): Return the value
directly from the PageLoadState object, since we don't need to
cache the value anymore.
(webkitWebViewSetTitle): Deleted.
(webkitWebViewSetEstimatedLoadProgress): Deleted.
* UIProcess/API/gtk/WebKitWebViewPrivate.h:

Canonical link: https://commits.webkit.org/154760.67@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174566 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: a12006becbcf9245109d71298df176a3a560c7c2
      https://github.com/WebKit/WebKit/commit/a12006becbcf9245109d71298df176a3a560c7c2
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-10 (Fri, 10 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/PlatformGTK.cmake
    M Source/WebCore/platform/graphics/GraphicsContext.h
    M Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
    M Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h

  Log Message:
  -----------
  Merge r174041 - [cairo] GraphicsContext should not depend on GTK+
https://bugs.webkit.org/show_bug.cgi?id=137175

Reviewed by Martin Robinson.

Remove the unused methods depending on GDK and simplify
GraphicsContext::drawFocusRing() using only cairo API.

* PlatformGTK.cmake: Move GraphicsContextCairo.cpp to the webcore sources.
* platform/graphics/GraphicsContext.h:
* platform/graphics/cairo/GraphicsContextCairo.cpp:
(WebCore::GraphicsContext::drawFocusRing): Iterate the rectangles
instead of creating a region for the rectangles and call gdk_cairo_region().
(WebCore::GraphicsContext::setGdkExposeEvent): Deleted.
(WebCore::GraphicsContext::gdkExposeEvent): Deleted.
(WebCore::GraphicsContext::gdkWindow): Deleted.
* platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
(WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):

Canonical link: https://commits.webkit.org/154760.68@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174568 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 0651cb0732e2cf3408285c093f83603e75fd8867
      https://github.com/WebKit/WebKit/commit/0651cb0732e2cf3408285c093f83603e75fd8867
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-10 (Fri, 10 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/PlatformGTK.cmake
    R Source/WebCore/platform/gtk/GtkPluginWidget.cpp
    R Source/WebCore/platform/gtk/GtkPluginWidget.h

  Log Message:
  -----------
  Merge r174042 - [GTK] Remove unused GtkPluginWidget
https://bugs.webkit.org/show_bug.cgi?id=137176

Reviewed by Csaba Osztrogonác.

It was only used by WebKit1.

* PlatformGTK.cmake:
* platform/gtk/GtkPluginWidget.cpp: Removed.
* platform/gtk/GtkPluginWidget.h: Removed.

Canonical link: https://commits.webkit.org/154760.69@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174569 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 7e19377e46ac3b3592fea536a5335c4877be23ff
      https://github.com/WebKit/WebKit/commit/7e19377e46ac3b3592fea536a5335c4877be23ff
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-10 (Fri, 10 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/PlatformGTK.cmake
    M Source/WebCore/accessibility/atk/WebKitAccessibleWrapperAtk.cpp
    M Source/WebCore/editing/atk/FrameSelectionAtk.cpp

  Log Message:
  -----------
  Merge r174043 - [ATK] WebKitAccessibleWrapperAtk should not depend on GTK
https://bugs.webkit.org/show_bug.cgi?id=137177

Reviewed by Martin Robinson.

It's used to get the web view widget, but there's no GtkWidget in
the web process and platformPageClient is always NULL.

* PlatformGTK.cmake: Move accessibility sources to the WebCore
sources list.
* accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
(atkParentOfRootObject): Remove code to get view GtkWidget.
* editing/atk/FrameSelectionAtk.cpp: Remove unneeded header include.

Canonical link: https://commits.webkit.org/154760.70@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174570 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 4daafc86c28ae27624524fd8e67c0bd02bb3d55a
      https://github.com/WebKit/WebKit/commit/4daafc86c28ae27624524fd8e67c0bd02bb3d55a
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-10 (Fri, 10 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    R Source/WebCore/platform/gtk/RenderThemeGtk.h
    A Source/WebCore/rendering/RenderThemeGtk.h

  Log Message:
  -----------
  Merge r174044 - Unreviewed. Move RenderThemeGtk.h from platform/gtk to rendering.

I forgot to move this file in r173111.

* rendering/RenderThemeGtk.h: Renamed from Source/WebCore/platform/gtk/RenderThemeGtk.h.

Canonical link: https://commits.webkit.org/154760.71@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174571 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 287392f0e23b0caf299584cc8f05105d27106b33
      https://github.com/WebKit/WebKit/commit/287392f0e23b0caf299584cc8f05105d27106b33
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-10 (Fri, 10 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/PlatformGTK.cmake

  Log Message:
  -----------
  Merge r174055 - Unreviewed. Move sources not using GTK+ from WebCorePlatformGTK_SOURCES to WebCore_SOURCES.

* PlatformGTK.cmake:

Canonical link: https://commits.webkit.org/154760.72@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174572 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: eaef746dfa1521102c5d58911ab8e65d310f1adf
      https://github.com/WebKit/WebKit/commit/eaef746dfa1521102c5d58911ab8e65d310f1adf
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-10 (Fri, 10 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/PlatformGTK.cmake
    M Source/WebCore/platform/graphics/IntPoint.h
    M Source/WebCore/platform/graphics/IntRect.h
    R Source/WebCore/platform/graphics/gtk/IntPointGtk.cpp
    R Source/WebCore/platform/graphics/gtk/IntRectGtk.cpp
    M Source/WebCore/platform/gtk/GtkInputMethodFilter.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/PlatformGTK.cmake

  Log Message:
  -----------
  Merge r174058 - [GTK] Remove IntPointGtk.cpp and IntRectGtk.cpp
https://bugs.webkit.org/show_bug.cgi?id=137209

Reviewed by Philippe Normand.

Source/WebCore:

IntPointGtk is unused and IntRectGtk is only required by GTK+2 and
only used when building with GTK+2 in GtkInputMethodFilter.cpp
that can be easily replaced.

* PlatformGTK.cmake:
* platform/graphics/IntPoint.h:
* platform/graphics/IntRect.h:
* platform/graphics/gtk/IntPointGtk.cpp: Removed.
* platform/graphics/gtk/IntRectGtk.cpp: Removed.
* platform/gtk/GtkInputMethodFilter.cpp:
(WebCore::GtkInputMethodFilter::setCursorRect):

Tools:

* TestWebKitAPI/PlatformGTK.cmake: Remove unneeded IntRectGtk.cpp
from the WebCore test sources.

Canonical link: https://commits.webkit.org/154760.73@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174573 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: fc52fc70db5ffecb6b3fee0d2deae5bdff93a8be
      https://github.com/WebKit/WebKit/commit/fc52fc70db5ffecb6b3fee0d2deae5bdff93a8be
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-10 (Fri, 10 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/PlatformGTK.cmake
    R Source/WebCore/platform/gtk/MainFrameScrollbarGtk.cpp
    R Source/WebCore/platform/gtk/MainFrameScrollbarGtk.h

  Log Message:
  -----------
  Merge r174059 - [GTK] Remove MainFrameScrollbarGtk.cpp
https://bugs.webkit.org/show_bug.cgi?id=137211

Reviewed by Philippe Normand.

This was only used by WebKit1.

* PlatformGTK.cmake:
* platform/gtk/MainFrameScrollbarGtk.cpp: Removed.
* platform/gtk/MainFrameScrollbarGtk.h: Removed.

Canonical link: https://commits.webkit.org/154760.74@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174574 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f3a7713b5725fbc5b3ad667953fa56230cc8ed66
      https://github.com/WebKit/WebKit/commit/f3a7713b5725fbc5b3ad667953fa56230cc8ed66
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-10 (Fri, 10 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/PlatformGTK.cmake
    R Source/WebCore/platform/gtk/GtkPopupMenu.cpp
    R Source/WebCore/platform/gtk/GtkPopupMenu.h
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/gtk/WebPopupMenuProxyGtk.cpp
    M Source/WebKit2/UIProcess/gtk/WebPopupMenuProxyGtk.h

  Log Message:
  -----------
  Merge r174103 - [GTK] Move GtkPopupMenu implementation to WebPopupMenuProxyGtk
https://bugs.webkit.org/show_bug.cgi?id=137193

Reviewed by Gustavo Noronha Silva.

Source/WebCore:

Remove GtkPopupMenu from platform.

* PlatformGTK.cmake:
* platform/gtk/GtkPopupMenu.cpp: Removed.
* platform/gtk/GtkPopupMenu.h: Removed.

Source/WebKit2:

GtkPopupMenu was in platform only to have a common implementation to
be shared with WebKit1. Now that it's only used by
WebPopupMenuProxyGtk in WebKit2, we can simplify the code by
merging the implementation directly into WebPopupMenuProxyGtk.

* UIProcess/gtk/WebPopupMenuProxyGtk.cpp:
(WebKit::WebPopupMenuProxyGtk::WebPopupMenuProxyGtk):
(WebKit::WebPopupMenuProxyGtk::~WebPopupMenuProxyGtk):
(WebKit::WebPopupMenuProxyGtk::populatePopupMenu):
(WebKit::WebPopupMenuProxyGtk::showPopupMenu):
(WebKit::WebPopupMenuProxyGtk::hidePopupMenu):
(WebKit::WebPopupMenuProxyGtk::typeAheadFind):
(WebKit::WebPopupMenuProxyGtk::resetTypeAheadFindState):
(WebKit::WebPopupMenuProxyGtk::selectItemCallback):
(WebKit::WebPopupMenuProxyGtk::keyPressEventCallback):
* UIProcess/gtk/WebPopupMenuProxyGtk.h:
(WebKit::WebPopupMenuProxyGtk::setCurrentlySelectedMenuItem):

Canonical link: https://commits.webkit.org/154760.75@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174575 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: fee6e5fcca907574d3901cae5a5a77ee3cc5526f
      https://github.com/WebKit/WebKit/commit/fee6e5fcca907574d3901cae5a5a77ee3cc5526f
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-10 (Fri, 10 Oct 2014)

  Changed paths:
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/CMakeLists.txt

  Log Message:
  -----------
  Merge r174310 - [GTK] Do not generate webkit2gtk-tests-resources.gresource unconditionally
https://bugs.webkit.org/show_bug.cgi?id=137391

Reviewed by Martin Robinson.

Add a custom command to only re-generate
webkit2gtk-tests-resources.gresource when any of its dependencies changes.

* TestWebKitAPI/Tests/WebKit2Gtk/CMakeLists.txt:

Canonical link: https://commits.webkit.org/154760.76@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174576 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: de9593cf591f4f12192be44855dda7aed136e6ff
      https://github.com/WebKit/WebKit/commit/de9593cf591f4f12192be44855dda7aed136e6ff
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-10 (Fri, 10 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/PlatformGTK.cmake

  Log Message:
  -----------
  Merge r174326 - [GTK] Do not generate a symlink in derived sources for every header in WebCore/bindings/gobject
https://bugs.webkit.org/show_bug.cgi?id=137389

Reviewed by Martin Robinson.

We only need a symlink for static sources that are included in
public generated headers, because they are added with as
<webkitdom/WebKitDOMFoo.h> so they need to be inside a webkitdom
directory. Also use proper targets and commands to create the
symlinks only when needed instead of for every build.

* PlatformGTK.cmake:

Canonical link: https://commits.webkit.org/154760.77@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174577 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: c0983deb540a768e87323070eebb5dc3b4119414
      https://github.com/WebKit/WebKit/commit/c0983deb540a768e87323070eebb5dc3b4119414
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-10 (Fri, 10 Oct 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/PlatformGTK.cmake
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/CMakeLists.txt
    M Tools/TestWebKitAPI/PlatformGTK.cmake
    M Tools/WebKitTestRunner/PlatformGTK.cmake

  Log Message:
  -----------
  Merge r174422 - [GTK] Make forwarding headers generation depend on source code
https://bugs.webkit.org/show_bug.cgi?id=137394

Reviewed by Philippe Normand.

Source/WebKit2:

Only run generate-forwarding-headers.pl when source code changes
and use a different target for the symlinks.

* PlatformGTK.cmake:

Tools:

* TestWebKitAPI/CMakeLists.txt: Add missing dependency rule.
* TestWebKitAPI/PlatformGTK.cmake: Only run
generate-forwarding-headers.pl when source code changes.
* WebKitTestRunner/PlatformGTK.cmake: Ditto.

Canonical link: https://commits.webkit.org/154760.78@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174578 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 95aa1b90b75fbd9bd2cb2047ba7681253e9a702b
      https://github.com/WebKit/WebKit/commit/95aa1b90b75fbd9bd2cb2047ba7681253e9a702b
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-12 (Sun, 12 Oct 2014)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/PlatformEfl.cmake
    M Source/WTF/wtf/PlatformGTK.cmake
    M Source/WTF/wtf/gobject/GMainLoopSource.cpp
    M Source/WTF/wtf/gobject/GMainLoopSource.h
    M Source/WTF/wtf/gobject/GMutexLocker.h
    A Source/WTF/wtf/gobject/GThreadSafeMainLoopSource.cpp
    A Source/WTF/wtf/gobject/GThreadSafeMainLoopSource.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/audio/gstreamer/AudioFileReaderGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/InbandTextTrackPrivateGStreamer.h
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h
    M Source/WebCore/platform/graphics/gstreamer/TrackPrivateBaseGStreamer.h
    M Source/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/WebKitMediaSourceGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WTF/gobject/GMainLoopSource.cpp

  Log Message:
  -----------
  Merge r174632 - [GLIB] Split GMainLoopSource moving thread safe implementation to its own class GThreadSafeMainLoopSource
https://bugs.webkit.org/show_bug.cgi?id=137485

Reviewed by Sergio Villar Senin.

Source/WebCore:

Use GThreadSafeMainLoopSource for GStreamer sources, since they
can be used from different threads. Also update GMutexLocker
usages, since it's now a template.

* platform/audio/gstreamer/AudioFileReaderGStreamer.cpp:
(WebCore::AudioFileReader::createBus):
* platform/graphics/gstreamer/InbandTextTrackPrivateGStreamer.h:
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
(WebCore::MediaPlayerPrivateGStreamerBase::updateTexture):
(WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):
(WebCore::MediaPlayerPrivateGStreamerBase::paint):
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
* platform/graphics/gstreamer/TrackPrivateBaseGStreamer.h:
* platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
(webkitVideoSinkTimeoutCallback):
(webkitVideoSinkRender):
(unlockBufferMutex):
(webkitVideoSinkUnlockStop):
(webkitVideoSinkStart):
* platform/graphics/gstreamer/WebKitMediaSourceGStreamer.cpp:
* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(webKitWebSrcGetProperty):
(webKitWebSrcStop):
(webKitWebSrcStart):
(webKitWebSrcChangeState):
(webKitWebSrcQueryWithParent):
(webKitWebSrcGetUri):
(webKitWebSrcSetUri):
(webKitWebSrcNeedDataMainCb):
(webKitWebSrcNeedDataCb):
(webKitWebSrcEnoughDataMainCb):
(webKitWebSrcEnoughDataCb):
(webKitWebSrcSeekDataCb):
(webKitWebSrcSetMediaPlayer):
(StreamingClient::createReadBuffer):
(StreamingClient::handleResponseReceived):
(StreamingClient::handleDataReceived):
(StreamingClient::handleNotifyFinished):
(ResourceHandleStreamingClient::wasBlocked):
(ResourceHandleStreamingClient::cannotShowURL):

Source/WTF:

We made GMainLoopSource thread safe, but in most of the cases we
know the sources are used by a single thread, which has an impact
in the performance (mutex, GCancellable, etc.). The new class
GThreadSafeMainLoopSource inherits from GMainLoopSource overriding
the new virtual methods and calling the parent for the common code.
GMutexLocker now supports recursive mutexes, it's a template that
can wrap a GMutex or a GRecMutex. GThreadSafeMainLoopSource uses a
recursive mutex using the new GMutexLocker API.

* wtf/PlatformEfl.cmake: Add new file to compilation.
* wtf/PlatformGTK.cmake: Ditto.
* wtf/gobject/GMainLoopSource.cpp:
(WTF::GMainLoopSource::GMainLoopSource):
(WTF::GMainLoopSource::~GMainLoopSource):
(WTF::GMainLoopSource::cancel):
(WTF::GMainLoopSource::schedule):
(WTF::GMainLoopSource::scheduleAfterDelay):
(WTF::GMainLoopSource::prepareVoidCallback):
(WTF::GMainLoopSource::finishVoidCallback):
(WTF::GMainLoopSource::voidCallback):
(WTF::GMainLoopSource::prepareBoolCallback):
(WTF::GMainLoopSource::finishBoolCallback):
(WTF::GMainLoopSource::boolCallback):
(WTF::GMainLoopSource::socketCallback):
(WTF::GMainLoopSource::cancelWithoutLocking): Deleted.
* wtf/gobject/GMainLoopSource.h:
* wtf/gobject/GMutexLocker.h:
(WTF::MutexWrapper<GMutex>::lock):
(WTF::MutexWrapper<GMutex>::unlock):
(WTF::MutexWrapper<GRecMutex>::lock):
(WTF::MutexWrapper<GRecMutex>::unlock):
(WTF::GMutexLocker::GMutexLocker):
(WTF::GMutexLocker::lock):
(WTF::GMutexLocker::unlock):
* wtf/gobject/GThreadSafeMainLoopSource.cpp: Added.
(WTF::GThreadSafeMainLoopSource::GThreadSafeMainLoopSource):
(WTF::GThreadSafeMainLoopSource::~GThreadSafeMainLoopSource):
(WTF::GThreadSafeMainLoopSource::cancel):
(WTF::GThreadSafeMainLoopSource::schedule):
(WTF::GThreadSafeMainLoopSource::scheduleAfterDelay):
(WTF::GThreadSafeMainLoopSource::prepareVoidCallback):
(WTF::GThreadSafeMainLoopSource::finishVoidCallback):
(WTF::GThreadSafeMainLoopSource::voidCallback):
(WTF::GThreadSafeMainLoopSource::prepareBoolCallback):
(WTF::GThreadSafeMainLoopSource::finishBoolCallback):
(WTF::GThreadSafeMainLoopSource::boolCallback):
* wtf/gobject/GThreadSafeMainLoopSource.h: Added.

Tools:

Update GMainLoopSource tests. Most of the tests are now run twice,
first with a GMainLoopSource and then with a
GThreadSafeMainLoopSource, since both should have the same
behaviour. The threading test uses GThreadSafeMainLoopSource and
the delete on destroy test uses GMainLoopSource. The tests
themselves haven't changed, since there's no change in behaviour.

* TestWebKitAPI/Tests/WTF/gobject/GMainLoopSource.cpp:
(TestWebKitAPI::GMainLoopSourceTest::source):
(TestWebKitAPI::basicRescheduling):
(TestWebKitAPI::TEST):
(TestWebKitAPI::reentrantRescheduling):
(TestWebKitAPI::cancelRepeatingSourceDuringDispatch):
(TestWebKitAPI::basicDestroyCallbacks):
(TestWebKitAPI::destroyCallbacksAfterCancellingDuringDispatch):
(TestWebKitAPI::destroyCallbacksAfterReschedulingDuringDispatch):

Canonical link: https://commits.webkit.org/154760.79@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174638 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: bda21efdb3dc570f9d31666bacdb51f040b64e8d
      https://github.com/WebKit/WebKit/commit/bda21efdb3dc570f9d31666bacdb51f040b64e8d
  Author: Sergio Villar Senin <svillar at igalia.com>
  Date:   2014-10-13 (Mon, 13 Oct 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/NetworkProcess/soup/NetworkProcessSoup.cpp
    M Source/WebKit2/WebProcess/soup/WebProcessSoup.cpp

  Log Message:
  -----------
  Merge r174639 - [SOUP] [WK2] WebProcess and NetworkProcess initialization clears cache contents
https://bugs.webkit.org/show_bug.cgi?id=137489

Reviewed by Carlos Garcia Campos.

Temporarily set the SoupCache's maximum size to a huge value
before calling soup_cache_load() so that the cache is not shrinked
to the default value.

* NetworkProcess/soup/NetworkProcessSoup.cpp:
(WebKit::NetworkProcess::platformInitializeNetworkProcess):
* WebProcess/soup/WebProcessSoup.cpp:
(WebKit::WebProcess::platformInitializeWebProcess):

Canonical link: https://commits.webkit.org/154760.80@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174644 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 79138fea13c3983dc405d9c6325eac4344e248cb
      https://github.com/WebKit/WebKit/commit/79138fea13c3983dc405d9c6325eac4344e248cb
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2014-10-13 (Mon, 13 Oct 2014)

  Changed paths:
    M Source/WebKit2/CMakeLists.txt
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/PlatformGTK.cmake
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/PlatformGTK.cmake

  Log Message:
  -----------
  Unreviewed. Fix make distcheck.

Source/WebKit2:

* CMakeLists.txt:
* PlatformGTK.cmake:

Tools:

* TestWebKitAPI/PlatformGTK.cmake:

Canonical link: https://commits.webkit.org/154760.81@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174645 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f43d332cc6eee8ba361cd6da346442cfd56d03ce
      https://github.com/WebKit/WebKit/commit/f43d332cc6eee8ba361cd6da346442cfd56d03ce
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2014-10-13 (Mon, 13 Oct 2014)

  Changed paths:
    M ChangeLog
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.6.1 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit2:

* gtk/NEWS: Add release notes for 2.6.1.

Canonical link: https://commits.webkit.org/154760.82@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174646 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: ef8b65b5e353b29b6fbacf194abb5fe689a76a62
      https://github.com/WebKit/WebKit/commit/ef8b65b5e353b29b6fbacf194abb5fe689a76a62
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderThemeGtk.cpp

  Log Message:
  -----------
  Merge r174929 - [GTK] Several labels are white instead of black
https://bugs.webkit.org/show_bug.cgi?id=137803

Reviewed by Martin Robinson.

Recent GTK+ versions require to explicitly set the state before
getting a color.

* rendering/RenderThemeGtk.cpp:
(WebCore::styleColor): Helper function to get a color from a
GtkStylecontext that explicitly sets the state before getting the color.
(WebCore::RenderThemeGtk::platformActiveSelectionBackgroundColor): Use styleColor().
(WebCore::RenderThemeGtk::platformInactiveSelectionBackgroundColor): Ditto.
(WebCore::RenderThemeGtk::platformActiveSelectionForegroundColor): Ditto.
(WebCore::RenderThemeGtk::platformInactiveSelectionForegroundColor): Ditto.
(WebCore::RenderThemeGtk::platformActiveListBoxSelectionBackgroundColor): Ditto.
(WebCore::RenderThemeGtk::platformInactiveListBoxSelectionBackgroundColor): Ditto.
(WebCore::RenderThemeGtk::platformActiveListBoxSelectionForegroundColor): Ditto.
(WebCore::RenderThemeGtk::platformInactiveListBoxSelectionForegroundColor): Ditto.
(WebCore::RenderThemeGtk::systemColor): Ditto.

Canonical link: https://commits.webkit.org/154760.83@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174932 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 8dda08d5e3e2f8c242586d4531d7b155aad66d84
      https://github.com/WebKit/WebKit/commit/8dda08d5e3e2f8c242586d4531d7b155aad66d84
  Author: Filip Pizlo <fpizlo at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/SpeculatedType.h
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/dfg/DFGInsertionSet.h
    M Source/JavaScriptCore/dfg/DFGNode.h

  Log Message:
  -----------
  Merge r174025, r174121, r174749, r174856, r174899 - DFG shouldn't insert store barriers when it has it on good authority that we're not storing a cell
https://bugs.webkit.org/show_bug.cgi?id=137161

Reviewed by Mark Hahnenberg.

This looks like a 1% Octane speed-up.

* bytecode/SpeculatedType.h:
(JSC::isNotCellSpeculation):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::insertStoreBarrier):
(JSC::DFG::FixupPhase::insertCheck):
* dfg/DFGNode.h:
(JSC::DFG::Node::shouldSpeculateNotCell):

REGRESSION (r174025): Invalid cast in JSC::asString
https://bugs.webkit.org/show_bug.cgi?id=137224

Reviewed by Geoffrey Garen.

Store barrier elision in fixup depends on checking the type of the value being stored. It's very important that
when we speak of "the value being stored" we are really referring to the right value.

The bug here was that the PutClosureVar case was assuming that child2 is the value being stored. It's actually
child3. So we were incorrectly removing all barriers from PutClosureVar.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):

REGRESSION(r174025): remote inspector crashes frequently when executing inspector frontend's JavaScript
https://bugs.webkit.org/show_bug.cgi?id=137758

Rubber stamped by Filip Pizlo.

Reverted r174025 for just PutByOffset Nodes.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):

Web Process crash when starting the web inspector after r174025.
<https://webkit.org/b/137340>

Reviewed by Filip Pizlo.

After r174025, we can generate a bad graph in the DFG fixup phase like so:

    102:<!0:-> StoreBarrier(Check:KnownCell:@19, ..., bc#44)
    60:<!0:->  PutStructure(Check:KnownCell:@19, ..., bc#44)
    103:<!0:-> Check(Check:NotCell:@54, ..., bc#44)
            // ^-- PutByOffset's StoreBarrier has been elided and replaced
            //     with a speculation check which can OSR exit.
    61:<!0:->  PutByOffset(Check:KnownCell:@19, ..., bc#44)

As a result, the structure change will get executed even if we end up OSR
exiting before the PutByOffset.  In the baseline JIT code, the structure now
erroneously tells the put operation that there is a value in that property
slot when it is actually uninitialized (hence, the crash).

The fix is to insert the Check at the earliest point possible:

1. If the checked node is in the same bytecode as the PutByOffset, then
   the earliest point where we can insert the Check is right after the
   checked node.

2. If the checked node is from a preceding bytecode (before the PutByOffset),
   then the earliest point where we can insert the Check is at the start
   of the current bytecode.

Also reverted the workaround from r174749: https://webkit.org/b/137758.

Benchmark results appear to be a wash on aggregate.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::indexOfNode):
(JSC::DFG::FixupPhase::indexOfFirstNodeOfExitOrigin):
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::insertCheck):
* dfg/DFGInsertionSet.h:
(JSC::DFG::InsertionSet::insertOutOfOrder):
(JSC::DFG::InsertionSet::insertOutOfOrderNode):

[Follow up] Web Process crash when starting the web inspector after r174025.
<https://webkit.org/b/137340>

Reviewed by Geoffrey Garen.

Applied Geoff's feedback to clean up some code for better clarity after
r174856.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::insertCheck):
* dfg/DFGInsertionSet.h:
(JSC::DFG::InsertionSet::insertOutOfOrder):

Canonical link: https://commits.webkit.org/154760.84@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174934 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e29348a29cb93c7a5e517ea6f3bebb2cecf4bc47
      https://github.com/WebKit/WebKit/commit/e29348a29cb93c7a5e517ea6f3bebb2cecf4bc47
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Main.html
    M Tools/ChangeLog
    M Tools/Scripts/run-gtk-tests
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestInspectorServer.cpp

  Log Message:
  -----------
  Merge r174926 - [GTK] Test TestWebKitAPI/WebKit2Gtk/TestInspectorServer fails
https://bugs.webkit.org/show_bug.cgi?id=132044

Reviewed by Brian Burg.

Source/WebInspectorUI:

Make sure Protocol/InspectorFrontendHostStub.js is loaded before
Base/Platform.js, because Platform uses the InspectorFrontendHost
object.

* UserInterface/Main.html:

Tools:

* TestWebKitAPI/Tests/WebKit2Gtk/TestInspectorServer.cpp:
(openRemoteDebuggingSession): Remove trailing slash when
concatenating base inspector URL with the page, because the
inspector returns the relative paths with a leading slash.

Canonical link: https://commits.webkit.org/154760.85@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174935 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e19b087b479f3b2fc464f41104e771cbc3de25f4
      https://github.com/WebKit/WebKit/commit/e19b087b479f3b2fc464f41104e771cbc3de25f4
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/gobject/GMainLoopSource.cpp
    M Source/WTF/wtf/gobject/GMainLoopSource.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/gtk/SharedTimerGtk.cpp
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp

  Log Message:
  -----------
  Merge r174818 - [GLIB] Add API to GMainLoopSource to schedule sources after a delay in microseconds
https://bugs.webkit.org/show_bug.cgi?id=137782

Reviewed by Sergio Villar Senin.

Source/WebCore:

* platform/gtk/SharedTimerGtk.cpp:
(WebCore::setSharedTimerFireInterval): Use microseconds instead of
milliseconds.

Source/WebKit2:

* WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp:
(WebKit::LayerTreeHostGtk::layerFlushTimerFired): Use microseconds
instead of milliseconds.

Source/WTF:

In some cases when we have a double with the time in seconds, the
conversion to milliseconds ends up truncating the value to 0, and
the source scheduled immediately.

* wtf/gobject/GMainLoopSource.cpp:
(WTF::createMicrosecondsTimeoutSource): Use a custom timeout
source that handles the interval in microseconds instead of milliseconds.
(WTF::GMainLoopSource::scheduleAfterDelay): Use MicrosecondsTimeoutSource.
(WTF::GMainLoopSource::scheduleAfterDelayAndDeleteOnDestroy): Ditto.
* wtf/gobject/GMainLoopSource.h:

Canonical link: https://commits.webkit.org/154760.86@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174936 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 98c402207743b75c9b5db1c5e928012b682d0fb9
      https://github.com/WebKit/WebKit/commit/98c402207743b75c9b5db1c5e928012b682d0fb9
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M ChangeLog
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Merge r174812 - REGRESSION(CMake): [GTK] WebKitSettings:enable-smooth-scrolling does nothing
https://bugs.webkit.org/show_bug.cgi?id=137781

Reviewed by Martin Robinson.

We used to enable smooth scrolling unconditionally in autotools
(via WebKitFeatures.m4), but since the switch to CMake it's
unconditionally disabled, so changing the setting doesn't have any
effect.

* Source/cmake/OptionsGTK.cmake: Enable smooth scrolling.

Canonical link: https://commits.webkit.org/154760.87@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174937 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 195d40801f8fbc436f42b7771bfc4b26f9c91bb7
      https://github.com/WebKit/WebKit/commit/195d40801f8fbc436f42b7771bfc4b26f9c91bb7
  Author: Saam Barati <saambarati1 at gmail.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/TypeSet.cpp
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Models/TypeSet.js
    M Source/WebInspectorUI/UserInterface/Views/TypeTokenView.js

  Log Message:
  -----------
  Merge r173805 - Web Inspector: fix TypeSet hierarchy in TypeTokenView
https://bugs.webkit.org/show_bug.cgi?id=136982

Reviewed by Joseph Pecoraro.

Source/JavaScriptCore:

TypeSet was computing the set of type booleans in the Inspector::Protocol::Runtime::TypeSet
object incorrectly because it was calling TypeSet::doesTypeConformTo(T) which checks if the
type set has only been of type T. It now checks '(m_seenTypes & T) != TypeNothing' to see
if type T is in the set of seen types, but not the entire set itself.

* runtime/TypeSet.cpp:
(JSC::TypeSet::inspectorTypeSet):

Source/WebInspectorUI:

The protocol object representation of TypeSet was being computed
incorrectly in JSC::TypeSet. This patch fixes that problem
and also asserts that the type information that the Web Inspector
receives is not empty.

* UserInterface/Models/TypeSet.js:
(WebInspector.TypeSet):
* UserInterface/Views/TypeTokenView.js:
(WebInspector.TypeTokenView.prototype._displayTypeName):

Canonical link: https://commits.webkit.org/154760.88@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174938 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 7f60daa291a237ecf0e55efbe7ceb7ba51a1068f
      https://github.com/WebKit/WebKit/commit/7f60daa291a237ecf0e55efbe7ceb7ba51a1068f
  Author: Joseph Pecoraro <pecoraro at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Views/CodeMirrorAdditions.js

  Log Message:
  -----------
  Merge r173792 - Web Inspector: Option+Click on CSS url(...) should jump to resource view
https://bugs.webkit.org/show_bug.cgi?id=136965

Patch by Joseph Pecoraro <pecoraro at apple.com> on 2014-09-20
Reviewed by Timothy Hatcher.

* UserInterface/Views/CodeMirrorAdditions.js:
When parsing CSS url(...) tokens, the contents of url(...)
are a "string" type, not "atom".

Canonical link: https://commits.webkit.org/154760.89@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174939 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 9e62d9d31cd482242faf325356cf5af5d0c49941
      https://github.com/WebKit/WebKit/commit/9e62d9d31cd482242faf325356cf5af5d0c49941
  Author: BJ Burg <burg at cs.washington.edu>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/inspector/InjectedScript.cpp
    M Source/JavaScriptCore/inspector/InjectedScriptBase.cpp
    M Source/JavaScriptCore/inspector/InjectedScriptManager.cpp
    M Source/JavaScriptCore/inspector/InspectorBackendDispatcher.cpp
    M Source/JavaScriptCore/inspector/InspectorProtocolTypes.h
    M Source/JavaScriptCore/inspector/InspectorValues.cpp
    M Source/JavaScriptCore/inspector/InspectorValues.h
    M Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp
    M Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.cpp
    M Source/JavaScriptCore/inspector/scripts/codegen/generate_protocol_types_implementation.py
    M Source/JavaScriptCore/inspector/scripts/codegen/generator_templates.py
    M Source/JavaScriptCore/inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result
    M Source/JavaScriptCore/replay/EncodedValue.cpp
    M Source/WebCore/ChangeLog
    M Source/WebCore/inspector/CommandLineAPIHost.cpp
    M Source/WebCore/inspector/InspectorCSSAgent.cpp
    M Source/WebCore/inspector/InspectorDOMAgent.cpp
    M Source/WebCore/inspector/InspectorDOMStorageAgent.cpp
    M Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
    M Source/WebCore/inspector/InspectorPageAgent.cpp
    M Source/WebCore/inspector/InspectorReplayAgent.cpp
    M Source/WebCore/inspector/InspectorResourceAgent.cpp
    M Source/WebCore/inspector/InspectorStyleSheet.cpp
    M Source/WebCore/inspector/InspectorStyleSheet.h
    M Source/WebCore/inspector/InspectorTimelineAgent.cpp
    M Source/WebCore/inspector/InspectorWorkerAgent.cpp

  Log Message:
  -----------
  Merge r174094 - Web Inspector: InspectorValues should use references for out parameters
https://bugs.webkit.org/show_bug.cgi?id=137190

Reviewed by Joseph Pecoraro.

Source/JavaScriptCore:

Use references for out parameters in asType() and getType() methods.
Also convert to references in some miscellaneous code where we don't
expect or handle null values.

Remove variants of asObject() and asArray() that return a nullable RefPtr.
Now, client code is forced to use out parameters and check for cast failure.

Iron out control flow in some functions and fix some style issues.

* inspector/InjectedScript.cpp:
(Inspector::InjectedScript::getFunctionDetails):
(Inspector::InjectedScript::wrapObject):
(Inspector::InjectedScript::wrapTable):
* inspector/InjectedScriptBase.cpp:
(Inspector::InjectedScriptBase::makeEvalCall):
* inspector/InjectedScriptManager.cpp:
(Inspector::InjectedScriptManager::injectedScriptForObjectId): Simplify control flow.
* inspector/InspectorBackendDispatcher.cpp:
(Inspector::InspectorBackendDispatcher::dispatch):
(Inspector::getPropertyValue):
(Inspector::AsMethodBridges::asInteger):
(Inspector::AsMethodBridges::asDouble):
(Inspector::AsMethodBridges::asString):
(Inspector::AsMethodBridges::asBoolean):
(Inspector::AsMethodBridges::asObject):
(Inspector::AsMethodBridges::asArray):
* inspector/InspectorProtocolTypes.h:
(Inspector::Protocol::BindingTraits<Protocol::Array<T>>::runtimeCast):
(Inspector::Protocol::BindingTraits<Protocol::Array<T>>::assertValueHasExpectedType):
* inspector/InspectorValues.cpp: Use more by-reference out parameters. Add more spacing.
(Inspector::InspectorValue::asBoolean):
(Inspector::InspectorValue::asDouble):
(Inspector::InspectorValue::asInteger):
(Inspector::InspectorValue::asString):
(Inspector::InspectorValue::asValue):
(Inspector::InspectorValue::asObject):
(Inspector::InspectorValue::asArray):
(Inspector::InspectorValue::parseJSON):
(Inspector::InspectorValue::toJSONString):
(Inspector::InspectorValue::writeJSON):
(Inspector::InspectorBasicValue::asBoolean):
(Inspector::InspectorBasicValue::asDouble):
(Inspector::InspectorBasicValue::asInteger):
(Inspector::InspectorBasicValue::writeJSON):
(Inspector::InspectorString::asString):
(Inspector::InspectorString::writeJSON):
(Inspector::InspectorObjectBase::asObject):
(Inspector::InspectorObjectBase::openAccessors):
(Inspector::InspectorObjectBase::getBoolean):
(Inspector::InspectorObjectBase::getString):
(Inspector::InspectorObjectBase::getObject):
(Inspector::InspectorObjectBase::getArray):
(Inspector::InspectorObjectBase::writeJSON):
(Inspector::InspectorArrayBase::asArray):
(Inspector::InspectorArrayBase::writeJSON):
* inspector/InspectorValues.h:
* inspector/agents/InspectorDebuggerAgent.cpp:
(Inspector::InspectorDebuggerAgent::breakpointActionsFromProtocol):
(Inspector::InspectorDebuggerAgent::setBreakpointByUrl):
(Inspector::parseLocation):
(Inspector::InspectorDebuggerAgent::setBreakpoint):
(Inspector::InspectorDebuggerAgent::continueToLocation):
(Inspector::InspectorDebuggerAgent::didParseSource):
* inspector/agents/InspectorRuntimeAgent.cpp:
(Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
* inspector/scripts/codegen/generate_protocol_types_implementation.py:
(ProtocolTypesImplementationGenerator):
(ProtocolTypesImplementationGenerator._generate_assertion_for_enum):
* inspector/scripts/codegen/generator_templates.py:
* inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
* replay/EncodedValue.cpp:
(JSC::EncodedValue::asObject):
(JSC::EncodedValue::asArray):
(JSC::EncodedValue::convertTo<bool>):
(JSC::EncodedValue::convertTo<double>):
(JSC::EncodedValue::convertTo<float>):
(JSC::EncodedValue::convertTo<int32_t>):
(JSC::EncodedValue::convertTo<int64_t>):
(JSC::EncodedValue::convertTo<uint32_t>):
(JSC::EncodedValue::convertTo<uint64_t>):
(JSC::EncodedValue::convertTo<String>):

Source/WebCore:

Clean up some call sites to explicitly check for cast success, and simplify
some exceptional control flows.

No new tests, no behavior changed.

* inspector/CommandLineAPIHost.cpp:
(WebCore::CommandLineAPIHost::inspectImpl):
* inspector/InspectorCSSAgent.cpp:
(WebCore::computePseudoClassMask):
* inspector/InspectorDOMAgent.cpp:
(WebCore::parseColor):
(WebCore::parseConfigColor):
(WebCore::parseQuad):
(WebCore::InspectorDOMAgent::performSearch):
(WebCore::InspectorDOMAgent::highlightConfigFromInspectorObject):
(WebCore::InspectorDOMAgent::innerHighlightQuad):
(WebCore::InspectorDOMAgent::highlightFrame):
* inspector/InspectorDOMStorageAgent.cpp:
(WebCore::InspectorDOMStorageAgent::findStorageArea):
* inspector/InspectorIndexedDBAgent.cpp: Use NeverDestroyed instead of DEPRECATED_DEFINE_STATIC_LOCAL.
* inspector/InspectorPageAgent.cpp:
(WebCore::InspectorPageAgent::didClearWindowObjectInWorld):
* inspector/InspectorReplayAgent.cpp:
(WebCore::InspectorReplayAgent::replayToPosition):
* inspector/InspectorResourceAgent.cpp:
(WebCore::InspectorResourceAgent::willSendRequest):
* inspector/InspectorStyleSheet.cpp:
(WebCore::InspectorStyle::styleWithProperties):
* inspector/InspectorStyleSheet.h:
(WebCore::InspectorCSSId::InspectorCSSId):
* inspector/InspectorTimelineAgent.cpp:
(WebCore::InspectorTimelineAgent::startFromConsole):
(WebCore::InspectorTimelineAgent::stopFromConsole):
* inspector/InspectorWorkerAgent.cpp:

Canonical link: https://commits.webkit.org/154760.90@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174941 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 68edd53b4ed4e0d4e981b6fcfe145c452f8a49ca
      https://github.com/WebKit/WebKit/commit/68edd53b4ed4e0d4e981b6fcfe145c452f8a49ca
  Author: Filip Pizlo <fpizlo at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

  Log Message:
  -----------
  Merge r174090 - Don't use GPRResult unless you're flushing registers and making a runtime function call
https://bugs.webkit.org/show_bug.cgi?id=137234

Rubber stamped by Andreas Kling.

Rename GPRResult to GPRFlushedCallResult, in an attempt to dissuade people from using it for results in the
general case.

Replace GPRResult with GPRTemporary in those places where it was causing bugs: particularly in GetDirectPname it
would cause us to spill the register that has the base, and the code was assuming (rightly) that the base and the
result were in different registers. That's a valid assumption when using GPRTemporary but not with GPRResult.
Also this code wasn't getting any benefit from using GPRResult because it wasn't doing flushRegisters().

I don't know how to test this. A test would require setting up a particularly awkward register allocation state.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileIn):
(JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck):
(JSC::DFG::SpeculativeJIT::compileNewFunctionExpression):
(JSC::DFG::SpeculativeJIT::compileRegExpExec):
(JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
(JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
(JSC::DFG::SpeculativeJIT::compileToStringOnCell):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::GPRFlushedCallResult::GPRFlushedCallResult):
(JSC::DFG::GPRFlushedCallResult2::GPRFlushedCallResult2):
(JSC::DFG::GPRResult::GPRResult): Deleted.
(JSC::DFG::GPRResult2::GPRResult2): Deleted.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::speculateDoubleRepMachineInt):

Canonical link: https://commits.webkit.org/154760.91@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174942 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: b0b6e7614397507637400beba4dfb1ac7f3b4b97
      https://github.com/WebKit/WebKit/commit/b0b6e7614397507637400beba4dfb1ac7f3b4b97
  Author: Filip Pizlo <fpizlo at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

  Log Message:
  -----------
  Merge r174091 - DFG HasStructureProperty codegen should use one fewer registers
https://bugs.webkit.org/show_bug.cgi?id=137235

Reviewed by Andreas Kling.

This was an obvious source of inefficiency and it was causing us to run out of registers on
x86-32.

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):

Canonical link: https://commits.webkit.org/154760.92@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174943 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 4383da1f4180872cb20247b53e628e79d76a1132
      https://github.com/WebKit/WebKit/commit/4383da1f4180872cb20247b53e628e79d76a1132
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGGraph.cpp
    M Source/JavaScriptCore/runtime/JSCell.h
    M Source/JavaScriptCore/runtime/StructureIDTable.h

  Log Message:
  -----------
  Merge r174122 - Label some asserts as having security implications.
<https://webkit.org/b/137260>

Reviewed by Filip Pizlo.

* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::handleAssertionFailure):
* runtime/JSCell.h:
(JSC::jsCast):
* runtime/StructureIDTable.h:
(JSC::StructureIDTable::get):

Canonical link: https://commits.webkit.org/154760.93@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174944 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 645b8b6be140a146d5d53c960562560da39d98b6
      https://github.com/WebKit/WebKit/commit/645b8b6be140a146d5d53c960562560da39d98b6
  Author: Yusuke Suzuki <utatane.tea at gmail.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/cssjit/StackAllocator.h

  Log Message:
  -----------
  Merge r174142 - CSS JIT: Enable multiple stack references allocation by allocateUninitialized
https://bugs.webkit.org/show_bug.cgi?id=135293

Reviewed by Benjamin Poulain.

* cssjit/StackAllocator.h:
(WebCore::StackAllocator::stackTop):
    Add stackTop method to check references are allocated easily.
(WebCore::StackAllocator::allocateUninitialized):

Canonical link: https://commits.webkit.org/154760.94@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174945 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 5d45c8201e425f076ea28c5175516b5ffe5536ac
      https://github.com/WebKit/WebKit/commit/5d45c8201e425f076ea28c5175516b5ffe5536ac
  Author: JinYoung Hur <hurims at gmail.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/API/C/WKPage.cpp

  Log Message:
  -----------
  Merge r174204 - Minor bug in UIClient::exceededDatabaseQuota()
https://bugs.webkit.org/show_bug.cgi?id=137213

Patch by JinYoung Hur <hurims at gmail.com> on 2014-10-02
Reviewed by Anders Carlsson.

Make sure not to call the completion handler twice if exceededDatabaseQuota is null.

* UIProcess/API/C/WKPage.cpp:
(WKPageSetPageUIClient):

Canonical link: https://commits.webkit.org/154760.95@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174947 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 355a0147088e2c1f94a987576700ece3da9cb5fb
      https://github.com/WebKit/WebKit/commit/355a0147088e2c1f94a987576700ece3da9cb5fb
  Author: Eva Balazsfalvi <evab.u-szeged at partner.samsung.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSParser.cpp
    M Source/WebCore/html/parser/HTMLPreloadScanner.cpp
    M Source/WebCore/page/Page.cpp
    M Source/WebCore/platform/graphics/WidthIterator.cpp
    M Source/WebCore/rendering/svg/SVGInlineTextBox.cpp

  Log Message:
  -----------
  Merge r174206 - Fix minimal build warnings
https://bugs.webkit.org/show_bug.cgi?id=137066

Reviewed by Daniel Bates.

No new tests, no behavior change.

* css/CSSParser.cpp:
(WebCore::isValidKeywordPropertyAndValue):
* html/parser/HTMLPreloadScanner.cpp:
(WebCore::TokenPreloadScanner::StartTagScanner::processAttributes):
* page/Page.cpp:
(WebCore::Page::setPageScaleFactor):
* platform/graphics/WidthIterator.cpp:
(WebCore::WidthIterator::glyphDataForCharacter):
* rendering/svg/SVGInlineTextBox.cpp:
(WebCore::SVGInlineTextBox::prepareGraphicsContextForTextPainting):

Canonical link: https://commits.webkit.org/154760.96@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174948 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 6d9de4d8c15d1e5e916ea1ae68f6c0968365d8b7
      https://github.com/WebKit/WebKit/commit/6d9de4d8c15d1e5e916ea1ae68f6c0968365d8b7
  Author: Carlos Alberto Lopez Perez <clopez at igalia.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Tools/ChangeLog
    M Tools/gtk/jhbuild.modules

  Log Message:
  -----------
  Merge r174209 - [GTK] [JHBuild] Switch sourceware.org mirror to http.

Unreviewed.

The ftp access is recently failing to work as expected, and the
bots fail to download the file.
The same mirror is available via http and seems to work better.

* gtk/jhbuild.modules:

Canonical link: https://commits.webkit.org/154760.97@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174949 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: b4dfa4c0fc3de421214d63ad2e22690d25816ad1
      https://github.com/WebKit/WebKit/commit/b4dfa4c0fc3de421214d63ad2e22690d25816ad1
  Author: Krzysztof Czech <k.czech at samsung.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/accessibility/aria-scrollbar-role-expected.txt
    M LayoutTests/accessibility/aria-scrollbar-role.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AccessibilityRenderObject.cpp

  Log Message:
  -----------
  Merge r174217 - AX: Default orientation for aria scrollbars should be vertical
https://bugs.webkit.org/show_bug.cgi?id=137341

Reviewed by Chris Fleizach.

Source/WebCore:

Default orientation for aria scrollbars regarding w3c spec should be vertical

No new tests, covering by existing one.

* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::orientation):

LayoutTests:

Update expectation and test for having new test case.

* accessibility/aria-scrollbar-role-expected.txt:
* accessibility/aria-scrollbar-role.html:

Canonical link: https://commits.webkit.org/154760.98@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174950 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 0b162985cc1a1e2251cab842c6c5a18a35d93cdb
      https://github.com/WebKit/WebKit/commit/0b162985cc1a1e2251cab842c6c5a18a35d93cdb
  Author: Anders Carlsson <andersca at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/JSString.h
    M Source/JavaScriptCore/runtime/JSStringBuilder.h

  Log Message:
  -----------
  Merge r174219 - Use variadic templates for jsMakeNontrivialString
https://bugs.webkit.org/show_bug.cgi?id=137325

Reviewed by Sam Weinig.

* runtime/JSString.h:
(JSC::jsNontrivialString):
Add an overload that takes an rvalue reference to a String so we can transfer ownership easily.

* runtime/JSStringBuilder.h:
(JSC::jsMakeNontrivialString):
Make this a variadic function template, with a single-parameter version that can steal the string if it's OK to do so.

Canonical link: https://commits.webkit.org/154760.99@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174951 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f2cd462a3bfe755a37b9e53b3a3ed6e98406980e
      https://github.com/WebKit/WebKit/commit/f2cd462a3bfe755a37b9e53b3a3ed6e98406980e
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/xml/XMLHttpRequestProgressEventThrottle.cpp
    M Source/WebCore/xml/XMLHttpRequestProgressEventThrottle.h

  Log Message:
  -----------
  Merge r174235 - XMLHttpRequestProgressEventThrottle shouldn't throttle / defer progress events if there are no listeners
https://bugs.webkit.org/show_bug.cgi?id=137346

Reviewed by Alexey Proskuryakov.

Previously XMLHttpRequestProgressEventThrottle would throttle / defer
progress events, which involves queueing events and starting timers,
even if there were no listeners for those events (which is fairly
common case).

This patch updates XMLHttpRequestProgressEventThrottle to make sure
there are actual progress event listeners *before* attempting to
throttle and do extra processing, to avoid doing unnecessary work.

This patch also makes XMLHttpRequestProgressEventThrottle::dispatchEvent()
private as this method is only called from other dispatch methods of
the class and never from the outside.

No new tests, no behavior change.

* xml/XMLHttpRequestProgressEventThrottle.cpp:
(WebCore::XMLHttpRequestProgressEventThrottle::dispatchThrottledProgressEvent):
(WebCore::XMLHttpRequestProgressEventThrottle::dispatchProgressEvent):

Canonical link: https://commits.webkit.org/154760.100@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174952 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: ed4d83291e77163871b6643d543fad1ae2aa16f4
      https://github.com/WebKit/WebKit/commit/ed4d83291e77163871b6643d543fad1ae2aa16f4
  Author: Saam Barati <saambarati1 at gmail.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/JSCJSValueInlines.h

  Log Message:
  -----------
  Merge r174260 - Change how 32-bit JSValues check if they are a Boolean

Rubber stamped by Filip Pizlo.

32-bit JSValue::isBoolean can simply check if its tag corresponds
to the boolean tag instead of checking if it's either true or false.

* runtime/JSCJSValueInlines.h:
(JSC::JSValue::isBoolean):

Canonical link: https://commits.webkit.org/154760.101@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174953 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 41f4f50e86d89cf68491f0174efdc6f5c0413275
      https://github.com/WebKit/WebKit/commit/41f4f50e86d89cf68491f0174efdc6f5c0413275
  Author: Bear Travis <betravis at adobe.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/css/fontloader-tab-index-expected.html
    A LayoutTests/fast/css/fontloader-tab-index.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/FontLoader.cpp
    M Source/WebCore/css/FontLoader.h

  Log Message:
  -----------
  Merge r174273 - REGRESSION (r173531): Use after free in WebCore::RenderStyle::fontMetrics /
WebCore::CSSPrimitiveValue::computeLengthDouble
https://bugs.webkit.org/show_bug.cgi?id=136864

Reviewed by Andreas Kling.

Source/WebCore:

FontLoader previously called updateDocumentStyleIfNeeded,
which would reset styles currently in use as part of
the tabIndex calculation. The FontLoader should instead
wait for pending stylesheets to load.

Tests: fast/css/fontloader-tab-index.html

* css/FontLoader.cpp:
(WebCore::FontLoader::notifyWhenFontsReady): Do not immediately
call loadingDone().
(WebCore::FontLoader::loadingDone): Wait for stylesheets to
finish loading rather than updating document styles.
* css/FontLoader.h:
(WebCore::FontLoader::loading): Include JS font loads when testing
for the loading state.

LayoutTests:

Test that getting the tab index on a body element with
font-relative measurements to a local @font-face do not
cause a crash.

* fast/css/fontloader-tab-index-expected.html: Added.
* fast/css/fontloader-tab-index.html: Added.

Canonical link: https://commits.webkit.org/154760.102@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174954 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 2a02415b94471a35775837734ff2e88be96f3833
      https://github.com/WebKit/WebKit/commit/2a02415b94471a35775837734ff2e88be96f3833
  Author: Tim Horton <timothy_horton at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderView.cpp
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/WebProcess/WebPage/WebPage.cpp

  Log Message:
  -----------
  Merge r174287 - WKWebView snapshot of Daring Fireball has the wrong color in the obscured inset
https://bugs.webkit.org/show_bug.cgi?id=137383
<rdar://problem/18535439>

Reviewed by Sam Weinig.

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::snapshotAtSize):
Use documentBackgroundColor instead of baseBackgroundColor if backgroundShouldExtendBeyondPage is set.

* rendering/RenderView.cpp:
(WebCore::RenderView::paintBoxDecorations):
Use documentBackgroundColor instead of baseBackgroundColor if backgroundShouldExtendBeyondPage is set.

Canonical link: https://commits.webkit.org/154760.103@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174955 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 39e7e9cffe0efe674c62147da4c3d8d9cf9ea270
      https://github.com/WebKit/WebKit/commit/39e7e9cffe0efe674c62147da4c3d8d9cf9ea270
  Author: Oliver Hunt <oliver at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
    M Source/JavaScriptCore/jit/JITOpcodes.cpp
    M Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
    M Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
    M Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
    M Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

  Log Message:
  -----------
  Merge r174294 - tearoff_arguments should always refer to the unmodified arguments register
https://bugs.webkit.org/show_bug.cgi?id=137406

Reviewed by Michael Saboff.

To simplify subsequent work, and remove unnecessary work from
actual execution this patch simply ensures that tear_off_arguments
refers to the actual unmodified arguments register.

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitReturn):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_tear_off_arguments):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_tear_off_arguments):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:

Canonical link: https://commits.webkit.org/154760.104@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174956 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 62f1e8c15192784be6221ea56113546f9fcb065b
      https://github.com/WebKit/WebKit/commit/62f1e8c15192784be6221ea56113546f9fcb065b
  Author: Saam Barati <saambarati1 at gmail.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/jit/JITOpcodes32_64.cpp

  Log Message:
  -----------
  Merge r174298 - Implement op_profile_type in the 32-bit baseline JIT
https://bugs.webkit.org/show_bug.cgi?id=137181

Reviewed by Michael Saboff.

Generate inline code to write to the TypeProfilerLog inside the 32-bit
baseline JIT instead of unconditionally bailing out to the slow path
for op_profile_type.

* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_profile_type):

Canonical link: https://commits.webkit.org/154760.105@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174957 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 7e25ba54a0032ca9e88b00cafa598c4b310ad877
      https://github.com/WebKit/WebKit/commit/7e25ba54a0032ca9e88b00cafa598c4b310ad877
  Author: Lorenzo Tilve <ltilve at igalia.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/gtk/GtkDragAndDropHelper.cpp
    M Source/WebCore/platform/gtk/GtkDragAndDropHelper.h
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/Shared/gtk/ArgumentCodersGtk.cpp
    M Source/WebKit2/Shared/gtk/ArgumentCodersGtk.h
    M Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp
    M Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h
    M Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp
    M Source/WebKit2/UIProcess/PageClient.h

  Log Message:
  -----------
  Merge r174328 - [GTK] Fix build when DRAG_SUPPORT is disabled
https://bugs.webkit.org/show_bug.cgi?id=137361

Patch by Lorenzo Tilve <ltilve at igalia.com> on 2014-10-05
Reviewed by Carlos Garcia Campos.

Flag out unbuildable code without DRAG_SUPPORT.

Source/WebCore:

* platform/gtk/GtkDragAndDropHelper.cpp:
* platform/gtk/GtkDragAndDropHelper.h:

Source/WebKit2:

* Shared/gtk/ArgumentCodersGtk.cpp:
* Shared/gtk/ArgumentCodersGtk.h:
* UIProcess/API/gtk/PageClientImpl.cpp:
* UIProcess/API/gtk/PageClientImpl.h:
* UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewBaseConstructed):
* UIProcess/PageClient.h:

Canonical link: https://commits.webkit.org/154760.106@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174958 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 29ddaea43ced7083a602b184b4e2943a966dddb4
      https://github.com/WebKit/WebKit/commit/29ddaea43ced7083a602b184b4e2943a966dddb4
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/PlatformGTK.cmake
    R Source/WebCore/platform/gtk/ClipboardUtilitiesGtk.cpp
    R Source/WebCore/platform/gtk/ClipboardUtilitiesGtk.h
    R Source/WebCore/platform/gtk/GtkDragAndDropHelper.cpp
    R Source/WebCore/platform/gtk/GtkDragAndDropHelper.h
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/PlatformGTK.cmake
    M Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp
    M Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp
    M Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBasePrivate.h
    A Source/WebKit2/UIProcess/gtk/DragAndDropHandler.cpp
    A Source/WebKit2/UIProcess/gtk/DragAndDropHandler.h

  Log Message:
  -----------
  Merge r174868 - [GTK] Move GtkDragAndDropHelper from Platform to WebKit2
https://bugs.webkit.org/show_bug.cgi?id=137422

Reviewed by Martin Robinson.

Source/WebCore:

Remove ClipboardUtilitiesGtk and GtkDragAndDropHelper.

* PlatformGTK.cmake:
* platform/gtk/ClipboardUtilitiesGtk.cpp: Removed.
* platform/gtk/ClipboardUtilitiesGtk.h: Removed.
* platform/gtk/GtkDragAndDropHelper.cpp: Removed.
* platform/gtk/GtkDragAndDropHelper.h: Removed.

Source/WebKit2:

WebKitWebViewBase is currently the only user of
GtkDragAndDropHelper, that was added to share the code with
WebKit1. Move all the drag and drop logic to a new class
DragAndDropHandler.

* PlatformGTK.cmake: Add new files to compilation.
* UIProcess/API/gtk/PageClientImpl.cpp:
(WebKit::PageClientImpl::startDrag):
* UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewBaseConstructed):
(webkitWebViewBaseDragDataGet):
(webkitWebViewBaseDragEnd):
(webkitWebViewBaseDragDataReceived):
(webkitWebViewBaseDragMotion):
(webkitWebViewBaseDragLeave):
(webkitWebViewBaseDragDrop):
(webkitWebViewBaseDragAndDropHandler):
(dragExitedCallback): Deleted.
(webkitWebViewBaseStartDrag): Deleted.
* UIProcess/API/gtk/WebKitWebViewBasePrivate.h:
* UIProcess/gtk/DragAndDropHandler.cpp: Added.
(WebKit::DragAndDropHandler::create):
(WebKit::DragAndDropHandler::DragAndDropHandler):
(WebKit::DragAndDropHandler::DroppingContext::DroppingContext):
(WebKit::dragOperationToGdkDragActions):
(WebKit::dragOperationToSingleGdkDragAction):
(WebKit::gdkDragActionToDragOperation):
(WebKit::DragAndDropHandler::startDrag):
(WebKit::DragAndDropHandler::fillDragData):
(WebKit::DragAndDropHandler::finishDrag):
(WebKit::DragAndDropHandler::dataObjectForDropData):
(WebKit::DragAndDropHandler::dragEntered):
(WebKit::DragAndDropHandler::requestDragData):
(WebKit::DragAndDropHandler::dragMotion):
(WebKit::DragAndDropHandler::dragLeave):
(WebKit::DragAndDropHandler::drop):
* UIProcess/gtk/DragAndDropHandler.h: Added.

Canonical link: https://commits.webkit.org/154760.107@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174959 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: d38497edd271f1a5f545a20ff054e02e89e9c161
      https://github.com/WebKit/WebKit/commit/d38497edd271f1a5f545a20ff054e02e89e9c161
  Author: Chris Fleizach <cfleizach at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AccessibilityObject.cpp
    M Source/WebCore/accessibility/AccessibilityTableCell.cpp

  Log Message:
  -----------
  Merge r174345 - AX: Performance: Certain Web site causes Safari to hang completely while entering form data
https://bugs.webkit.org/show_bug.cgi?id=137420

Reviewed by Mario Sanchez Prada.

If a website has multiple nested tables that are not "accessibility" tables, the performance of accessibility slows to a crawl because:
  1) We are re-computing accessibilityIsIgnored many times.
       As a solution, we can enable the isIgnoredCache when updating children.
  2) When asking if an object isTableCell, we'd go up the parent chain, asking each of those parents the same question, which exploded into calling this many times.
      As a solution, I've changed our determination of isTableCell to instead check if the parent is an accessibiltyTable which should be much faster.

No new functionality. Existing tests cover changes.

* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::updateChildrenIfNecessary):
(WebCore::AccessibilityObject::accessibilityIsIgnored):
* accessibility/AccessibilityTableCell.cpp:
(WebCore::AccessibilityTableCell::parentTable):
(WebCore::AccessibilityTableCell::isTableCell):

Canonical link: https://commits.webkit.org/154760.108@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174960 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: cdf530afbd1a03da491974f15ddb5694159bdcb6
      https://github.com/WebKit/WebKit/commit/cdf530afbd1a03da491974f15ddb5694159bdcb6
  Author: Oliver Hunt <oliver at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/interpreter/Interpreter.cpp

  Log Message:
  -----------
  Merge r174361 - Fix cloop build.

Canonical link: https://commits.webkit.org/154760.109@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174961 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: fec9d26f649ade63d21bb1007c7eebf041057a27
      https://github.com/WebKit/WebKit/commit/fec9d26f649ade63d21bb1007c7eebf041057a27
  Author: David Hyatt <hyatt at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/inline-block/simple-line-layout-expected.html
    A LayoutTests/fast/inline-block/simple-line-layout.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/SimpleLineLayoutFunctions.h

  Log Message:
  -----------
  Merge r174370 - REGRESSION (Simple Line Layout): Inline block baselines computed incorrectly
https://bugs.webkit.org/show_bug.cgi?id=137461

Reviewed by Simon Fraser.

Source/WebCore:

Added fast/inline-block/simple-line-layout.html

* rendering/SimpleLineLayoutFunctions.h:
(WebCore::SimpleLineLayout::computeFlowFirstLineBaseline):
(WebCore::SimpleLineLayout::computeFlowLastLineBaseline):
Fix the baseline computation functions in simple line layout to
use lineCount rather than runCount.

LayoutTests:

* fast/inline-block/simple-line-layout-expected.html: Added.
* fast/inline-block/simple-line-layout.html: Added.

Canonical link: https://commits.webkit.org/154760.110@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174962 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 0dec1aafeb9b02509a74e1595d855e60b7600165
      https://github.com/WebKit/WebKit/commit/0dec1aafeb9b02509a74e1595d855e60b7600165
  Author: Martin Hock <mhock at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/dom/ViewportArguments.cpp
    M Source/WebCore/dom/ViewportArguments.h
    M Source/WebCore/page/ViewportConfiguration.cpp
    M Source/WebCore/page/ViewportConfiguration.h

  Log Message:
  -----------
  Merge r174405 - Defer resolution of viewport size.
https://bugs.webkit.org/show_bug.cgi?id=137376
rdar://problem/18558094

Reviewed by Benjamin Poulain.

ViewportConfiguration should resolve the viewport size on configuration update.

* dom/Document.cpp:
(WebCore::Document::processViewport): Defer resolution of viewport size.
* dom/ViewportArguments.cpp:
(WebCore::finalizeViewportArguments): Deleted.
* dom/ViewportArguments.h:
* page/ViewportConfiguration.cpp:
(WebCore::ViewportConfiguration::updateConfiguration): Resolve viewport size.
(WebCore::ViewportConfiguration::viewportArgumentsLength): Resolves width or height based on viewport arguments.
* page/ViewportConfiguration.h:

Canonical link: https://commits.webkit.org/154760.111@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174963 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: b4bdd8e0b7a09caba53dcdd00fd70bec563c5d95
      https://github.com/WebKit/WebKit/commit/b4bdd8e0b7a09caba53dcdd00fd70bec563c5d95
  Author: Darin Adler <darin at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderTreeAsText.cpp
    M Source/WebCore/rendering/RenderTreeAsText.h
    M Source/WebCore/rendering/SimpleLineLayoutFunctions.cpp
    M Source/WebCore/rendering/SimpleLineLayoutResolver.h

  Log Message:
  -----------
  Merge r174451 - ASSERTION FAILED: underlyingStringIsValid()
https://bugs.webkit.org/show_bug.cgi?id=137502

Reviewed by Anders Carlsson.

* rendering/RenderTreeAsText.cpp:
(WebCore::quoteAndEscapeNonPrintables): Take a StringView instead of a String.
(WebCore::writeTextRun): Ditto.
(WebCore::writeSimpleLine): Ditto.

* rendering/RenderTreeAsText.h: Removed unneeded include, tweaked formatting,
changed quoteAndEscapeNonPrintables to take a StringView.

* rendering/SimpleLineLayoutFunctions.cpp:
(WebCore::SimpleLineLayout::paintFlow): Tighten code using a modern for loop.
(WebCore::SimpleLineLayout::showLineLayoutForFlow): Update to work with a
StringView result for SimpleLineLayout::RunResolver::Run::text.

* rendering/SimpleLineLayoutResolver.h:
(WebCore::SimpleLineLayout::RunResolver::Run::text): Changed return type to
StringView to fix the lifetime bug and also to improve performance by getting
rid of the need to allocate and destroy a StringImpl object.

Canonical link: https://commits.webkit.org/154760.112@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174964 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 879e935fda9d15e5336aeefa4927f50a20dfee4a
      https://github.com/WebKit/WebKit/commit/879e935fda9d15e5336aeefa4927f50a20dfee4a
  Author: Myles C. Maxfield <mmaxfield at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/svg/text/resources/Litherum.svg
    A LayoutTests/svg/text/svg-font-word-rounding-hacks-spaces-expected.html
    A LayoutTests/svg/text/svg-font-word-rounding-hacks-spaces.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/SimpleFontData.h
    M Source/WebCore/svg/SVGFontData.cpp

  Log Message:
  -----------
  Merge r174466 - Text drawn with an SVG font has no spaces when word-rounding hacks are enabled
https://bugs.webkit.org/show_bug.cgi?id=137463

Reviewed by Darin Adler.

Source/WebCore:

When rounding hacks are enabled, we use the "adjusted space width" instead of the
regular space width. However, the SVG-font-specific implementation of the
SimpleFontData constructor doesn't initialize this value, so it was getting set
to an undefined value (which happened to be close to 0 in my tests).

Test: svg/text/svg-font-word-rounding-hacks-spaces.html

* css/CSSFontFaceSource.cpp:
(WebCore::CSSFontFaceSource::getFontData):
(WebCore::CSSFontFaceSource::ensureFontData):
* loader/cache/CachedFont.cpp:
(WebCore::CachedFont::ensureCustomFontData):
(WebCore::CachedFont::getSVGFontById):
* platform/graphics/SimpleFontData.h:
* svg/SVGFontData.cpp:
(WebCore::SVGFontData::initializeFontData):

LayoutTests:

Make sure that spaces are present.

* svg/text/svg-font-word-rounding-hacks-spaces.html:
* svg/text/svg-font-word-rounding-hacks-spaces-expected.html:

Canonical link: https://commits.webkit.org/154760.113@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174965 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 838bd6bfb8e8b5750e8df49cac3585cae67ca925
      https://github.com/WebKit/WebKit/commit/838bd6bfb8e8b5750e8df49cac3585cae67ca925
  Author: Akos Kiss <akiss at inf.u-szeged.hu>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/jit/ThunkGenerators.cpp

  Log Message:
  -----------
  Merge r174503 - Ensure that inline assembly Thunk functions don't conflict with the section designations of the compiler
https://bugs.webkit.org/show_bug.cgi?id=137434

Patch by Akos Kiss <akiss at inf.u-szeged.hu> on 2014-10-09
Reviewed by Michael Saboff.

The ARM64 version of the defineUnaryDoubleOpWrapper macro in
ThunkGenerators.cpp contains inline assembly with .text assembler
directive followed by a static variable declaration. This macro gets
expanded several times afterwards, however, only during the compilation
of the first expansion does gcc insert a .data assembler directive
before the assembled version of the static variable. Thus, only the
first variable gets allocated in the .data section, all the others
remain in .text. If JavaScriptCore is built as a shared library then
this causes a segmentation fault during dynamic linking.

This patch puts a .previous directive at the end of the inline assembly
to ensure that the assumptions of the compiler about the sections are
not broken and the following variable goes to the right place.

* jit/ThunkGenerators.cpp:

Canonical link: https://commits.webkit.org/154760.114@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174966 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: bc4701273e60b7652e5e8e9e1aaef4ee653bf46d
      https://github.com/WebKit/WebKit/commit/bc4701273e60b7652e5e8e9e1aaef4ee653bf46d
  Author: Bear Travis <betravis at adobe.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/FontLoader.cpp

  Log Message:
  -----------
  Merge r174515 - [CSS Font Loading] Decrement the font loading count before notifying callbacks
https://bugs.webkit.org/show_bug.cgi?id=137401

Reviewed by Alexey Proskuryakov.

Source/WebCore:

In the callbacks, it should appear that font load has completed. This is
accessed through loading(), which relies on the current number of
fonts loading via JS and CSS.

Unskipping the failing test http/tests/webfont/fontloader-loading-attribute.html
test which tests this.

* css/FontLoader.cpp:
(WebCore::LoadFontCallback::notifyLoaded):

LayoutTests:

* platform/mac/TestExpectations: Unskip the test this bug was causing to fail.

Canonical link: https://commits.webkit.org/154760.115@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174967 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 12bfaf18b85a83617014a270b540ff2532640791
      https://github.com/WebKit/WebKit/commit/12bfaf18b85a83617014a270b540ff2532640791
  Author: Dean Jackson <dino at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/css/computed-clip-with-auto-rect-expected.txt
    A LayoutTests/fast/css/computed-clip-with-auto-rect.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSComputedStyleDeclaration.cpp

  Log Message:
  -----------
  Merge r174543 - Computed style for clip is wrong with respect to auto
https://bugs.webkit.org/show_bug.cgi?id=137567

Reviewed by Simon Fraser.

Source/WebCore:

Make sure that the computed style of clip returns the
correct value when the input is "auto", or in this
case "rect(auto, auto, auto, auto)". Before this
patch it returned "rect(0px, 0px, 0px, 0px)" which
was completely wrong.

Test: fast/css/computed-clip-with-auto-rect.html

* css/CSSComputedStyleDeclaration.cpp:
(WebCore::autoOrZoomAdjustedValue): Helper function to make the correct keyword or length.
(WebCore::specifiedValueForGridTrackBreadth): It can use the helper too.
(WebCore::ComputedStyleExtractor::propertyValue): If the
top/right/bottom/left is "auto", add that identifier
to the output rectangle.

LayoutTests:

Test that an input of clip: rect(auto, auto, auto, auto)
is the same on the way out.

* fast/css/computed-clip-with-auto-rect-expected.txt: Added.
* fast/css/computed-clip-with-auto-rect.html: Added.

Canonical link: https://commits.webkit.org/154760.116@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174969 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 6d1f1d95418e9a8316c1a6d215f01895d601a16b
      https://github.com/WebKit/WebKit/commit/6d1f1d95418e9a8316c1a6d215f01895d601a16b
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/xmlhttprequest/reentrant-cancel-abort-expected.txt
    A LayoutTests/http/tests/xmlhttprequest/reentrant-cancel-abort.html
    M LayoutTests/http/tests/xmlhttprequest/reentrant-cancel.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/xml/XMLHttpRequest.cpp
    M Source/WebCore/xml/XMLHttpRequest.h

  Log Message:
  -----------
  Merge r174684 - [XHR] Abort method execution when m_loader->cancel() in internalAbort() caused reentry
https://bugs.webkit.org/show_bug.cgi?id=126975

Patch by Youenn Fablet <youennf at gmail.com> on 2014-10-14
Reviewed by Alexey Proskuryakov.

Source/WebCore:

Merging https://chromium.googlesource.com/chromium/blink/+/0d75daf2053631518606ae15daaece701a25b2c4
Ensuring new test from https://codereview.chromium.org/76133002/ is passing.

Test: http/tests/xmlhttprequest/reentrant-cancel-abort.html

* xml/XMLHttpRequest.cpp:
(WebCore::XMLHttpRequest::open): exit early if internalAbort asks so
(WebCore::XMLHttpRequest::abort): exit early if internalAbort asks so
(WebCore::XMLHttpRequest::internalAbort): ask calling function to exit early if a new loader is created during the cancellation of the loader (potential reentrant case through window.onload callback)
(WebCore::XMLHttpRequest::didTimeout): exit early if internalAbort asks so
* xml/XMLHttpRequest.h:

LayoutTests:

Adding reentrant-cancel-abort.html (from https://codereview.chromium.org/76133002/)
that crashes without the patch
Updated reentrant-cancel.html test to expect the exception
that is now hit in initSend function (since a XHR open() call is aborted)

* http/tests/xmlhttprequest/reentrant-cancel-abort-expected.txt: Added.
* http/tests/xmlhttprequest/reentrant-cancel-abort.html: Added.
* http/tests/xmlhttprequest/reentrant-cancel.html:

Canonical link: https://commits.webkit.org/154760.117@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174970 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f47e651aa46a7d0740dbf65f61fd8bae778cd509
      https://github.com/WebKit/WebKit/commit/f47e651aa46a7d0740dbf65f61fd8bae778cd509
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/animation/AnimationController.cpp
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderElement.h

  Log Message:
  -----------
  Merge r174703 - Introduce an isCSSAnimated flag on RenderElement for performance
https://bugs.webkit.org/show_bug.cgi?id=137583

Reviewed by Simon Fraser.

I noticed when profiling the ebay.com page load that isRunningAnimationOnRenderer()
and isRunningAcceleratedAnimationOnRenderer() were called frequently, causing
~4.7 millions m_compositeAnimations HashMap lookups.

This patch introduces an isCSSAnimated flag on RenderElement to return early if
there is no animation on the renderer, thus avoiding HashMap lookups. This reduces
the number of HashMap lookups from ~4.7 millions to ~68k. On my machine, I see
the following performance improvements:
- isRunning*AnimationOnRenderer() / computeCompositingRequirements()
  - before: ~45ms  / ~90ms
  - after:  ~4ms / ~30ms

No new tests, no behavior change.

* page/animation/AnimationController.cpp:
(WebCore::AnimationControllerPrivate::ensureCompositeAnimation):
(WebCore::AnimationControllerPrivate::clear):
(WebCore::AnimationControllerPrivate::isRunningAnimationOnRenderer):
(WebCore::AnimationControllerPrivate::isRunningAcceleratedAnimationOnRenderer):
(WebCore::AnimationController::isRunningAnimationOnRenderer):
(WebCore::AnimationController::isRunningAcceleratedAnimationOnRenderer):
* rendering/RenderElement.cpp:
(WebCore::RenderElement::RenderElement):
* rendering/RenderElement.h:
(WebCore::RenderElement::isCSSAnimating):
(WebCore::RenderElement::setIsCSSAnimating):

Canonical link: https://commits.webkit.org/154760.118@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174971 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 25932f85059cde001c9de9731c2c961bb6089025
      https://github.com/WebKit/WebKit/commit/25932f85059cde001c9de9731c2c961bb6089025
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSComputedStyleDeclaration.cpp
    M Source/WebCore/page/animation/AnimationController.cpp
    M Source/WebCore/page/animation/AnimationController.h
    M Source/WebCore/page/animation/AnimationControllerPrivate.h
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderLayer.cpp
    M Source/WebCore/rendering/RenderLayerBacking.cpp
    M Source/WebCore/rendering/RenderLayerCompositor.cpp

  Log Message:
  -----------
  Merge r174804 - Leverage the new RenderElement::m_isCSSAnimating flag in more places
https://bugs.webkit.org/show_bug.cgi?id=137786

Reviewed by Simon Fraser.

Leverage the new RenderElement::m_isCSSAnimating flag that was introduced
in r174703 in more places, for performance. This avoids doing extra work
for renderers on which we are not running animations on. This patch also
updates the API a bit to use more references instead of pointers, making
it clear the RenderElement cannot be null and thus avoiding unnecessary
null checks.

No new tests, no behavior change.

* css/CSSComputedStyleDeclaration.cpp:
(WebCore::computeRenderStyleForProperty):
* page/animation/AnimationController.cpp:
(WebCore::AnimationControllerPrivate::ensureCompositeAnimation):
(WebCore::AnimationControllerPrivate::clear):
(WebCore::AnimationControllerPrivate::updateAnimationTimerForRenderer):
(WebCore::AnimationControllerPrivate::isRunningAnimationOnRenderer):
(WebCore::AnimationControllerPrivate::isRunningAcceleratedAnimationOnRenderer):
(WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
(WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
(WebCore::AnimationControllerPrivate::getAnimatedStyleForRenderer):
(WebCore::AnimationController::cancelAnimations):
(WebCore::AnimationController::updateAnimations):
(WebCore::AnimationController::getAnimatedStyleForRenderer):
(WebCore::AnimationController::notifyAnimationStarted):
(WebCore::AnimationController::isRunningAnimationOnRenderer):
(WebCore::AnimationController::isRunningAcceleratedAnimationOnRenderer):
* page/animation/AnimationController.h:
* page/animation/AnimationControllerPrivate.h:
* rendering/RenderElement.cpp:
(WebCore::RenderElement::willBeDestroyed):
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::currentTransform):
* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::updateGeometry):
(WebCore::RenderLayerBacking::notifyAnimationStarted):
* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::requiresCompositingForAnimation):
(WebCore::RenderLayerCompositor::isRunningAcceleratedTransformAnimation):

Canonical link: https://commits.webkit.org/154760.119@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174973 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 9b15be71b6fdd22853c120e5d7c765002d15cd24
      https://github.com/WebKit/WebKit/commit/9b15be71b6fdd22853c120e5d7c765002d15cd24
  Author: Alexey Proskuryakov <ap at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/WebProcess/WebPage/WebPage.cpp

  Log Message:
  -----------
  Merge r174708 - REGRESSION (r165356): Issues with Japanese text input
https://bugs.webkit.org/show_bug.cgi?id=137719
rdar://problem/18431952
rdar://problem/18483741

Reviewed by Darin Adler.

* WebProcess/WebPage/WebPage.cpp: (WebKit::WebPage::didChangeSelection):
In sync code path, ensure consistent message delivery order by adding
a DispatchMessageEvenWhenWaitingForSyncReply flag. This way, delayed
EditorStateChanged messages won't confuse UI process.

Canonical link: https://commits.webkit.org/154760.120@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174974 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: a7da604cbfdd835172427c9c493f10332b41d533
      https://github.com/WebKit/WebKit/commit/a7da604cbfdd835172427c9c493f10332b41d533
  Author: Dan Bernstein <mitz at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/loader/url-parse-1-expected.txt
    M LayoutTests/fast/loader/url-parse-1.html
    M LayoutTests/fast/url/file-http-base-expected.txt
    M LayoutTests/fast/url/host-expected.txt
    M LayoutTests/fast/url/invalid-urls-utf8-expected.txt
    M LayoutTests/fast/url/relative-expected.txt
    M LayoutTests/fast/url/standard-url-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/URL.cpp

  Log Message:
  -----------
  Merge r174712 - URLs that start with http:/// and https:/// lose two slashes when parsed, causing assertion failure and inconsistent behavior
https://bugs.webkit.org/show_bug.cgi?id=137718

Reviewed by Alexey Proskuryakov.

Source/WebCore:

Added cases to fast/loader/url-parse-1.html.

* platform/URL.cpp:
(WebCore::URL::parse): In hierarchical schemes other than file:, ignore any additional
slashes after the ://, as prescribed by the authority-ignore-slashes state in the current
URL spec.

LayoutTests:

* fast/loader/url-parse-1-expected.txt: Updated results.
* fast/loader/url-parse-1.html: Added a few test cases.
* fast/url/file-http-base-expected.txt: Updated results.
* fast/url/host-expected.txt: Ditto.
* fast/url/invalid-urls-utf8-expected.txt: Ditto.
* fast/url/relative-expected.txt: Ditto.
* fast/url/standard-url-expected.txt: Ditto.

Canonical link: https://commits.webkit.org/154760.121@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174975 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 3029b480495c58683b8f709e86b3c16294750c98
      https://github.com/WebKit/WebKit/commit/3029b480495c58683b8f709e86b3c16294750c98
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/layers/parent-clipping-overflow-is-overwritten-by-child-clipping-expected.html
    A LayoutTests/fast/layers/parent-clipping-overflow-is-overwritten-by-child-clipping.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderLayer.cpp

  Log Message:
  -----------
  Merge r174716 - REGRESSION (Safari 7.1/8.0): Border-radius and overflow hidden renders incorrectly.
https://bugs.webkit.org/show_bug.cgi?id=137205

Reviewed by Simon Fraser.

Child layer should not reset radius clipping behaviour.

Source/WebCore:

Test: fast/layers/parent-clipping-overflow-is-overwritten-by-child-clipping.html

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::calculateClipRects):

LayoutTests:

* fast/layers/parent-clipping-overflow-is-overwritten-by-child-clipping-expected.html: Added.
* fast/layers/parent-clipping-overflow-is-overwritten-by-child-clipping.html: Added.

Canonical link: https://commits.webkit.org/154760.122@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174976 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: aa4e4938b3acf50241c17225f46a147b2cb6f1f8
      https://github.com/WebKit/WebKit/commit/aa4e4938b3acf50241c17225f46a147b2cb6f1f8
  Author: Jer Noble <jer.noble at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/HTMLMediaElement.cpp

  Log Message:
  -----------
  Merge r174720 - REGRESSION (r159208): Crash when clicking scrubber after navigating away/back to video
https://bugs.webkit.org/show_bug.cgi?id=137715

Reviewed by Darin Adler.

Simple null-check of m_player in refreshCachedTime.

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::refreshCachedTime):

Canonical link: https://commits.webkit.org/154760.123@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174977 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 413ae57d6f06c64d590cd1b0e89e8ac68cef98cd
      https://github.com/WebKit/WebKit/commit/413ae57d6f06c64d590cd1b0e89e8ac68cef98cd
  Author: Alexey Proskuryakov <ap at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/platform/mac/editing/input/selected-composed-text-painting-expected.html
    A LayoutTests/platform/mac/editing/input/selected-composed-text-painting.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/InlineTextBox.cpp

  Log Message:
  -----------
  Merge r174807 - REGRESSION (r169024): Undetermined text is not displayed in the search field of Adobe Help Website
https://bugs.webkit.org/show_bug.cgi?id=137679
rdar://problem/18450335

Reviewed by Enrica Casucci.

Source/WebCore:

Test: platform/mac/editing/input/selected-composed-text-painting.html

* rendering/InlineTextBox.cpp: (WebCore::InlineTextBox::paint): We do not paint
selection beckground for unconfirmed text with underlines, so we should use a regular
style for text painting, as well.

LayoutTests:

* platform/mac/editing/input/selected-composed-text-painting-expected.html: Added.
* platform/mac/editing/input/selected-composed-text-painting.html: Added.

Canonical link: https://commits.webkit.org/154760.124@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174980 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 20ad5385a13df055d7021c65cd3d3ff97b87ce83
      https://github.com/WebKit/WebKit/commit/20ad5385a13df055d7021c65cd3d3ff97b87ce83
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/SimpleFontData.h
    M Source/WebCore/svg/SVGFontData.h

  Log Message:
  -----------
  Merge r174853 - Avoid unnecessary isSVGFont() check in SimpleFontData::applyTransforms()
https://bugs.webkit.org/show_bug.cgi?id=137836

Reviewed by Andreas Kling.

Avoid unnecessary isSVGFont() check in SimpleFontData::applyTransforms().
This function is only called from WidthIterator::applyFontTransforms(),
which already makes sure to call applyTransforms() if isSVGFont()
returns false. This patch replaces the check with a simple assertion.

No new tests, no behavior change.

* platform/graphics/SimpleFontData.h:
* svg/SVGFontData.h:

Canonical link: https://commits.webkit.org/154760.125@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174981 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 17fbef844560be3d5fb829950bc1e7a574372c4f
      https://github.com/WebKit/WebKit/commit/17fbef844560be3d5fb829950bc1e7a574372c4f
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp

  Log Message:
  -----------
  Merge r174861 - [GTK] Improve documentation of webkit_web_view_get_tls_info()
https://bugs.webkit.org/show_bug.cgi?id=137852

Patch by Michael Catanzaro <mcatanzaro at igalia.com> on 2014-10-18
Reviewed by Martin Robinson.

* UIProcess/API/gtk/WebKitWebView.cpp:

Canonical link: https://commits.webkit.org/154760.126@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174982 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 5ff603bfc804b02350d4c9f332421b72c6e87811
      https://github.com/WebKit/WebKit/commit/5ff603bfc804b02350d4c9f332421b72c6e87811
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestSSL.cpp

  Log Message:
  -----------
  Merge r174930 - Change the default TLS errors policy to WEBKIT_TLS_ERRORS_POLICY_FAIL
https://bugs.webkit.org/show_bug.cgi?id=137832

Patch by Michael Catanzaro <mcatanzaro at igalia.com> on 2014-10-20
Reviewed by Carlos Garcia Campos.

Source/WebKit2:

Too many general-purpose browsers that really need this policy
are not selecting it, so let's do so for them.

* UIProcess/API/gtk/WebKitWebContext.cpp:
(createDefaultWebContext):

Tools:

Ensure each test sets the TLS errors policy that it really needs.
Have each test except testTLSErrorsPolicy stash and restore the original
TLS errors policy. Update testTLSErrorsPolicy to account for the new
default policy.

* TestWebKitAPI/Tests/WebKit2Gtk/TestSSL.cpp:
(testSSL):
(testInsecureContent):
(testTLSErrorsPolicy):
(testTLSErrorsRedirect):
(testTLSErrorsHTTPAuth):
(testLoadFailedWithTLSErrors):
(beforeAll):

Canonical link: https://commits.webkit.org/154760.127@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174983 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 9421d5f9087edf53c5bb003218657535fac98d4f
      https://github.com/WebKit/WebKit/commit/9421d5f9087edf53c5bb003218657535fac98d4f
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2014-10-21 (Tue, 21 Oct 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/NetworkProcess/EntryPoint/unix/NetworkProcessMain.cpp
    M Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp

  Log Message:
  -----------
  Merge r174927 - [SOUP] Disable SSLv3
https://bugs.webkit.org/show_bug.cgi?id=137859

Patch by Michael Catanzaro <mcatanzaro at igalia.com> on 2014-10-21
Reviewed by Carlos Garcia Campos.

Set G_TLS_GNUTLS_PRIORITY if unset.

* NetworkProcess/EntryPoint/unix/NetworkProcessMain.cpp:
(main):
* WebProcess/EntryPoint/unix/WebProcessMain.cpp:
(main):

Canonical link: https://commits.webkit.org/154760.128@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174984 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 5a8e65baaa51bc2cc28b3684be1f4ccb1a255d33
      https://github.com/WebKit/WebKit/commit/5a8e65baaa51bc2cc28b3684be1f4ccb1a255d33
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2014-10-22 (Wed, 22 Oct 2014)

  Changed paths:
    M ChangeLog
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.6.2 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit2:

* gtk/NEWS: Add release notes for 2.6.2.

Canonical link: https://commits.webkit.org/154760.129@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175026 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 95ec1783d80b2fcd905fa69c1ca6da4e90942e81
      https://github.com/WebKit/WebKit/commit/95ec1783d80b2fcd905fa69c1ca6da4e90942e81
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-10-27 (Mon, 27 Oct 2014)

  Changed paths:
    M ChangeLog
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Merge r173999 - [GTK] Enable CSS_IMAGE_SET in production builds
https://bugs.webkit.org/show_bug.cgi?id=137142

Reviewed by Alejandro G. Castro.

This is required by the inspector to show some of the icons that
has a HiDPI variant.

* Source/cmake/OptionsGTK.cmake:

Canonical link: https://commits.webkit.org/154760.130@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175215 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 76f8476d043c110d67b552f2fa8b2d643899bea4
      https://github.com/WebKit/WebKit/commit/76f8476d043c110d67b552f2fa8b2d643899bea4
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2014-11-07 (Fri, 07 Nov 2014)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/GetPtr.h
    M Source/WTF/wtf/OwnPtr.h
    M Source/WTF/wtf/PassOwnPtr.h
    M Source/WTF/wtf/PassRefPtr.h
    M Source/WTF/wtf/Ref.h
    M Source/WTF/wtf/RefPtr.h
    M Source/WTF/wtf/gobject/GRefPtr.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AccessibilityObject.cpp
    M Source/WebCore/bindings/js/JSDOMBinding.h
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/dom/Document.h
    M Source/WebCore/dom/Element.cpp
    M Source/WebCore/dom/Element.h
    M Source/WebCore/html/shadow/MediaControlElements.cpp
    M Source/WebCore/html/track/VTTRegion.cpp
    M Source/WebCore/inspector/InspectorCSSAgent.cpp
    M Source/WebCore/page/PerformanceTiming.cpp
    M Source/WebCore/rendering/FlowThreadController.cpp

  Log Message:
  -----------
  Merge r173765 - Allow DOM methods to return references instead of pointers
https://bugs.webkit.org/show_bug.cgi?id=136931

Source/WebCore:

Reviewed by Sam Weinig.

It is common practice in WebKit to have methods return a reference
instead of a pointer if the pointer can never be null. However, this
unfortunately did not work for DOM methods (functions called by JS
bindings). This prevented further refactoring.

This patch brings support for having DOM methods to return references
instead of pointers when the pointer cannot be null. The generated
bindings were calling WTF::getPtr() on the pointer type returned by
the implementation already (in case it was a smart pointer type).
This patch leverages this by having WTF::getPtr() convert reference
arguments into raw pointers.

This patch also updates a few DOM methods on Document and Element
classes to return a reference instead of a pointer, to test the change.
There are likely more DOM methods that can be updated though.

No new tests, no behavior change.

* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::classList):
* bindings/js/JSDOMBinding.h:
(WTF::getPtr): Deleted.
* dom/Document.cpp:
(WebCore::Document::implementation):
(WebCore::Document::webkitGetNamedFlows):
(WebCore::Document::namedFlows):
(WebCore::Document::setXMLVersion):
(WebCore::Document::setXMLStandalone):
(WebCore::Document::securityPolicy):
(WebCore::Document::styleSheets):
* dom/Document.h:
(WebCore::Document::timing):
* dom/Element.cpp:
(WebCore::Element::classList):
(WebCore::Element::dataset):
* dom/Element.h:
* html/shadow/MediaControlElements.cpp:
(WebCore::MediaControlPanelElement::setPosition):
(WebCore::MediaControlPanelElement::resetPosition):
(WebCore::MediaControlClosedCaptionsTrackListElement::updateDisplay):
* html/track/VTTRegion.cpp:
(WebCore::VTTRegion::displayLastTextTrackCueBox):
(WebCore::VTTRegion::willRemoveTextTrackCueBox):
* inspector/InspectorCSSAgent.cpp:
(WebCore::InspectorCSSAgent::getAllStyleSheets):
(WebCore::InspectorCSSAgent::getNamedFlowCollection):
* page/PerformanceTiming.cpp:
(WebCore::PerformanceTiming::documentTiming):
* rendering/FlowThreadController.cpp:
(WebCore::FlowThreadController::ensureRenderFlowThreadWithName):

Source/WTF:

Add support for having WTF::getPtr() transform reference arguments
into raw pointers so that DOM methods can now return references when
appropriate and so that the generated bindings code can handle this
via WTF::getPtr().

This patch had to alter the way getPtr() was overloaded for smart
pointer types so that we don't call &p on smart pointers but p.get().
This was needed because the new WTF::getPtr(T&) was being called for
RefPtr<T> arguments instead of the getPtr(const RefPtr<T>&) overload.
This was addressed using traits and template specialization to
distinguish WTF smart pointers from other types.

Reviewed by Sam Weinig.

* wtf/GetPtr.h:
(WTF::getPtr):
* wtf/OwnPtr.h:
(WTF::getPtr): Deleted.
* wtf/PassOwnPtr.h:
(WTF::getPtr): Deleted.
* wtf/PassRefPtr.h:
(WTF::getPtr): Deleted.
* wtf/Ref.h:
* wtf/RefPtr.h:
(WTF::getPtr): Deleted.
* wtf/gobject/GRefPtr.h:
(WTF::getPtr): Deleted.

Canonical link: https://commits.webkit.org/154760.131@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175747 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: b1c53fa60f2f26edf6035e7f0a6d746b705a766e
      https://github.com/WebKit/WebKit/commit/b1c53fa60f2f26edf6035e7f0a6d746b705a766e
  Author: Simon Fraser <simon.fraser at apple.com>
  Date:   2014-11-07 (Fri, 07 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/dom/Document/CaretRangeFromPoint/hittest-relative-to-viewport-expected.txt
    M LayoutTests/fast/dom/Document/CaretRangeFromPoint/hittest-relative-to-viewport.html
    M LayoutTests/platform/mac/fast/dom/Document/CaretRangeFromPoint/hittest-relative-to-viewport-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/dom/Document.h
    M Source/WebCore/dom/TreeScope.cpp
    M Source/WebCore/dom/TreeScope.h
    M Source/WebCore/page/FrameView.cpp

  Log Message:
  -----------
  Merge r173857 - Move nodeFromPoint() back to Document where it belongs
https://bugs.webkit.org/show_bug.cgi?id=137012

Reviewed by Zalan Bujtas.
Source/WebCore:

nodeFromPoint() was moved into TreeScope for ShadowDOM work, but now we can move
it back to its logical place.

Make versions of elementFromPoint and caretRangeFromPoint that take LayoutPoints,
and change the current scale/offset code to be in layout units (which results
in a small behavior change).

elementFromPoint(int, int) and caretRangeFromPoint(int, int) are still required
for bindings code.

* dom/Document.cpp:
(WebCore::Document::nodeFromPoint):
(WebCore::Document::elementFromPoint):
(WebCore::Document::caretRangeFromPoint):
* dom/Document.h:
(WebCore::Document::elementFromPoint): Move logic from TreeScope::elementFromPoint()
here.
* dom/TreeScope.cpp:
(WebCore::nodeFromPoint): Deleted.
(WebCore::TreeScope::elementFromPoint): Deleted.
* dom/TreeScope.h:

LayoutTests:

All platforms use subpixel layout now, so remove the conditional behavior in this test.
Fix the test to account for scaling now being done in layout units.

* fast/dom/Document/CaretRangeFromPoint/hittest-relative-to-viewport-expected.txt:
* fast/dom/Document/CaretRangeFromPoint/hittest-relative-to-viewport.html:
* platform/mac/fast/dom/Document/CaretRangeFromPoint/hittest-relative-to-viewport-expected.txt:

Canonical link: https://commits.webkit.org/154760.132@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175749 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 954388ff6bef438acf2020fcbac25a304043b58a
      https://github.com/WebKit/WebKit/commit/954388ff6bef438acf2020fcbac25a304043b58a
  Author: Akos Kiss <akiss at inf.u-szeged.hu>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/Platform.h

  Log Message:
  -----------
  Merge r174511 - Enable ARM64 disassembler for all platforms
https://bugs.webkit.org/show_bug.cgi?id=137560

Patch by Akos Kiss <akiss at inf.u-szeged.hu> on 2014-10-09
Reviewed by Michael Saboff.

Remove PLATFORM conditions from around WTF_USE_ARM64_DISASSEMBLER since
the ARM64 disassembler has no platform dependencies anymore.

* wtf/Platform.h:

Canonical link: https://commits.webkit.org/154760.133@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175882 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 63c2c44e9335721109247f6557c3d77f921976a0
      https://github.com/WebKit/WebKit/commit/63c2c44e9335721109247f6557c3d77f921976a0
  Author: Said Abou-Hallawa <sabouhallawa at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/mathml/opentype/munderover-window-resize-expected.txt
    A LayoutTests/mathml/opentype/munderover-window-resize.html
    M LayoutTests/platform/mac/mathml/opentype/opentype-stretchy-horizontal-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp
    M Source/WebCore/rendering/mathml/RenderMathMLOperator.h
    M Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp

  Log Message:
  -----------
  Merge r174540 - RenderMathMLUnderOver adds spacing to the child operator indefinitely when resizing the window.
https://bugs.webkit.org/show_bug.cgi?id=137330

Patch by Said Abou-Hallawa <sabouhallawa at apple.com> on 2014-10-09
Reviewed by Darin Adler.

The layout for the <mundercover> math object happens in two separate passes. The first pass runs
the layout for the two children and then calculates the maximum child width.  It then sets the
stretch size for the math operator child.  And finally it runs the second layout pass by calling
the base class layout() function. The base class function then runs the layout for the children
rendering blocks.  In the operator child function computePreferredLogicalWidths(), the stretch
size is used to adjust the width (or the height) of the operator. Then it adds the leading and
trailing spaces and the total will be the operator child width.

When resizing or zooming the window, the render objects are just invalidated but marked as 'needs-
Layout'.  The problem is happening because the stretch size of the math operator is not reset
before running the layout.  The old logical width (or height) of the the math operator child which
is equal to the stretch size plus the leading and trailing spaces for is compared with the glyph
size if the old logical width ( or height) is larger, it is set to be the stretch size.  When it
is used again because of invalidation, new leading and trailing spaces are included in the new
logical width.  So with every zooming-in or out or window resizing, new leading and trailing
spaces are added to the logical width of the math operator child or the math <munderober> object.

Ensure the stretch size of the math operator render object is reset before running its layout.
Running the layout means either the page is just loaded or it's invalidated which means, no
layout stall data should be used.

Test: mathml/opentype/munderover-window-resize.html

* rendering/mathml/RenderMathMLOperator.cpp:
(WebCore::RenderMathMLOperator::resetStretchSize):
* rendering/mathml/RenderMathMLOperator.h:
resetStretchSize() sets the stretch size to its original value when the class is created.
* rendering/mathml/RenderMathMLUnderOver.cpp:
(WebCore::RenderMathMLUnderOver::layout):
Make sure the operator stretch size is reset before calling its layout. Also make sure the new
maximum stretch size to the operator objects that were invalid and needsLayout.

LayoutTests:
RenderMathMLUnderOver adds spacing to the child operator indefinitely when zooming or resizing the window.
https://bugs.webkit.org/show_bug.cgi?id=137330

Patch by Said Abou-Hallawa <sabouhallawa at apple.com> on 2014-10-09
Reviewed by Darin Adler, Daniel Bates.

When the alignment is center, which is the common case for math, changing the size of
an object affects the position of this object also.  We need to confirm that zooming or
resizing the window should not affect the rectangle of the over/under math object operator.

* mathml/opentype/munderover-window-resize-expected.txt: Added.
* mathml/opentype/munderover-window-resize.html: Added.
New test with many under and over math objects.  After loading the page, the window is resized and
the view is zoomed in and out to make sure the layout of these under and over objects were not changed.
* platform/mac/mathml/opentype/opentype-stretchy-horizontal-expected.txt:
This test was wrong because of the spacing issue. The page has two <mover> math objects at the beginning.
Each of them has an <mspace> child. The width of the first <mspace> is 1em while the width of the second
<mspace> is 2em. The font size is 10pt. So it is expected to have the first one 10 pixels and the second
to be 20 pixels. In the test, the width of the first is 22 and the width of the second is 32.
I do expect this test to fail on other platforms since they have the same mistake which is now fixed. I am
going to submit the mac expected version only and when it fails I am going to collect the result and submit
another patch for the other platforms expected files.

Canonical link: https://commits.webkit.org/154760.134@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175883 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e7ca825517e6810044516275f5e15279e691585e
      https://github.com/WebKit/WebKit/commit/e7ca825517e6810044516275f5e15279e691585e
  Author: Mike West <mkwst at chromium.org>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/security/referrer-policy-https-no-referrer-expected.txt
    A LayoutTests/http/tests/security/referrer-policy-https-no-referrer-when-downgrade-expected.txt
    A LayoutTests/http/tests/security/referrer-policy-https-no-referrer-when-downgrade.html
    A LayoutTests/http/tests/security/referrer-policy-https-no-referrer.html
    A LayoutTests/http/tests/security/referrer-policy-https-unsafe-url-expected.txt
    A LayoutTests/http/tests/security/referrer-policy-https-unsafe-url.html
    M LayoutTests/http/tests/security/referrer-policy-invalid-expected.txt
    A LayoutTests/http/tests/security/referrer-policy-no-referrer-expected.txt
    A LayoutTests/http/tests/security/referrer-policy-no-referrer-when-downgrade-expected.txt
    A LayoutTests/http/tests/security/referrer-policy-no-referrer-when-downgrade.html
    A LayoutTests/http/tests/security/referrer-policy-no-referrer.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp

  Log Message:
  -----------
  Merge r174640 - Referrer Policy: Update <meta name="referrer"> values to match the spec
https://bugs.webkit.org/show_bug.cgi?id=137635

Reviewed by Jochen Eisinger.

Source/WebCore:

The Referrer Policy specification ([Working Draft][WD], [Editor's
draft[ED]) defines different keywords than we originally
implemented. We should support them in the interests of clarity and
interoperability with other browsers implementing the specification.

[WD]: http://www.w3.org/TR/referrer-policy/#referrer-policy-delivery-meta
[ED]: http://w3c.github.io/webappsec/specs/referrer-policy/#referrer-policy-delivery-meta

This patch is a port of Blink's https://codereview.chromium.org/607433002/

Tests: http/tests/security/referrer-policy-conflicting-policies.html
       http/tests/security/referrer-policy-https-no-referrer-when-downgrade.html
       http/tests/security/referrer-policy-https-no-referrer.html
       http/tests/security/referrer-policy-https-unsafe-url.html
       http/tests/security/referrer-policy-no-referrer-when-downgrade.html
       http/tests/security/referrer-policy-no-referrer.html

* dom/Document.cpp:
(WebCore::Document::processReferrerPolicy):

LayoutTests:

* http/tests/security/referrer-policy-https-no-referrer-expected.txt: Added.
* http/tests/security/referrer-policy-https-no-referrer-when-downgrade-expected.txt: Added.
* http/tests/security/referrer-policy-https-no-referrer-when-downgrade.html: Added.
* http/tests/security/referrer-policy-https-no-referrer.html: Added.
* http/tests/security/referrer-policy-https-unsafe-url-expected.txt: Added.
* http/tests/security/referrer-policy-https-unsafe-url.html: Added.
* http/tests/security/referrer-policy-invalid-expected.txt: Update the error message with new keywords.
* http/tests/security/referrer-policy-no-referrer-expected.txt: Added.
* http/tests/security/referrer-policy-no-referrer-when-downgrade-expected.txt: Added.
* http/tests/security/referrer-policy-no-referrer-when-downgrade.html: Added.
* http/tests/security/referrer-policy-no-referrer.html: Added.

Canonical link: https://commits.webkit.org/154760.135@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175884 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 968580c1c640f022f8c6d1084ff55ed55e462747
      https://github.com/WebKit/WebKit/commit/968580c1c640f022f8c6d1084ff55ed55e462747
  Author: Alejandro G. Castro <alex at webkit.org>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebCore/mathml/MathMLTextElement.cpp
    M Source/WebCore/mathml/MathMLTextElement.h
    M Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp
    M Source/WebCore/rendering/mathml/RenderMathMLOperator.h

  Log Message:
  -----------
  Merge r174677 - Changes in the stretchy attribute do not update rendering
https://bugs.webkit.org/show_bug.cgi?id=136883

Reviewed by Darin Adler.

Source/WebCore:

Test: mathml/presentation/mo-stretch-update.html

We need to relayout when a change in the stretchy attribute
happens.

* mathml/MathMLTextElement.cpp:
(WebCore::MathMLTextElement::parseAttribute): Parse the
modifications of the stretchy attribute.
* mathml/MathMLTextElement.h:
* rendering/mathml/RenderMathMLOperator.cpp:
(WebCore::RenderMathMLOperator::setOperatorFlagAndScheduleLayoutIfNeeded):
Add function that receives the value instead of looking for it and
checks if the change should schedule a layout.
(WebCore::RenderMathMLOperator::setOperatorFlagFromAttribute):
(WebCore::RenderMathMLOperator::setOperatorFlagFromAttributeValue):
Add function that receives the value instead of looking for it.
* rendering/mathml/RenderMathMLOperator.h:

LayoutTests:

The test updates the stretchy value in a timeout.

* mathml/presentation/mo-stretch-update-expected.html: Added.
* mathml/presentation/mo-stretch-update.html: Added.

Canonical link: https://commits.webkit.org/154760.136@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175885 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e57608f584a660e04384008f868b91e757309f34
      https://github.com/WebKit/WebKit/commit/e57608f584a660e04384008f868b91e757309f34
  Author: Dean Jackson <dino at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/WebCore.exp.in
    M Source/WebCore/accessibility/AccessibilityNodeObject.cpp
    M Source/WebCore/accessibility/AccessibilityObject.cpp
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/dom/Document.h
    M Source/WebCore/dom/EventTarget.cpp
    M Source/WebCore/dom/UserGestureIndicator.cpp
    M Source/WebCore/dom/UserGestureIndicator.h
    M Source/WebCore/page/EventHandler.cpp
    M Source/WebCore/rendering/HitTestResult.cpp

  Log Message:
  -----------
  Merge r174700 - Crash in WebCore::UserGestureIndicator::processingUserGesture with WebWorkers
https://bugs.webkit.org/show_bug.cgi?id=137676
<rdar://problem/15735049>

Reviewed by Alexey Proskuryakov.

Remove the code I added that tracks the timestamp of the most recent
user gesture from the event handling dispatch, as it was both
a silly place to do it and it originally crashed when events were fired from
Worker threads (although this was fixed in r152238).

It's now recorded by going through UserGestureIndicator, which is good because
it knows when a user has triggered an event. Its constructor now takes
a pointer to Document, and updates the timestamp there if necessary.

Not all UserGestureIndicator instances needed to reset the timestamp; Those did
not have to pass along the Document.

This is untestable due to the fix mentioned above.

* WebCore.exp.in: Change constructor signature.

* accessibility/AccessibilityNodeObject.cpp: Pass a pointer to the Document into the UserGestureIndicator.
(WebCore::AccessibilityNodeObject::increment):
(WebCore::AccessibilityNodeObject::decrement):
* accessibility/AccessibilityObject.cpp: Ditto.
(WebCore::AccessibilityObject::press):

* dom/Document.cpp:
(WebCore::Document::updateLastHandledUserGestureTimestamp): Renamed.
* dom/Document.h:

* dom/EventTarget.cpp: Remove the code to update the timestamp.
(WebCore::EventTarget::fireEventListeners):

* dom/UserGestureIndicator.cpp:
(WebCore::UserGestureIndicator::UserGestureIndicator): If there is a Document and
this is a user gesture, then reset the timestamp.
* dom/UserGestureIndicator.h:

* page/EventHandler.cpp: Pass a pointer to the Document.
(WebCore::EventHandler::handleMousePressEvent):
(WebCore::EventHandler::handleMouseDoubleClickEvent):
(WebCore::EventHandler::handleMouseReleaseEvent):
(WebCore::EventHandler::keyEvent):
(WebCore::EventHandler::handleTouchEvent):

* rendering/HitTestResult.cpp: Ditto.
(WebCore::HitTestResult::toggleMediaFullscreenState):
(WebCore::HitTestResult::enterFullscreenForVideo):

Canonical link: https://commits.webkit.org/154760.137@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175888 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 5fa1466f03c25636f0dc8ecfff6a0ccb3e64c6f0
      https://github.com/WebKit/WebKit/commit/5fa1466f03c25636f0dc8ecfff6a0ccb3e64c6f0
  Author: Andrei Bucur <abucur at adobe.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/multicol/multicol-all-positioned-crash-expected.txt
    A LayoutTests/fast/multicol/multicol-all-positioned-crash.html
    A LayoutTests/fast/multicol/multicol-transform-containing-block-expected.txt
    A LayoutTests/fast/multicol/multicol-transform-containing-block.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/FlowThreadController.cpp
    M Source/WebCore/rendering/FlowThreadController.h
    M Source/WebCore/rendering/LayoutState.h
    M Source/WebCore/rendering/RenderBlock.cpp
    M Source/WebCore/rendering/RenderBlock.h
    M Source/WebCore/rendering/RenderBlockFlow.cpp
    M Source/WebCore/rendering/RenderBox.cpp
    M Source/WebCore/rendering/RenderFlowThread.cpp
    M Source/WebCore/rendering/RenderFlowThread.h
    M Source/WebCore/rendering/RenderLayer.cpp
    M Source/WebCore/rendering/RenderObject.cpp
    M Source/WebCore/rendering/RenderObject.h
    M Source/WebCore/rendering/RenderRegion.cpp
    M Source/WebCore/rendering/RenderView.cpp
    M Source/WebCore/rendering/RenderView.h

  Log Message:
  -----------
  Merge r174761 - ASSERTION  FAILED in WebCore::RenderFlowThread::getRegionRangeForBox
https://bugs.webkit.org/show_bug.cgi?id=135563

Reviewed by David Hyatt.

Source/WebCore:

The new multi-column code doesn't work correctly when the document contains nested fragmentation
contexts. The problem is the current flow thread concept that can store only one RenderFlowThread
at a time and use it during layout.

The stored flow thread is always correct for regions because named flow threads are absolutley positioned
so every child renderer is contained inside them (with the expcetion of fixed positioned elements which are
treated separately).

For multi-column elements this is no longer the case. An absolutely positioned element inside a static
multi-column element will be contained by a block outside the fragmentation context. It can even be
contained by a different multi-column element in the case of nested flow threads.

The patch below explores a solution that's not based on a current flow thread stored globally. The proposed
patch makes every block to store a pointer to its fragmentation context and a flag that states if this pointer
needs to be updated or not. If the renderer is not a block it will get its flow thread from the containing
block. Once the containing flow thread is requested for the block, the pointer is computed and cached until
invalidated:
- when a subtree is removed from a flow thread
- when the position property of an element inside a flow thread changes

The process is recursive and it doesn't affect elements that are not nested inside a flow thread. If a block
changes position from relative to static, any element that was contained by it can only be contained by an
ancestor of the block. This ancestor will still be outside of any flow thread. This ensures that non-fragmentation
code is not affected from a performance perspective.

The patch affects the results of the performance tests:
- the regions layout tests have a decreased performance raging from 2% to 5-6%
- the regions selection tests have an increased performance raging from 1-2% to 10%
- the multicolumn layout tests (now pending review in b137687) have an increased performance
raging from 1.8% to 5%

Tests: fast/multicol/multicol-all-positioned-crash.html
       fast/multicol/multicol-transform-containing-block.html

* rendering/FlowThreadController.cpp:
(WebCore::FlowThreadController::FlowThreadController):
* rendering/FlowThreadController.h:
(WebCore::FlowThreadController::currentRenderFlowThread): Deleted.
(WebCore::FlowThreadController::setCurrentRenderFlowThread): Deleted.
* rendering/LayoutState.h:
(WebCore::LayoutState::currentRenderFlowThread):
(WebCore::LayoutState::setCurrentRenderFlowThread):
* rendering/RenderBlock.cpp:
(WebCore::RenderBlockRareData::RenderBlockRareData):
(WebCore::RenderBlock::styleWillChange):
(WebCore::RenderBlock::styleDidChange):
(WebCore::RenderBlock::collapseAnonymousBoxChild):
(WebCore::RenderBlock::cachedFlowThreadContainingBlock):
(WebCore::RenderBlock::cachedFlowThreadContainingBlockNeedsUpdate):
(WebCore::RenderBlock::setCachedFlowThreadContainingBlockNeedsUpdate):
(WebCore::RenderBlock::updateCachedFlowThreadContainingBlock):
(WebCore::RenderBlock::locateFlowThreadContainingBlock):
* rendering/RenderBlock.h:
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::styleWillChange):
* rendering/RenderBox.cpp:
(WebCore::RenderBox::borderBoxRectInRegion):
* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::layout):
(WebCore::RenderFlowThread::updateAllLayerToRegionMappings):
(WebCore::RenderFlowThread::repaintRectangleInRegions):
(WebCore::CurrentRenderFlowThreadMaintainer::CurrentRenderFlowThreadMaintainer): Deleted.
(WebCore::CurrentRenderFlowThreadMaintainer::~CurrentRenderFlowThreadMaintainer): Deleted.
(WebCore::CurrentRenderFlowThreadDisabler::CurrentRenderFlowThreadDisabler): Deleted.
(WebCore::CurrentRenderFlowThreadDisabler::~CurrentRenderFlowThreadDisabler): Deleted.
* rendering/RenderFlowThread.h:
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::paintLayer):
(WebCore::RenderLayer::hitTestLayer):
(WebCore::RenderLayer::mapLayerClipRectsToFragmentationLayer):
(WebCore::RenderLayer::calculateClipRects):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::showRegionsInformation):
(WebCore::RenderObject::insertedIntoTree):
(WebCore::RenderObject::removeFromRenderFlowThread):
(WebCore::RenderObject::removeFromRenderFlowThreadIncludingDescendants):
(WebCore::RenderObject::invalidateFlowThreadContainingBlockIncludingDescendants):
(WebCore::RenderObject::currentRenderNamedFlowFragment):
(WebCore::RenderObject::locateFlowThreadContainingBlock):
(WebCore::RenderObject::locateFlowThreadContainingBlockNoCache): Deleted.
(WebCore::RenderObject::removeFromRenderFlowThreadRecursive): Deleted.
* rendering/RenderObject.h:
(WebCore::RenderObject::flowThreadContainingBlock):
* rendering/RenderRegion.cpp:
(WebCore::RenderRegion::computeOverflowFromFlowThread):
* rendering/RenderView.cpp:
(WebCore::RenderView::pushLayoutStateForCurrentFlowThread):
(WebCore::RenderView::popLayoutStateForCurrentFlowThread):
* rendering/RenderView.h:

LayoutTests:

A test verifying that positioned elements inside multi-column containers don't
cause assertions or crashes.

* fast/multicol/multicol-all-positioned-crash-expected.txt: Added.
* fast/multicol/multicol-all-positioned-crash.html: Added.
* fast/multicol/multicol-transform-containing-block-expected.txt: Added.
* fast/multicol/multicol-transform-containing-block.html: Added.

Canonical link: https://commits.webkit.org/154760.138@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175890 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 60acf6cf21c1ef355ba6d25f8c4650a88e9d885b
      https://github.com/WebKit/WebKit/commit/60acf6cf21c1ef355ba6d25f8c4650a88e9d885b
  Author: Adrien Destugues <pulkomandy at gmail.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/profiler/ProfileGenerator.cpp

  Log Message:
  -----------
  Merge r174762 - Use isnan from std namespace in ProfileGenerator.cpp
https://bugs.webkit.org/show_bug.cgi?id=137653

Patch by Adrien Destugues <pulkomandy at gmail.com> on 2014-10-16
Reviewed by Darin Adler.

The C++ isnan() function is in the std namespace. The unprefixed isnan
may be available because of C99 headers leakage in C++, but should not
be used.

No new tests: no functional change, build fix on platforms which don't
export C99 functions in C++.

* profiler/ProfileGenerator.cpp:
(JSC::ProfileGenerator::beginCallEntry):
(JSC::ProfileGenerator::endCallEntry):
(JSC::ProfileGenerator::didPause):
(JSC::ProfileGenerator::didContinue):

Canonical link: https://commits.webkit.org/154760.139@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175891 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 1057e88d2bf28043cfc89ddd239ff398ad3e6ee6
      https://github.com/WebKit/WebKit/commit/1057e88d2bf28043cfc89ddd239ff398ad3e6ee6
  Author: Adrien Destugues <pulkomandy at gmail.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/texmap/TextureMapper.cpp
    M Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp

  Log Message:
  -----------
  Merge r174802 - Missing RefPtr.release() calls in TextureMapper
https://bugs.webkit.org/show_bug.cgi?id=137777

Patch by Adrien Destugues <pulkomandy at gmail.com> on 2014-10-16
Reviewed by Chris Dumez.

No new tests: no functional change, cleanup/optimization.

Avoids useless ref/deref cycle when returning from functions.

* platform/graphics/texmap/TextureMapper.cpp:
(WebCore::TextureMapper::acquireTextureFromPool):
* platform/graphics/texmap/TextureMapperLayer.cpp:
(WebCore::TextureMapperLayer::paintIntoSurface):

Canonical link: https://commits.webkit.org/154760.140@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175892 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 845983e6b3b163cc8fcaf5d11a0cc81ac07983b2
      https://github.com/WebKit/WebKit/commit/845983e6b3b163cc8fcaf5d11a0cc81ac07983b2
  Author: Roger Fong <roger_fong at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp

  Log Message:
  -----------
  Merge r174855 - Calling glReadPixels with BGRA format on an NVIDIA machine with an opaque context returns the wrong alpha values.
https://bugs.webkit.org/show_bug.cgi?id=137793.
<rdar://problem/15408133>

Reviewed by Dean Jackson.

This fixes conformance test context/context-attribute-preserve-drawing-buffer.html.

* platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
(WebCore::GraphicsContext3D::readPixelsAndConvertToBGRAIfNecessary):
On an NVIDIA machine, when the context has alpha turned off, call glReadPixels with RGBA format and then convert to RGBA.

Canonical link: https://commits.webkit.org/154760.141@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175893 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 15b317a1933dfd7669ce67f328a4a39a2a910d2e
      https://github.com/WebKit/WebKit/commit/15b317a1933dfd7669ce67f328a4a39a2a910d2e
  Author: Csaba Osztrogonác <ossy at webkit.org>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/JavaScriptCore/CMakeLists.txt
    M Source/JavaScriptCore/ChangeLog

  Log Message:
  -----------
  Merge r174883 - [cmake] Remove duplicated source files
https://bugs.webkit.org/show_bug.cgi?id=137875

Reviewed by Gyuyoung Kim.

* CMakeLists.txt:

Canonical link: https://commits.webkit.org/154760.142@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175894 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: ea0bf5ccdf0864095868fa138f02da16a8b7ae43
      https://github.com/WebKit/WebKit/commit/ea0bf5ccdf0864095868fa138f02da16a8b7ae43
  Author: Roger Fong <roger_fong at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp

  Log Message:
  -----------
  Merge r174916 - Use glFinish instead of glFlush when drawing WebGL output to screen.
https://bugs.webkit.org/show_bug.cgi?id=137897.
<rdar://problem/15846550>

Reviewed by Brent Fulgham.

Passes all conformance tests.
Performance tested by http://threejs.org/examples/#webgl_performance and Unity WebGL performance tests.

* platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
(WebCore::GraphicsContext3D::prepareTexture):

Canonical link: https://commits.webkit.org/154760.143@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175895 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 8d89e8cb89239414b35f4800130fd65278d0f7d5
      https://github.com/WebKit/WebKit/commit/8d89e8cb89239414b35f4800130fd65278d0f7d5
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/xmlhttprequest/set-bad-headervalue-expected.txt
    A LayoutTests/http/tests/xmlhttprequest/set-bad-headervalue.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/HTTPParsers.cpp

  Log Message:
  -----------
  Merge r174920 - Tighten XMLHttpRequest setRequestHeader value check
https://bugs.webkit.org/show_bug.cgi?id=128593

Patch by Youenn Fablet <youenn.fablet at crf.canon.fr> on 2014-10-20
Reviewed by Darin Adler.

Source/WebCore:

Test: http/tests/xmlhttprequest/set-bad-headervalue.html

* platform/network/HTTPParsers.cpp:
(WebCore::isValidHTTPHeaderValue): Updated header values check according RFC 7230.
(WebCore::isValidHTTPToken): Renamed variable name and updated RFC related comment.

LayoutTests:

Added a test originating from w3c-test.org to test header values checking.
Testing headers with non ASCII characters and various control characters.

* http/tests/xmlhttprequest/set-bad-headervalue-expected.txt: Added.
* http/tests/xmlhttprequest/set-bad-headervalue.html: Added.

Canonical link: https://commits.webkit.org/154760.144@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175896 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 9990be4a43dfd089b025c7c7ce32c0316a2a71c4
      https://github.com/WebKit/WebKit/commit/9990be4a43dfd089b025c7c7ce32c0316a2a71c4
  Author: Jeffrey Pfau <jpfau at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/frames/exponential-frames-expected.txt
    A LayoutTests/fast/frames/exponential-frames.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/HTMLFrameElementBase.cpp

  Log Message:
  -----------
  Merge r174922 - Ensure attached frame count doesn't exceed the maximum allowed frames
https://bugs.webkit.org/show_bug.cgi?id=136457

Reviewed by Alexey Proskuryakov.

Source/WebCore:

Test: fast/frames/exponential-frames.html

* html/HTMLFrameElementBase.cpp:
(WebCore::HTMLFrameElementBase::isURLAllowed):

LayoutTests:

* fast/frames/exponential-frames-expected.txt: Added.
* fast/frames/exponential-frames.html: Added.

Canonical link: https://commits.webkit.org/154760.145@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175897 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 7f77d982545e090025b66b854848691dd647884b
      https://github.com/WebKit/WebKit/commit/7f77d982545e090025b66b854848691dd647884b
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/clip/overflow-hidden-with-border-radius-overflow-clipping-parent-expected.html
    A LayoutTests/fast/clip/overflow-hidden-with-border-radius-overflow-clipping-parent.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderLayer.cpp
    M Source/WebCore/rendering/RenderLayer.h

  Log Message:
  -----------
  Merge r174986 - REGRESSION: Google Search (mobile) video thumbnails are too large.
https://bugs.webkit.org/show_bug.cgi?id=137895

Reviewed by Simon Fraser.

This patch fixes layer clipping when an ancestor layer has border-radius clipping.

In cases, where the current layer has non-radius cliprect, while an ancestor layer
has border-radius clipping, we only use the border-radius rect to clip.

Source/WebCore:

Test: fast/clip/overflow-hidden-with-border-radius-overflow-clipping-parent.html

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::clipToRect):
(WebCore::RenderLayer::restoreClip):
(WebCore::RenderLayer::collectFragments):
(WebCore::RenderLayer::calculateClipRects):
* rendering/RenderLayer.h:
(WebCore::ClipRect::ClipRect):
(WebCore::ClipRect::effectedByRadius):
(WebCore::ClipRect::setEffectedByRadius):
(WebCore::ClipRect::operator==):
(WebCore::ClipRect::operator!=):
(WebCore::ClipRect::intersect):
(WebCore::ClipRect::hasRadius): Deleted.
(WebCore::ClipRect::setHasRadius): Deleted.

LayoutTests:

* fast/clip/overflow-hidden-with-border-radius-overflow-clipping-parent-expected.html: Added.
* fast/clip/overflow-hidden-with-border-radius-overflow-clipping-parent.html: Added.

Canonical link: https://commits.webkit.org/154760.146@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175898 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: d4f1ef0a9e014235841a53fdc86a36a58db92c51
      https://github.com/WebKit/WebKit/commit/d4f1ef0a9e014235841a53fdc86a36a58db92c51
  Author: Joanmarie Diggs <jdiggs at igalia.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/accessibility/css-content-attribute.html
    A LayoutTests/platform/gtk/accessibility/css-content-attribute-expected.txt
    M LayoutTests/platform/mac/accessibility/css-content-attribute-expected.txt
    R LayoutTests/platform/mac/accessibility/css-content-attribute.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AccessibilityRenderObject.cpp

  Log Message:
  -----------
  Merge r174992 - AX: [ATK] CSS-generated text content not exposed to assistive technologies
https://bugs.webkit.org/show_bug.cgi?id=137669

Reviewed by Chris Fleizach.

Source/WebCore:

Do not use a text iterator to get the text for elements which include
pseudo elements.

Test: accessibility/css-content-attribute.html

* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::textUnderElement):

LayoutTests:

Moved the Mac platform test and modified it to dump the accessible tree
and string values rather than a platform-specific hierarchy so that it
could be shared across platforms.

* accessibility/css-content-attribute.html: Added.
* platform/gtk/accessibility/css-content-attribute-expected.txt: Added.
* platform/mac/accessibility/css-content-attribute-expected.txt: Modified to reflect new output.
* platform/mac/accessibility/css-content-attribute.html: Removed.

Canonical link: https://commits.webkit.org/154760.147@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175899 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 39951420546a98f915ab7102bfc17ba1f56c0369
      https://github.com/WebKit/WebKit/commit/39951420546a98f915ab7102bfc17ba1f56c0369
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/jit/JITThunks.cpp

  Log Message:
  -----------
  Merge r175005 - Remove erroneous canUseJIT() in the intrinsics version of JITThunks::hostFunctionStub().
<https://webkit.org/b/137937>

Reviewed by Michael Saboff.

This version of JITThunks::hostFunctionStub() can only be called from the intrinsics
version of VM::getHostFunction() which asserts canUseJIT().  Hence, we can eliminate
the canUseJIT() check in JITThunks::hostFunctionStub().  We don't handle the
!canUseJIT() case properly there anyway.

* jit/JITThunks.cpp:
(JSC::JITThunks::hostFunctionStub):

Canonical link: https://commits.webkit.org/154760.148@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175900 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 65dccb36755af7d3be5c9abe0d3df41b05a60446
      https://github.com/WebKit/WebKit/commit/65dccb36755af7d3be5c9abe0d3df41b05a60446
  Author: Tibor Meszaros <tmeszaros.u-szeged at partner.samsung.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/css3/font-weight-expected.txt
    A LayoutTests/css3/font-weight-multiple-selectors-expected.txt
    A LayoutTests/css3/font-weight-multiple-selectors.html
    A LayoutTests/css3/font-weight.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/DeprecatedStyleBuilder.cpp
    M Source/WebCore/platform/graphics/FontDescription.cpp

  Log Message:
  -----------
  Merge r175043 - Match spec for font-weight: bolder|lighter
https://bugs.webkit.org/show_bug.cgi?id=137919

Patch by Tibor Meszaros <tmeszaros.u-szeged at partner.samsung.com> on 2014-10-22
Reviewed by Andreas Kling.

This patch is a merge of Blink's
Source/WebCore:

https://chromiumcodereview.appspot.com/15994009

Currently, bolder and lighter change font-weight in a non-compliant way.
The spec (http://www.w3.org/TR/css3-fonts/#bolderlighter) defines
exactly what the computed values should be given the inherited weight values,
so we should match those.

The removed FIXME's for selecting the next lightest/heaviest weight from
the used font family seems to refer to behaviour from
CSS1 (http://www.w3.org/TR/CSS1/#font-weight), while this is replaced
with a simpler procedure for resolving bolder and lighter in font weights
in CSS2 (http://www.w3.org/TR/CSS2/fonts.html#propdef-font-weight) and CSS3 (link above).

and https://codereview.chromium.org/137813004

According to http://dev.w3.org/csswg/css-fonts/#font-weight-prop, the computed
weight of 'lighter' and 'bolder' are based on the inherited 'font-weight', so set
that inherited weight before calculating 'lighter' and 'bolder'.

Tests: css3/font-weight-multiple-selectors.html
       css3/font-weight.html

* css/DeprecatedStyleBuilder.cpp:
(WebCore::ApplyPropertyFontWeight::applyValue):
* platform/graphics/FontDescription.cpp:
(WebCore::FontDescription::lighterWeight):
(WebCore::FontDescription::bolderWeight):

LayoutTests:

https://chromiumcodereview.appspot.com/15994009 and
https://codereview.chromium.org/137813004

* css3/font-weight-expected.txt: Added.
* css3/font-weight-multiple-selectors-expected.txt: Added.
* css3/font-weight-multiple-selectors.html: Added.
* css3/font-weight.html: Added.

Canonical link: https://commits.webkit.org/154760.149@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175901 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: c3b2cd56691c830cbf7df3a0bb853ba0b2e147b7
      https://github.com/WebKit/WebKit/commit/c3b2cd56691c830cbf7df3a0bb853ba0b2e147b7
  Author: Shivakumar J M <shiva.jm at samsung.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/xmlhttprequest/basic-auth-responseURL-expected.txt
    A LayoutTests/http/tests/xmlhttprequest/basic-auth-responseURL.html
    A LayoutTests/http/tests/xmlhttprequest/cross-origin-redirect-responseURL-expected.txt
    A LayoutTests/http/tests/xmlhttprequest/cross-origin-redirect-responseURL.html
    A LayoutTests/http/tests/xmlhttprequest/redirect-credentials-responseURL-expected.txt
    A LayoutTests/http/tests/xmlhttprequest/redirect-credentials-responseURL.html
    A LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-responseURL-expected.txt
    A LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-responseURL.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/xml/XMLHttpRequest.cpp
    M Source/WebCore/xml/XMLHttpRequest.h
    M Source/WebCore/xml/XMLHttpRequest.idl

  Log Message:
  -----------
  Merge r175053 - XMLHttpRequest should support attribute responseURL as per latest XHR spec.
https://bugs.webkit.org/show_bug.cgi?id=136938

Patch by Shivakumar JM <shiva.jm at samsung.com> on 2014-10-22
Reviewed by Alexey Proskuryakov.

Source/WebCore:

Tests: http/tests/xmlhttprequest/basic-auth-responseURL.html
       http/tests/xmlhttprequest/cross-origin-redirect-responseURL.html
       http/tests/xmlhttprequest/redirect-credentials-responseURL.html
       http/tests/xmlhttprequest/xmlhttprequest-responseURL.html

XMLHttpRequest should support attribute responseURL

* xml/XMLHttpRequest.cpp:
(WebCore::XMLHttpRequest::responseURL):
* xml/XMLHttpRequest.h:
* xml/XMLHttpRequest.idl:

LayoutTests:

Added test to check responseURL attribute in XMLHttpRequest.

* http/tests/xmlhttprequest/basic-auth-responseURL-expected.txt: Added.
* http/tests/xmlhttprequest/basic-auth-responseURL.html: Added.
* http/tests/xmlhttprequest/cross-origin-redirect-responseURL-expected.txt: Added.
* http/tests/xmlhttprequest/cross-origin-redirect-responseURL.html: Added.
* http/tests/xmlhttprequest/redirect-credentials-responseURL-expected.txt: Added.
* http/tests/xmlhttprequest/redirect-credentials-responseURL.html: Added.
* http/tests/xmlhttprequest/xmlhttprequest-responseURL-expected.txt: Added.
* http/tests/xmlhttprequest/xmlhttprequest-responseURL.html: Added.

Canonical link: https://commits.webkit.org/154760.150@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175902 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 15d1cfcd26e3d943aaf15726cdefd5154268e2fb
      https://github.com/WebKit/WebKit/commit/15d1cfcd26e3d943aaf15726cdefd5154268e2fb
  Author: Said Abou-Hallawa <sabouhallawa at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/security/resources/image-with-css-cross-domain-circle.css
    A LayoutTests/http/tests/security/resources/image-with-css-cross-domain-circle2.css
    A LayoutTests/http/tests/security/resources/image-with-css-cross-domain.svg
    A LayoutTests/http/tests/security/resources/image-with-remote-image.svg
    A LayoutTests/http/tests/security/svg-image-with-cached-remote-image-expected.html
    A LayoutTests/http/tests/security/svg-image-with-cached-remote-image.html
    A LayoutTests/http/tests/security/svg-image-with-css-cross-domain-expected.html
    A LayoutTests/http/tests/security/svg-image-with-css-cross-domain.css
    A LayoutTests/http/tests/security/svg-image-with-css-cross-domain.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/cache/CachedResourceLoader.cpp

  Log Message:
  -----------
  Merge r175074 - SVG loaded through html <img> can't request to load any external resources.
https://bugs.webkit.org/show_bug.cgi?id=137762.

Patch by Said Abou-Hallawa <sabouhallawa at apple.com> on 2014-10-22
Reviewed by Daniel Bates.

Source/WebCore:

SVG images have unique security rules that prevent them from loading any external
resources. This patch enforces these rules in CachedResourceLoader::canRequest for
all non-data-uri resources.

The fix and the tests are ported but modified a little from the chromium fix:
http://src.chromium.org/viewvc/blink?view=rev&rev=176084

Test: http/tests/security/svg-image-with-cached-remote-image.html
      http/tests/security/svg-image-with-css-cross-domain.html

For the SVG image, prevent loading any external sub-resource except for data urls.
* loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::canRequest):

LayoutTests:

Ensure that SVG images, which are loaded through the <img> tag or through the
CSS background image, cannot load any external sub-resource except for data-
URL resources (though this doesn't work at the time of writing, see bug #137941).
Also ensure the same rule is enforced on cached resources.

The tests are ported but modified a little from the chromium fix:
http://src.chromium.org/viewvc/blink?view=rev&rev=176084

Set the circle background to orange
* http/tests/security/resources/image-with-css-cross-domain-circle.css: Added.
(circle):

Set the circle stroke-width = 2 and the circle stroke = red
* http/tests/security/resources/image-with-css-cross-domain-circle2.css: Added.
(circle):

This svg references the two css files: one is relative path and the other is absolute path
* http/tests/security/resources/image-with-css-cross-domain.svg: Added.

This svg references an external image.
* http/tests/security/resources/image-with-remote-image.svg: Added.

A helper css which sets the formatting style for some html tags
* http/tests/security/svg-image-with-css-cross-domain.css: Added.
(span):
(span.circle-css-cross-domain):
(embed):
(iframe):

Test the svg which is referenced as a cached image by an <object> tag, does not load
external sub-resource.
* http/tests/security/svg-image-with-cached-remote-image-expected.html: Added.
* http/tests/security/svg-image-with-cached-remote-image.html: Added.

Test loading sub-resources for an svg which is included in the html by different ways
and which references external css files.
Ensure the image object does not load any external sub-resources.
* http/tests/security/svg-image-with-css-cross-domain-expected.html: Added.
* http/tests/security/svg-image-with-css-cross-domain.html: Added.

Canonical link: https://commits.webkit.org/154760.151@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175903 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 186aee7627fa69b619b3323d9ca749ce79277768
      https://github.com/WebKit/WebKit/commit/186aee7627fa69b619b3323d9ca749ce79277768
  Author: Byungseon Shin <sun.shin at lge.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/js/dom/script-tests/date-DST-time-cusps.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/JavaScriptCore.order
    M Source/JavaScriptCore/runtime/DateConstructor.cpp
    M Source/JavaScriptCore/runtime/DateInstance.cpp
    M Source/JavaScriptCore/runtime/DatePrototype.cpp
    M Source/JavaScriptCore/runtime/JSDateMath.cpp
    M Source/JavaScriptCore/runtime/JSDateMath.h
    M Source/JavaScriptCore/runtime/VM.h
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/DateMath.cpp
    M Source/WTF/wtf/DateMath.h

  Log Message:
  -----------
  Merge r175078 - String(new Date(Mar 30 2014 01:00:00)) is wrong in CET
https://bugs.webkit.org/show_bug.cgi?id=130967

Patch by Byungseon Shin <sun.shin at lge.com> on 2014-10-22
Reviewed by Mark Lam.

Source/JavaScriptCore:

By definition of calculateLocalTimeOffset, input time should be UTC time.
But there are many cases when input time is based on local time.
So, it gives erroneous results while calculating offset of DST boundary time.
By adding a argument to distinguish UTC and local time, we can get the correct offset.

* JavaScriptCore.order:
* runtime/DateConstructor.cpp:
(JSC::constructDate):
(JSC::callDate):
(JSC::dateUTC):
* runtime/DateInstance.cpp:
(JSC::DateInstance::calculateGregorianDateTime):
(JSC::DateInstance::calculateGregorianDateTimeUTC):
* runtime/DatePrototype.cpp:
(JSC::setNewValueFromTimeArgs):
(JSC::setNewValueFromDateArgs):
(JSC::dateProtoFuncSetMilliSeconds):
(JSC::dateProtoFuncSetUTCMilliseconds):
(JSC::dateProtoFuncSetSeconds):
(JSC::dateProtoFuncSetUTCSeconds):
(JSC::dateProtoFuncSetMinutes):
(JSC::dateProtoFuncSetUTCMinutes):
(JSC::dateProtoFuncSetHours):
(JSC::dateProtoFuncSetUTCHours):
(JSC::dateProtoFuncSetDate):
(JSC::dateProtoFuncSetUTCDate):
(JSC::dateProtoFuncSetMonth):
(JSC::dateProtoFuncSetUTCMonth):
(JSC::dateProtoFuncSetFullYear):
(JSC::dateProtoFuncSetUTCFullYear):
(JSC::dateProtoFuncSetYear):
* runtime/JSDateMath.cpp:
(JSC::localTimeOffset):
(JSC::gregorianDateTimeToMS):
(JSC::msToGregorianDateTime):
(JSC::parseDateFromNullTerminatedCharacters):
* runtime/JSDateMath.h:
* runtime/VM.h:
(JSC::LocalTimeOffsetCache::LocalTimeOffsetCache):
(JSC::LocalTimeOffsetCache::reset):
Passing TimeType argument to distingush UTC time and local time.

Source/WTF:

By definition of calculateLocalTimeOffset, input time should be UTC time.
But there are many cases when input time is based on local time.
So, it gives erroneous results while calculating offset of DST boundary time.
By adding a argument to distinguish UTC and local time, we can get the correct offset.

* wtf/DateMath.cpp:
(WTF::calculateLocalTimeOffset):
(WTF::parseDateFromNullTerminatedCharacters):
Compensate time offset depends on UTC time or local time.
* wtf/DateMath.h:
Add argument to differenciate UTC or local time.

LayoutTests:

Set latest DST timezone boundary values on
<http://www.timeanddate.com/time/zone/usa/los-angeles>

* js/dom/script-tests/date-DST-time-cusps.js:

Canonical link: https://commits.webkit.org/154760.152@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175904 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 1d81e12708aff76b8057307c911a47c3b5513c56
      https://github.com/WebKit/WebKit/commit/1d81e12708aff76b8057307c911a47c3b5513c56
  Author: Milan Crha <mcrha at redhat.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/gtk/WidgetBackingStoreGtkX11.cpp
    M Source/WebCore/platform/gtk/WidgetBackingStoreGtkX11.h

  Log Message:
  -----------
  Merge r175087 - Do not build WidgetBackingStoreGtkX11 when not used.
<https://webkit.org/b/137972>.

Patch by Milan Crha <mcrha at redhat.com> on 2014-10-22
Reviewed by Carlos Garcia Campos.

* platform/gtk/WidgetBackingStoreGtkX11.cpp:
* platform/gtk/WidgetBackingStoreGtkX11.h:

Canonical link: https://commits.webkit.org/154760.153@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175905 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 3b002da70803747bac25e1f96800c2aaec42a1cc
      https://github.com/WebKit/WebKit/commit/3b002da70803747bac25e1f96800c2aaec42a1cc
  Author: Milan Crha <mcrha at redhat.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp

  Log Message:
  -----------
  Merge r175088 - Do not include GraphicsContext3D.h when 3D_GRAPHICS is not used.
<https://webkit.org/b/137969>.

Patch by Milan Crha <mcrha at redhat.com> on 2014-10-22
Reviewed by Carlos Garcia Campos.

* platform/graphics/cairo/GraphicsContext3DCairo.cpp:

Canonical link: https://commits.webkit.org/154760.154@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175906 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f2e7b2ccfb9b93c3e63f0898d2a72bfcd2c679ad
      https://github.com/WebKit/WebKit/commit/f2e7b2ccfb9b93c3e63f0898d2a72bfcd2c679ad
  Author: Milan Crha <mcrha at redhat.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderThemeGtk.cpp

  Log Message:
  -----------
  Merge r175095 - RenderThemeGtk::mediaControlsScript() is not defined when VIDEO is disabled.
<https://webkit.org/b/137970>.

Patch by Milan Crha <mcrha at redhat.com> on 2014-10-23
Reviewed by Carlos Garcia Campos.

* rendering/RenderThemeGtk.cpp:

Canonical link: https://commits.webkit.org/154760.155@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175907 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: ff3c2610c514f842b39c92ca9275b7d4485c7dba
      https://github.com/WebKit/WebKit/commit/ff3c2610c514f842b39c92ca9275b7d4485c7dba
  Author: Krzysztof Czech <k.czech at samsung.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AccessibilityNodeObject.cpp
    M Source/WebCore/accessibility/AccessibilityRenderObject.cpp
    M Source/WebCore/accessibility/AccessibilityTableRow.cpp

  Log Message:
  -----------
  Merge r175100 - AX: Do the early return when role is different than UnknownRole
https://bugs.webkit.org/show_bug.cgi?id=137880

Reviewed by Chris Fleizach.

We do not need to call ariaRoleAttribute() to check whether m_ariaRole is different than UnknownRole.
Just check m_ariaRole instead.

No new tests, no behavior change, just some cleanup

* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::determineAccessibilityRole):
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::determineAccessibilityRole):
* accessibility/AccessibilityTableRow.cpp:
(WebCore::AccessibilityTableRow::determineAccessibilityRole):

Canonical link: https://commits.webkit.org/154760.156@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175908 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 6bd88d16ac91b455770deb2785fd99cf9e2c5c99
      https://github.com/WebKit/WebKit/commit/6bd88d16ac91b455770deb2785fd99cf9e2c5c99
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/InlineASM.h
    M Source/WTF/wtf/Platform.h

  Log Message:
  -----------
  Merge r175115 - [GTK] Fix build on Hurd
https://bugs.webkit.org/show_bug.cgi?id=138003

Reviewed by Carlos Garcia Campos.

* wtf/InlineASM.h:
* wtf/Platform.h:

Canonical link: https://commits.webkit.org/154760.157@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175910 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 65e146f4c8ff0db5d219f36d477078150eb85642
      https://github.com/WebKit/WebKit/commit/65e146f4c8ff0db5d219f36d477078150eb85642
  Author: Myles C. Maxfield <mmaxfield at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/editing/caret/color-span-inside-editable-background-expected.html
    A LayoutTests/editing/caret/color-span-inside-editable-background.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/editing/FrameSelection.cpp

  Log Message:
  -----------
  Merge r175152 - Carets in GMail and iCloud compositions are the foreground text color
https://bugs.webkit.org/show_bug.cgi?id=138029

Reviewed by Simon Fraser.

Source/WebCore:

Previously, we were only checking whether the background colors of the foreground and background
elements were the same, rather than taking validity and opacity into consideration.

Test: editing/caret/color-span-inside-editable-background.html

* editing/FrameSelection.cpp:
(WebCore::disappearsIntoBackground):
(WebCore::CaretBase::paintCaret):

LayoutTests:

Test the case where the content editable root has a background color specified.

* editing/caret/color-span-inside-editable-background-expected.html: Added.
* editing/caret/color-span-inside-editable-background.html: Added.

Canonical link: https://commits.webkit.org/154760.158@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175911 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: bec568741a151740f8b1b40a58c760a572003ef7
      https://github.com/WebKit/WebKit/commit/bec568741a151740f8b1b40a58c760a572003ef7
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/SearchInputType.cpp

  Log Message:
  -----------
  Merge r175158 - WebContent crash at WebCore::RenderTextControl::textFormControlElement const.
https://bugs.webkit.org/show_bug.cgi?id=138035

Reviewed by Antti Koivisto.

NULL-check element().renderer() before using it.

* html/SearchInputType.cpp:
(WebCore::SearchInputType::didSetValueByUserEdit):

Canonical link: https://commits.webkit.org/154760.159@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175912 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 34e330f5c69675a55b6135615c8738ca94d0e7d6
      https://github.com/WebKit/WebKit/commit/34e330f5c69675a55b6135615c8738ca94d0e7d6
  Author: Benjamin Poulain <benjamin at webkit.org>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/selectors/images-with-usemap-should-not-match-link-expected.txt
    A LayoutTests/fast/selectors/images-with-usemap-should-not-match-link.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AccessibilityNodeObject.cpp
    M Source/WebCore/accessibility/AccessibilityNodeObject.h
    M Source/WebCore/accessibility/AccessibilityObject.h
    M Source/WebCore/accessibility/AccessibilityRenderObject.cpp
    M Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm
    M Source/WebCore/dom/Node.h
    M Source/WebCore/html/HTMLImageElement.cpp

  Log Message:
  -----------
  Merge r175213 - Images with usemap should not have a link state
https://bugs.webkit.org/show_bug.cgi?id=138071

Reviewed by Andreas Kling.

Source/WebCore:

Image tags were incorrectly getting a link state if a usemap is defined.
The <area> of the usemap is supposed to get the link state, but never the image.

Unfortunately, the Accessibility code was relying on the wrong behavior
to set the ImageMapRole, most of the patch is updating that code to get
the correct role without the link state.

Test: fast/selectors/images-with-usemap-should-not-match-link.html

The accessibility code is covered by a few tests in accessibility/.
The test accessibility/aria-used-on-image-maps.html ensure the <area>
elements also get the correct role.

* dom/Node.h:
(WebCore::Node::setIsLink):
(WebCore::Node::clearIsLink): Deleted.
Unused code.

(WebCore::Node::isLink):
Move with its setter for clarity.

* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::parseAttribute):
This is the bug.

* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::determineAccessibilityRole):
Here the branches for the role ImageMap where behind isLink() which would
never be valid after the fix.

My fix here was to use the same definition previously set by HTMLImageElement::parseAttribute(),
any usemap attribute qualifies the node for ImageMapRole.

(WebCore::AccessibilityRenderObject::anchorElement):
(WebCore::AccessibilityRenderObject::linkedUIElements):
(WebCore::AccessibilityRenderObject::url):

* accessibility/AccessibilityObject.h:
(WebCore::AccessibilityObject::isAnchor): Deleted.
Something funny I discovered is the Accessibility code worked around the bug
by defining isAnchor() that exclude images from isLink().

Since isLink() will no longer be true for images, the hack can be removed.

* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::anchorElement):
(WebCore::AccessibilityNodeObject::isAnchor): Deleted.
* accessibility/AccessibilityNodeObject.h:
* accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
(-[WebAccessibilityObjectWrapper accessibilityAttributeNames]):

LayoutTests:

* fast/selectors/images-with-usemap-should-not-match-link-expected.txt: Added.
* fast/selectors/images-with-usemap-should-not-match-link.html: Added.

Canonical link: https://commits.webkit.org/154760.160@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175913 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e76c1a92484d7d299bb89a8d12c83b46eb49385f
      https://github.com/WebKit/WebKit/commit/e76c1a92484d7d299bb89a8d12c83b46eb49385f
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp
    M Source/WebCore/rendering/mathml/RenderMathMLOperator.h

  Log Message:
  -----------
  Merge r175221 - Shrink MathMLOperatorDictionary::dictionary table
https://bugs.webkit.org/show_bug.cgi?id=137914

Reviewed by Darin Adler.

Improve packing of the Entry structure that's used for elements
of the MathMLOperatorDictionary::dictionary table. This drops the
size of the struct from 16 bytes to just 4 bytes, and shrinks the
size of the dictionary table from rougly 16 kB down to 4 kB.

* rendering/mathml/RenderMathMLOperator.cpp:
(WebCore::MathMLOperatorDictionary::ExtractKey):
(WebCore::RenderMathMLOperator::setOperatorProperties):
* rendering/mathml/RenderMathMLOperator.h:

Canonical link: https://commits.webkit.org/154760.161@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175914 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 1b94952bedc3977f8e291907f6b47618cc7de541
      https://github.com/WebKit/WebKit/commit/1b94952bedc3977f8e291907f6b47618cc7de541
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/HashTraits.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/WebCore.exp.in
    M Source/WebCore/loader/CrossOriginAccessControl.cpp
    M Source/WebCore/loader/CrossOriginAccessControl.h
    M Source/WebCore/loader/CrossOriginPreflightResultCache.cpp
    M Source/WebCore/loader/DocumentLoader.cpp
    M Source/WebCore/loader/cache/CachedRawResource.cpp
    M Source/WebCore/platform/network/HTTPHeaderMap.cpp
    M Source/WebCore/platform/network/HTTPHeaderMap.h
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/Shared/WebCoreArgumentCoders.cpp

  Log Message:
  -----------
  Merge r175231 - Use separate HashMaps for common and uncommon headers in HTTPHeaderMap
https://bugs.webkit.org/show_bug.cgi?id=138079

Reviewed by Anders Carlsson.

Source/WebCore:

Use separate HashMaps for common and uncommon headers in HTTPHeaderMap:
- a (faster) HashMap<HTTPHeaderMap, String> for common HTTP headers
- a HashMap<String, String, CaseFoldingHash> for uncommon ones

This avoids having to construct Strings from HTTPHeaderMap values for
storing. This also means we have less isolated String copies to do when
creating cross-thread data. The common headers HashMap should also be
a bit more efficient due to faster hashing and faster key comparison in
case of collision.

Some calls sites can also benefit from having direct access to common
headers of the request in HTTPHeaderName type.

This patch adds a new HTTPHeaderMapConstIterator iterator type for
HTTPHeaderMap so that call sites that do not need / want to distinguish
common / uncommon headers still do not need to. They can keep using
modern C++ loops over HTTPHeaderMap objects and get <String, String>
key/value pairs.

No new tests, no behavior change.

* loader/CrossOriginAccessControl.cpp:
(WebCore::isOnAccessControlSimpleRequestHeaderWhitelist):
Have isOnAccessControlSimpleRequestHeaderWhitelist() take a
HTTPHeaderName in argument instead of a String as only common headers
are in the whitelist.

(WebCore::isSimpleCrossOriginAccessRequest):
Call isOnAccessControlSimpleRequestHeaderWhitelist() only for common
HTTP headers.

* loader/CrossOriginAccessControl.h:
Have isOnAccessControlSimpleRequestHeaderWhitelist() take a
HTTPHeaderName in argument instead of a String as only common headers
are in the whitelist.

* loader/CrossOriginPreflightResultCache.cpp:
(WebCore::CrossOriginPreflightResultCacheItem::allowsCrossOriginHeaders):
Call isOnAccessControlSimpleRequestHeaderWhitelist() only for common
HTTP headers.

* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::responseReceived):
Call httpHeaderFields().commonHeaders().find() instead of
httpHeaderFields().find() as we are looking for a common header.
HTTPHeaderMap::find(HTTPHeaderName) was removed now that we have a
HashMap dedicated to common headers.

* loader/cache/CachedRawResource.cpp:
(WebCore::shouldIgnoreHeaderForCacheReuse):
Update argument type to be a HTTPHeaderName instead of a String as
only common HTTP headers can be ignored for cache reuse. The
implementation already dealt with HTTPHeaderName type and had to
call findHTTPHeaderName(). This is no longer needed now that the
call site now has direct access to common headers in HTTPHeaderName
type.

(WebCore::CachedRawResource::canReuse):
- Only call shouldIgnoreHeaderForCacheReuse() for common HTTP headers.
- Slightly optimize the second loop (the one over oldHeaderMap) to only
  check that the key is present in newHeaderMap, without actually
  comparing the String values. If the String values were different, the
  first loop would have seen it already and we would have returned
  early.

Source/WebKit2:

Update the WK2 IPC HTTPHeaderMap serialization / deserialization code
to leverage the fact that HTTPHeaderMap now stores common HTTP headers
and uncommon one in separate HashMaps. This speeds up deserialization
as we no longer need to call findHTTPHeaderName() for every decoded
header. We already know if the header is a common one or not, and if
it is then we already have a HTTPHeaderName type instead of a String.

I see that we spend ~40% less time in HTTPHeaderMap decoding when
loading http://flickr.com/explore, while the encoding takes about
the same amount of time as before.

* Shared/WebCoreArgumentCoders.cpp:
(IPC::ArgumentCoder<HTTPHeaderMap>::encode):
(IPC::ArgumentCoder<HTTPHeaderMap>::decode):

Source/WTF:

Add HashTraits for C++11 strong enum types. Using integer HashTraits for
strong enums would be inconvenient as it would require casting between
integer and strong enum types.

* wtf/HashTraits.h:
(WTF::StrongEnumHashTraits::emptyValue):
(WTF::StrongEnumHashTraits::constructDeletedValue):
(WTF::StrongEnumHashTraits::isDeletedValue):

Canonical link: https://commits.webkit.org/154760.162@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175915 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 65c705872b328f3698990ed12a5761958fbd624c
      https://github.com/WebKit/WebKit/commit/65c705872b328f3698990ed12a5761958fbd624c
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/cache/xhr-uncommon-header-expected.txt
    A LayoutTests/http/tests/cache/xhr-uncommon-header.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/HTTPHeaderMap.h

  Log Message:
  -----------
  Merge r175312 - Crash in CachedRawResource::canReuse() when reloading http://dnd.wizards.com/dungeons-and-dragons/story
https://bugs.webkit.org/show_bug.cgi?id=138164

Reviewed by Andreas Kling.

Source/WebCore:

This patch fixes a crash when reloading the following URL:
http://dnd.wizards.com/dungeons-and-dragons/story

We were crashing in CachedRawResource::canReuse() because header.key
would sometimes be a null String and we would call
HashMap::get(nullString).

The real issue was that header.key was null in the first place, which
means that even though the HTTPHeaderMap iterator is valid, it->key
is a null String, which should never happen. There was a bug in the
HTTPHeaderMapConstIterator() constructor that would cause the
iterator key/value pair to not get initialized if the HTTPHeaderMap
contained *only* uncommon HTTP headers. This patch updates the
constructor so that we fall back to updating the key/value from the
uncommon header map, if we failed to initialized from the common
header map (because it was empty).

Test: http/tests/cache/xhr-uncommon-header.html

* platform/network/HTTPHeaderMap.h:
(WebCore::HTTPHeaderMap::HTTPHeaderMapConstIterator::HTTPHeaderMapConstIterator):

LayoutTests:

Add a layout test that does XHR loads from cache with only uncommon
HTTP headers to reproduce a crash in CachedRawResource::canReuse()
when iterating over a HTTPHeaderMap that had uncommon HTTP headers
but no common ones.

* http/tests/cache/xhr-uncommon-header-expected.txt: Added.
* http/tests/cache/xhr-uncommon-header.html: Added.

Canonical link: https://commits.webkit.org/154760.163@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175916 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 8e5c42bebda90c53ec133fcae7c8f090bd618a9c
      https://github.com/WebKit/WebKit/commit/8e5c42bebda90c53ec133fcae7c8f090bd618a9c
  Author: Chris Fleizach <cfleizach at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/accessibility/input-type-hidden-in-aria-hidden-false-expected.txt
    A LayoutTests/accessibility/input-type-hidden-in-aria-hidden-false.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AccessibilityNodeObject.cpp

  Log Message:
  -----------
  Merge r175241 - AX: input type=hidden is being exposed when aria-hidden=false
https://bugs.webkit.org/show_bug.cgi?id=138106

Reviewed by Benjamin Poulain.

Source/WebCore:

If an input type=hidden was inside an aria-hidden=false, it would appear because
the lack of a RenderObject behind that object was not blocking its adoption into the AX tree.
We should explicity check for whether the type is hidden and then return an appropriate role.

Test: accessibility/input-type-hidden-in-aria-hidden-false.html

* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::determineAccessibilityRole):
(WebCore::AccessibilityNodeObject::computeAccessibilityIsIgnored):

LayoutTests:

* accessibility/input-type-hidden-in-aria-hidden-false-expected.txt: Added.
* accessibility/input-type-hidden-in-aria-hidden-false.html: Added.

Canonical link: https://commits.webkit.org/154760.164@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175917 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 2f7559f9eed93d34cc979d8cd2c52730945e1736
      https://github.com/WebKit/WebKit/commit/2f7559f9eed93d34cc979d8cd2c52730945e1736
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/js/array-length-shortening-expected.txt
    A LayoutTests/js/array-length-shortening.html
    A LayoutTests/js/for-of-crash-expected.txt
    A LayoutTests/js/for-of-crash.html
    A LayoutTests/js/script-tests/array-length-shortening.js
    A LayoutTests/js/script-tests/for-of-crash.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/jit/ThunkGenerators.cpp

  Log Message:
  -----------
  Merge r175243 - Crash when attempting to perform array iteration on a non-array with numeric keys not initialized.
<https://webkit.org/b/137814>

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

The arrayIteratorNextThunkGenerator() thunk was not checking for the case where
the butterfly may be NULL.  This was the source of the crash, and is now fixed.

In addition, it is also not checking for the case where a property named "length"
may have been set on the iterated object.  The thunk only checks the butterfly's
publicLength for its iteration operation.  Array objects will work fine with this
because it always updates its butterfly's publicLength when its length changes.
In the case of iterable non-Array objects, the "length" property will require a
look up outside of the scope of this thunk.  The fix is simply to limit the fast
case checks in this thunk to Array objects.

* jit/ThunkGenerators.cpp:
(JSC::arrayIteratorNextThunkGenerator):

LayoutTests:

* js/array-length-shortening-expected.txt: Added.
* js/array-length-shortening.html: Added.
* js/for-of-crash-expected.txt: Added.
* js/for-of-crash.html: Added.
* js/script-tests/array-length-shortening.js: Added.
(testLengthShortening):
(denseInt32Elements):
(denseDoubleElements):
(denseObjectElements):
(holeyInt32Elements):
(holeyDoubleElements):
(holeyObjectElements):
(arrayStorageInt32Elements):
(arrayStorageDoubleElements):
(arrayStorageObjectElements):
(sparseInt32Elements):
(sparseDoubleElements):
(sparseObjectElements):
* js/script-tests/for-of-crash.js: Added.
(foo):

Canonical link: https://commits.webkit.org/154760.165@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175918 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: eb5c6cb9e7daf57dc972da7364491ea9f2383178
      https://github.com/WebKit/WebKit/commit/eb5c6cb9e7daf57dc972da7364491ea9f2383178
  Author: Jeffrey Pfau <jpfau at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/FrameLoader.cpp

  Log Message:
  -----------
  Merge r175277 - FrameProgressTracker expects Page to not have detached
https://bugs.webkit.org/show_bug.cgi?id=138061

Reviewed by Alexey Proskuryakov.

In some cases, a Page may be detached from a Frame before its
FrameLoader is torn down, causing FrameProgressTracker's destructor
to hit a null pointer.

No new tests; it is impossible to reliably simulate the null pointer
case without intrusive code changes.

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::FrameProgressTracker::~FrameProgressTracker):

Canonical link: https://commits.webkit.org/154760.166@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175919 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e5719b5a68d8027884ac89631afd4c3ec0d0876b
      https://github.com/WebKit/WebKit/commit/e5719b5a68d8027884ac89631afd4c3ec0d0876b
  Author: Ting-Wei Lan <lantw44 at gmail.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/Platform/IPC/ArgumentCoders.h

  Log Message:
  -----------
  Merge r175299 - Cast std::chrono::duration.count() to int64_t in ArgumentCoder
https://bugs.webkit.org/show_bug.cgi?id=136981

Patch by Ting-Wei Lan <lantw44 at gmail.com> on 2014-10-28
Reviewed by Alexey Proskuryakov.

Explicitly cast the return value of std::chrono::duration.count() to
a fixed-size interger type, which prevents compilation error when
the return value type matches neither int32_t nor int64_t.

* Platform/IPC/ArgumentCoders.h:

Canonical link: https://commits.webkit.org/154760.167@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175920 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 75284d10c1a7b87b7b298a950df11d80b25d3bbf
      https://github.com/WebKit/WebKit/commit/75284d10c1a7b87b7b298a950df11d80b25d3bbf
  Author: Raphael Kubo da Costa <rakuco at webkit.org>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M ChangeLog
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Merge r175344 - [GTK] Bump libsoup's minimum version to 2.42.0.
https://bugs.webkit.org/show_bug.cgi?id=138086

Reviewed by Martin Robinson.

The SOUP_CHECK_VERSION macro was added in libsoup 2.41.1, and the
soup-version.h header was added to soup.h in 2.41.4, which then becomes
the minimum version required to build the port these days.

In addition, since the autotools build system required 2.42.0 before
being retired, require the same version here. Version 2.42.0 was also
recommended in
https://lists.webkit.org/pipermail/webkit-gtk/2013-March/001387.html.

* Source/cmake/OptionsGTK.cmake:

Canonical link: https://commits.webkit.org/154760.168@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175921 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 8196b245b312162aa86865bd10881e574372a3e3
      https://github.com/WebKit/WebKit/commit/8196b245b312162aa86865bd10881e574372a3e3
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/inline/crash-when-inline-box-has-invalid-float-expected.txt
    A LayoutTests/fast/inline/crash-when-inline-box-has-invalid-float.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlockFlow.cpp
    M Source/WebCore/rendering/RootInlineBox.h

  Log Message:
  -----------
  Merge r175345 - Remove invalid float from RootInlineBox.
https://bugs.webkit.org/show_bug.cgi?id=137707

Reviewed by Antti Koivisto.

In certain cases, floating boxes get attached to the last (root) inline box.
When this particular floating box gets destroyed, it also needs to be detached
from the last inline box.
Source/WebCore:

1. Introduce RootInlineBox::removeFloat() (vs. RootInlineBox::appendFloat())
2. Ensure that it is called when the floating box is being destroyed.

Test: fast/inline/crash-when-inline-box-has-invalid-float.html

* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::removeFloatingObject):
(WebCore::RenderBlockFlow::markAllDescendantsWithFloatsForLayout): During style recalc, while
tearing down the render tree, we can get to a state where a block element has both inline and block children.
It happens when the style change on an element makes sibling anonymous block wrappers detached.
In that case the markAllDescendantsWithFloatsForLayout() call does not get propagated down on the
block child elements as we return early at the childrenInline() check.
* rendering/RootInlineBox.h:
(WebCore::RootInlineBox::removeFloat):

LayoutTests:

* fast/inline/crash-when-inline-box-has-invalid-float-expected.txt: Added.
* fast/inline/crash-when-inline-box-has-invalid-float.html: Added.

Canonical link: https://commits.webkit.org/154760.169@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175922 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 55d9ae92d71f8e373c043f57b2d2989307aacefb
      https://github.com/WebKit/WebKit/commit/55d9ae92d71f8e373c043f57b2d2989307aacefb
  Author: Alexey Proskuryakov <ap at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/Page.cpp
    M Source/WebCore/page/Settings.cpp
    M Source/WebCore/page/Settings.h

  Log Message:
  -----------
  Merge r175347 - Notify Settings object when its Page object goes away.
https://bugs.webkit.org/show_bug.cgi?id=138183
rdar://problem/18786900

Reviewed by Andreas Kling.

I could not make a test for this issue.

* page/Page.cpp:
(WebCore::Page::~Page):
* page/Settings.cpp:
(WebCore::setImageLoadingSettings):
(WebCore::Settings::Settings):
(WebCore::Settings::setTextAutosizingEnabled):
(WebCore::Settings::setTextAutosizingWindowSizeOverride):
(WebCore::Settings::setTextAutosizingFontScaleFactor):
(WebCore::Settings::setMediaTypeOverride):
(WebCore::Settings::setScriptEnabled):
(WebCore::Settings::setUserStyleSheetLocation):
(WebCore::Settings::setMinDOMTimerInterval):
(WebCore::Settings::minDOMTimerInterval):
(WebCore::Settings::domTimerAlignmentInterval):
(WebCore::Settings::setUsesPageCache):
(WebCore::Settings::setScreenFontSubstitutionEnabled):
(WebCore::Settings::setFontRenderingMode):
(WebCore::Settings::setDNSPrefetchingEnabled):
(WebCore::Settings::setStorageBlockingPolicy):
(WebCore::Settings::setBackgroundShouldExtendBeyondPage):
(WebCore::Settings::setScrollingPerformanceLoggingEnabled):
(WebCore::Settings::setHiddenPageDOMTimerThrottlingEnabled):
(WebCore::Settings::setHiddenPageCSSAnimationSuspensionEnabled):
(WebCore::Settings::setFontFallbackPrefersPictographs):
* page/Settings.h:
(WebCore::Settings::pageDestroyed):

Canonical link: https://commits.webkit.org/154760.170@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175923 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: c8ff6632bbd5e900486d269fd35fd00d17fad2ec
      https://github.com/WebKit/WebKit/commit/c8ff6632bbd5e900486d269fd35fd00d17fad2ec
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSPrimitiveValue.cpp

  Log Message:
  -----------
  Merge r175177 - Replace INT_MIN/MAX / kFixedPointDenominator with intMin/MaxForLayoutUnit.
https://bugs.webkit.org/show_bug.cgi?id=138047

Reviewed by Andreas Kling.

No change in functionality.

* css/CSSPrimitiveValue.cpp:

Canonical link: https://commits.webkit.org/154760.171@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175924 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 3b1e460028c9e7847e7c26df9e78a87d107c05b6
      https://github.com/WebKit/WebKit/commit/3b1e460028c9e7847e7c26df9e78a87d107c05b6
  Author: Said Abou-Hallawa <sabouhallawa at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/css3/infinite-word-spacing-expected.txt
    A LayoutTests/css3/infinite-word-spacing.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSPrimitiveValue.cpp
    M Source/WebCore/css/CSSPrimitiveValue.h
    M Source/WebCore/css/DeprecatedStyleBuilder.cpp

  Log Message:
  -----------
  Merge r175197 - Clamp wordSpacing percentage value.
https://bugs.webkit.org/show_bug.cgi?id=129350.

Patch by Said Abou-Hallawa <sabouhallawa at apple.com> on 2014-10-24
Reviewed by Zalan Bujtas.

Source/WebCore:

When the CSS wordSpacing property is percentage, its value has to be within the
pre-defined min/max values for the CSS length type. This is done the same way
the wordSpacing of type <length> is handled.

Tests: css3/infinite-word-spacing.html.

Move the definitions of minValueForCssLength and maxValueForCssLength from the
.cpp file to the .h file.
* css/CSSPrimitiveValue.cpp:
* css/CSSPrimitiveValue.h:

Clamp the wordSpacing value to minValueForCssLength and maxValueForCssLength when
its type is percentage.
* css/DeprecatedStyleBuilder.cpp:
(WebCore::ApplyPropertyWordSpacing::applyValue):

LayoutTests:

Make sure that setting the CSS style wordSpacing property to very huge percentage
value and blending this value with other values for animating key frames does
not assert or crash. The expectation is to have this huge value to be clamped to
the pre-defined min/max values for the CSS length type. So when blending the clamped
value with other wordSpacing values, the result can't be NaN. This should be very
similar to the case when it is set to a huge <length> value.

* css3/infinite-word-spacing-expected.txt: Added.
* css3/infinite-word-spacing.html: Added.

Canonical link: https://commits.webkit.org/154760.172@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175925 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 76963fa2769002cb6f95a3dae5d6074d4fab2438
      https://github.com/WebKit/WebKit/commit/76963fa2769002cb6f95a3dae5d6074d4fab2438
  Author: Said Abou-Hallawa <sabouhallawa at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/css3/calculated-word-spacing-expected.txt
    A LayoutTests/css3/calculated-word-spacing.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/style/RenderStyle.cpp

  Log Message:
  -----------
  Merge r175363 - ASSERTION NOT REACHED because RenderStyle::setWordSpacing() does not handle a Length value of type 'Calculated'.
https://bugs.webkit.org/show_bug.cgi?id=138054.

Patch by Said Abou-Hallawa <sabouhallawa at apple.com> on 2014-10-29
Reviewed by Zalan Bujtas.

Source/WebCore:

A Length of type 'Calculated' can be generated from blending two lengths of
different types. Setting the wordSpacing of the render style should be handled
correctly when the type of the new value is 'Calculated'.

Tests: css3/calculated-word-spacing.html.

Add a case for setting the render style wordSpacing to a <length> of type 'Calculated'.
* rendering/style/RenderStyle.cpp:
(WebCore::RenderStyle::setWordSpacing):

LayoutTests:

Ensure the render style's wordSpacing can be set correctly when the type of
the new value is 'Calculated'. The 'Calculated' Length value can result from
blending two Length values of different types. And these two Length values
are defined in two consecutive css animation key frames.

* css3/calculated-word-spacing-expected.txt: Added.
* css3/calculated-word-spacing.html: Added.

Canonical link: https://commits.webkit.org/154760.173@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175926 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 8e73e4ceca6b1f012fc8753ba2726d2dcb6a8d65
      https://github.com/WebKit/WebKit/commit/8e73e4ceca6b1f012fc8753ba2726d2dcb6a8d65
  Author: Andreas Kling <akling at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/jit/Repatch.cpp
    M Source/JavaScriptCore/runtime/JSArray.h
    M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
    M Source/JavaScriptCore/runtime/RegExpCachedResult.cpp
    M Source/JavaScriptCore/runtime/RegExpCachedResult.h
    M Source/JavaScriptCore/runtime/RegExpConstructor.cpp
    M Source/JavaScriptCore/runtime/RegExpMatchesArray.cpp
    M Source/JavaScriptCore/runtime/RegExpMatchesArray.h
    M Source/JavaScriptCore/runtime/RegExpObject.cpp
    M Source/JavaScriptCore/runtime/StringPrototype.cpp

  Log Message:
  -----------
  Merge r175365 - Use plain JSArray for RegExp matches instead of a lazily populated custom object.
<https://webkit.org/b/138191>

Reviewed by Geoffrey Garen.

We're already offering two RegExp matching APIs, one that collects subpattern
matches (exec), and one that simply tests for a match (test).
Given that, it was pretty overkill to lazily populate the resulting array of
matches, since the user could simply use test() if they didn't need them.

This allows the JIT to generate better code for RegExp match arrays, and also
enables some fast paths in the JSC runtime that check if an object isJSArray().

Looks like ~1.5% improvement on Octane/regexp according to run-jsc-benchmarks.

* jit/Repatch.cpp:
(JSC::tryCacheGetByID):
* runtime/JSArray.h:
(JSC::createArrayButterflyWithExactLength): Deleted.
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
* runtime/RegExpCachedResult.cpp:
(JSC::RegExpCachedResult::visitChildren):
(JSC::RegExpCachedResult::lastResult):
(JSC::RegExpCachedResult::leftContext):
(JSC::RegExpCachedResult::rightContext):
* runtime/RegExpCachedResult.h:
(JSC::RegExpCachedResult::RegExpCachedResult):
(JSC::RegExpCachedResult::record):
(JSC::RegExpCachedResult::input):
* runtime/RegExpConstructor.cpp:
(JSC::RegExpConstructor::getBackref):
(JSC::RegExpConstructor::getLastParen):
(JSC::RegExpConstructor::getLeftContext):
(JSC::RegExpConstructor::getRightContext):
* runtime/RegExpMatchesArray.cpp:
(JSC::createRegExpMatchesArray):
(JSC::RegExpMatchesArray::RegExpMatchesArray): Deleted.
(JSC::RegExpMatchesArray::create): Deleted.
(JSC::RegExpMatchesArray::finishCreation): Deleted.
(JSC::RegExpMatchesArray::visitChildren): Deleted.
(JSC::RegExpMatchesArray::reifyAllProperties): Deleted.
(JSC::RegExpMatchesArray::reifyMatchProperty): Deleted.
(JSC::RegExpMatchesArray::leftContext): Deleted.
(JSC::RegExpMatchesArray::rightContext): Deleted.
* runtime/RegExpMatchesArray.h:
(JSC::RegExpMatchesArray::createStructure): Deleted.
(JSC::RegExpMatchesArray::reifyAllPropertiesIfNecessary): Deleted.
(JSC::RegExpMatchesArray::reifyMatchPropertyIfNecessary): Deleted.
(JSC::RegExpMatchesArray::getOwnPropertySlot): Deleted.
(JSC::RegExpMatchesArray::getOwnPropertySlotByIndex): Deleted.
(JSC::RegExpMatchesArray::put): Deleted.
(JSC::RegExpMatchesArray::putByIndex): Deleted.
(JSC::RegExpMatchesArray::deleteProperty): Deleted.
(JSC::RegExpMatchesArray::deletePropertyByIndex): Deleted.
(JSC::RegExpMatchesArray::getOwnPropertyNames): Deleted.
(JSC::RegExpMatchesArray::defineOwnProperty): Deleted.
(JSC::isRegExpMatchesArray): Deleted.
* runtime/RegExpObject.cpp:
(JSC::RegExpObject::exec):
* runtime/StringPrototype.cpp:
(JSC::stringProtoFuncMatch):

Canonical link: https://commits.webkit.org/154760.174@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175927 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f8bc35e8fff4497fd41c502a5bb1dcd139338a73
      https://github.com/WebKit/WebKit/commit/f8bc35e8fff4497fd41c502a5bb1dcd139338a73
  Author: Philippe Normand <philn at igalia.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/ImageGStreamer.h
    M Source/WebCore/platform/graphics/gstreamer/ImageGStreamerCairo.cpp
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h
    M Source/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.cpp

  Log Message:
  -----------
  Merge r175370 - [GStreamer] Video resolution changes trigger a crash in the TextureMapper
https://bugs.webkit.org/show_bug.cgi?id=137065

Reviewed by Gustavo Noronha Silva.

Switch to GstSample for buffer+caps communication between the
video sink and the player. Using a single object type for this
avoid issues where the caps might not correctly describe the
buffer contents anymore, for example when the video resolution is
changed.

* platform/graphics/gstreamer/ImageGStreamer.h: Use GstSample
instead of GstBuffer+GstCaps.
(WebCore::ImageGStreamer::createImage):
* platform/graphics/gstreamer/ImageGStreamerCairo.cpp: Ditto.
(ImageGStreamer::ImageGStreamer):
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
(WebCore::mediaPlayerPrivateRepaintCallback): The repaint signal
now uses a GstSample instead of a GstBuffer.
(WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
Store the current sample instead of a buffer. Also renamed the
mutex protecting access to the sample.
(WebCore::MediaPlayerPrivateGStreamerBase::~MediaPlayerPrivateGStreamerBase): Ditto.
(WebCore::MediaPlayerPrivateGStreamerBase::naturalSize): Return
early if no sample is available. The caps used to get the video
size are store in the sample.
(WebCore::MediaPlayerPrivateGStreamerBase::updateTexture): Use
GstSample instead of GstBuffer.
(WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint): Ditto.
(WebCore::MediaPlayerPrivateGStreamerBase::paint): Ditto.
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
* platform/graphics/gstreamer/VideoSinkGStreamer.cpp: Now store a
GstSample internally. Also removed the now useless current-caps property.
(_WebKitVideoSinkPrivate::_WebKitVideoSinkPrivate): Renamed the
mutex protecting access to the sample.
(_WebKitVideoSinkPrivate::~_WebKitVideoSinkPrivate): Ditto.
(webkit_video_sink_init): Disable last-sample in basesink since we
already store one in our sink anyway.
(webkitVideoSinkTimeoutCallback): Switch to GstSample.
(webkitVideoSinkRender): Ditto.
(unlockSampleMutex): Ditto.
(webkitVideoSinkUnlock): Ditto.
(webkitVideoSinkUnlockStop): Ditto.
(webkitVideoSinkStop): Ditto!
(webkitVideoSinkStart): Ditto.
(webkit_video_sink_class_init): Drop current-caps property.
(webkitVideoSinkGetProperty): Deleted.
(unlockBufferMutex): Deleted.

Canonical link: https://commits.webkit.org/154760.175@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175928 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 8b5386da9754e042f6cdad8680571c9416ca257c
      https://github.com/WebKit/WebKit/commit/8b5386da9754e042f6cdad8680571c9416ca257c
  Author: Andreas Kling <akling at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/RegExpCachedResult.cpp

  Log Message:
  -----------
  Merge r175372 - Unreviewed assertion fix.

RegExpCachedResult::m_reified is now the dedicated member that knows whether
the result was reified into an array or not. Check that instead of m_result
which is now single-purpose.

* runtime/RegExpCachedResult.cpp:
(JSC::RegExpCachedResult::setInput):

Canonical link: https://commits.webkit.org/154760.176@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175929 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 4427ceefd9a77fc942a3cb85cee6457c646bd859
      https://github.com/WebKit/WebKit/commit/4427ceefd9a77fc942a3cb85cee6457c646bd859
  Author: Jeffrey Pfau <jpfau at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/RefCounted.h

  Log Message:
  -----------
  Merge r175382 - ASSERT(!m_deletionHasBegun) in RefCounted.h should be ASSERT_WITH_SECURITY_IMPLICATION
https://bugs.webkit.org/show_bug.cgi?id=138141

Reviewed by Alexey Proskuryakov.

* wtf/RefCounted.h:
(WTF::RefCountedBase::ref):
(WTF::RefCountedBase::relaxAdoptionRequirement):
(WTF::RefCountedBase::derefBase):
(WTF::adopted):

Canonical link: https://commits.webkit.org/154760.177@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175933 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e96cb7b84b37ea68860f5a82a3cde7f342156e27
      https://github.com/WebKit/WebKit/commit/e96cb7b84b37ea68860f5a82a3cde7f342156e27
  Author: Simon Fraser <simon.fraser at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderObject.cpp

  Log Message:
  -----------
  Merge r175395 - Short-circuit repaints with empty rects
https://bugs.webkit.org/show_bug.cgi?id=138234

Reviewed by Zalan Bujtas.

Repaints with an empty rectangle are common enough that it's worth
short-circuiting them.

* rendering/RenderObject.cpp:
(WebCore::RenderObject::repaintUsingContainer):

Canonical link: https://commits.webkit.org/154760.178@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175934 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 9891b152e054caa1f0c796fc1267516db4e1c521
      https://github.com/WebKit/WebKit/commit/9891b152e054caa1f0c796fc1267516db4e1c521
  Author: Andreas Kling <akling at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/RegExpObject.cpp

  Log Message:
  -----------
  Merge r175416 - Make writes to RegExpObject.lastIndex cacheable.
<https://webkit.org/b/138255>

Reviewed by Geoffrey Garen.

We were neglecting to IC the puts to RegExpObject.lastIndex on Octane/regexp,
and ended up spending 4.5% of a time profile in operationPutByIdNonStrict.

~3% progression on Octane/regexp.

* runtime/RegExpObject.cpp:
(JSC::regExpObjectSetLastIndexStrict):
(JSC::regExpObjectSetLastIndexNonStrict):
(JSC::RegExpObject::put):

Canonical link: https://commits.webkit.org/154760.179@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175935 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: c94c5b251d5c31d97ca59943e90ef7b60caccb72
      https://github.com/WebKit/WebKit/commit/c94c5b251d5c31d97ca59943e90ef7b60caccb72
  Author: Benjamin Poulain <bpoulain at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/css/crash-on-incomplete-webkit-any-expected.txt
    A LayoutTests/fast/css/crash-on-incomplete-webkit-any.html
    A LayoutTests/fast/css/pseudo-escaped-parenthesis-expected.txt
    A LayoutTests/fast/css/pseudo-escaped-parenthesis.html
    A LayoutTests/fast/selectors/invalid-functional-pseudo-class-expected.txt
    A LayoutTests/fast/selectors/invalid-functional-pseudo-class.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSParserValues.cpp

  Log Message:
  -----------
  Merge r175432 - Pseudo classes with an escaped parenthesis generate invalid rules
https://bugs.webkit.org/show_bug.cgi?id=138266

Patch by Benjamin Poulain <bpoulain at apple.com> on 2014-10-31
Reviewed by Antti Koivisto.

Source/WebCore:

Since the functional pseudo classes are part of the list of PseudoClassAndCompatibilityElement,
they could be created by the rule
     pseudo:
         ':' IDENT
if the parenthesis is escaped. For example, with ":not\\(", the IDENT would be
"not(", CSSParserSelector::parsePseudoClassAndCompatibilityElementSelector would
find a pseudo class type of PseudoClassNot, and the action would create an invalid
CSSSelector for a :not() without nested selector.

This patch fixes the issue by detecting the function case in
CSSParserSelector::parsePseudoClassAndCompatibilityElementSelector().

An other solution would be to split PseudoClassAndCompatibilityElement into simple pseudo class
and functional pseudo classes. We may do that some day but at the moment it is a lot of work with
a little benefit.

Tests: fast/css/crash-on-incomplete-webkit-any.html
       fast/css/pseudo-escaped-parenthesis.html
       fast/selectors/invalid-functional-pseudo-class.html

* css/CSSParserValues.cpp:
(WebCore::CSSParserSelector::parsePseudoClassAndCompatibilityElementSelector):

LayoutTests:

* fast/selectors/invalid-functional-pseudo-class-expected.txt: Added.
* fast/selectors/invalid-functional-pseudo-class.html: Added.
New test for all the functional pseudo classes.

* fast/css/crash-on-incomplete-webkit-any-expected.txt: Added.
* fast/css/crash-on-incomplete-webkit-any.html: Added.
* fast/css/pseudo-escaped-parenthesis-expected.txt: Added.
* fast/css/pseudo-escaped-parenthesis.html: Added.
Those tests come from blink. Rune solved the same problem a year ago on blink
in https://chromiumcodereview.appspot.com/23710067
The patch is quite different because blink uses an ancient code base, but the tests
can still be useful so I included them here.

Canonical link: https://commits.webkit.org/154760.180@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175936 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 45c365cd42877ddc7d6e580f22f0bd3ffc916b9c
      https://github.com/WebKit/WebKit/commit/45c365cd42877ddc7d6e580f22f0bd3ffc916b9c
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/scripts/CodeGeneratorJS.pm

  Log Message:
  -----------
  Merge r175462 - Reduce the cost of argumentCount checks in the JS bindings
https://bugs.webkit.org/show_bug.cgi?id=138289

Reviewed by Sam Weinig.

Slightly reduce the cost of argumentCount checks in the JS bindings by
hinting to the compiler that it is UNLIKELY that those methods are
called with too few arguments.

I see a 3% progression on PerformanceTests/DOM/DOMDivWalk.html
performance test.

No new tests, no behavior change.

* bindings/scripts/CodeGeneratorJS.pm:
(GenerateArgumentsCountCheck):

Canonical link: https://commits.webkit.org/154760.181@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175938 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 6e65862d9a05e84d9cb0351c4db91a74389987a8
      https://github.com/WebKit/WebKit/commit/6e65862d9a05e84d9cb0351c4db91a74389987a8
  Author: Andreas Kling <akling at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderLayerModelObject.cpp
    M Source/WebCore/rendering/RenderLayerModelObject.h

  Log Message:
  -----------
  Merge r175475 - RenderLayerModelObject shouldn't need a pre-destructor hook.
<https://webkit.org/b/138314>

Reviewed by Antti Koivisto.

Move code from the willBeDestroyed() pre-destructor hook to the regular
~RenderLayerModelObject() destructor.

We just need to unregister the renderer from the FrameView's set of
viewport-constrained objects. That doesn't require being able to walk
the render tree or call virtuals, which is the main reason you'd use
willBeDestroyed().

* rendering/RenderLayerModelObject.cpp:
(WebCore::RenderLayerModelObject::~RenderLayerModelObject):
(WebCore::RenderLayerModelObject::willBeDestroyed): Deleted.
* rendering/RenderLayerModelObject.h:

Canonical link: https://commits.webkit.org/154760.182@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175940 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: a776c429cfdada540609177af208a105b4906592
      https://github.com/WebKit/WebKit/commit/a776c429cfdada540609177af208a105b4906592
  Author: Alexey Proskuryakov <ap at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/mediacontrols/mediaControlsBase.js

  Log Message:
  -----------
  Merge r175477 - REGRESSION: Using a media element changes window.name
https://bugs.webkit.org/show_bug.cgi?id=138278
rdar://problem/18704134

Apply the same fix to mediaControlsBase.js. I do not know who uses this file, but
there is no reason to have the bug there.

* Modules/mediacontrols/mediaControlsBase.js:
(Controller.prototype.addVideoListeners):
(Controller.prototype.removeVideoListeners):
(Controller.prototype.disconnectControls):

Canonical link: https://commits.webkit.org/154760.183@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175942 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 682d73cf269558e2154c900b3c6a45155d207241
      https://github.com/WebKit/WebKit/commit/682d73cf269558e2154c900b3c6a45155d207241
  Author: Andreas Kling <akling at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderCounter.cpp
    M Source/WebCore/rendering/RenderCounter.h

  Log Message:
  -----------
  Merge r175485 - RenderCounter shouldn't need a pre-destructor hook.
<https://webkit.org/b/138316>

Reviewed by Antti Koivisto.

RenderCounter will automatically register/unregister itself with
the RenderView when constructed/destroyed.

It was using a willBeDestroyed() hook because it used to be that you
couldn't get to the RenderView in the destructor. That's no longer
an issue as Document promises that RenderView is the last render tree
node to go away.

* rendering/RenderCounter.cpp:
(WebCore::RenderCounter::~RenderCounter):
(WebCore::RenderCounter::willBeDestroyed): Deleted.
* rendering/RenderCounter.h:

Canonical link: https://commits.webkit.org/154760.184@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175943 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 1ef5f11748b2d14de83510178845cb283d90e08c
      https://github.com/WebKit/WebKit/commit/1ef5f11748b2d14de83510178845cb283d90e08c
  Author: Nikos Andronikos <nikos.andronikos-webkit at cisra.canon.com.au>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/svg/animations/animate-marker-orienttype-1-expected.txt
    A LayoutTests/svg/animations/animate-marker-orienttype-1.html
    A LayoutTests/svg/animations/animate-marker-orienttype-2-expected.txt
    A LayoutTests/svg/animations/animate-marker-orienttype-2.html
    A LayoutTests/svg/animations/animate-marker-orienttype-3-expected.txt
    A LayoutTests/svg/animations/animate-marker-orienttype-3.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/svg/SVGAnimatedAngle.cpp
    M Source/WebCore/svg/SVGMarkerElement.cpp
    M Source/WebCore/svg/SVGMarkerElement.h

  Log Message:
  -----------
  Merge r175525 - Fix animation of orient attribute on marker element
https://bugs.webkit.org/show_bug.cgi?id=137942

Source/WebCore:

Patch by Nikos Andronikos <nikos.andronikos-webkit at cisra.canon.com.au> on 2014-11-04
Reviewed by Dirk Schulze.

Fixed implementation of SVG animated angles and the SVG
marker element orient attribute.
SVG animated angle was missing the logic to support animation
from auto to a numeric angle value - this is now added.
The SVG marker element getter for orientType was not returning
the animated value for orientType so in some cases (i.e. when
the initial value and the animated values were of different types)
the animation was not being rendered - although it was running.

Tests: svg/animations/animate-marker-orienttype-1.html
       svg/animations/animate-marker-orienttype-2.html
       svg/animations/animate-marker-orienttype-3.html

* svg/SVGAnimatedAngle.cpp:
(WebCore::SVGAnimatedAngleAnimator::calculateAnimatedValue):
Added logic to support auto to angle animation.
* svg/SVGMarkerElement.cpp:
(WebCore::SVGMarkerElement::orientType):
This method now returns the animated value if an animation is
running.
* svg/SVGMarkerElement.h:

LayoutTests:

Patch by Nikos Andrkos Andronikos <nikos.andronikos-webkit at cisra.canon.com.au> on 2014-11-04
Reviewed by Dirk Schulze.

Test the rendered result of the animation of the orient attribute.
Existing tests were only testing the animated value in the DOM.

* svg/animations/animate-marker-orienttype-1-expected.txt: Added.
* svg/animations/animate-marker-orienttype-1.html: Added.
* svg/animations/animate-marker-orienttype-2-expected.txt: Added.
* svg/animations/animate-marker-orienttype-2.html: Added.
* svg/animations/animate-marker-orienttype-3-expected.txt: Added.
* svg/animations/animate-marker-orienttype-3.html: Added.

Canonical link: https://commits.webkit.org/154760.185@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175944 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: a5d7263098777724c92e5087b3a0a761e4fa062a
      https://github.com/WebKit/WebKit/commit/a5d7263098777724c92e5087b3a0a761e4fa062a
  Author: Philippe Normand <philn at igalia.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/MediaPlayer.cpp
    M Source/WebCore/platform/graphics/MediaPlayerPrivate.h
    M Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp
    M Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
    M Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
    M Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm

  Log Message:
  -----------
  Merge r175526 - [LEAK] [GStreamer] Removing video element will not free assigned memory
https://bugs.webkit.org/show_bug.cgi?id=46560

Reviewed by Eric Carlson.

Moved the ::extraMemoryCost() implementation to the
MediaPlayerPivateInterface base class. This default implementation
is now shared between the various MediaPlayerPrivate backends,
excepted the AVF MediaSource player which still reports no extra
memory cost.

* platform/graphics/MediaPlayerPrivate.h:
(WebCore::MediaPlayerPrivateInterface::totalBytes): Make
totalBytes() part of the MediaPlayerPrivate interface.
(WebCore::MediaPlayerPrivateInterface::extraMemoryCost): Default
implementation.
* platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
(WebCore::MediaPlayerPrivateAVFoundation::extraMemoryCost): Deleted.
* platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:

Canonical link: https://commits.webkit.org/154760.186@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175945 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: cbfc4d3a58f3b1c8a05705520bcc543032c5f2d5
      https://github.com/WebKit/WebKit/commit/cbfc4d3a58f3b1c8a05705520bcc543032c5f2d5
  Author: Andreas Kling <akling at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderQuote.cpp
    M Source/WebCore/rendering/RenderQuote.h

  Log Message:
  -----------
  Merge r175528 - RenderQuote shouldn't need a pre-destructor hook.
<https://webkit.org/b/138352>

Reviewed by Antti Koivisto.

The willBeDestroyed() hook in RenderQuote came from the time when it was
potential unsafe to access the RenderView from a renderer destructor.

Move the code to the plain ol' destructor instead.

* rendering/RenderQuote.cpp:
(WebCore::RenderQuote::~RenderQuote):
(WebCore::RenderQuote::willBeDestroyed): Deleted.
* rendering/RenderQuote.h:

Canonical link: https://commits.webkit.org/154760.187@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175946 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 124be3ed46dc3e0cc34d78023a5fd55f555c43f1
      https://github.com/WebKit/WebKit/commit/124be3ed46dc3e0cc34d78023a5fd55f555c43f1
  Author: Andreas Kling <akling at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBox.cpp
    M Source/WebCore/rendering/RenderBox.h

  Log Message:
  -----------
  Merge r175580 - RenderBox shouldn't need a pre-destructor hook.
<https://webkit.org/b/138367>

Reviewed by Antti Koivisto.

Move teardown logic from willBeDestroyed() to the regular ~RenderBox()
destructor since none of it depends on being in-tree or having a fully
constructed vtable.

* rendering/RenderBox.cpp:
(WebCore::RenderBox::~RenderBox):
(WebCore::RenderBox::willBeDestroyed): Deleted.
* rendering/RenderBox.h:

Canonical link: https://commits.webkit.org/154760.188@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175948 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: b0650be0d1098eff9df47b8b82a6a4897d663f74
      https://github.com/WebKit/WebKit/commit/b0650be0d1098eff9df47b8b82a6a4897d663f74
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/SpaceSplitString.cpp

  Log Message:
  -----------
  Merge r175602 - Avoid double hash table lookup in SpaceSplitStringData::create()
https://bugs.webkit.org/show_bug.cgi?id=138396

Reviewed by Ryosuke Niwa.

Avoid double hash table lookup in SpaceSplitStringData::create() by
calling HashMap::add() and using the AddResult, instead of calling
HashMap::get() then HashMap::add().

No new tests, no behavior change.

* dom/SpaceSplitString.cpp:
(WebCore::SpaceSplitStringData::create):

Canonical link: https://commits.webkit.org/154760.189@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175949 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 18dcb5626d82504bdcaa3b9fe74627c97a09a96c
      https://github.com/WebKit/WebKit/commit/18dcb5626d82504bdcaa3b9fe74627c97a09a96c
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp

  Log Message:
  -----------
  Merge r175619 - NetscapePlugin: NPP_GetValue should receive a pointer to NPBool, not bool
https://bugs.webkit.org/show_bug.cgi?id=138418

Reviewed by Carlos Garcia Campos.

Replace bool with NPBool, which is actually an unsigned char.

* WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp:
(WebKit::NetscapePlugin::platformPostInitialize):

Canonical link: https://commits.webkit.org/154760.190@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175950 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 7c8d993c65034dad3b766441a2e5316c4923e780
      https://github.com/WebKit/WebKit/commit/7c8d993c65034dad3b766441a2e5316c4923e780
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp

  Log Message:
  -----------
  Merge r175696 - [GTK] [Stable] webkitgtk 2.6.1 fails to load flashplugin
https://bugs.webkit.org/show_bug.cgi?id=137849

Reviewed by Carlos Garcia Campos.

NPPVpluginNeedsXEmbed is a boolean value, so it should normally
use an NPBool (1 byte). However some plugins (the Flash player in
particular) are using an int instead, so we have to do it as well
else we'll end up corrupting the stack.

* WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp:
(WebKit::NetscapePlugin::platformPostInitialize):

Canonical link: https://commits.webkit.org/154760.191@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175951 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 9b8297b2b1b16ec309b070ccea25fab6696f7c9f
      https://github.com/WebKit/WebKit/commit/9b8297b2b1b16ec309b070ccea25fab6696f7c9f
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/dom/HTMLInputElement/input-type-attribute-expected.txt
    A LayoutTests/fast/dom/HTMLInputElement/input-type-attribute.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/FileInputType.cpp
    M Source/WebCore/html/HTMLInputElement.cpp
    M Source/WebCore/html/HTMLInputElement.h
    M Source/WebCore/html/HTMLInputElement.idl

  Log Message:
  -----------
  Merge r175622 - Stop special-casing the empty string in HTMLInputElement.type setter
https://bugs.webkit.org/show_bug.cgi?id=138403

Reviewed by Ryosuke Niwa.

Source/WebCore:

Stop special-casing the empty string in HTMLInputElement.type setter.
Previously, if input.type is set to "", we would remove the type
attribute. This is inconsistent with the specification and the behavior
of other browsers (tested Firefox 33 and Chrome 38). Instead, we should
set the attribute to the empty string.

Also stop treating null as a null string to align with the
specification and other browsers (tested Firefox 33 and Chrome 38).

Finally, update HTMLInputElement::setType() to take an AtomicString in
argument instead of a String as it ends up calling setAttribute(), and
thus needing an AtomicString.

Test: fast/dom/HTMLInputElement/input-type-attribute.html

* html/FileInputType.cpp:
(WebCore::UploadButtonElement::UploadButtonElement):
* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::setType):
* html/HTMLInputElement.h:
* html/HTMLInputElement.idl:

LayoutTests:

Add layout test to check the functionality of the HTMLInputElement.type
getter and setter.

* fast/dom/HTMLInputElement/input-type-attribute-expected.txt: Added.
* fast/dom/HTMLInputElement/input-type-attribute.html: Added.

Canonical link: https://commits.webkit.org/154760.192@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175952 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 52567caee204e58b86e4c8bf773d7d5f90752c4e
      https://github.com/WebKit/WebKit/commit/52567caee204e58b86e4c8bf773d7d5f90752c4e
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/MathExtras.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/DOMTimer.cpp
    M Source/WebCore/platform/graphics/FloatQuad.cpp

  Log Message:
  -----------
  Merge r175655 - Assertion hit DOMTimer::updateTimerIntervalIfNecessary()
https://bugs.webkit.org/show_bug.cgi?id=138440

Reviewed by Geoffrey Garen.

Source/WebCore:

We sometimes hit the ASSERT(repeatInterval() == previousInterval)
assertion in DOMTimer::updateTimerIntervalIfNecessary() when visiting
the following pages:
http://lifehacker.com/the-healthiest-foods-for-one-handed-snacking-while-gami-1654728164
http://longform.org/posts/like-something-the-lord-made

After debugging, the issue turned out to be that we are comparing
floating point numbers using ==, and the check sometimes fails even
though the values really close to each other. This patch updates the
DOMTimer code to use WTF::withinEpsilon() instead of operator==()
to compare the floating point intervals.

I confirmed manually that the assertion is no longer hit.

* page/DOMTimer.cpp:
(WebCore::DOMTimer::updateTimerIntervalIfNecessary):
* platform/graphics/FloatQuad.cpp:
(WebCore::FloatQuad::isRectilinear):
(WebCore::withinEpsilon): Deleted.

Source/WTF:

Move the withinEpsilon() function to WTF to avoid code duplication.

* wtf/MathExtras.h:
(WTF::withinEpsilon):

Canonical link: https://commits.webkit.org/154760.193@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175955 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 7021ffe61c73a02d26a98807f06eaa97d53ca44c
      https://github.com/WebKit/WebKit/commit/7021ffe61c73a02d26a98807f06eaa97d53ca44c
  Author: Shivakumar J M <shiva.jm at samsung.com>
  Date:   2014-11-11 (Tue, 11 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/dom/Text/splitText-expected.txt
    A LayoutTests/fast/dom/Text/splitText.html
    M LayoutTests/fast/dom/non-numeric-values-numeric-parameters-expected.txt
    M LayoutTests/fast/dom/script-tests/non-numeric-values-numeric-parameters.js
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Text.idl

  Log Message:
  -----------
  Merge r175688 - splitText API does not match DOM specification.
https://bugs.webkit.org/show_bug.cgi?id=138405

Patch by Shivakumar JM <shiva.jm at samsung.com> on 2014-11-05
Reviewed by Chris Dumez.
Source/WebCore:

Make the offset argument for splitText API as mandatory (and thus throw if it is omitted) and stop throwing if the offset argument is
negative (and wraps to a valid index) as per specification: https://w3c.github.io/dom/#interface-text. Also This matches the behavior
of both Firefox 33 and Chrome 38.

Test: fast/dom/Text/splitText.html

* dom/Text.idl:

LayoutTests:

* fast/dom/Text/splitText-expected.txt: Added.
* fast/dom/Text/splitText.html: Added.
* fast/dom/non-numeric-values-numeric-parameters-expected.txt:
* fast/dom/script-tests/non-numeric-values-numeric-parameters.js:

Canonical link: https://commits.webkit.org/154760.194@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175959 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f0467e9c120b29a771c988ec12aa9b97e60a3a1d
      https://github.com/WebKit/WebKit/commit/f0467e9c120b29a771c988ec12aa9b97e60a3a1d
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2014-11-12 (Wed, 12 Nov 2014)

  Changed paths:
    M ChangeLog
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.6.3 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit2:

* gtk/NEWS: Add release notes for 2.6.3.

Canonical link: https://commits.webkit.org/154760.195@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176012 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: eeaca9a7b86e04e10a47eb57b28a26359ffd7d65
      https://github.com/WebKit/WebKit/commit/eeaca9a7b86e04e10a47eb57b28a26359ffd7d65
  Author: David Kilzer <ddkilzer at webkit.org>
  Date:   2014-11-12 (Wed, 12 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/ProcessingInstruction.cpp

  Log Message:
  -----------
  Merge r175974 - Protect Document in ProcessingInstruction::setXSLStyleSheet()
<http://webkit.org/b/138621>

Reviewed by Andreas Kling.

The patch is inspired by the following Blink revision by
<tasak at google.com>:
<https://src.chromium.org/viewvc/blink?view=rev&revision=182309>

* dom/ProcessingInstruction.cpp:
(WebCore::ProcessingInstruction::setXSLStyleSheet):

Canonical link: https://commits.webkit.org/154760.196@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176014 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 6568937ceb34dd4884ac8b463dd7aa55e588c00e
      https://github.com/WebKit/WebKit/commit/6568937ceb34dd4884ac8b463dd7aa55e588c00e
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/js/get-by-pname-expected.txt
    M LayoutTests/js/script-tests/get-by-pname.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

  Log Message:
  -----------
  Merge r175724 - slow_path_get_direct_pname() needs to be hardened against a constant baseValue.
<https://webkit.org/b/138476>

Reviewed by Michael Saboff.

Source/JavaScriptCore:

slow_path_get_direct_pname() currently assumes that the baseValue is always a
non-constant virtual register.  However, this is not always the case like in the
following:

    function foo() {
        var o = { a:1 };
        for (var n in o)
            0[n];
    }
    foo();

This patch fixes it to also check for constant virtual register indexes.

* runtime/CommonSlowPaths.cpp:
(JSC::SLOW_PATH_DECL):

LayoutTests:

* js/get-by-pname-expected.txt:
* js/script-tests/get-by-pname.js:
(getByPnameOnConstant):
(getByPnameOnVar):
- Added more test cases.

Canonical link: https://commits.webkit.org/154760.197@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176176 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: c6cefc4c36df7733287f26affcc59b644c034594
      https://github.com/WebKit/WebKit/commit/c6cefc4c36df7733287f26affcc59b644c034594
  Author: Joanmarie Diggs <jdiggs at igalia.com>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/platform/gtk/accessibility/menu-list-unfocused-notifications-expected.txt
    A LayoutTests/platform/gtk/accessibility/menu-list-unfocused-notifications.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/atk/AXObjectCacheAtk.cpp

  Log Message:
  -----------
  Merge r176076 - AX: [ATK] Accessible focus events are emitted when the selection is changed in non-focused combo boxes
https://bugs.webkit.org/show_bug.cgi?id=137866

Reviewed by Mario Sanchez Prada.

Source/WebCore:

Check that the AccessibilityMenuList is really focused before notifying
the platform that it is focused. Likewise, only notify the platform of
an AccessibilityMenuListOption focus gain if the AccessibilityMenuList
containing that option is expanded.

Test: platform/gtk/accessibility/menu-list-unfocused-notifications.html

* accessibility/atk/AXObjectCacheAtk.cpp:
(WebCore::notifyChildrenSelectionChange):
(WebCore::AXObjectCache::postPlatformNotification):

LayoutTests:

* platform/gtk/accessibility/menu-list-unfocused-notifications-expected.txt: Added.
* platform/gtk/accessibility/menu-list-unfocused-notifications.html: Added.

Canonical link: https://commits.webkit.org/154760.198@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176177 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: b9e767582551af337f194f4b21026fd2725612af
      https://github.com/WebKit/WebKit/commit/b9e767582551af337f194f4b21026fd2725612af
  Author: Joanmarie Diggs <jdiggs at igalia.com>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/platform/gtk/accessibility/detached-object-role-expected.txt
    A LayoutTests/platform/gtk/accessibility/detached-object-role.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/atk/WebKitAccessibleWrapperAtk.cpp
    M Tools/ChangeLog
    M Tools/WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp

  Log Message:
  -----------
  Merge r176091 - AX: [ATK] Do not return ATK_ROLE_UNKNOWN for null or otherwise invalid accessible objects
https://bugs.webkit.org/show_bug.cgi?id=137867

Reviewed by Chris Fleizach.

Source/WebCore:

Return ATK_ROLE_INVALID for null or otherwise invalid accessible objects.

Test: platform/gtk/accessibility/detached-object-role.html

* accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
(webkitAccessibleGetRole):

Tools:

Add ATK_ROLE_INVALID to roleToString. Remove the null AtkRole check in
AccessibilityUIElement::role: ATK_ROLE_INVALID = 0, and we need to be
able to test for the presence of ATK_ROLE_INVALID.

* WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp:
(WTR::AccessibilityUIElement::role):

LayoutTests:

* platform/gtk/accessibility/detached-object-role-expected.txt: Added.
* platform/gtk/accessibility/detached-object-role.html: Added.

Canonical link: https://commits.webkit.org/154760.199@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176178 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: dc10e1b707f4d713c5614f76195aae224a8923d7
      https://github.com/WebKit/WebKit/commit/dc10e1b707f4d713c5614f76195aae224a8923d7
  Author: Timothy Hatcher <timothy at apple.com>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Base/ImageUtilities.js
    R Source/WebInspectorUI/UserInterface/Images/NavigationItemProbes.pdf
    A Source/WebInspectorUI/UserInterface/Images/NavigationItemProbes.svg
    A Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemProbes.svg
    M Source/WebInspectorUI/UserInterface/Views/ProbeDetailsSidebarPanel.js

  Log Message:
  -----------
  Merge r176080 - Web Inspector: Replace PDF Probes icon with SVG version
https://bugs.webkit.org/show_bug.cgi?id=137296

Reviewed by Joseph Pecoraro.

* UserInterface/Images/NavigationItemProbes.pdf: Removed.
* UserInterface/Images/NavigationItemProbes.svg: Added.
* UserInterface/Views/ProbeDetailsSidebarPanel.js:
(WebInspector.ProbeDetailsSidebarPanel): Use NavigationItemProbes.svg.
* UserInterface/Images/gtk/NavigationItemProbes.svg: Added.

Canonical link: https://commits.webkit.org/154760.200@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176179 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 15cca39a8bc839e94b79fab3608c51e896c566a4
      https://github.com/WebKit/WebKit/commit/15cca39a8bc839e94b79fab3608c51e896c566a4
  Author: Mihnea Ovidenie <mihnea at adobe.com>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/multicol/newmulticol/ruby-from-multicol-to-auto-expected.txt
    A LayoutTests/fast/multicol/newmulticol/ruby-from-multicol-to-auto.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderRuby.cpp

  Log Message:
  -----------
  Merge r175807 - ASSERTION FAILED: !object || !object->parent()->isRuby() || is<RenderRubyRun>(*object) || (object->isInline() && (object->isBeforeContent() || object->isAfterContent())) || (object->isAnonymous() && ... ) in WebCore::isAnonymousRubyInlineBlock
https://bugs.webkit.org/show_bug.cgi?id=137958

Reviewed by Chris Dumez.

Source/WebCore:

When a ruby element, with block behavior, dynamically changes its style
from multicol to without multicol, we have to remove its special children,
RenderMultiColumnFlowThread and RenderMultiColumnSet, the normal way using
the method in RenderBlockFlow base class. This patch adds both
RenderMultiColumnFlowThread and RenderMultiColumnSet to the list of RenderRuby
children removed normally and adds a new function - isRubyChildForNormalRemove -
to test the condition and use it in the assertion in RenderRuby*::removeChild
method.

Test: fast/multicol/newmulticol/ruby-from-multicol-to-auto.html

* rendering/RenderRuby.cpp:
(WebCore::isRubyChildForNormalRemove):
(WebCore::RenderRubyAsInline::removeChild):
(WebCore::RenderRubyAsBlock::removeChild):

LayoutTests:

* fast/multicol/newmulticol/ruby-from-multicol-to-auto-expected.txt: Added.
* fast/multicol/newmulticol/ruby-from-multicol-to-auto.html: Added.

Canonical link: https://commits.webkit.org/154760.201@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176181 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f4eceae6ca6165e9a5095bd10a2a0d93de76d177
      https://github.com/WebKit/WebKit/commit/f4eceae6ca6165e9a5095bd10a2a0d93de76d177
  Author: Csaba Osztrogonác <ossy at webkit.org>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/editing/execCommand/crash-137961-expected.txt
    A LayoutTests/editing/execCommand/crash-137961.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/editing/ApplyStyleCommand.cpp

  Log Message:
  -----------
  Merge r175809 - Crash in WebCore::Node::getFlag
https://bugs.webkit.org/show_bug.cgi?id=137961

Reviewed by Antti Koivisto.

Source/WebCore:

* editing/ApplyStyleCommand.cpp:
(WebCore::ApplyStyleCommand::applyBlockStyle): Null pointer check added.

LayoutTests:

* editing/execCommand/crash-137961-expected.txt: Added.
* editing/execCommand/crash-137961.html: Added.

Canonical link: https://commits.webkit.org/154760.202@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176182 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 23ca9768492c27628b6e14085415e1f3d60fb4cd
      https://github.com/WebKit/WebKit/commit/23ca9768492c27628b6e14085415e1f3d60fb4cd
  Author: Daniel Bates <dbates at webkit.org>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/frames/flattening/iframe-flattening-inside-flexbox-with-delayed-scroll-update-expected.txt
    A LayoutTests/fast/frames/flattening/iframe-flattening-inside-flexbox-with-delayed-scroll-update.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlock.cpp

  Log Message:
  -----------
  Merge r175965 - [Frame Flattening] ASSERT(transaction->view == &view()) fails in RenderBlock::removeFromUpdateScrollInfoAfterLayoutTransaction()
https://bugs.webkit.org/show_bug.cgi?id=138615
<rdar://problem/18928487>

Reviewed by David Hyatt.

Source/WebCore:

Fixes an issue where we always expected that the RenderView associated with the RenderBlock called in
RenderBlock::removeFromUpdateScrollInfoAfterLayoutTransaction() is the same as the RenderView associated with
the top transaction in the UpdateScrollInfoAfterLayoutTransaction stack regardless of frame flattening. This
expectation is only true when frame flattening is disabled.

Test: fast/frames/flattening/iframe-flattening-inside-flexbox-with-delayed-scroll-update.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::removeFromUpdateScrollInfoAfterLayoutTransaction):

LayoutTests:

Add a test that causes an assertion failure in affected builds.

* fast/frames/flattening/iframe-flattening-inside-flexbox-with-delayed-scroll-update-expected.txt: Added.
* fast/frames/flattening/iframe-flattening-inside-flexbox-with-delayed-scroll-update.html: Added.

Canonical link: https://commits.webkit.org/154760.203@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176183 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 123a63491143fcbc3e604100ed8ba6d294b13e21
      https://github.com/WebKit/WebKit/commit/123a63491143fcbc3e604100ed8ba6d294b13e21
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/Shared/soup/WebCoreArgumentCodersSoup.cpp

  Log Message:
  -----------
  Merge r176071 - [SOUP] Missing ResourceRequest members encoded/decoded
https://bugs.webkit.org/show_bug.cgi?id=138694

Reviewed by Sergio Villar Senin.

At least timeoutInterval and priority should also be
encoded/decoded. This fixes all http/tests/xmlhttprequest/timeout/
tests when using the network process, since the timeout is always
0 for all requests that we send to the network process.

* Shared/soup/WebCoreArgumentCodersSoup.cpp:
(IPC::ArgumentCoder<ResourceRequest>::encodePlatformData):
(IPC::ArgumentCoder<ResourceRequest>::decodePlatformData):

Canonical link: https://commits.webkit.org/154760.204@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176184 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 0dcbb21735e243b452a1558a63854d126bc401c7
      https://github.com/WebKit/WebKit/commit/0dcbb21735e243b452a1558a63854d126bc401c7
  Author: Jon Honeycutt <jhoneycutt at apple.com>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/forms/placeholder-attribute-ordering-expected.html
    A LayoutTests/fast/forms/placeholder-attribute-ordering.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/TextFieldInputType.cpp

  Log Message:
  -----------
  Merge r176082 - REGRESSION (r172826): Password field placeholder text is missing if
placeholder attribute precedes type attribute

<https://bugs.webkit.org/show_bug.cgi?id=138682>
<rdar://problem/18574213>

Source/WebCore:

When the placeholder attribute is encountered, a shadow tree is created
to include the placeholder element. When the type attribute is
encountered, the previous shadow tree is destroyed, and a new shadow
tree is created. TextFieldInputType::createShadowSubtree() did not
handle creating the placeholder element.

This regressed in r172826 because prior to r172826, the placeholder
element would be recreated when
HTMLTextFormControlElement::updatePlaceholderVisibility() was called.
In r172826, updatePlaceholderVisibility() was changed to only show or
hide the placeholder element if it exists.

Reviewed by Benjamin Poulain.

* html/TextFieldInputType.cpp:
(WebCore::TextFieldInputType::createShadowSubtree):
Call updatePlaceholderVisibility() to insert the placeholder element
(after the inner text element has been inserted, as it appears before
it in the shadow DOM).

LayoutTests:

Reviewed by Benjamin Poulain.

* fast/forms/placeholder-attribute-ordering-expected.html: Added.
* fast/forms/placeholder-attribute-ordering.html: Added.

Canonical link: https://commits.webkit.org/154760.205@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176185 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: d471496f665f625230953d2dc039a01642c8e0d9
      https://github.com/WebKit/WebKit/commit/d471496f665f625230953d2dc039a01642c8e0d9
  Author: Benjamin Poulain <benjamin at webkit.org>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/ARMv7Assembler.h
    M Source/JavaScriptCore/disassembler/ARMv7/ARMv7DOpcode.cpp
    M Source/JavaScriptCore/disassembler/ARMv7/ARMv7DOpcode.h

  Log Message:
  -----------
  Merge r176083 - ARMv7(s) Assembler: LDRH with immediate offset is loading from the wrong offset
https://bugs.webkit.org/show_bug.cgi?id=136914

Reviewed by Michael Saboff.

TLDR: the immediate offset of half-word load was divided by 2.

Story time: So I started getting those weird reports of :nth-child() behaving bizarrely
on ARMv7 and ARMv7s. To make things worse, the behavior changes depending on style updates.

I started looking the disassembly on the tests cases...

The first thing I noticed was that the computation of An+B looked wrong. For example,
in the case of n+6, the instruction should have been:
    subs r1, r1, #6
but was
    subs r1, r1, #2

After spending a lot of time trying to find the error in the assembler, I discovered
the problem was not real, but just a bug in the disassembler.
This is the first fix: ARMv7DOpcodeAddSubtractImmediate3's immediate3() was truncating
the value to 2 bits instead of 3 bits.

The disassembler being fixed, I still have no lead on the weird bug. Some disassembly later,
I realize the LDRH instruction is not decoded at all. The reason is that both LDRH and STRH
were under the umbrella ARMv7DOpcodeLoadStoreRegisterImmediateHalfWord but the pattern
only matched SRTH.

I fix that next, ARMv7DOpcodeLoadStoreRegisterImmediateHalfWord is split into
ARMv7DOpcodeStoreRegisterImmediateHalfWord and ARMv7DOpcodeLoadRegisterImmediateHalfWord,
each with their own pattern and their instruction group.

Now that I can see the LDRHs correctly, there is something fishy about them, their offset
is way too small for the data I load.

This time, looking at the binary, the generated code is indeed incorrect. It turns out that
the ARMv7 assembler shifted the offset of half-word load as if they were byte load: divided by 4.
As a result, all the load of half-words with more than zero offset were loading
values with a smaller offset than what they should have.

That being fixed, I dump the assembly: still wrong. I am ready to throw my keyboard through
my screen at that point.

Looking at the disassembler, there is yet again a bug. The computation of the scale() adjustment
of the offset was incorrect for anything but word loads.
I replaced it by a switch-case to make it explicit.

STRH is likely incorrect too. I'll fix that in a follow up, I want to survey all the 16 bits cases
that are not directly used by the CSS JIT.

* assembler/ARMv7Assembler.h:
(JSC::ARMv7Assembler::ldrh):
Fix the immediate scaling. Add an assertion to make sure the alignment of the input is correct.

* disassembler/ARMv7/ARMv7DOpcode.cpp:
(JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterImmediate::scale):
Fix the scaling code. Just hardcode instruction-to-scale table.

* disassembler/ARMv7/ARMv7DOpcode.h:
(JSC::ARMv7Disassembler::ARMv7DOpcodeAddSubtractImmediate3::immediate3):
The mask for a 3 bits immediate is not 3 :)

(JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterImmediate::scale): Deleted.

Canonical link: https://commits.webkit.org/154760.206@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176186 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 80fcfebf1c51ccc722f613b553c418255faedcd4
      https://github.com/WebKit/WebKit/commit/80fcfebf1c51ccc722f613b553c418255faedcd4
  Author: Benjamin Poulain <bpoulain at apple.com>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/ARMv7Assembler.h

  Log Message:
  -----------
  Merge r176151 - STRH can store values with the wrong offset
https://bugs.webkit.org/show_bug.cgi?id=138723

Patch by Benjamin Poulain <bpoulain at apple.com> on 2014-11-14
Reviewed by Michael Saboff.

This is the counterpart of r176083 for the str instruction.

I believe this code is currently unreachable because there is only one client of strh()
in the MacroAssembler and it always setup the scale explicitely.

* assembler/ARMv7Assembler.h:
(JSC::ARMv7Assembler::strh):

Canonical link: https://commits.webkit.org/154760.207@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176187 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 761e8377c056a9f9cf0c2d2c4f6f9fe231a7f1d2
      https://github.com/WebKit/WebKit/commit/761e8377c056a9f9cf0c2d2c4f6f9fe231a7f1d2
  Author: Dan Bernstein <mitz at apple.com>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/FrameLoader.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit2Cocoa/Navigation.mm

  Log Message:
  -----------
  Merge r176096 - Policy client not called for navigations through the page cache
https://bugs.webkit.org/show_bug.cgi?id=138703

Reviewed by Alexey Proskuryakov.

Source/WebCore:

Test added to TestWebKitAPI/Tests/WebKit2Cocoa/Navigation.mm.

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::loadDifferentDocumentItem): When using a cached page, which already
has a document loader, set the document loader’s triggering action (so that the policy
client sees that this is a back/forward navigation) and clear its last checked request (so
that the policy client gets called).

Tools:

* TestWebKitAPI/Tests/WebKit2Cocoa/Navigation.mm:
(-[DecidePolicyForPageCacheNavigationDelegate webView:didFinishNavigation:]):
(-[DecidePolicyForPageCacheNavigationDelegate webView:decidePolicyForNavigationAction:decisionHandler:]):

Canonical link: https://commits.webkit.org/154760.208@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176188 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: c39599569b89266ace9647142495552a45e65d0c
      https://github.com/WebKit/WebKit/commit/c39599569b89266ace9647142495552a45e65d0c
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/Shared/soup/WebCoreArgumentCodersSoup.cpp

  Log Message:
  -----------
  Merge r176119 - [SOUP] Encode/Decode allowCookies in ResourceRequest
https://bugs.webkit.org/show_bug.cgi?id=138730

Reviewed by Sergio Villar Senin.

We are not sending this information to the network process, making
cookies always available. Fixes
http/tests/xmlhttprequest/cross-origin-no-authorization.html when
network process is enabled.

* Shared/soup/WebCoreArgumentCodersSoup.cpp:
(IPC::ArgumentCoder<ResourceRequest>::encodePlatformData):
(IPC::ArgumentCoder<ResourceRequest>::decodePlatformData):

Canonical link: https://commits.webkit.org/154760.209@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176189 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 3e81af85127a9641167cd88ca7f04635af45ac08
      https://github.com/WebKit/WebKit/commit/3e81af85127a9641167cd88ca7f04635af45ac08
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/ResourceHandleInternal.h
    M Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp

  Log Message:
  -----------
  Merge r176120 - [SOUP] Use GMainLoopSource for request timeout in ResourceHandle
https://bugs.webkit.org/show_bug.cgi?id=138695

Reviewed by Sergio Villar Senin.

We are currently using soup_timeout_add() that simply creates a
GSource and attaches it to the given context. Using
GMainLoopSource we simplify the code and fix any potential problem
of converting the double value into milliseconds.

* platform/network/ResourceHandleInternal.h:
* platform/network/soup/ResourceHandleSoup.cpp:
(WebCore::cleanupSoupRequestOperation):
(WebCore::ResourceHandle::sendPendingRequest):
(WebCore::ResourceHandle::platformSetDefersLoading):
(WebCore::requestTimeoutCallback): Deleted.

Canonical link: https://commits.webkit.org/154760.210@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176190 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: c8ad80b369e7dce37e3f3ab2386a4d81f38e3583
      https://github.com/WebKit/WebKit/commit/c8ad80b369e7dce37e3f3ab2386a4d81f38e3583
  Author: David Hyatt <hyatt at apple.com>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/repaint/table-row-repaint-expected.txt
    A LayoutTests/fast/repaint/table-row-repaint.html
    M LayoutTests/platform/mac/accessibility/table-detection-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderTableCell.h
    M Source/WebCore/rendering/RenderTableRow.cpp

  Log Message:
  -----------
  Merge r176124 - Table rows repaint entire table when their background color changes.
https://bugs.webkit.org/show_bug.cgi?id=26662

Reviewed by Simon Fraser.

Added fast/repaint/table-row-repaint.html

Source/WebCore:

* rendering/RenderTableCell.h:
* rendering/RenderTableRow.cpp:
(WebCore::RenderTableRow::clippedOverflowRectForRepaint):
Improve table row's function to unite with the cell rects that can possibly
have the the row's background color painted behind them.

LayoutTests:

* fast/repaint/table-row-repaint-expected.txt: Added.
* fast/repaint/table-row-repaint.html: Added.
* platform/mac/accessibility/table-detection-expected.txt:

Canonical link: https://commits.webkit.org/154760.211@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176191 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 1996ef986dde64e785af601ab0baa339bbb9d9a2
      https://github.com/WebKit/WebKit/commit/1996ef986dde64e785af601ab0baa339bbb9d9a2
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp

  Log Message:
  -----------
  Merge r176154 - Network process crash when running http/tests/appcache/fallback.html
https://bugs.webkit.org/show_bug.cgi?id=138740

Reviewed by Alexey Proskuryakov.

It happens because ResourceHandle::continueWillSendRequest() is
called with a null request. We could handle that case in the
ResourceHandle, but the thing is tha the behaviour is
not the same for async loads, or when loading in the web
process. In WebResourceLoader::willSendRequest(),
ResourceRequest::willSendRequest() is called, and cancels the load
if the client returns a null request. In this case, the
ResourceLoader is detached and WebResourceLoader::willSendRequest()
returns early without sending the ContinueWillSendRequest message
to the network process. However, for synchronous loads,
NetworkResourceLoader::continueWillSendRequest() is always called.

Fixes http/tests/appcache/fallback.html for GTK port when using
the network process.

* NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::continueWillSendRequest): Do not
call ResourceHandle::continueWillSendRequest() if the client
request is null, since the load is going to be cancelled.

Canonical link: https://commits.webkit.org/154760.212@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176192 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 102434eebcba257eb94ea20bee9af20176dfed35
      https://github.com/WebKit/WebKit/commit/102434eebcba257eb94ea20bee9af20176dfed35
  Author: Joanmarie Diggs <jdiggs at igalia.com>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/atk/WebKitAccessibleInterfaceValue.cpp

  Log Message:
  -----------
  Merge r176163 - AX: [ATK] REGRESSION(r166288): Accessible values are no longer accessible via AT-SPI2
https://bugs.webkit.org/show_bug.cgi?id=138776

Reviewed by Chris Fleizach.

r166288 used #if...#else instead of #if...#endif, thus disabling the old
AtkValue support. Unfortunately AT-SPI2 doesn't yet have support for the
new AtkValue API. Thus r166288 broke access to value-holding elements for
AT-SPI2 assistive technologies. Replacing #else with #endif fixes things.

No new tests because catching this regression would require AT-SPI2.

* accessibility/atk/WebKitAccessibleInterfaceValue.cpp:
(webkitAccessibleValueGetMinimumIncrement):
(webkitAccessibleValueInterfaceInit):

Canonical link: https://commits.webkit.org/154760.213@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176193 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: fc1436d5833c1caa1848b48f96edb1c1ba43f38c
      https://github.com/WebKit/WebKit/commit/fc1436d5833c1caa1848b48f96edb1c1ba43f38c
  Author: Shivakumar J M <shiva.jm at samsung.com>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/dom/HTMLAnchorElement/anchor-text-attribute-expected.txt
    A LayoutTests/fast/dom/HTMLAnchorElement/anchor-text-attribute.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/HTMLAnchorElement.cpp
    M Source/WebCore/html/HTMLAnchorElement.h
    M Source/WebCore/html/HTMLAnchorElement.idl

  Log Message:
  -----------
  Merge r176169 - Attribute text in HTMLAnchorElement should behave as per specification.
https://bugs.webkit.org/show_bug.cgi?id=138557

Patch by Shivakumar JM <shiva.jm at samsung.com> on 2014-11-16
Reviewed by Darin Adler.

Source/WebCore:

attribute text in HTMLAnchorElement should not be readonly as per specification
http://www.w3.org/TR/html/text-level-semantics.html#dom-a-text. It should behave as textContent attribute.
Also This matches the behavior of Chrome 38 and FireFox.

Test: fast/dom/HTMLAnchorElement/anchor-text-attribute.html

* html/HTMLAnchorElement.cpp:
(WebCore::HTMLAnchorElement::text):
(WebCore::HTMLAnchorElement::setText):
* html/HTMLAnchorElement.h:
* html/HTMLAnchorElement.idl:

LayoutTests:

* fast/dom/HTMLAnchorElement/anchor-text-attribute-expected.txt: Added.
* fast/dom/HTMLAnchorElement/anchor-text-attribute.html: Added.

Canonical link: https://commits.webkit.org/154760.214@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176194 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 66b22ef65426036aca17e970a1d0f78df153acc0
      https://github.com/WebKit/WebKit/commit/66b22ef65426036aca17e970a1d0f78df153acc0
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2014-11-17 (Mon, 17 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/css/style-builder-infinite-value-expected.txt
    A LayoutTests/fast/css/style-builder-infinite-value.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSParser.cpp
    M Source/WebCore/css/CSSValuePool.cpp

  Log Message:
  -----------
  Merge r176170 - Assertion hit when setting a very large value to 'border-width' / 'font-size' CSS properties
https://bugs.webkit.org/show_bug.cgi?id=138770

Reviewed by Darin Adler.

Source/WebCore:

When setting a very large value to a CSS property, it is represented internally as
infinity. r166114 already tried to deal with this by adding an std::isinf() check
in CSSValuePool::createValue() and returning an identifier CSSPrimitiveValue with
CSSValueInvalid value in such case. The issue is that doing leads to the
StyleBuilder getting a CSSValueInvalid CSSPrimitive value as input, which is not
handled and leads to assertions.

This patch updates the CSSParser to detect cases where the double value is
infinity earlier (in CSSParser::validUnit() and parseSimpleLengthValue()), so
that we mark the value as invalid and actually drop it. As a result,
CSSPrimitiveValues with CSSValueInvalid value no longer make their way to the
StyleBuilder.

Test: fast/css/style-builder-infinite-value.html
      fast/css/infinite-floating-value.html

* css/CSSParser.cpp:
(WebCore::parseSimpleLengthValue):
(WebCore::CSSParser::validUnit):
* css/CSSValuePool.cpp:
(WebCore::CSSValuePool::createValue):

LayoutTests:

Add a layout test setting very large values to 'border-width' and
'font-size' CSS properties.

* fast/css/style-builder-infinite-value-expected.txt: Added.
* fast/css/style-builder-infinite-value.html: Added.

Canonical link: https://commits.webkit.org/154760.215@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176195 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f509734282acc634a1b88c4f9f7a572369ef1fd1
      https://github.com/WebKit/WebKit/commit/f509734282acc634a1b88c4f9f7a572369ef1fd1
  Author: Carlos Alberto Lopez Perez <clopez at igalia.com>
  Date:   2014-11-18 (Tue, 18 Nov 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/NetworkProcess/EntryPoint/unix/NetworkProcessMain.cpp
    M Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp

  Log Message:
  -----------
  Merge r176252 - [SOUP] [GnuTLS] Don't use a SSL3.0 record version in client hello.
https://bugs.webkit.org/show_bug.cgi?id=138794

Reviewed by Sergio Villar Senin.

It seems that following POODLE many sites incorrectly banned SSL 3.0
record packet versions. Since GnuTLS uses a SSL 3.0 record to
advertise TLS 1.2, they are effectively banning it even if it doesn't
advertise SSL 3.0. That is a server issue, but it can be worked around
by using the modifier %LATEST_RECORD_VERSION.

With this modifier, GnuTLS will use the latest TLS version record
in client hello instead of using the default SSL 3.0.

* NetworkProcess/EntryPoint/unix/NetworkProcessMain.cpp:
(main):
* WebProcess/EntryPoint/unix/WebProcessMain.cpp:
(main):

Canonical link: https://commits.webkit.org/154760.216@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176253 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 7e395f0158ef0e11809b57655a4d9e545e450812
      https://github.com/WebKit/WebKit/commit/7e395f0158ef0e11809b57655a4d9e545e450812
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2014-11-20 (Thu, 20 Nov 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/API/gtk/WebKitPrintOperation.cpp

  Log Message:
  -----------
  Merge r176316 - [GTK] Error in documentation of webkit_print_operation_get_page_setup()
https://bugs.webkit.org/show_bug.cgi?id=138868

Patch by Michael Catanzaro <mcatanzaro at igalia.com> on 2014-11-19
Reviewed by Carlos Garcia Campos.

Fix copypaste error in documentation of
webkit_print_operation_get_page_setup().

* UIProcess/API/gtk/WebKitPrintOperation.cpp:

Canonical link: https://commits.webkit.org/154760.217@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176386 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: b563974e4f1bd6a2993bb9b3ba1bc33bf371697a
      https://github.com/WebKit/WebKit/commit/b563974e4f1bd6a2993bb9b3ba1bc33bf371697a
  Author: Joanmarie Diggs <jdiggs at igalia.com>
  Date:   2014-11-20 (Thu, 20 Nov 2014)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/platform/gtk/accessibility/combobox-descendants-orientation-crash-expected.txt
    A LayoutTests/platform/gtk/accessibility/combobox-descendants-orientation-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AccessibilityMenuListOption.cpp

  Log Message:
  -----------
  Merge r176254 - AX: [ATK] Crash getting the orientation of a MenuListOption after the MenuList was removed from the document
https://bugs.webkit.org/show_bug.cgi?id=138727

Reviewed by Chris Fleizach.

Source/WebCore:

AccessibilityMenuListOption::elementRect() returns the value of the
grandparent MenuList, asserting that the grandparent exists with that
role. But it is possible to have an existing MenuListOption and remove
the element which had been backing that MenuList from the document.
Adding null checks prior to the assertions prevents our crashing if the
parent or grandparent was removed.

Test: platform/gtk/accessibility/combobox-descendants-orientation-crash.html

* accessibility/AccessibilityMenuListOption.cpp:
(WebCore::AccessibilityMenuListOption::elementRect):

LayoutTests:

* platform/gtk/accessibility/combobox-descendants-orientation-crash-expected.txt: Added.
* platform/gtk/accessibility/combobox-descendants-orientation-crash.html: Added.

Canonical link: https://commits.webkit.org/154760.218@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176389 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 76f46ce2b52d598a18204d4a9edd42dba166746d
      https://github.com/WebKit/WebKit/commit/76f46ce2b52d598a18204d4a9edd42dba166746d
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-11-20 (Thu, 20 Nov 2014)

  Changed paths:
    M ChangeLog
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/PlatformGTK.cmake
    M Source/PlatformGTK.cmake
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/PlatformGTK.cmake
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Merge r175450 - REGRESSION(CMake): Make it possible to build without introspection
https://bugs.webkit.org/show_bug.cgi?id=138006

Reviewed by Philippe Normand.

.:

Add ENABLE_INTROSPECTION option.

* Source/PlatformGTK.cmake: Dot not add gir global target if
introspection is disabled.
* Source/cmake/OptionsGTK.cmake: Do not add gir individual targets if
introspection is disabled.

Source/JavaScriptCore:

Do not install introspection files when introspection is disabled.

* PlatformGTK.cmake:

Source/WebKit2:

Do not install introspection files when introspection is disabled.

* PlatformGTK.cmake:

Canonical link: https://commits.webkit.org/154760.219@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176391 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f8478e64f065fb297fe4d9d181b2ad38a53b4693
      https://github.com/WebKit/WebKit/commit/f8478e64f065fb297fe4d9d181b2ad38a53b4693
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2014-11-20 (Thu, 20 Nov 2014)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/WebPageProxy.cpp

  Log Message:
  -----------
  Merge r175451 - REGRESSION(r163656): Remote inspector doesn't work unless preferences change after page initialization
https://bugs.webkit.org/show_bug.cgi?id=138246

Reviewed by Joseph Pecoraro.

The problem is that initializeWebPage() is still using
pageGroup().preferences() instead of m_preferences to check if
developer extras are enabled to enable remote inspection of the page.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::initializeWebPage): Use m_preferences
instead of pageGroup().preferences().

Canonical link: https://commits.webkit.org/154760.220@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176392 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 0a528866aa44324ecbca871c893b317696f242bf
      https://github.com/WebKit/WebKit/commit/0a528866aa44324ecbca871c893b317696f242bf
  Author: Ting-Wei Lan <lantw44 at gmail.com>
  Date:   2014-11-20 (Thu, 20 Nov 2014)

  Changed paths:
    M Tools/ChangeLog
    M Tools/gtk/gtkdoc.py

  Log Message:
  -----------
  Merge r176198 - [GTK] Add library search paths from LDFLAGS before pkg-config --libs
https://bugs.webkit.org/show_bug.cgi?id=136018

Patch by Ting-Wei Lan <lantw44 at gmail.com> on 2014-11-17
Reviewed by Carlos Garcia Campos.

It is possible that the order of -L arguments in the output of
pkg-config is wrong, which causes the linker to find the wrong
version (usually older version) of libraries when running
gtkdoc-scangobj.

* gtk/gtkdoc.py:
(GTKDoc._run_gtkdoc_scangobj):

Canonical link: https://commits.webkit.org/154760.221@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176394 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 1c8bb858d1dccb5ce4879ebd948f9fb887ee1e75
      https://github.com/WebKit/WebKit/commit/1c8bb858d1dccb5ce4879ebd948f9fb887ee1e75
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2014-11-21 (Fri, 21 Nov 2014)

  Changed paths:
    M ChangeLog
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.6.4 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit2:

* gtk/NEWS: Add release notes for 2.6.4.

Canonical link: https://commits.webkit.org/154760.222@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176443 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 0a3c07e6faca3e65d96d5ee2a82529acc3f9043c
      https://github.com/WebKit/WebKit/commit/0a3c07e6faca3e65d96d5ee2a82529acc3f9043c
  Author: Philippe Normand <philn at igalia.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/webaudio/AudioContext.cpp
    M Source/WebCore/Modules/webaudio/AudioContext.h
    M Source/WebCore/Modules/webaudio/AudioDestinationNode.cpp
    M Source/WebCore/Modules/webaudio/OfflineAudioDestinationNode.cpp
    M Source/WebCore/Modules/webaudio/PannerNode.cpp
    M Source/WebCore/Modules/webaudio/PannerNode.h
    M Source/WebCore/Modules/webaudio/RealtimeAnalyser.cpp
    M Source/WebCore/Modules/webaudio/RealtimeAnalyser.h
    M Source/WebCore/platform/audio/HRTFDatabaseLoader.cpp

  Log Message:
  -----------
  Merge r176259 - HRTFDatabaseLoader is not an absolute condition to run audioContext
https://bugs.webkit.org/show_bug.cgi?id=138829

Reviewed by Jer Noble.

This patch is a port of the following Blink revision by
<keonho07.kim at samsung.com>:
<https://src.chromium.org/viewvc/blink?revision=167887&view=revision>

* Modules/webaudio/AudioContext.cpp:
(WebCore::AudioContext::AudioContext):
(WebCore::AudioContext::isRunnable): Deleted.
* Modules/webaudio/AudioContext.h:
(WebCore::AudioContext::hrtfDatabaseLoader): Deleted.
* Modules/webaudio/AudioDestinationNode.cpp:
(WebCore::AudioDestinationNode::render):
* Modules/webaudio/OfflineAudioDestinationNode.cpp:
(WebCore::OfflineAudioDestinationNode::offlineRender):
* Modules/webaudio/PannerNode.cpp:
(WebCore::PannerNode::PannerNode):
(WebCore::PannerNode::process):
(WebCore::PannerNode::initialize):
(WebCore::PannerNode::setPanningModel):
* Modules/webaudio/PannerNode.h:
* Modules/webaudio/RealtimeAnalyser.cpp:
* Modules/webaudio/RealtimeAnalyser.h:
* platform/audio/HRTFDatabaseLoader.cpp:
(WebCore::HRTFDatabaseLoader::createAndLoadAsynchronouslyIfNecessary):

Canonical link: https://commits.webkit.org/154760.223@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178256 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 266ad630249db7ecdffea3114b67012acc179593
      https://github.com/WebKit/WebKit/commit/266ad630249db7ecdffea3114b67012acc179593
  Author: Philippe Normand <philn at igalia.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp
    M Source/WebCore/Modules/webaudio/AudioBufferSourceNode.h
    M Source/WebCore/Modules/webaudio/AudioBufferSourceNode.idl
    M Source/WebCore/Modules/webaudio/AudioScheduledSourceNode.cpp
    M Source/WebCore/Modules/webaudio/AudioScheduledSourceNode.h
    M Source/WebCore/Modules/webaudio/OscillatorNode.idl

  Log Message:
  -----------
  Merge r176311 - start/stop method for AudioBufferSourceNodes and OscillatorNodes can take no args
https://bugs.webkit.org/show_bug.cgi?id=138739

Reviewed by Darin Adler.

Source/WebCore:

The patch is inspired by the following Blink revision by
<rtoy at google.com>:
<https://src.chromium.org/viewvc/blink?view=rev&revision=160845>

Test: webaudio/dom-exceptions.html

* Modules/webaudio/AudioBufferSourceNode.cpp:
(WebCore::AudioBufferSourceNode::start):
(WebCore::AudioBufferSourceNode::startPlaying):
(WebCore::AudioBufferSourceNode::noteGrainOn):
(WebCore::AudioBufferSourceNode::startGrain): Deleted.
* Modules/webaudio/AudioBufferSourceNode.h:
* Modules/webaudio/AudioBufferSourceNode.idl:
* Modules/webaudio/AudioScheduledSourceNode.cpp:
(WebCore::AudioScheduledSourceNode::start):
(WebCore::AudioScheduledSourceNode::stop):
* Modules/webaudio/AudioScheduledSourceNode.h:
* Modules/webaudio/OscillatorNode.idl:

LayoutTests:

* webaudio/dom-exceptions-expected.txt: Added.
* webaudio/dom-exceptions.html: Added.

Canonical link: https://commits.webkit.org/154760.224@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178257 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: c8d4840b481ccb9d120e6224ee14519e9b54e45c
      https://github.com/WebKit/WebKit/commit/c8d4840b481ccb9d120e6224ee14519e9b54e45c
  Author: Philippe Normand <philn at igalia.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/track/VideoTrack.cpp

  Log Message:
  -----------
  Merge r176322 - Missing NULL-check in VideoTrack::setLanguage
https://bugs.webkit.org/show_bug.cgi?id=138867

Reviewed by Jer Noble.

* html/track/VideoTrack.cpp:
(WebCore::VideoTrack::setLanguage): Prevent change event creation
on an empty video track list.

Canonical link: https://commits.webkit.org/154760.225@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178258 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: bf6a626e45d02f0a48be75ac53493de0551cd8c2
      https://github.com/WebKit/WebKit/commit/bf6a626e45d02f0a48be75ac53493de0551cd8c2
  Author: Myles C. Maxfield <mmaxfield at apple.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/multicol/orphans-negative-line-spacing-expected.html
    A LayoutTests/fast/multicol/orphans-negative-line-spacing.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlockFlow.cpp

  Log Message:
  -----------
  Merge r176285 - Multicolumn layout with negative line spacing and orphans causes pieces of letters to be shown at the bottom of columns
https://bugs.webkit.org/show_bug.cgi?id=138204

Source/WebCore:

Reviewed by Dave Hyatt.

This code is responsible for pushing block elements to the next column if
the "orphans" CSS property is triggered. The mechanism by which this is
achieved is to push the block down such that the origin of the block is
at the origin of the next column. However, if there is negative line
spacing, the top portion of the text might actually be on top of the
origin of the block. Therefore, the block wasn't being pushed down enough
to entirely contain its text, so the top pieces were being drawn on the
previous column.

Test: fast/multicol/orphans-negative-line-spacing.html

* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::adjustLinePositionForPagination):

LayoutTests:

Patch by Myles C. Maxfield <litherum at gmail.com> on 2014-11-18
Reviewed by Dave Hyatt.

Create a layout where the "orphans" css property causes a block element to
be pushed to the next column.

* fast/multicol/orphans-negative-line-spacing-expected.html: Added.
* fast/multicol/orphans-negative-line-spacing.html: Added.

Canonical link: https://commits.webkit.org/154760.226@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178259 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 6e703052934f77c086f32b40169439dfb74d78fc
      https://github.com/WebKit/WebKit/commit/6e703052934f77c086f32b40169439dfb74d78fc
  Author: David Hyatt <hyatt at apple.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/inline-block/inline-block-empty-spans-expected.html
    A LayoutTests/fast/inline-block/inline-block-empty-spans.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/line/BreakingContextInlineHeaders.h

  Log Message:
  -----------
  Merge r176287 - REGRESSION(r152313): Inline-block element doesn't wrap properly
https://bugs.webkit.org/show_bug.cgi?id=138846 - <rdar://problem/18838703>

Reviewed by Simon Fraser.

Source/WebCore:

Added fast/inline-block/inline-block-empty-spans.html

* rendering/line/BreakingContextInlineHeaders.h:
(WebCore::BreakingContext::canBreakAtThisPosition):

LayoutTests:

* fast/inline-block/inline-block-empty-spans-expected.html: Added.
* fast/inline-block/inline-block-empty-spans.html: Added.

Canonical link: https://commits.webkit.org/154760.227@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178260 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: b94b9cdbfebbd879b3e30b98f1e104cb87ca07ab
      https://github.com/WebKit/WebKit/commit/b94b9cdbfebbd879b3e30b98f1e104cb87ca07ab
  Author: David Hyatt <hyatt at apple.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/block/selection-block-gap-crash-expected.txt
    A LayoutTests/fast/block/selection-block-gap-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlock.cpp

  Log Message:
  -----------
  Merge r176295 - REGRESSION (r167210): Invalid cast in WebCore::RenderBlock::blockSelectionGaps
https://bugs.webkit.org/show_bug.cgi?id=137590

Reviewed by Dean Jackson.

Source/WebCore:

Added fast/block/selection-block-gaps-crash.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::blockSelectionGaps):
Check that we really are a RenderBlock before recurring.

LayoutTests:

* fast/block/selection-block-gap-crash-expected.txt: Added.
* fast/block/selection-block-gap-crash.html: Added.

Canonical link: https://commits.webkit.org/154760.228@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178261 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 3af94e7f3933a504d3033aef35e6536e9b6ee486
      https://github.com/WebKit/WebKit/commit/3af94e7f3933a504d3033aef35e6536e9b6ee486
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/css/flex-shrink-calculated-value-expected.txt
    A LayoutTests/fast/css/flex-shrink-calculated-value.html
    A LayoutTests/fast/css/z-index-calculated-value-expected.txt
    A LayoutTests/fast/css/z-index-calculated-value.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSPrimitiveValueMappings.h

  Log Message:
  -----------
  Merge r176301 - Crash when setting 'z-index' / 'flex-shrink' CSS properties to a calculated value
https://bugs.webkit.org/show_bug.cgi?id=138783

Reviewed by Andreas Kling.

Source/WebCore:

Update operators converting CSSPrimitiveValue to integer / floating
point types to properly handle calculated values (e.g. 'calc(2 * 3)').
Previously, this was not working in release builds and we would hit an
ASSERT_NOT_REACHED() in debug builds.

Tests: fast/css/flex-shrink-calculated-value.html
       fast/css/z-index-calculated-value.html

* css/CSSPrimitiveValueMappings.h:
(WebCore::CSSPrimitiveValue::operator unsigned short):
(WebCore::CSSPrimitiveValue::operator int):
(WebCore::CSSPrimitiveValue::operator unsigned):
(WebCore::CSSPrimitiveValue::operator float):

LayoutTests:

Add layout tests to check that settings 'z-index' / 'flex-shrink' CSS
properties to a calculated value does not crash and behaves as
expected.

* fast/css/flex-shrink-calculated-value-expected.txt: Added.
* fast/css/flex-shrink-calculated-value.html: Added.
* fast/css/z-index-calculated-value-expected.txt: Added.
* fast/css/z-index-calculated-value.html: Added.

Canonical link: https://commits.webkit.org/154760.229@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178262 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: dbb22558c0efba8f4122b3191e804827aac4919f
      https://github.com/WebKit/WebKit/commit/dbb22558c0efba8f4122b3191e804827aac4919f
  Author: Antti Koivisto <antti at apple.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/FrameView.cpp

  Log Message:
  -----------
  Merge r176384 - REGRESSION (r172854): Web Viewer in FileMaker does not render a Base64 encoded animated-GIF
https://bugs.webkit.org/show_bug.cgi?id=138807
<rdar://problem/18829540>

Reviewed by Simon Fraser.

Animation gets paused because WebKit thinks the GIF is outside of the view.

* page/FrameView.cpp:
(WebCore::FrameView::windowClipRect):

We need to convert to window coordinates in paintsEntireContents mode too so these functions are consistent.
This matters with some WK1 API clients.

Canonical link: https://commits.webkit.org/154760.230@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178263 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: fb8cc1e5ae562aac2809f3eb22dce06dbb0557db
      https://github.com/WebKit/WebKit/commit/fb8cc1e5ae562aac2809f3eb22dce06dbb0557db
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/js/dfg-inline-identity-expected.txt
    A LayoutTests/js/dfg-inline-identity.html
    A LayoutTests/js/script-tests/dfg-inline-identity.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

  Log Message:
  -----------
  Merge r176399 - WTFCrashWithSecurityImplication under SpeculativeJIT::compile() when loading a page from theblaze.com.
<https://webkit.org/b/137642>

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

In the DFG, we have a ConstantFolding phase that occurs after all LocalCSE
phases have already transpired.  Hence, Identity nodes introduced in the
ConstantFolding phase will be left in the node graph.  Subsequently, the
DFG code generator asserts that CSE phases have consumed all Identity nodes.
This turns out to not be true.  Hence, the crash.  We fix this by teaching
the DFG code generator to emit code for Identity nodes.

Unlike the DFG, the FTL does not have this issue.  That is because the FTL
plan has GlobalCSE phases that come after ConstantFolding and any other
phases that can generate Identity nodes.  Hence, for the FTL, it is true that
CSE will consume all Identity nodes, and the code generator should not see any
Identity nodes.

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):

LayoutTests:

* js/dfg-inline-identity-expected.txt: Added.
* js/dfg-inline-identity.html: Added.
* js/script-tests/dfg-inline-identity.js: Added.
(o.toKey):
(foo):
(test):

Canonical link: https://commits.webkit.org/154760.231@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178264 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 218c0c94a3d3ed2b4f29319683116cd9aeed113e
      https://github.com/WebKit/WebKit/commit/218c0c94a3d3ed2b4f29319683116cd9aeed113e
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/clip/css-clip-does-not-work-when-border-radius-is-present-expected.html
    A LayoutTests/fast/clip/css-clip-does-not-work-when-border-radius-is-present.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderLayer.cpp

  Log Message:
  -----------
  Merge r176432 - REGRESSION (174986): CSS clip property is ignored when border-radius is present.
https://bugs.webkit.org/show_bug.cgi?id=138935
rdar://problem/18965984

Reviewed by Simon Fraser.

Revert back to r163382 and fix bug 127729 properly. Save the graphics context when paint and clip rects are
the same, but the clip rect has radius.
Each iteration on ::clipRect() from r163382 onwards just introduced yet another regression.

Source/WebCore:

Test: fast/clip/css-clip-does-not-work-when-border-radius-is-present.html

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::clipToRect):

LayoutTests:

* fast/clip/css-clip-does-not-work-when-border-radius-is-present-expected.html: Added.
* fast/clip/css-clip-does-not-work-when-border-radius-is-present.html: Added.

Canonical link: https://commits.webkit.org/154760.232@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178267 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 06ba7bd23609d50a38c199fbb132aa890788207e
      https://github.com/WebKit/WebKit/commit/06ba7bd23609d50a38c199fbb132aa890788207e
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/css/font-calculated-value-expected.txt
    A LayoutTests/fast/css/font-calculated-value.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSParser.cpp

  Log Message:
  -----------
  Merge r176454 - Crash when setting 'font' CSS property to 'calc(2 * 3)'
https://bugs.webkit.org/show_bug.cgi?id=138933

Reviewed by Darin Adler.

Source/WebCore:

The CSS Parser was not handling calculated values when parsing the font
weight. This would lead us to hit an assertion when parsing a font
property whose weight is set to a calculated value.

This patch updates parseFontWeight() to properly handle calculated
values.

Test: fast/css/font-calculated-value.html

* css/CSSParser.cpp:
(WebCore::CSSParser::parseFontWeight):

LayoutTests:

Add a layout test to cover the case where the 'font' CSS property is
set to a value whose weight is a calculated value, to make sure it
does not crash and behaves as intended.

* fast/css/font-calculated-value-expected.txt: Added.
* fast/css/font-calculated-value.html: Added.

Canonical link: https://commits.webkit.org/154760.233@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178268 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: a58e8275fe236507f1f9156061b083ab022d327d
      https://github.com/WebKit/WebKit/commit/a58e8275fe236507f1f9156061b083ab022d327d
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/css/order-calculated-value-expected.txt
    A LayoutTests/fast/css/order-calculated-value.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSParser.cpp

  Log Message:
  -----------
  Merge r176171 - Crash when setting 'order' CSS property to a calculated value
https://bugs.webkit.org/show_bug.cgi?id=138780

Reviewed by Darin Adler.

Source/WebCore:

CSS Calculated values were not handled by the CSS parser for 'order'
CSS property. As a result, using calculated values wouldn't work in
release builds and would hit an assertion in debug builds.

This patch updates the CSS parser to directly convert the
CSS Calculated value into a simple integer CSSPrimitiveValue for
'order' property. We could have marked CSS Calculated values as
valid in the CSS Parser instead but this would have brought issues:
- The calculated value needs to be adjusted to INT_MIN + 2 if it is less
  than that. This would force us to calculate the expression anyway.
- The StyleBuilder would need updating to properly handle CSS Calculated
  values for 'order'.

Test: fast/css/order-calculated-value.html

* css/CSSParser.cpp:
(WebCore::CSSParser::parseValue):

LayoutTests:

Add a layout test to validate that setting a calculated value to the
'order' CSS property does not crash and behaves as expected.

* fast/css/order-calculated-value-expected.txt: Added.
* fast/css/order-calculated-value.html: Added.

Canonical link: https://commits.webkit.org/154760.234@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178269 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 800d94cb05fe19b03ec9790e7104cb07e5d37191
      https://github.com/WebKit/WebKit/commit/800d94cb05fe19b03ec9790e7104cb07e5d37191
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/css/transition-delay-calculated-value-expected.txt
    A LayoutTests/fast/css/transition-delay-calculated-value.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSPrimitiveValue.h

  Log Message:
  -----------
  Merge r176458 - Crash when setting 'transition-delay' CSS property to a calculated value
https://bugs.webkit.org/show_bug.cgi?id=138784

Reviewed by Sam Weinig.

Source/WebCore:

Update CSSPrimitiveValue::computeTime() to use primitiveType() instead
of m_primitiveUnitType so that it properly handles calculated values.
Without this, we would hit the ASSERT_NOT_REACHED() assertion in
computeTime() for calculated values.

Test: fast/css/transition-delay-calculated-value.html

* css/CSSPrimitiveValue.h:
(WebCore::CSSPrimitiveValue::computeTime):

LayoutTests:

Add a layout test to check that setting the 'transition-delay' CSS
property to a calculated value does not crash and works as intended.

* fast/css/transition-delay-calculated-value-expected.txt: Added.
* fast/css/transition-delay-calculated-value.html: Added.

Canonical link: https://commits.webkit.org/154760.235@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178270 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 840328c26dcecca3c126063ff18228b8268d8823
      https://github.com/WebKit/WebKit/commit/840328c26dcecca3c126063ff18228b8268d8823
  Author: Michael Saboff <msaboff at apple.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/ComplexGetStatus.cpp

  Log Message:
  -----------
  Merge r176506 - r176455: ASSERT(!m_vector.isEmpty()) in IntendedStructureChain.cpp(143)
https://bugs.webkit.org/show_bug.cgi?id=139000

Reviewed by Darin Adler.

Check that the chainCount is non-zero before using a StructureChain.

* bytecode/ComplexGetStatus.cpp:
(JSC::ComplexGetStatus::computeFor):

Canonical link: https://commits.webkit.org/154760.236@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178271 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 3233652a94cee4eac5cb987acd7ced2872193437
      https://github.com/WebKit/WebKit/commit/3233652a94cee4eac5cb987acd7ced2872193437
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/PlatformGTK.cmake

  Log Message:
  -----------
  Merge r176519 - Webkit2 doesnt build on powerpc 32 bits
https://bugs.webkit.org/show_bug.cgi?id=130837

Reviewed by Carlos Garcia Campos.

Check if libatomic is needed in order to use std::atomic, and add
it to the list of WebKit2 libraries.

* PlatformGTK.cmake:

Canonical link: https://commits.webkit.org/154760.237@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178272 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f8f31da8da5e3954d5f3a3bff93498254d033281
      https://github.com/WebKit/WebKit/commit/f8f31da8da5e3954d5f3a3bff93498254d033281
  Author: Ting-Wei Lan <lantw44 at gmail.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/PlatformGTK.cmake

  Log Message:
  -----------
  Merge r176540 - [GTK] Use LD_LIBRARY_PATH to make g-ir-scanner use the newly-built
version of libraries when running the temporary executable
https://bugs.webkit.org/show_bug.cgi?id=138833

Patch by Ting-Wei Lan <lantw44 at gmail.com> on 2014-11-25
Reviewed by Carlos Garcia Campos.

This patch modifies LD_LIBRARY_PATH to make sure the dynamic linker
find the correct version of libraries when running the temporary
executable to generate the .gir file.

* PlatformGTK.cmake:

Canonical link: https://commits.webkit.org/154760.238@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178273 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 1a84900e9f5a231b03a29e3618e087fb056009a5
      https://github.com/WebKit/WebKit/commit/1a84900e9f5a231b03a29e3618e087fb056009a5
  Author: Philippe Normand <philn at igalia.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/GStreamerUtilities.cpp

  Log Message:
  -----------
  Merge r176541 - [GStreamer] gstmpegts is not initialized
https://bugs.webkit.org/show_bug.cgi?id=139039

Reviewed by Carlos Garcia Campos.

* platform/graphics/gstreamer/GStreamerUtilities.cpp:
(WebCore::initializeGStreamer): Initialize the gstmpegts library.

Canonical link: https://commits.webkit.org/154760.239@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178274 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: da36f48a7d5b2a4b0acebee4fb478854b996d2e8
      https://github.com/WebKit/WebKit/commit/da36f48a7d5b2a4b0acebee4fb478854b996d2e8
  Author: Andres Gomez <agomez at igalia.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Images/gtk/NavigationItemProbes.svg

  Log Message:
  -----------
  Merge r176548 - Web Inspector: Update NavigationItemProbes icon for the GTK+ port
https://bugs.webkit.org/show_bug.cgi?id=139074

Reviewed by Carlos Garcia Campos.

NavigationItemProbes was updated for the Mac port and we are now
having a similar ideogram in GTK+.

* UserInterface/Images/gtk/NavigationItemProbes.svg: Updated.

Canonical link: https://commits.webkit.org/154760.240@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178275 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 2fb5139e5a303253bd1686170c67aab1b50017f7
      https://github.com/WebKit/WebKit/commit/2fb5139e5a303253bd1686170c67aab1b50017f7
  Author: Antti Koivisto <antti at apple.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/HTMLPlugInImageElement.cpp

  Log Message:
  -----------
  Merge r176554 - CrashTracer: com.apple.WebKit.WebContent at com.apple.WebCore: WebCore::HTMLPlugInImageElement::updateSnapshot + 108
https://bugs.webkit.org/show_bug.cgi?id=139057

Reviewed by Anders Carlsson.

No test, don't know how to repro.

* html/HTMLPlugInImageElement.cpp:
(WebCore::HTMLPlugInImageElement::updateSnapshot): Null check the renderer.

Canonical link: https://commits.webkit.org/154760.241@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178276 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 6e52b8183e9452ec70577238508428a1108620ba
      https://github.com/WebKit/WebKit/commit/6e52b8183e9452ec70577238508428a1108620ba
  Author: Philippe Normand <philn at igalia.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp

  Log Message:
  -----------
  Merge r176561 - [GStreamer] HTTP source element lacks SCHEDULING query support
https://bugs.webkit.org/show_bug.cgi?id=139064

Reviewed by Carlos Garcia Campos.

No new tests, covered by http/tests/media/hls.

* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(webKitWebSrcQueryWithParent): Make the element handle SCHEDULING
queries with the BANDWIDTH_LIMITED flag. This helps uridecodebin
to configure itself for adaptive streaming playback scenarios.

Canonical link: https://commits.webkit.org/154760.242@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178277 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 029c34ded57c37621c22dad39fe78e43a0879acf
      https://github.com/WebKit/WebKit/commit/029c34ded57c37621c22dad39fe78e43a0879acf
  Author: Philippe Normand <philn at igalia.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M ChangeLog
    M Source/cmake/FindGStreamer.cmake

  Log Message:
  -----------
  Merge r176565 - [CMake] Build failure against GStreamer git master
https://bugs.webkit.org/show_bug.cgi?id=138872

Reviewed by Csaba Osztrogon.

* Source/cmake/FindGStreamer.cmake: Simplified the
FIND_GSTREAMER_COMPONENT macro. Trust pkg-config for include
headers lookup, there's no need to do this manually. Also
explicitely check the version specified in GStreamer_FIND_VERSION.

Canonical link: https://commits.webkit.org/154760.243@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178278 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e41740c3e21c5421262fe098c4cb653aeaeef7f9
      https://github.com/WebKit/WebKit/commit/e41740c3e21c5421262fe098c4cb653aeaeef7f9
  Author: Anders Carlsson <andersca at apple.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/Storage/StorageManager.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/PlatformWebView.h
    M Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
    A Tools/TestWebKitAPI/Tests/WebKit2/CloseFromWithinCreatePage.cpp
    A Tools/TestWebKitAPI/Tests/WebKit2/close-from-within-create-page.html
    M Tools/TestWebKitAPI/mac/PlatformWebViewMac.mm

  Log Message:
  -----------
  Merge r176574 - Crash when calling WKPageClose on the originated page from within createNewPage callback
https://bugs.webkit.org/show_bug.cgi?id=139099
<rdar://problem/19052564>

Reviewed by Sam Weinig.

Source/WebKit2:

Null check the namespace ID.

* UIProcess/Storage/StorageManager.cpp:
(WebKit::StorageManager::cloneSessionStorageNamespaceInternal):

Tools:

Add a test.

* TestWebKitAPI/PlatformWebView.h:
* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/WebKit2/CloseFromWithinCreatePage.cpp: Added.
(TestWebKitAPI::runJavaScriptAlert):
(TestWebKitAPI::createNewPage):
(TestWebKitAPI::TEST):
* TestWebKitAPI/Tests/WebKit2/close-from-within-create-page.html: Added.
* TestWebKitAPI/mac/PlatformWebViewMac.mm:
(TestWebKitAPI::PlatformWebView::PlatformWebView):

Canonical link: https://commits.webkit.org/154760.244@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178280 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 8e18924d13e51cbb273397674834c9af8c56073d
      https://github.com/WebKit/WebKit/commit/8e18924d13e51cbb273397674834c9af8c56073d
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/inline/out-of-flow-positioned-render-replaced-box-moves-expected.html
    A LayoutTests/fast/inline/out-of-flow-positioned-render-replaced-box-moves.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/InlineBox.cpp

  Log Message:
  -----------
  Merge r176619 - Twitter avatar moves when hovering/unhovering the "follow" button.
https://bugs.webkit.org/show_bug.cgi?id=139147
rdar://problem/19096508

Reviewed by Simon Fraser.

This patch ensures that the out of flow positioned render boxes (RenderReplaced) do not
get repositioned when their inline box wrappers move.
Ideally, out of flow positioned renderers do not have inline wrappers by the time we start
placing inline boxes, but in certain case (optimized code path for descendantsHaveSameLineHeightAndBaseline()),
they are still part of the inline box tree.
This patch prevents those renderer boxes from getting positioned as part of the inline box placement.
They will get removed later at RenderBlockFlow::computeBlockDirectionPositionsForLine().

Source/WebCore:

Test: fast/inline/out-of-flow-positioned-render-replaced-box-moves.html

* rendering/InlineBox.cpp:
(WebCore::InlineBox::adjustPosition):

LayoutTests:

* fast/inline/out-of-flow-positioned-render-replaced-box-moves-expected.html: Added.
* fast/inline/out-of-flow-positioned-render-replaced-box-moves.html: Added.

Canonical link: https://commits.webkit.org/154760.245@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178282 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: dc4daef3319c442e7f746705b964eb43e52b9d26
      https://github.com/WebKit/WebKit/commit/dc4daef3319c442e7f746705b964eb43e52b9d26
  Author: Michael Saboff <msaboff at apple.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

  Log Message:
  -----------
  Merge r176624 - Crash (integer overflow) beneath ByteCodeParser::handleGetById typing in search field on weather.com
https://bugs.webkit.org/show_bug.cgi?id=139165

Reviewed by Oliver Hunt.

If we don't have any getById or putById variants, emit non-cached versions of these operations.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleGetById):
(JSC::DFG::ByteCodeParser::handlePutById):

Canonical link: https://commits.webkit.org/154760.246@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178283 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: cbba4457ac340bc3e60b454d050f2754e48ec254
      https://github.com/WebKit/WebKit/commit/cbba4457ac340bc3e60b454d050f2754e48ec254
  Author: Matthew Mirman <mmirman at apple.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/jit/JITOperations.cpp
    M Source/JavaScriptCore/runtime/JSCJSValue.h
    M Source/JavaScriptCore/runtime/JSCJSValueInlines.h
    A Source/JavaScriptCore/tests/stress/recursive_property_redefine_during_inline_caching.js

  Log Message:
  -----------
  Merge r176676 - Fixes inline cache fast path accessing nonexistant getters.
<rdar://problem/18416918>
https://bugs.webkit.org/show_bug.cgi?id=136961

Reviewed by Filip Pizlo.

Fixes a bug in inline caching where getters would have been able to
modify the property they are getting during
building the inline cache and then accessing that
property through the inline cache site causing a recursive
inline cache building and allowing the fast path of the cache to
try to load a getter for the property that no longer exists.

* jit/JITOperations.cpp: Switched use of get to getPropertySlot.
* runtime/JSCJSValue.h:
added getPropertySlot for when you don't want to perform the get quite yet but want
to fill out the slot.
* runtime/JSCJSValueInlines.h: Added implementation for getPropertySlot
(JSC::JSValue::get): changed to simply call getPropertySlot
(JSC::JSValue::getPropertySlot): added.
* tests/stress/recursive_property_redefine_during_inline_caching.js: Added test case for bug.
(test):

Canonical link: https://commits.webkit.org/154760.247@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178286 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 404cf9633645d0519bcd28a0423511cb8e5f32a4
      https://github.com/WebKit/WebKit/commit/404cf9633645d0519bcd28a0423511cb8e5f32a4
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/multicol/svg-content-as-column-spanner-crash-expected.txt
    A LayoutTests/fast/multicol/svg-content-as-column-spanner-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp

  Log Message:
  -----------
  Merge r176750 - ASSERTION: RenderMultiColumnFlowThread::processPossibleSpannerDescendant() when column spanner's parent is not a RenderBlockFlow.
https://bugs.webkit.org/show_bug.cgi?id=139188
rdar://problem/18502182

Reviewed by David Hyatt.

This patch ensures that the validation check for spanner in isValidColumnSpanner() is in synch
with the expectation in RenderMultiColumnFlowThread::processPossibleSpannerDescendant().
(descendant's parent is expected to be a RenderBlockFlow)

Source/WebCore:

Test: fast/multicol/svg-content-as-column-spanner-crash.html

* rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::isValidColumnSpanner):

LayoutTests:

* fast/multicol/svg-content-as-column-spanner-crash-expected.txt: Added.
* fast/multicol/svg-content-as-column-spanner-crash.html: Added.

Canonical link: https://commits.webkit.org/154760.248@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178317 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 3309f5b60825747c1e3091122b80f3241f5d373d
      https://github.com/WebKit/WebKit/commit/3309f5b60825747c1e3091122b80f3241f5d373d
  Author: Myles C. Maxfield <mmaxfield at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/lists/rtl-marker-expected.html
    A LayoutTests/fast/lists/rtl-marker.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderListMarker.cpp

  Log Message:
  -----------
  Merge r176768 - List markers in RTL languages do not draw the first character.
https://bugs.webkit.org/show_bug.cgi?id=139244

Reviewed by Simon Fraser.

Source/WebCore:

Off-by-one error when reversing the string (from LTR to RTL)

Test: fast/lists/rtl-marker.html

* rendering/RenderListMarker.cpp:
(WebCore::RenderListMarker::paint):

LayoutTests:

* fast/lists/rtl-marker-expected.html: Added.
* fast/lists/rtl-marker.html: Added.

Canonical link: https://commits.webkit.org/154760.249@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178318 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 917e7ae0c7b60f3b2c47a3809e824b375b67f47a
      https://github.com/WebKit/WebKit/commit/917e7ae0c7b60f3b2c47a3809e824b375b67f47a
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M ChangeLog
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Merge r176787 - can not find cairo-gl.h when build webkit with gtk on ubuntu 14.04
https://bugs.webkit.org/show_bug.cgi?id=136576

Reviewed by Carlos Garcia Campos.

CMake should complain if Accelerated 2D Canvas is explicitly
enabled but cairo-gl is not found.

* Source/cmake/OptionsGTK.cmake:

Canonical link: https://commits.webkit.org/154760.250@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178319 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e745d93e1871fa5c6e5c8332284124cdababbc87
      https://github.com/WebKit/WebKit/commit/e745d93e1871fa5c6e5c8332284124cdababbc87
  Author: Oliver Hunt <oliver at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/MapData.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/js/SerializedScriptValue.cpp

  Log Message:
  -----------
  Merge r176803 - Serialization of MapData object provides unsafe access to internal types
https://bugs.webkit.org/show_bug.cgi?id=138653

Patch by Oliver Hunt <oliver at apple.com> on 2014-12-04
Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Converting these ASSERTs into RELEASE_ASSERTs, as it is now obvious
that despite trying hard to be safe in all cases it's simply to easy
to use an iterator in an unsafe state.

* runtime/MapData.h:
(JSC::MapData::const_iterator::key):
(JSC::MapData::const_iterator::value):

Source/WebCore:

We now keep the value portion of the key/value pair in MapData as a
separate stack. This allows us to maintain the spec semantic of
"atomic" serialisation of the key/value pair without retaining the
use of a potentially invalid iterator.

* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneSerializer::serialize):

Canonical link: https://commits.webkit.org/154760.251@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178320 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: c980fbaf741d73960a3ef315247363998cf191a6
      https://github.com/WebKit/WebKit/commit/c980fbaf741d73960a3ef315247363998cf191a6
  Author: Adenilson Cavalcanti <cavalcantii at gmail.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/borders/mixed-border-style2.html
    A LayoutTests/platform/mac-mavericks/fast/borders/mixed-border-style2-expected.png
    A LayoutTests/platform/mac-mavericks/fast/borders/mixed-border-style2-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderObject.cpp
    M Source/WebCore/rendering/RenderObject.h

  Log Message:
  -----------
  Merge r176816 - Groove/inset/outset borders show solid if the color is black
https://bugs.webkit.org/show_bug.cgi?id=58608

Reviewed by Simon Fraser.

Source/WebCore:

Test: fast/borders/mixed-border-style2.html

This patch will lighten/darken the border side colors, handling
border decoration in a similar way as Firefox does.

* rendering/RenderObject.cpp:
(WebCore::RenderObject::drawLineForBoxSide):
(WebCore::RenderObject::calculateBorderStyleColor):
* rendering/RenderObject.h:

LayoutTests:

* fast/borders/mixed-border-style2.html: Added.
* platform/mac-mavericks/fast/borders/mixed-border-style2-expected.png: Added.
* platform/mac-mavericks/fast/borders/mixed-border-style2-expected.txt: Added.

Canonical link: https://commits.webkit.org/154760.252@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178321 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 1252190864c3647b47824f82c2685f1022a7a4c7
      https://github.com/WebKit/WebKit/commit/1252190864c3647b47824f82c2685f1022a7a4c7
  Author: Antti Koivisto <antti at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/NetworkProcess/NetworkConnectionToWebProcess.cpp
    M Source/WebKit2/NetworkProcess/NetworkConnectionToWebProcess.h
    M Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp
    M Source/WebKit2/NetworkProcess/NetworkResourceLoader.h

  Log Message:
  -----------
  Merge r176818 - REGRESSION (r173468): Cannot step in WebInspector
https://bugs.webkit.org/show_bug.cgi?id=139260

Reviewed by Alexey Proskuryakov.

Inspector defers all loads and starts a nested runloop when it hits a breakpoint. When continuing it undefers the loads.
If the script execution was triggered from the didFinishLoading callback of the main resource then the main resource would
already be in the finished state in the network process side and setDefersLoading(false) message would end up restarting its load.
Since loads are not meant to restart the generated callbacks would assert or crash the web process when handled in the next
nested inspector runloop.

Fix by taking care that cleaned up NetworkResourceLoaders are always removed from the loader map of
the NetworkConnectionToWebProcess and so can't end up handling late messages.

No test, this requires JS debugger to trigger.

* NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::didCleanupResourceLoader):

    This is now the only way to remove resource loaders.
    It is called from NetworkResourceLoader::cleanup only.

(WebKit::NetworkConnectionToWebProcess::didClose):
(WebKit::NetworkConnectionToWebProcess::removeLoadIdentifier):

    Calling abort  removes the resource loader (since it calls cleanup) so no need to do it explicitly anymore.

* NetworkProcess/NetworkConnectionToWebProcess.h:
* NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::start):

    We are guaranteed to be reffed by NetworkConnectionToWebProcess until cleanup so the explicit ref/deref can be removed.

(WebKit::NetworkResourceLoader::cleanup):

    Call to NetworkConnectionToWebProcess::didCleanupResourceLoader to make the loader unreachable.

* NetworkProcess/NetworkResourceLoader.h:
(WebKit::NetworkResourceLoader::identifier):

Canonical link: https://commits.webkit.org/154760.253@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178322 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e0ef2ef6acc4ef2dbc4a6fb4aef40354a9289dd4
      https://github.com/WebKit/WebKit/commit/e0ef2ef6acc4ef2dbc4a6fb4aef40354a9289dd4
  Author: Andreas Kling <akling at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/JSString.h

  Log Message:
  -----------
  Merge r176824 - REGRESSION(r173188): Text inserted when trying to delete a word from the Twitter message box.
<https://webkit.org/b/139076>

Reviewed by Geoffrey Garen.

The StringImpl* -> Weak<JSString> cache used by the DOM bindings
had a bug where the key could become a stale pointer if the cached
JSString had its internal StringImpl atomicized.

If a new StringImpl was then later constructed at the exact same
address as the stale key, before the Weak<JSString> got booted out
of the string cache, we'd now have a situation where asking the
string cache for that key would return the old JSString.

Solve this by not allowing JSString::toExistingAtomicString() to
change the JSString's internal StringImpl unless it's resolving a
rope string. (The StringImpl nullity determines rope state.)

This means that calling toExistingAtomicString() may now have to
query the AtomicString table on each call rather than just once.
All clients of this API would be forced to do this regardless,
since they return value will be used to key into containers with
AtomicStringImpl* keys.

No test because this relies on malloc putting two StringImpls
at the same address at different points in time and we have no
mechanism to reliably test that.

* runtime/JSString.h:
(JSC::JSString::toExistingAtomicString):

Canonical link: https://commits.webkit.org/154760.254@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178323 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: cf2a2790306f45312967d930c8098fcff7fafb18
      https://github.com/WebKit/WebKit/commit/cf2a2790306f45312967d930c8098fcff7fafb18
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderEmbeddedObject.cpp

  Log Message:
  -----------
  Merge r176874 - Issue repaint at setUnavailablePluginIndicatorIsHidden() only when embedded object's indicator status changes.
https://bugs.webkit.org/show_bug.cgi?id=139311

Reviewed by Tim Horton.

Not testable.

* rendering/RenderEmbeddedObject.cpp:
(WebCore::RenderEmbeddedObject::setUnavailablePluginIndicatorIsHidden):

Canonical link: https://commits.webkit.org/154760.255@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178324 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: c3c52defc0364adec887cf480207f7c71db4f1c2
      https://github.com/WebKit/WebKit/commit/c3c52defc0364adec887cf480207f7c71db4f1c2
  Author: Myles C. Maxfield <mmaxfield at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/text/vertical-quotation-marks-expected.html
    A LayoutTests/fast/text/vertical-quotation-marks.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/FontGlyphs.cpp

  Log Message:
  -----------
  Merge r176903 - Directional single quotation marks are not rotated in vertical text
https://bugs.webkit.org/show_bug.cgi?id=138526

Source/WebCore:

Reviewed by Darin Adler.

In vertical text, directional single quotation marks are not rotated along with
the rest of the letters.

Test: fast/text/vertical-quotation-marks.html

* platform/graphics/FontGlyphs.cpp:
(WebCore::shouldIgnoreRotation):

LayoutTests:

Compare vertical and horizontal renderings.

Reviewed by Darin Adler.

* fast/text/vertical-quotation-marks-expected.html: Added.
* fast/text/vertical-quotation-marks.html: Added.

Canonical link: https://commits.webkit.org/154760.256@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178325 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: c9b24c1578f14ad8875076934ad35941646317b2
      https://github.com/WebKit/WebKit/commit/c9b24c1578f14ad8875076934ad35941646317b2
  Author: Antti Koivisto <antti at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/multipart/multipart-image-expected.html
    A LayoutTests/http/tests/multipart/multipart-image.html
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp

  Log Message:
  -----------
  Merge r176905 - REGRESSION (173394): Support for webcam is broken
https://bugs.webkit.org/show_bug.cgi?id=139313

Reviewed by Alexey Proskuryakov.

Source/WebKit2:

* NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::didReceiveResponseAsync):

    Don't buffer when handling multipart/x-mixed-replace. Multiple calls to didReceiveResponseAsync break assumptions.

LayoutTests:

We had no coverage for actually rendering multipart content.

* http/tests/multipart/multipart-image-expected.html: Added.
* http/tests/multipart/multipart-image.html: Added.

Canonical link: https://commits.webkit.org/154760.257@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178326 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e164e28ae2d6274787746387af8a6ae1f5ad5d42
      https://github.com/WebKit/WebKit/commit/e164e28ae2d6274787746387af8a6ae1f5ad5d42
  Author: Alexey Proskuryakov <ap at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/http/tests/multipart/multipart-image.html
    M LayoutTests/http/tests/multipart/resources/multipart.php

  Log Message:
  -----------
  Merge r176990 - REGRESSION (173394): Support for webcam is broken
https://bugs.webkit.org/show_bug.cgi?id=139313

Test by Antti Koivisto, reviewed and tweaked by Alexey Proskuryakov.

* http/tests/multipart/multipart-image-expected.html: Added.
* http/tests/multipart/multipart-image.html: Added.

* http/tests/multipart/resources/multipart.php: Multiopart boundary must start on
a new line, so make it so. In newwer OS versions, CFNetwork has a workaround that
makes invalid multipart response work, which is why the test was passing locally.

Canonical link: https://commits.webkit.org/154760.258@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178327 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 72293af8ddda5981200a33870bae3ede67ef955d
      https://github.com/WebKit/WebKit/commit/72293af8ddda5981200a33870bae3ede67ef955d
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/xmlhttprequest/resources/headers.php
    A LayoutTests/http/tests/xmlhttprequest/resources/not-ascii-status.php
    A LayoutTests/http/tests/xmlhttprequest/response-special-characters-expected.txt
    A LayoutTests/http/tests/xmlhttprequest/response-special-characters.html
    R LayoutTests/platform/efl/http/tests/security/contentSecurityPolicy/source-list-parsing-nonascii-expected.txt
    R LayoutTests/platform/gtk/http/tests/security/contentSecurityPolicy/source-list-parsing-nonascii-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/curl/CurlDownload.cpp
    M Source/WebCore/platform/network/curl/ResourceHandleManager.cpp
    M Source/WebCore/platform/network/soup/ResourceRequestSoup.cpp
    M Source/WebCore/platform/network/soup/ResourceResponseSoup.cpp

  Log Message:
  -----------
  Merge r176930 - [Soup][Curl] HTTP header values should be treated as latin1, not UTF-8
https://bugs.webkit.org/show_bug.cgi?id=128739

Patch by Youenn Fablet <youenn.fablet at crf.canon.fr> on 2014-12-07
Reviewed by Martin Robinson.
Source/WebCore:

Removed UTF-8 conversion of HTTP header values (SOUP and CURL).
Removed unnecessary UTF-8 conversion of HTTP header names (SOUP).
Changed conversion of HTTP method from UTF-8 to ASCII (SOUP and CURL).
Added explicit UTF-8 conversion of Content-Disposition header to compute download suggested filename.

Test: http/tests/xmlhttprequest/response-special-characters.html

* platform/network/curl/CurlDownload.cpp:
(WebCore::CurlDownload::headerCallback): Removed header conversion.
* platform/network/curl/ResourceHandleManager.cpp:
(WebCore::headerCallback): Ditto.
(WebCore::ResourceHandleManager::initializeHandle): Changed HTTP method conversion to ASCI.
* platform/network/soup/ResourceRequestSoup.cpp:
(WebCore::ResourceRequest::updateFromSoupMessageHeaders): Removed header conversion.
(WebCore::ResourceRequest::updateSoupMessage): Changed HTTP method conversion to ASCII.
(WebCore::ResourceRequest::toSoupMessage): Ditto.
(WebCore::ResourceRequest::updateFromSoupMessage):
* platform/network/soup/ResourceResponseSoup.cpp:
(WebCore::ResourceResponse::updateFromSoupMessageHeaders): Rmoved header conversion.
(WebCore::ResourceResponse::platformSuggestedFilename): Added explicit conversion of contentDisposition to UTF-8.

LayoutTests:

Tests that non ascii header & reason phrase values are correctly retrieved by the web application.
headers.php script sends a response that includes non ascii header value.
not-ascii-status.php sends a response that includes non ascii reason phrase.
Removed specific gtk/efl expectations as now aligned with regular expectation.

* http/tests/xmlhttprequest/resources/headers.php: Added.
* http/tests/xmlhttprequest/resources/not-ascii-status.php: Added.
* http/tests/xmlhttprequest/response-special-characters-expected.txt: Added.
* http/tests/xmlhttprequest/response-special-characters.html: Added.
* platform/efl/http/tests/security/contentSecurityPolicy/source-list-parsing-nonascii-expected.txt: Removed.
* platform/gtk/http/tests/security/contentSecurityPolicy/source-list-parsing-nonascii-expected.txt: Removed.

Canonical link: https://commits.webkit.org/154760.259@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178328 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 4eafcb1b7b49c9ab18bfd35f9712c9ba4aed22f1
      https://github.com/WebKit/WebKit/commit/4eafcb1b7b49c9ab18bfd35f9712c9ba4aed22f1
  Author: Gwang Yoon Hwang <yoon at igalia.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp

  Log Message:
  -----------
  Merge r176931 - [TextureMapper] Normalize pattern transform for pattern compositing
https://bugs.webkit.org/show_bug.cgi?id=139374

Reviewed by Martin Robinson.

In CoordGfx/TexMapGL, pattern compositing (for background image) uses
the patternTransform shader uniform. However, current implementation
miscalculates its transform matrix. It uses simple rectToRect
transformationMatrix which produces unnormalized garbage term.
This causes unexpected behavior at the fragmentation stage in some
mobile GPUs.

It should calculate its scale based on tileSize and contentSize,
and its position based on tilePhase and contentSize.

No new tests because the bug only occurs on some mobile GPUs.

* platform/graphics/texmap/TextureMapperLayer.cpp:
(WebCore::TextureMapperLayer::computePatternTransformIfNeeded):

Canonical link: https://commits.webkit.org/154760.260@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178329 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 781867de4b2b7bc15c529d19eee772b02c59be7c
      https://github.com/WebKit/WebKit/commit/781867de4b2b7bc15c529d19eee772b02c59be7c
  Author: Sebastian Dröge <sebastian at centricular.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp

  Log Message:
  -----------
  Merge r176936 - [GStreamer] Add application/x-mpegurl to the list of supported mimetypes.
https://bugs.webkit.org/show_bug.cgi?id=139343

Patch by Sebastian Dröge <sebastian at centricular.com> on 2014-12-08
Reviewed by Gustavo Noronha Silva.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::mimeTypeCache):
It's an alternative mimetype for the already supported
application/vnd.apple.mpegurl (aka HLS) and adding it
allows all streams on http://www.jwplayer.com/html5/hls/
to be played.

Canonical link: https://commits.webkit.org/154760.261@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178330 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 58bc16b59f9252861e9d44fee16af47e5ea81c6c
      https://github.com/WebKit/WebKit/commit/58bc16b59f9252861e9d44fee16af47e5ea81c6c
  Author: Sebastian Dröge <sebastian at centricular.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp

  Log Message:
  -----------
  Merge r176938 - [GStreamer] Add video/flv to the list of supported mimetypes
https://bugs.webkit.org/show_bug.cgi?id=139344

Patch by Sebastian Dröge <sebastian at centricular.com> on 2014-12-08
Reviewed by Gustavo Noronha Silva.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::mimeTypeCache):
Add video/flv additional to video/x-flv to the list of supported
mimetypes. It's used on some websites, e.g.
http://www.jwplayer.com/html5/formats/

Canonical link: https://commits.webkit.org/154760.262@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178331 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 9728d05e4e3d00057dc24a8b7c3711e084ab5a99
      https://github.com/WebKit/WebKit/commit/9728d05e4e3d00057dc24a8b7c3711e084ab5a99
  Author: Nilamdyuti Goswami <nilamdyuti at gmail.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/as.po

  Log Message:
  -----------
  Merge r176944 - [as] Updated Assamese translations of WebKitGtk+
https://bugs.webkit.org/show_bug.cgi?id=137487

Patch by Nilamdyuti Goswami <nilamdyuti at gmail.com> on 2014-12-08
Reviewed by Carlos Garcia Campos.

* as.po:

Canonical link: https://commits.webkit.org/154760.263@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178332 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 462be38336e6a9bc3ba0bfb77d7be5a73c27c18d
      https://github.com/WebKit/WebKit/commit/462be38336e6a9bc3ba0bfb77d7be5a73c27c18d
  Author: Doron Wloschowsky <doron_wloschowsky at scee.net>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/harfbuzz/HarfBuzzFaceCairo.cpp

  Log Message:
  -----------
  Merge r176945 - Webkit using Harfbuzz does not display Arabic script correctly
https://bugs.webkit.org/show_bug.cgi?id=136337

Patch by Doron Wloschowsky <doron_wloschowsky at scee.net> on 2014-12-08
Reviewed by Carlos Garcia Campos.

Using reinterpret_cast to convert hb_codepoint_t* into UChar*
doesn't work on big endian systems.

* platform/graphics/harfbuzz/HarfBuzzFaceCairo.cpp:
(WebCore::harfBuzzGetGlyph):

Canonical link: https://commits.webkit.org/154760.264@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178333 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: ee513bf70dd7ff16ee6ee52b626ed7b72e9a3364
      https://github.com/WebKit/WebKit/commit/ee513bf70dd7ff16ee6ee52b626ed7b72e9a3364
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage-expected.txt
    A LayoutTests/js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.html
    A LayoutTests/js/script-tests/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGArrayMode.h

  Log Message:
  -----------
  Merge r176972 - CFA wrongly assumes that a speculation for SlowPutArrayStorageShape disallows ArrayStorageShape arrays.
<https://webkit.org/b/139327>

Reviewed by Michael Saboff.

Source/JavaScriptCore:

The code generator and runtime slow paths expects otherwise.  This patch fixes
CFA to match the code generator's expectation.

* dfg/DFGArrayMode.h:
(JSC::DFG::ArrayMode::arrayModesThatPassFiltering):
(JSC::DFG::ArrayMode::arrayModesWithIndexingShapes):

LayoutTests:

* js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage-expected.txt: Added.
* js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.html: Added.
* js/script-tests/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.js: Added.
(foo):
(test):

Canonical link: https://commits.webkit.org/154760.265@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178334 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: ef84d8cd0c522ba6ad876f7f88152aa1fa7a9f25
      https://github.com/WebKit/WebKit/commit/ef84d8cd0c522ba6ad876f7f88152aa1fa7a9f25
  Author: Myles C. Maxfield <mmaxfield at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/box-sizing/box-sizing.html
    M LayoutTests/fast/forms/textfield-overflow-by-value-update-expected.txt
    M LayoutTests/fast/regions/cssom/client-rects-inline-complex.html
    M LayoutTests/fast/regions/overflow/overflow-region-inline-expected.html
    A LayoutTests/fast/text/small-line-height-expected.html
    A LayoutTests/fast/text/small-line-height.html
    A LayoutTests/platform/mac-mountainlion/fast/forms/search-vertical-alignment-expected.png
    M LayoutTests/platform/mac-mountainlion/fast/forms/search-vertical-alignment-expected.txt
    M LayoutTests/platform/mac/fast/box-sizing/box-sizing-expected.png
    M LayoutTests/platform/mac/fast/box-sizing/box-sizing-expected.txt
    R LayoutTests/platform/mac/fast/forms/textfield-overflow-by-value-update-expected.png
    M LayoutTests/platform/mac/fast/multicol/client-rects-expected.png
    M LayoutTests/platform/mac/fast/multicol/client-rects-expected.txt
    M LayoutTests/platform/mac/fast/multicol/client-rects-spanners-complex-expected.png
    M LayoutTests/platform/mac/fast/multicol/client-rects-spanners-complex-expected.txt
    M LayoutTests/platform/mac/fast/multicol/client-rects-spanners-expected.png
    M LayoutTests/platform/mac/fast/multicol/client-rects-spanners-expected.txt
    M LayoutTests/platform/mac/fast/multicol/layers-split-across-columns-expected.png
    M LayoutTests/platform/mac/fast/multicol/layers-split-across-columns-expected.txt
    M LayoutTests/platform/mac/fast/multicol/newmulticol/client-rects-expected.png
    M LayoutTests/platform/mac/fast/multicol/newmulticol/client-rects-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlock.cpp

  Log Message:
  -----------
  Merge r176978 - Inline elements whose parents have small line-height are laid out too low
https://bugs.webkit.org/show_bug.cgi?id=139375

Reviewed by Dave Hyatt.

Source/WebCore:

This is a port of the Blink patch at
https://src.chromium.org/viewvc/blink?revision=155253&view=revision.

When laying out inline elements, we try to align leaf children's parents'
baselines across the entire line. However, if you set line-height: 0px on a
span, the entire InlineBox which represents that span will have a height of
0, and therefore be laid out entirely on the baseline. In addition, we will
try to vertically center the leaf text in the span's InlineBox, which means
the leaf text will be vertically centered on the baseline. All the other
major browsers do not have this behavior; instead, they line up the boxes
as you would expect.

This bug led to a rendering problem on the front page of the New York Times.

Here is the ChangeLog from the Blink patch:

Fix baseline position when it is outside the element's box

Specifically, we shouldn't force the baseline to be inside the element. IE
and FF don't do this, and it's incompatible with the CSS spec:

"The baseline of an 'inline-block' is the baseline of its last line box in
the normal flow, unless it has either no in-flow line boxes or if its
'overflow' property has a computed value other than 'visible', in which case
the baseline is the bottom margin edge."
-- http://www.w3.org/TR/CSS21/visudet.html#leading

It doesn't have a special case for "baseline is outside of the element's
margin box".

Test: fast/text/small-line-height.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::baselinePosition):

LayoutTests:

Add fast/text/small-line-height.html for a simple example. In addition, update
existing tests.

* fast/forms/textfield-overflow-by-value-update-expected.txt:
* fast/regions/cssom/client-rects-inline-complex.html:
* fast/regions/overflow/overflow-region-inline-expected.html:
* fast/text/small-line-height-expected.html: Added.
* fast/text/small-line-height.html: Added.
* platform/mac/fast/box-sizing/box-sizing-expected.png:
* platform/mac/fast/box-sizing/box-sizing-expected.txt:
* platform/mac/fast/forms/search-vertical-alignment-expected.png:
* platform/mac/fast/forms/search-vertical-alignment-expected.txt:
* platform/mac/fast/forms/textfield-overflow-by-value-update-expected.png: Removed.
* platform/mac/fast/multicol/client-rects-expected.png:
* platform/mac/fast/multicol/client-rects-expected.txt:
* platform/mac/fast/multicol/client-rects-spanners-complex-expected.png:
* platform/mac/fast/multicol/client-rects-spanners-complex-expected.txt:
* platform/mac/fast/multicol/client-rects-spanners-expected.png:
* platform/mac/fast/multicol/client-rects-spanners-expected.txt:
* platform/mac/fast/multicol/layers-split-across-columns-expected.png:
* platform/mac/fast/multicol/layers-split-across-columns-expected.txt:
* platform/mac/fast/multicol/newmulticol/client-rects-expected.png:
* platform/mac/fast/multicol/newmulticol/client-rects-expected.txt:

Canonical link: https://commits.webkit.org/154760.266@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178335 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: cef7a6edc7e9821352a5e45ce39c909f80241a1d
      https://github.com/WebKit/WebKit/commit/cef7a6edc7e9821352a5e45ce39c909f80241a1d
  Author: Matthew Mirman <mmirman at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/jit/JITOperations.cpp
    M Source/JavaScriptCore/jit/Repatch.cpp
    M Source/JavaScriptCore/jit/Repatch.h
    A Source/JavaScriptCore/tests/stress/put-by-id-strict-build-list-order.js

  Log Message:
  -----------
  Merge r177083 - Fixes operationPutByIds such that they check that the put didn't
change the structure of the object who's property access is being
cached.
https://bugs.webkit.org/show_bug.cgi?id=139196

Reviewed by Filip Pizlo.

* jit/JITOperations.cpp:
(JSC::operationGetByIdOptimize): changed get to getPropertySlot
(JSC::operationPutByIdStrictBuildList): saved the structure before the put.
(JSC::operationPutByIdNonStrictBuildList): ditto.
(JSC::operationPutByIdDirectStrictBuildList): ditto.
(JSC::operationPutByIdDirectNonStrictBuildList): ditto.
* jit/Repatch.cpp:
(JSC::tryCachePutByID): fixed structure() to use the existant vm.
(JSC::tryBuildPutByIdList): Added a check that the old structure's id
is the same as the new.
(JSC::buildPutByIdList): Added an argument
* jit/Repatch.h:
(JSC::buildPutByIdList): Added an argument
* tests/stress/put-by-id-strict-build-list-order.js: Added.

Canonical link: https://commits.webkit.org/154760.267@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178336 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 74c8dbe48da7a4573806802c68d7c4cfb4758629
      https://github.com/WebKit/WebKit/commit/74c8dbe48da7a4573806802c68d7c4cfb4758629
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/mediacontrols/mediaControlsBase.js
    M Source/WebCore/Modules/mediacontrols/mediaControlsGtk.js

  Log Message:
  -----------
  Merge r177015 - [Media][GTK][EFL] Reduce style updates (painting) in controls
https://bugs.webkit.org/show_bug.cgi?id=137773

Reviewed by Carlos Garcia Campos.

Don't update media controls if they are not visible, and
initialize slider to a zero value.

* Modules/mediacontrols/mediaControlsBase.js:
(Controller.prototype.createControls):
(Controller.prototype.handleDurationChange):
(Controller.prototype.updateProgress):
(Controller.prototype.updateTime):
* Modules/mediacontrols/mediaControlsGtk.js:
(ControllerGtk.prototype.updateTime):

Canonical link: https://commits.webkit.org/154760.268@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178337 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 8b2fd64890c000b1838f795d91df3c45eaa0cf09
      https://github.com/WebKit/WebKit/commit/8b2fd64890c000b1838f795d91df3c45eaa0cf09
  Author: Ting-Wei Lan <lantw44 at gmail.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/PlatformGTK.cmake

  Log Message:
  -----------
  Merge r177016 - [GTK] LDFLAGS is ignored when running g-ir-scanner
https://bugs.webkit.org/show_bug.cgi?id=138832

Patch by Ting-Wei Lan <lantw44 at gmail.com> on 2014-12-09
Reviewed by Carlos Garcia Campos.

GTK+ requires libintl on FreeBSD because there is no gettext
implementation in FreeBSD libc. In order to link to libintl, which is
not located in the default search path of the linker, we need to add
the required path via the linker command line. However, LDFLAGS is
ignored when running g-ir-scanner starting from r167873, so we have
to manually pick required flags from CMAKE_SHARED_LINKER_FLAGS and
put them in correct order to prevent g-ir-scanner from linking to
the installed version of libraries.

* PlatformGTK.cmake:

Canonical link: https://commits.webkit.org/154760.269@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178338 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 704d63f0a4fbf0dd80d2d64e190b97049c2198d8
      https://github.com/WebKit/WebKit/commit/704d63f0a4fbf0dd80d2d64e190b97049c2198d8
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/gobject/ConvertToUTF8String.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/DOMNodeTest.cpp

  Log Message:
  -----------
  Merge r177019 - convertToUTF8String converts null string to empty string
https://bugs.webkit.org/show_bug.cgi?id=133904

Reviewed by Carlos Garcia Campos.

Source/WebCore:

Test added to Tools/TestWebKitAPI/Tests/WebKit2Gtk/DOMNodeTest.cpp

Return 0 if the string is null.

* bindings/gobject/ConvertToUTF8String.cpp:
(convertToUTF8String):

Tools:

Test that trying to get the value of a non-existent attribute
returns 0 instead of an empty string.

* TestWebKitAPI/Tests/WebKit2Gtk/DOMNodeTest.cpp:
(WebKitDOMNodeTest::testInsertion):

Canonical link: https://commits.webkit.org/154760.270@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178339 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 41335a6e05836e3fed5033b07a92d5f7c7331785
      https://github.com/WebKit/WebKit/commit/41335a6e05836e3fed5033b07a92d5f7c7331785
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/ThreadingPthreads.cpp

  Log Message:
  -----------
  Merge r177023 - Undefined Symbol build error "_objc_registerThreadWithCollector" when building WebKit GTK Mac OS X on Snow Leopard
https://bugs.webkit.org/show_bug.cgi?id=58737

Reviewed by Darin Adler.

Replace OS(MAC_OS_X) with PLATFORM(MAC) to prevent using
osx-specific code in WebKitGTK+ builds.

* wtf/ThreadingPthreads.cpp:
(WTF::initializeCurrentThreadInternal):

Canonical link: https://commits.webkit.org/154760.271@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178340 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 4d15147090860dee965dd9223f47af8fc23414bf
      https://github.com/WebKit/WebKit/commit/4d15147090860dee965dd9223f47af8fc23414bf
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/notifications/legacy/notification-request-permission-then-navigate-expected.txt
    A LayoutTests/http/tests/notifications/legacy/notification-request-permission-then-navigate.html
    A LayoutTests/http/tests/notifications/legacy/resources/notify-opener-done.html
    A LayoutTests/http/tests/notifications/legacy/resources/request-permission-then-navigate.html
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/WebProcess/Notifications/NotificationPermissionRequestManager.cpp

  Log Message:
  -----------
  Merge r177033 - [WK2] Crash when answering notification permission request after navigating
https://bugs.webkit.org/show_bug.cgi?id=139429
<rdar://problem/18921122>

Reviewed by Andreas Kling.

Source/WebKit2:

When requesting a notification permission, navigating away and then
answering the permission, WebKit2 would crash. This is because upon
navigating, the request is cancelled and removed from the HashMaps
in NotificationPermissionRequestManager. When
didReceiveNotificationPermissionDecision() is later called, it would
look for the request identifier in m_idToOriginMap HashMap. As the
request was cancelled, HashMap::take() call would return null for
the SecurityOrigin*. This security origin pointer is then removed
from m_originToIDMap, but the code was failing to do a null check
first. Calling HashMap::remove(nullptr) would then crash.

This patch adds the missing null check and a layout test to cover
this case.

Test: http/tests/notifications/legacy/notification-request-permission-then-navigate.html

* WebProcess/Notifications/NotificationPermissionRequestManager.cpp:
(WebKit::NotificationPermissionRequestManager::didReceiveNotificationPermissionDecision):

LayoutTests:

Add layout test to cover the case where the notification permission is
requesting before navigating to a new URL and answered after the page
is navigated away.

* http/tests/notifications/legacy/notification-request-permission-then-navigate-expected.txt: Added.
* http/tests/notifications/legacy/notification-request-permission-then-navigate.html: Added.
* http/tests/notifications/legacy/resources/notify-opener-done.html: Added.
* http/tests/notifications/legacy/resources/request-permission-then-navigate.html: Added.

Canonical link: https://commits.webkit.org/154760.272@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178341 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: ae0949bf50f41b6a8a0c4862e18a9b8897f0cde6
      https://github.com/WebKit/WebKit/commit/ae0949bf50f41b6a8a0c4862e18a9b8897f0cde6
  Author: Bem Jones-Bey <bjonesbe at adobe.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlockFlow.cpp

  Log Message:
  -----------
  Merge r177049 - REGRESSION(r155906): Page content disappears on Tuaw article after loading
https://bugs.webkit.org/show_bug.cgi?id=138100

Reviewed by Simon Fraser.

.:

DRT causes an extra paint which makes it impossible to test this with
an automated test.

* ManualTests/float-layer-not-painting.html: Added.

Source/WebCore:

Test: ManualTests/float-layer-not-painting.html

* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::insertFloatingObject): If a layout happens,
it can change whether the float's renderer has a self painting layer.
So in that case, we need to update the flag on the FloatingObject
instance for that float.

Canonical link: https://commits.webkit.org/154760.273@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178342 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: d2923299e54c6738aac3e44556dc2f3f24c9465c
      https://github.com/WebKit/WebKit/commit/d2923299e54c6738aac3e44556dc2f3f24c9465c
  Author: Myles C. Maxfield <mmaxfield at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/events/scroll-to-anchor-vertical-lr-writing-mode-expected.html
    A LayoutTests/fast/events/scroll-to-anchor-vertical-lr-writing-mode.html
    A LayoutTests/fast/events/scroll-to-anchor-vertical-writing-mode-contained-2-expected.html
    A LayoutTests/fast/events/scroll-to-anchor-vertical-writing-mode-contained-2.html
    A LayoutTests/fast/events/scroll-to-anchor-vertical-writing-mode-contained-expected.html
    A LayoutTests/fast/events/scroll-to-anchor-vertical-writing-mode-contained.html
    A LayoutTests/fast/events/scroll-to-anchor-vertical-writing-mode-expected.html
    A LayoutTests/fast/events/scroll-to-anchor-vertical-writing-mode.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/FrameView.cpp
    M Source/WebCore/rendering/ScrollBehavior.cpp
    M Source/WebCore/rendering/ScrollBehavior.h

  Log Message:
  -----------
  Merge r177050 - Scrolling to anchor tags does nothing in vertical-rl writing mode
https://bugs.webkit.org/show_bug.cgi?id=137838

Reviewed by David Hyatt.

Source/WebCore:

Scroll to a particular tag, and make sure the viewport is rendered as expected.

Tests: fast/events/scroll-to-anchor-vertical-lr-writing-mode.html
       fast/events/scroll-to-anchor-vertical-writing-mode-contained-2.html
       fast/events/scroll-to-anchor-vertical-writing-mode-contained.html
       fast/events/scroll-to-anchor-vertical-writing-mode.html

* page/FrameView.cpp:
(WebCore::FrameView::scrollToAnchor):
* rendering/ScrollBehavior.cpp:
* rendering/ScrollBehavior.h:

LayoutTests:

When we specify the behavior regarding scrolling to anchor tags, we previously had
only described behavior regarding horizontal text. When we have vertical text, we
need to switch the horizontal and vertical scrolling policies.

* fast/events/scroll-to-anchor-vertical-lr-writing-mode-expected.html: Added.
* fast/events/scroll-to-anchor-vertical-lr-writing-mode.html: Added.
* fast/events/scroll-to-anchor-vertical-writing-mode-contained-2-expected.html: Added.
* fast/events/scroll-to-anchor-vertical-writing-mode-contained-2.html: Added.
* fast/events/scroll-to-anchor-vertical-writing-mode-contained-expected.html: Added.
* fast/events/scroll-to-anchor-vertical-writing-mode-contained.html: Added.
* fast/events/scroll-to-anchor-vertical-writing-mode-expected.html: Added.
* fast/events/scroll-to-anchor-vertical-writing-mode.html: Added.

Canonical link: https://commits.webkit.org/154760.274@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178343 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 91b897e6cc5fcb0a967b4e719aea3c558261aab5
      https://github.com/WebKit/WebKit/commit/91b897e6cc5fcb0a967b4e719aea3c558261aab5
  Author: Antti Koivisto <antti at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/css/calc-binary-operation-crash-expected.txt
    A LayoutTests/fast/css/calc-binary-operation-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSCalculationValue.cpp

  Log Message:
  -----------
  Merge r177089 - Crash when creating CSSCalcBinaryOperation
https://bugs.webkit.org/show_bug.cgi?id=134886
rdar://problem/17663561

Reviewed by Chris Dumez.

Source/WebCore:

Test: fast/css/calc-binary-operation-crash.html

* css/CSSCalculationValue.cpp:
(WebCore::determineCategory):

Ensure that both axis are within the addSubtractResult table.
Remove unneeded CalcOther test. The call site guarantees it doesn't happen and the normal cases would handle it anyway.
Also strengthen some asserts.

LayoutTests:

* fast/css/calc-binary-operation-crash-expected.txt: Added.
* fast/css/calc-binary-operation-crash.html: Added.

Canonical link: https://commits.webkit.org/154760.275@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178344 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 427e985a7e7b22d315e700dac56b91d643c866ef
      https://github.com/WebKit/WebKit/commit/427e985a7e7b22d315e700dac56b91d643c866ef
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/forms/input-maxlength-inserting-in-middle-expected.txt
    A LayoutTests/fast/forms/input-maxlength-inserting-in-middle.html
    A LayoutTests/fast/forms/input-maxlength-paste-clusters-in-middle-expected.txt
    A LayoutTests/fast/forms/input-maxlength-paste-clusters-in-middle.html
    A LayoutTests/fast/forms/input-maxlength-paste-in-middle-expected.txt
    A LayoutTests/fast/forms/input-maxlength-paste-in-middle.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/TextFieldInputType.cpp

  Log Message:
  -----------
  Merge r177098 - REGRESSION(r164329): Input fields are not honoring the maxlength attribute
https://bugs.webkit.org/show_bug.cgi?id=139447

Reviewed by Benjamin Poulain.

Source/WebCore:

The bug was caused by String::substring being called with the selection's end offset
in the second argument instead of the selection's length in handleBeforeTextInsertedEvent.

Fixed the bug by passing the right second argument to String::substring.

Test: fast/forms/input-maxlength-inserting-in-middle.html

* html/TextFieldInputType.cpp:
(WebCore::TextFieldInputType::handleBeforeTextInsertedEvent):

LayoutTests:

Added regression tests.

* fast/forms/input-maxlength-inserting-in-middle-expected.txt: Added.
* fast/forms/input-maxlength-inserting-in-middle.html: Added.
* fast/forms/input-maxlength-paste-clusters-in-middle-expected.txt: Added.
* fast/forms/input-maxlength-paste-clusters-in-middle.html: Added.
* fast/forms/input-maxlength-paste-in-middle-expected.txt: Added.
* fast/forms/input-maxlength-paste-in-middle.html: Added.

Canonical link: https://commits.webkit.org/154760.276@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178345 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 2f10def7d34a6bb4de1f9ff00dcf4368fefe3f8e
      https://github.com/WebKit/WebKit/commit/2f10def7d34a6bb4de1f9ff00dcf4368fefe3f8e
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/repaint/implicitly-positioned-block-repaint-complex-line-layout-expected.txt
    A LayoutTests/fast/repaint/implicitly-positioned-block-repaint-complex-line-layout.html
    A LayoutTests/fast/repaint/implicitly-positioned-block-repaint-simple-line-layout-expected.txt
    A LayoutTests/fast/repaint/implicitly-positioned-block-repaint-simple-line-layout.html
    M LayoutTests/platform/mac/fast/line-grid/line-align-right-edges-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlockFlow.cpp
    M Source/WebCore/rendering/RenderBlockFlow.h
    M Source/WebCore/rendering/RenderBlockLineLayout.cpp

  Log Message:
  -----------
  Merge r177128 - Continuously repainting large parts of Huffington Post.
https://bugs.webkit.org/show_bug.cgi?id=139468

Reviewed by Antti Koivisto.

This patch eliminates redundant repaint requests for inlines when neither the parent
block flow nor any of the inline children are dirty.
Previously,
1. simple line layout always recalculated inline content positions regardless of whether
the content needed relayout at all; as a result, it always triggered full repaint.
2. inline tree layout ignored the needslayout flag on the last line and treated it dirty
(unless it broke cleanly (<div>foo<br></div>)).
This was an ancient workaround for an editing/insert use case, but it seems not to be the case anymore.

Source/WebCore:

Tests: fast/repaint/implicitly-positioned-block-repaint-complex-line-layout.html
       fast/repaint/implicitly-positioned-block-repaint-simple-line-layout.html

* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::layoutInlineChildren):
(WebCore::RenderBlockFlow::layoutSimpleLines): Check if we need to trigger layout at all.
* rendering/RenderBlockFlow.h:
* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlockFlow::determineStartPosition): Remove the last line dirty hack. If it
happens to introduce regression, we should fix it at the caller site to make the line dirty.

LayoutTests:

* fast/repaint/implicitly-positioned-block-repaint-complex-line-layout-expected.txt: Added.
* fast/repaint/implicitly-positioned-block-repaint-complex-line-layout.html: Added.
* fast/repaint/implicitly-positioned-block-repaint-simple-line-layout-expected.txt: Added.
* fast/repaint/implicitly-positioned-block-repaint-simple-line-layout.html: Added.
* platform/mac/fast/line-grid/line-align-right-edges-expected.txt:

Canonical link: https://commits.webkit.org/154760.277@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178346 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: ee7d3ac023c2334711d5591e543f59e9e1875aa5
      https://github.com/WebKit/WebKit/commit/ee7d3ac023c2334711d5591e543f59e9e1875aa5
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/images/animated-gif-body-delegated-background-image-expected.txt
    A LayoutTests/fast/images/animated-gif-body-delegated-background-image.html
    A LayoutTests/fast/images/animated-gif-body-outside-viewport-expected.txt
    A LayoutTests/fast/images/animated-gif-body-outside-viewport.html
    A LayoutTests/fast/images/animated-gif-html-background-image-expected.txt
    A LayoutTests/fast/images/animated-gif-html-background-image.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/testing/Internals.cpp
    M Source/WebCore/testing/Internals.h
    M Source/WebCore/testing/Internals.idl

  Log Message:
  -----------
  Merge r177135 - http://omfgdogs.info/ only animates when you resize the window
https://bugs.webkit.org/show_bug.cgi?id=139435
<rdar://problem/19190493>

Reviewed by Simon Fraser.

Source/WebCore:

After r163928, we would fail to animate a gif if:
- it is used as a background image of a 0-height html element
- it is used as a background image of a 0-height body element whose
  background is delegated to the root (because the root has no
  background).

This is because in such cases, shouldRepaintForImageAnimation()
should use the background rect instead of the renderer's overflow
rect to determine if the image is inside the viewport. Both cases
are addressed in this patch.

Tests: fast/images/animated-gif-body-delegated-background-image.html
       fast/images/animated-gif-body-outside-viewport.html
       fast/images/animated-gif-html-background-image.html

* rendering/RenderElement.cpp:
(WebCore::shouldRepaintForImageAnimation):
* testing/Internals.cpp:
(WebCore::Internals::hasPausedImageAnimations):
* testing/Internals.h:
* testing/Internals.idl:

LayoutTests:

Add layout tests to make sure a gif image is still animated if:
- It is used as a background image of a 0-height html element
- It is used as a background image of a 0-height body element that
  is delegated to the root (because the root has no background)

Also add a layout test to make sure we still stop the gif animation
if it is used as background image of a body that is outside the
viewport.

* fast/images/animated-gif-body-delegated-background-image-expected.txt: Added.
* fast/images/animated-gif-body-delegated-background-image.html: Added.
* fast/images/animated-gif-body-outside-viewport-expected.txt: Added.
* fast/images/animated-gif-body-outside-viewport.html: Added.
* fast/images/animated-gif-html-background-image-expected.txt: Added.
* fast/images/animated-gif-html-background-image.html: Added.

Canonical link: https://commits.webkit.org/154760.278@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178347 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 857f149a093035b5ff36f259ffc8b58c5b89fc11
      https://github.com/WebKit/WebKit/commit/857f149a093035b5ff36f259ffc8b58c5b89fc11
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp
    M Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.h

  Log Message:
  -----------
  Merge r177144 - [GTK] Timers might never be fired during animations
https://bugs.webkit.org/show_bug.cgi?id=139062

Reviewed by Martin Robinson.

This can happen in old/slow machines where the time to render
layers might take more than 0.016. Since the layer flush timer is
using a higher priority than WebCore timers, when scheduling all
(or several) layer flushes immediately, no other sources with
lower priority are dispatched in the main loop. We could detect if
we are scheduling layer flushes immediately for too long (100ms)
and schedule the next flush after a delay to ensure other sources
with lower priority have a chance to be dispatched. Also use a
lower priority, GDK_PRIORITY_EVENTS is too high, so we use
GDK_PRIORITY_REDRAW - 1 to ensure it's higher than WebCore timers.

* WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp:
(WebKit::LayerTreeHostGtk::LayerTreeHostGtk): Rename
m_lastFlushTime as m_lastImmediateFlushTime.
(WebKit::LayerTreeHostGtk::layerFlushTimerFired): Save the
fireTime before calling flushAndRenderLayers() and compute the
next flush delay based on the elapsed time using monotonically
increasing time instead of current time. Use the target delay
as next flush delay if we have scheduled flushes immediately for
more than 100ms.
(WebKit::LayerTreeHostGtk::flushAndRenderLayers): Do not save the
layer flush time here, it's done in layerFlushTimerFired() so that
we don't need to keep it as a member.
(WebKit::LayerTreeHostGtk::scheduleLayerFlush): Use global
layerFlushTimerPriority.
* WebProcess/WebPage/gtk/LayerTreeHostGtk.h:

Canonical link: https://commits.webkit.org/154760.279@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178348 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 28da89d786f460fa210d842b2fa323ebd8ff6f7d
      https://github.com/WebKit/WebKit/commit/28da89d786f460fa210d842b2fa323ebd8ff6f7d
  Author: Alexey Proskuryakov <ap at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/editing/Editor.cpp
    M Source/WebCore/loader/EmptyClients.h
    M Source/WebCore/loader/FrameLoader.cpp
    M Source/WebCore/page/EditorClient.h
    M Source/WebKit/mac/ChangeLog
    M Source/WebKit/mac/WebCoreSupport/WebEditorClient.h
    M Source/WebKit/mac/WebCoreSupport/WebEditorClient.mm
    M Source/WebKit/win/ChangeLog
    M Source/WebKit/win/WebCoreSupport/WebEditorClient.cpp
    M Source/WebKit/win/WebCoreSupport/WebEditorClient.h
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/API/mac/WKView.mm
    M Source/WebKit2/UIProcess/WebPageProxy.cpp
    M Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.cpp
    M Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h
    M Source/WebKit2/WebProcess/WebPage/WebPage.cpp
    M Source/WebKit2/WebProcess/WebPage/WebPage.h

  Log Message:
  -----------
  Merge r177152 - REGRESSION (Async Text Input): Text input method state is not reset when reloading a page
https://bugs.webkit.org/show_bug.cgi?id=139504
rdar://problem/19034674

Reviewed by Enrica Casucci.

Source/WebCore:

Explicitly notify EditorClient when a composition is voluntarily canceled by WebCore.
These are almost certainly not all the places where this happens, but this fixes the bug,
and lays the groundwork for using this new client call instead of didChangeSelection
hacks.

* editing/Editor.cpp:
(WebCore::Editor::clear):
(WebCore::Editor::cancelComposition):
* loader/EmptyClients.h:
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::willTransitionToCommitted):
* page/EditorClient.h:

Source/WebKit/mac:

Stub out new client calls, this patch does not attempt to make any changes on WebKit1.

* WebCoreSupport/WebEditorClient.h:
* WebCoreSupport/WebEditorClient.mm:
(WebEditorClient::discardedComposition):

Source/WebKit/win:

Stub out new client calls, this patch doesn't attempt to make any changes on Windows.

* WebCoreSupport/WebEditorClient.cpp:
(WebEditorClient::discardedComposition):
* WebCoreSupport/WebEditorClient.h:

Source/WebKit2:

WebKit2 used to look at EditorState changes and guess when to cancel a composition.
This was quite unreliable, and needlessly complicated - WebCore knows when it decides
to destroy a composition, so it now explicitly notifies the clients.

* UIProcess/API/mac/WKView.mm: (-[WKView _processDidExit]): Address crashing case too.
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::resetStateAfterProcessExited):
* WebProcess/WebCoreSupport/WebEditorClient.cpp:
(WebKit::WebEditorClient::discardedComposition):
* WebProcess/WebCoreSupport/WebEditorClient.h:
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::didChangeSelection):
(WebKit::WebPage::discardedComposition):
* WebProcess/WebPage/WebPage.h:

Canonical link: https://commits.webkit.org/154760.280@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178350 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e4b5df0778d89ef6481edfb94daaceab930ef2ab
      https://github.com/WebKit/WebKit/commit/e4b5df0778d89ef6481edfb94daaceab930ef2ab
  Author: Dean Jackson <dino at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/canvas/webgl/angle-instanced-arrays-out-of-bounds-expected.txt
    A LayoutTests/fast/canvas/webgl/angle-instanced-arrays-out-of-bounds.html
    A LayoutTests/fast/canvas/webgl/resources/out-of-bounds-test.js
    A LayoutTests/platform/mac-mountainlion/fast/canvas/webgl/angle-instanced-arrays-out-of-bounds-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/canvas/WebGLRenderingContext.cpp
    M Source/WebCore/html/canvas/WebGLRenderingContext.h

  Log Message:
  -----------
  Merge r177165 - InstancedArray crashes attempting to draw out of bounds
https://bugs.webkit.org/show_bug.cgi?id=139521
Source/WebCore:

Reviewed by Simon Fraser.

We were not doing index validation correctly for instancing.

Test: fast/canvas/webgl/angle-instanced-arrays-out-of-bounds.html

* html/canvas/WebGLRenderingContext.cpp:
(WebCore::WebGLRenderingContext::validateVertexAttributes): We need to check
the number of instances drawn against the amount of instance data that has
been provided, taking into account the number of repeats (the divisor).
(WebCore::WebGLRenderingContext::drawArrays): Added some whitespace to make it more clear.
(WebCore::WebGLRenderingContext::validateDrawElements): This needs to take a primcount
parameter so that it can correctly validate the call (when used from drawElementsInstanced).
(WebCore::WebGLRenderingContext::drawElements): New signature to validate.
(WebCore::WebGLRenderingContext::drawArraysInstanced): Rearrange this a bit. The
primcount validation is already being done by the validateDrawArrays call. Also, there
was a bogus UNUSED_PARAM hanging around.
(WebCore::WebGLRenderingContext::drawElementsInstanced): Similar rearrangement. Use
the primcount parameter.
* html/canvas/WebGLRenderingContext.h:

LayoutTests:

<rdar://problem/17540398>

Reviewed by Simon Fraser.

This is a copy of the official webgl/1.0.3 test.

* platform/mac-mountainlion/fast/canvas/webgl/angle-instanced-arrays-out-of-bounds-expected.txt: Added. This extension is not available on Mountain Lion.
* fast/canvas/webgl/angle-instanced-arrays-out-of-bounds-expected.txt: Added.
* fast/canvas/webgl/angle-instanced-arrays-out-of-bounds.html: Added.
* fast/canvas/webgl/resources/out-of-bounds-test.js: Added.
(OutOfBoundsTest):

Canonical link: https://commits.webkit.org/154760.281@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178351 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 8745b09d051caacb78c6d5e8575188b09f3784b1
      https://github.com/WebKit/WebKit/commit/8745b09d051caacb78c6d5e8575188b09f3784b1
  Author: Alexey Proskuryakov <ap at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/FormData.h

  Log Message:
  -----------
  Merge r177188 - Initialize m_ownsGeneratedFile when decoding a FormDataElement
https://bugs.webkit.org/show_bug.cgi?id=139566

Reviewed by Tim Horton.

No tests, because it's random, and I couldn't reproduce an assertion failure in
controlled circumstances.

* platform/network/FormData.h: (WebCore::FormDataElement::decode): A newly created
FormDataElement by definition doesn't own the file.

Canonical link: https://commits.webkit.org/154760.282@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178352 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: ab29ff78f39a9fc9285077d4a9d875ce78b2a572
      https://github.com/WebKit/WebKit/commit/ab29ff78f39a9fc9285077d4a9d875ce78b2a572
  Author: Matthew Mirman <mmirman at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/JSArray.cpp
    A Source/JavaScriptCore/tests/stress/sparse_splice.js

  Log Message:
  -----------
  Merge r177245 - shiftCountWithArrayStorage should exit to slow path if the object has a sparse map.
https://bugs.webkit.org/show_bug.cgi?id=139598
<rdar://problem/18779367>

Reviewed by Filip Pizlo.

* runtime/JSArray.cpp:
(JSC::JSArray::shiftCountWithArrayStorage): Added check for object having a sparse map.
* tests/stress/sparse_splice.js: Added.

Canonical link: https://commits.webkit.org/154760.283@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178353 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e019f5ed6b21dfb65f9247254102ff7c7384e8fb
      https://github.com/WebKit/WebKit/commit/e019f5ed6b21dfb65f9247254102ff7c7384e8fb
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/dom/dom-parse-close-form-expected.txt
    A LayoutTests/fast/dom/dom-parse-close-form.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/parser/HTMLConstructionSite.cpp
    M Source/WebCore/html/parser/HTMLConstructionSite.h

  Log Message:
  -----------
  Merge r177263 - REGRESSION(r160182): Fragment parser doesn't close a form element with a close tag
https://bugs.webkit.org/show_bug.cgi?id=139561

Reviewed by Darin Adler.

Source/WebCore:

The bug was caused by us not setting the form pointer in insertHTMLFormElement.
Since we already avoid associating a form inside HTMLConstructionSite::createHTMLElement,
we didn't need this code at all.

Fixed the bug by partially reverting r160182.

Test: fast/dom/dom-parse-close-form.html

* html/parser/HTMLConstructionSite.cpp:
(WebCore::HTMLConstructionSite::insertHTMLFormElement):
(WebCore::HTMLConstructionSite::insideTemplateElement): Deleted.
* html/parser/HTMLConstructionSite.h:

LayoutTests:

Added a regression test.

* fast/dom/dom-parse-close-form-expected.txt: Added.
* fast/dom/dom-parse-close-form.html: Added.

Canonical link: https://commits.webkit.org/154760.284@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178354 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 07586c863b90e708706d2e35032e17503a9cf48c
      https://github.com/WebKit/WebKit/commit/07586c863b90e708706d2e35032e17503a9cf48c
  Author: Xavier Claessens <xavier.claessens at collabora.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp

  Log Message:
  -----------
  Merge r177279 - [GStreamer] the webkitwebsrc element can stale
https://bugs.webkit.org/show_bug.cgi?id=138425

Patch by Xavier Claessens <xavier.claessens at collabora.com> on 2014-12-15
Reviewed by Philippe Normand.

* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(removeTimeoutSources):
(webKitWebSrcStart):
(webKitWebSrcChangeState):

Canonical link: https://commits.webkit.org/154760.285@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178355 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e1eb78840e9485d10a64663ed459312e74f70d43
      https://github.com/WebKit/WebKit/commit/e1eb78840e9485d10a64663ed459312e74f70d43
  Author: Simon Fraser <simon.fraser at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSComputedStyleDeclaration.cpp
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/page/FrameView.cpp
    M Source/WebCore/page/animation/AnimationController.cpp
    M Source/WebCore/page/animation/AnimationController.h
    M Source/WebCore/page/animation/AnimationControllerPrivate.h

  Log Message:
  -----------
  Merge r177302 - REGRESSION (r168217): Images are cropped out during animation at jetblue.com
https://bugs.webkit.org/show_bug.cgi?id=136410
rdar://problem/18188533

Reviewed by Dean Jackson.

During GraphicsLayer flushing, for tiled layers we can compute a visible rect using
the current state of an animation, which is obtained via the AnimationController.
If that animation was running in a subframe, AnimationController could use a stale
beginAnimationUpdateTime since no-one called its beginAnimationUpdate(). That
resulted in an incorrect computation of the visible rect, resulting in missing tiles.

There are two parts to this fix. First, add an assertion that beginAnimationUpdateTime()
is being called inside an animation update block. This required moving m_beginAnimationUpdateCount
into AnimationControllerPrivate, and changes to endAnimationUpdate().

The second is adding a AnimationUpdateBlock to getAnimatedStyleForRenderer(), which
can be called outside of style resolution. We also need some in other API functions.

Testing revealed that layout can call via layoutOverflowRectForPropagation(), suggesting
that we should have an animation batch inside FrameView::layout(). In addition, a single
resolveStyle/layout should use the same animationBeginTime, so we add a batch to
updateLayoutAndStyleIfNeededRecursive().

No test because it's timing-dependent. Existing tests exercise the new assertion.

* css/CSSComputedStyleDeclaration.cpp:
(WebCore::computeRenderStyleForProperty):
* page/FrameView.cpp:
(WebCore::FrameView::layout):
(WebCore::FrameView::updateLayoutAndStyleIfNeededRecursive):
* page/animation/AnimationController.cpp:
(WebCore::AnimationPrivateUpdateBlock::AnimationPrivateUpdateBlock):
(WebCore::AnimationPrivateUpdateBlock::~AnimationPrivateUpdateBlock):
(WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
(WebCore::AnimationControllerPrivate::animationTimerFired):
(WebCore::AnimationControllerPrivate::suspendAnimationsForDocument):
(WebCore::AnimationControllerPrivate::resumeAnimationsForDocument):
(WebCore::AnimationControllerPrivate::beginAnimationUpdateTime):
(WebCore::AnimationControllerPrivate::beginAnimationUpdate):
(WebCore::AnimationControllerPrivate::endAnimationUpdate):
(WebCore::AnimationControllerPrivate::getAnimatedStyleForRenderer):
(WebCore::AnimationController::AnimationController):
(WebCore::AnimationController::notifyAnimationStarted):
(WebCore::AnimationController::pauseAnimationAtTime):
(WebCore::AnimationController::pauseTransitionAtTime):
(WebCore::AnimationController::resumeAnimationsForDocument):
(WebCore::AnimationController::startAnimationsIfNotSuspended):
(WebCore::AnimationController::beginAnimationUpdate):
(WebCore::AnimationController::endAnimationUpdate):
* page/animation/AnimationController.h:
* page/animation/AnimationControllerPrivate.h:

Canonical link: https://commits.webkit.org/154760.286@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178356 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f99ada86110a82b16b307d664d121fe9eb90af2c
      https://github.com/WebKit/WebKit/commit/f99ada86110a82b16b307d664d121fe9eb90af2c
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/images/animated-gif-webkit-transform-expected.txt
    A LayoutTests/fast/images/animated-gif-webkit-transform.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp

  Log Message:
  -----------
  Merge r177360 - REGRESSION (r163928): Animated GIFs are not resumed when translated into view using -webkit-transform
https://bugs.webkit.org/show_bug.cgi?id=139672
<rdar://problem/19260797>

Reviewed by Antti Koivisto.

Source/WebCore:

After r163928, animated GIFs were not resumed when translated into view
using '-webkit-transform' CSS property.

This broke animated gifs on the mobile version of weibo.com (which is
one of the most popular blogging sites in China) on iPhone. e.g.
http://m.weibo.cn/page/tpl?containerid=1005052150182731_-_WEIBO_SECOND_PROFILE_WEIBO&itemid=&title=全部微博

This patch calls FrameView::resumeVisibleImageAnimationsIncludingSubframes()
after style recalc so that we resume animated images if they become visible
after the style has changed. Doing so after layout wouldn't work because
no layout happens in this case.

Test: fast/images/animated-gif-webkit-transform.html

* dom/Document.cpp:
(WebCore::Document::recalcStyle):

LayoutTests:

Add a layout test to verity that animated images are properly paused /
resumed when translated in and out of view using '-webkit-transform'
CSS property.

* fast/images/animated-gif-webkit-transform-expected.txt: Added.
* fast/images/animated-gif-webkit-transform.html: Added.

Canonical link: https://commits.webkit.org/154760.287@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178357 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e765ab03e385fcdeb4d06c14b93a1ec74b0fc705
      https://github.com/WebKit/WebKit/commit/e765ab03e385fcdeb4d06c14b93a1ec74b0fc705
  Author: Joseph Pecoraro <pecoraro at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/inspector/InspectorDOMAgent.cpp

  Log Message:
  -----------
  Merge r177518 - Web Inspector: ASSERT seen closing/opening multiple inspectors
https://bugs.webkit.org/show_bug.cgi?id=139783

Patch by Joseph Pecoraro <pecoraro at apple.com> on 2014-12-18
Reviewed by Timothy Hatcher.

* inspector/InspectorDOMAgent.cpp:
(WebCore::InspectorDOMAgent::nodeForObjectId):

Canonical link: https://commits.webkit.org/154760.288@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178358 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 93d75c3d22b08656eff403be0c9821e968eaa33c
      https://github.com/WebKit/WebKit/commit/93d75c3d22b08656eff403be0c9821e968eaa33c
  Author: Chris Fleizach <cfleizach at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AccessibilityNodeObject.cpp
    M Source/WebCore/accessibility/AccessibilityObject.h

  Log Message:
  -----------
  Merge r177537 - AX: Recursive crash at WebCore::accessibleNameForNode
https://bugs.webkit.org/show_bug.cgi?id=139616

Reviewed by Mario Sanchez Prada.

Source/WebCore:

An image that uses aria-labelledby to reference its own parent can lead to a recursion crash.
There needs to be some information we can pass through these methods to ensure we don't hit this case.

Test: accessibility/accessibility-description-crash.html

* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::alternativeText):
(WebCore::AccessibilityNodeObject::textUnderElement):
(WebCore::accessibleNameForNode):
(WebCore::AccessibilityNodeObject::accessibilityDescriptionForElements):
* accessibility/AccessibilityObject.h:
(WebCore::AccessibilityTextUnderElementMode::AccessibilityTextUnderElementMode):

LayoutTests:

* accessibility/accessibility-description-crash-expected.txt: Added.
* accessibility/accessibility-description-crash.html: Added.

Canonical link: https://commits.webkit.org/154760.289@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178359 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 83cdec0b18e2404d72a9463debc98c43c54782f2
      https://github.com/WebKit/WebKit/commit/83cdec0b18e2404d72a9463debc98c43c54782f2
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/editing/selection/clearselection-on-detached-subtree-crash-expected.txt
    A LayoutTests/editing/selection/clearselection-on-detached-subtree-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBox.cpp
    M Source/WebCore/rendering/RenderView.cpp

  Log Message:
  -----------
  Merge r178231 - Calling clearSelection on a detached RenderObject leads to segfault.
https://bugs.webkit.org/show_bug.cgi?id=140275

Reviewed by Simon Fraser.

We collect selection rects and compute selection gaps in order to
paint/clear selection. With certain content, we need to be able
to walk the tree up to a particular container to compute the selection rect.
However this container might not be available when the selection is part of a detached tree.
This is a null-check fix to ensure we don't crash in such cases, but in the long run
selection gaps and rect should be cached between two layouts so that we don't need to
keep collecting/recomputing them. Tracked here: webkit.org/b/140321

Source/WebCore:

Test: editing/selection/clearselection-on-detached-subtree-crash.html

* rendering/RenderBox.cpp:
(WebCore::RenderBox::containingBlockLogicalWidthForContent):
(WebCore::RenderBox::containingBlockLogicalHeightForContent):
* rendering/RenderView.cpp:
(WebCore::RenderView::clearSelection):

LayoutTests:

* editing/selection/clearselection-on-detached-subtree-crash-expected.txt: Added.
* editing/selection/clearselection-on-detached-subtree-crash.html: Added.

Canonical link: https://commits.webkit.org/154760.290@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178360 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 0100336b6dc6121e41ad596bb875558cd052f5c1
      https://github.com/WebKit/WebKit/commit/0100336b6dc6121e41ad596bb875558cd052f5c1
  Author: Manuel Rego Casasnovas <rego at igalia.com>
  Date:   2015-01-15 (Thu, 15 Jan 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/css-grid-layout/grid-was-populated-assert-expected.txt
    A LayoutTests/fast/css-grid-layout/grid-was-populated-assert.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderGrid.cpp
    M Source/WebCore/rendering/RenderGrid.h

  Log Message:
  -----------
  Merge r174946 - ASSERTION FAILED: !gridWasPopulated() in WebCore::RenderGrid::placeItemsOnGrid
https://bugs.webkit.org/show_bug.cgi?id=136939

Reviewed by Darin Adler.

Source/WebCore:

In some particular situations computeIntrinsicLogicalWidths() is called
in the middle of layoutGridItems(). In these cases we do not need to
populate the grid again, so we should avoid calling placeItemsOnGrid().
In addition, we do not need to clean the grid either, as that will be
done later by layoutGridItems().

Test: fast/css-grid-layout/grid-was-populated-assert.html

* rendering/RenderGrid.cpp:
(WebCore::RenderGrid::computeIntrinsicLogicalWidths): Avoid calls to
placeItemsOnGrid() and clearGrid() if the grid was already populated.
* rendering/RenderGrid.h: Move gridWasPopulated() header out of the
debug ifdefs.

LayoutTests:

Added a test case to reproduce the crash in debug mode.

* fast/css-grid-layout/grid-was-populated-assert-expected.txt: Added.
* fast/css-grid-layout/grid-was-populated-assert.html: Added.

Canonical link: https://commits.webkit.org/154760.291@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178497 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: bc27ea5d343a41b8c91b21a6622f47d8f583feb2
      https://github.com/WebKit/WebKit/commit/bc27ea5d343a41b8c91b21a6622f47d8f583feb2
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-01-15 (Thu, 15 Jan 2015)

  Changed paths:
    M Source/WebCore/platform/gtk/RedirectedXCompositeWindow.cpp
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp

  Log Message:
  -----------
  Merge r178414 - [GTK] Do not resize the redirected XComposite window when not in accelerated compositing mode
https://bugs.webkit.org/show_bug.cgi?id=140353

Reviewed by Martin Robinson.

We create the redirected XComposite window unconditionally, but
with a size of 1x1 to save memory. However, we are always resizing
it, so in the end we always end up with a XWindow allocated for
the same size of the web view, even for web views that never enter
in accelerated compositing mode.

* UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewRenderAcceleratedCompositingResults): Resize the
RedirectedXCompositeWindow to the current web view size to ensure
the sizes match before drawing.
(resizeWebKitWebViewBaseFromAllocation): Only resize the
RedirectedXCompositeWindow when in accelerated compositing mode.
* UIProcess/gtk/RedirectedXCompositeWindow.cpp:
(WebKit::RedirectedXCompositeWindow::resize): Return early if the
given size is the current size.

Canonical link: https://commits.webkit.org/154760.292@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178502 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 5afe84f001a013cecd78a9e87a1b528d53a1a291
      https://github.com/WebKit/WebKit/commit/5afe84f001a013cecd78a9e87a1b528d53a1a291
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-01-15 (Thu, 15 Jan 2015)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp

  Log Message:
  -----------
  Merge r178415 - [GTK] Do not schedule a redraw for the redirected XComposite window when not in accelerated compositing mode
https://bugs.webkit.org/show_bug.cgi?id=140354

Reviewed by Martin Robinson.

The RedirectedXCompositeWindow uses XDamage to be notified when
the XWindow has been modified. Since the redirected window is
created unconditionally we always receive a XDamage notify when
the window is mapped, and we schedule a redraw in the web view
even when the web view is not in accelerated compositing mode.

* UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewBaseRealize): Only call gtk_widget_queue_draw() when
in accelerated compositing mode.

Canonical link: https://commits.webkit.org/154760.293@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178503 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: b361acb9f04af2f4344b097681b00d3ad8136acc
      https://github.com/WebKit/WebKit/commit/b361acb9f04af2f4344b097681b00d3ad8136acc
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2015-01-15 (Thu, 15 Jan 2015)

  Changed paths:
    M Tools/ChangeLog
    M Tools/gtk/gtkdoc.py

  Log Message:
  -----------
  Merge r178103 - [GTK] Build gtk-doc without gtkdoc-mktmpl
https://bugs.webkit.org/show_bug.cgi?id=140225

Patch by Michael Catanzaro <mcatanzaro at igalia.com> on 2015-01-07
Reviewed by Darin Adler.

Stop calling gtkdoc-mktmpl. It's being removed upstream, and since we
don't modify the tmpl files that it generates, it's not doing anything
for us.

* gtk/gtkdoc.py:
(GTKDoc.generate):
(GTKDoc._run_gtkdoc_scangobj):
(GTKDoc._run_gtkdoc_mktmpl): Deleted.

Canonical link: https://commits.webkit.org/154760.294@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178504 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 2f535ef655f9cb2d65cc8b43fd6fa94691db40df
      https://github.com/WebKit/WebKit/commit/2f535ef655f9cb2d65cc8b43fd6fa94691db40df
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2015-01-15 (Thu, 15 Jan 2015)

  Changed paths:
    M ChangeLog
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.6.5 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit2:

* gtk/NEWS: dd release notes for 2.6.5.

Canonical link: https://commits.webkit.org/154760.295@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178506 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e86a21dd30c934bf6d24ae807891dc3275eec711
      https://github.com/WebKit/WebKit/commit/e86a21dd30c934bf6d24ae807891dc3275eec711
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M ChangeLog
    M Source/PlatformGTK.cmake
    M Tools/ChangeLog
    M Tools/gtk/make-dist.py
    R Tools/gtk/manifest.txt
    A Tools/gtk/manifest.txt.in

  Log Message:
  -----------
  Merge r178672 - [GTK] Generate the make dist manifest from a CMake template file
https://bugs.webkit.org/show_bug.cgi?id=139387

Patch by Michael Catanzaro <mcatanzaro at igalia.com> on 2015-01-19
Reviewed by Martin Robinson.

.:

Generate manifest.txt from manifest.txt.in. Only expose the dist and
distcheck targets for developer builds, as they won't work when
building from a tarball because the manifest is not distributed.

* Source/PlatformGTK.cmake:

Tools:

Remove the code that performs variable substitution on manifest.txt.
Replace the custom variables used in that file with CMake variables.

* gtk/make-dist.py:
(Manifest.add_directory):
(Manifest.get_full_source_path):
(Manifest.process_line):
(Manifest.resolve_variables): Deleted.
(Manifest.get_full_tarball_path): Deleted.
* gtk/manifest.txt.in: Renamed from Tools/gtk/manifest.txt.

Canonical link: https://commits.webkit.org/154760.296@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182380 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 46386bf9f2e7659a6587ef484f63ed39cfd30b2d
      https://github.com/WebKit/WebKit/commit/46386bf9f2e7659a6587ef484f63ed39cfd30b2d
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M ChangeLog
    M Source/PlatformGTK.cmake
    M Source/WebCore/ChangeLog
    M Source/WebCore/PlatformGTK.cmake
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/PlatformGTK.cmake
    A Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-4.0-sections.txt
    A Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-4.0.types
    R Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
    R Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk.types
    M Tools/ChangeLog
    M Tools/gtk/generate-gtkdoc
    M Tools/gtk/manifest.txt.in
    M Tools/gtk/webkitdom.py

  Log Message:
  -----------
  Merge r179111 - [GTK] gtkdoc does not appear in DevHelp
https://bugs.webkit.org/show_bug.cgi?id=139369

.:

Patch by Michael Catanzaro <mcatanzaro at igalia.com> on 2015-01-26
Reviewed by Philippe Normand.

Expect the gtkdoc to be generated in folders named with the API version.

* Source/PlatformGTK.cmake:

Source/WebCore:

Patch by Michael Catanzaro <mcatanzaro at igalia.com> on 2015-01-26
Reviewed by Philippe Normand.

* PlatformGTK.cmake: Include the API version in the gtkdoc filenames.

Source/WebKit2:

Patch by Michael Catanzaro <mcatanzaro at igalia.com> on 2015-01-26
Reviewed by Philippe Normand.

* PlatformGTK.cmake: Include the API version in the gtkdoc filenames.
* UIProcess/API/gtk/docs/webkit2gtk-4.0-sections.txt: Renamed from Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt.
* UIProcess/API/gtk/docs/webkit2gtk-4.0.types: Renamed from Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk.types.

Tools:

Patch by Michael Catanzaro  <mcatanzaro at igalia.com> and Carlos Garcia Campos <cgarcia at igalia.com> on 2015-01-26
Reviewed by Philippe Normand.

* gtk/generate-gtkdoc: Create the generators in the main function
and use them to get the local cross renference dependencies. Also
pass the generator module name to webkitdom.write_doc_files().
(get_gtkdoc_module_paths): Receive a list of local cross reference
dependencies.
(get_generator_for_config): Set the main_sgml_file property of the
GtkDoc object from the configuration file.
(generate_documentation): Generate the documentation for the given
generator.
(generate_documentation_for_config): Deleted.
* gtk/manifest.txt.in: Expect the API version in the gtkdoc filenames.
* gtk/webkitdom.py:
(write_doc_files): Receive the module name used to build the
-sections.txt filename.

Canonical link: https://commits.webkit.org/154760.297@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182381 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 0c215f797b2c7e750aaf90fe857a814d5c0e4413
      https://github.com/WebKit/WebKit/commit/0c215f797b2c7e750aaf90fe857a814d5c0e4413
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/gobject/GMutexLocker.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp
    M Source/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp

  Log Message:
  -----------
  Merge r179866 - [GTK] GMutexLocker build issue
https://bugs.webkit.org/show_bug.cgi?id=141381

Reviewed by Žan Doberšek.

Source/WebCore:

Use always WTF::GMutexLocker because newer glib versions have a
GMutexLocker in the public API.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
(WebCore::MediaPlayerPrivateGStreamerBase::naturalSize):
(WebCore::MediaPlayerPrivateGStreamerBase::updateTexture):
(WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):
(WebCore::MediaPlayerPrivateGStreamerBase::paint):
* platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
(webkitVideoSinkTimeoutCallback):
(webkitVideoSinkRender):
(unlockSampleMutex):
(webkitVideoSinkUnlockStop):
(webkitVideoSinkStart):
* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(webKitWebSrcGetProperty):
(webKitWebSrcStop):
(webKitWebSrcStart):
(webKitWebSrcChangeState):
(webKitWebSrcQueryWithParent):
(webKitWebSrcGetUri):
(webKitWebSrcSetUri):
(webKitWebSrcNeedDataMainCb):
(webKitWebSrcNeedDataCb):
(webKitWebSrcEnoughDataMainCb):
(webKitWebSrcEnoughDataCb):
(webKitWebSrcSeekDataCb):
(webKitWebSrcSetMediaPlayer):
(StreamingClient::createReadBuffer):
(StreamingClient::handleResponseReceived):
(StreamingClient::handleDataReceived):
(StreamingClient::handleNotifyFinished):
(ResourceHandleStreamingClient::wasBlocked):
(ResourceHandleStreamingClient::cannotShowURL):

Source/WTF:

Remove using WTF::GMutexLocker from the header, since newer glib
versions have a GMutexLocker in the public API.

* wtf/gobject/GMutexLocker.h:

Canonical link: https://commits.webkit.org/154760.298@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182382 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: b980a667946c713870534a8316f7247ff4598965
      https://github.com/WebKit/WebKit/commit/b980a667946c713870534a8316f7247ff4598965
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/API/gtk/WebKitUserContent.cpp

  Log Message:
  -----------
  Unreviewed. Fix typo in API doc comment.

* UIProcess/API/gtk/WebKitUserContent.cpp:

Canonical link: https://commits.webkit.org/154760.299@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182383 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 6f7b1a7fc48756f374ccfac008936fa370e402bc
      https://github.com/WebKit/WebKit/commit/6f7b1a7fc48756f374ccfac008936fa370e402bc
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/PlatformGTK.cmake
    R Source/WebCore/platform/gtk/DragIcon.cpp
    R Source/WebCore/platform/gtk/DragIcon.h
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
    M Source/WebKit2/UIProcess/gtk/DragAndDropHandler.cpp
    M Source/WebKit2/UIProcess/gtk/DragAndDropHandler.h

  Log Message:
  -----------
  Merge r182175 - [GTK] DnD icon/widget has odd background
https://bugs.webkit.org/show_bug.cgi?id=143217

Reviewed by Martin Robinson.

Source/WebCore:

Remove DragIcon class since it's no longer needed with GTK+3 and
the GTK+2 code there is unused. GTK+ knows what to do with a cairo
surface, I guess we migrated the GTK+2 code to GTK+3 without
realizing that using the surface was enough.

* PlatformGTK.cmake:
* platform/gtk/DragIcon.cpp: Removed.
* platform/gtk/DragIcon.h: Removed.

Source/WebKit2:

Use gtk_drag_set_icon_surface() to set the drag icon image,
instead of DragIcon class.

* UIProcess/API/gtk/WebKitWebView.cpp:
* UIProcess/gtk/DragAndDropHandler.cpp:
(WebKit::DragAndDropHandler::startDrag):
* UIProcess/gtk/DragAndDropHandler.h:

Canonical link: https://commits.webkit.org/154760.300@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182384 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f4be50e6345230fccb0bd33b8df251c00f17a314
      https://github.com/WebKit/WebKit/commit/f4be50e6345230fccb0bd33b8df251c00f17a314
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/gtk/ScrollbarThemeGtk.cpp

  Log Message:
  -----------
  Merge r181744 - [GTK] Scrollbars look bad with GTK+ 3.16
https://bugs.webkit.org/show_bug.cgi?id=140800

Reviewed by Sergio Villar Senin.

Take margin into account when rendering scrollbars. This fixes the
huge scrollbars rendered with GTK+ 3.16. We don't need to check
the GTK+ version because in previous versions the marging were 0,
so the same code just works.

* platform/gtk/ScrollbarThemeGtk.cpp:
(WebCore::adjustRectAccordingToMargin):
(WebCore::ScrollbarThemeGtk::paintTrackBackground):
(WebCore::ScrollbarThemeGtk::paintThumb):

Canonical link: https://commits.webkit.org/154760.301@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182385 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 93e30678786049db591a84e5fcb10b37315c160d
      https://github.com/WebKit/WebKit/commit/93e30678786049db591a84e5fcb10b37315c160d
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
    M Source/WebKit2/WebProcess/WebPage/gtk/PrinterListGtk.cpp
    M Source/WebKit2/WebProcess/WebPage/gtk/PrinterListGtk.h
    M Source/WebKit2/WebProcess/WebPage/gtk/WebPrintOperationGtk.cpp

  Log Message:
  -----------
  Merge r179744 - ASSERTION FAILED: !m_adoptionIsRequired in WTF::RefCountedBase::ref
https://bugs.webkit.org/show_bug.cgi?id=141035

Reviewed by Sergio Villar Senin.

Rename PrinterListGtk::singleton() as PrinterListGtk::getOrCreate(), and
make it return nullptr when the shared PrinterListGtk object is
still being created. This can happen if the nested loop used by
gtk_enumerate_printers dispatches a GSource that starts a new
synchronous print operation. In that case we just ignore the
second print operation, since there's already one ongoing.

* WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::print): Return early if
PrinterListGtk::getOrCreate() return nullptr.
* WebProcess/WebPage/gtk/PrinterListGtk.cpp:
(WebKit::PrinterListGtk::getOrCreate): Return nullptr if the
PrinterListGtk is still enumerating the printers.
(WebKit::PrinterListGtk::PrinterListGtk): Initialize
m_enumeratingPrinters to true before calling
gtk_enumerate_printers, and to false once it finishes.
(WebKit::PrinterListGtk::singleton): Deleted.
(WebKit::PrinterListGtk::enumeratePrintersFunction): Deleted.
* WebProcess/WebPage/gtk/PrinterListGtk.h:
* WebProcess/WebPage/gtk/WebPrintOperationGtk.cpp: Add an
assertion here since PrinterListGtk::getOrCreate() should never
return nullptr at this point.

Canonical link: https://commits.webkit.org/154760.302@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182387 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 222720ffaa6666a2a82c04e69a208e8631d2f907
      https://github.com/WebKit/WebKit/commit/222720ffaa6666a2a82c04e69a208e8631d2f907
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebCore/platform/gtk/RedirectedXCompositeWindow.cpp
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp
    M Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp
    M Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBasePrivate.h

  Log Message:
  -----------
  Merge r179397 - [GTK] Resize the redirected XComposite again after leaving accelerated compositing mode
https://bugs.webkit.org/show_bug.cgi?id=140935

Reviewed by Sergio Villar Senin.

Since r178414 we don't resize the redirected XComposite window
until we enter accelerated compositing mode, but after leaving it
the redirected window keeps its size. We should resize it to 1x1
again and free the XPixmap and cairo surface to save that memory
while not in accelerated compositing mode.

* UIProcess/API/gtk/PageClientImpl.cpp:
(WebKit::PageClientImpl::enterAcceleratedCompositingMode): Notify
the WebKitWebViewBase.
(WebKit::PageClientImpl::exitAcceleratedCompositingMode): Ditto.
* UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewBaseEnterAcceleratedCompositingMode): Resize the
XComposite window to the current drawing area size.
(webkitWebViewBaseExitAcceleratedCompositingMode): Resize the
XComposite window to and empty size.
* UIProcess/API/gtk/WebKitWebViewBasePrivate.h:
* UIProcess/gtk/RedirectedXCompositeWindow.cpp:
(WebKit::RedirectedXCompositeWindow::RedirectedXCompositeWindow):
Do not initialize m_size since we now handle the empty size as a
especial case. Make sure we always create the X window with at
least 1x1 size.
(WebKit::RedirectedXCompositeWindow::resize): Resize the window to
at least 1x1, but when en empty size is given, call
cleanupPixmapAndPixmapSurface() to release those resources.
(WebKit::RedirectedXCompositeWindow::surface): Create the cairo
surface with at least 1x1 size.

Canonical link: https://commits.webkit.org/154760.303@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182389 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 7078ad7d2fce13269bd8d22797315981671dea1d
      https://github.com/WebKit/WebKit/commit/7078ad7d2fce13269bd8d22797315981671dea1d
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Tools/ChangeLog
    M Tools/Scripts/run-gtk-tests
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestWebKitWebView.cpp
    M Tools/TestWebKitAPI/gtk/WebKit2Gtk/WebViewTest.cpp
    M Tools/TestWebKitAPI/gtk/WebKit2Gtk/WebViewTest.h

  Log Message:
  -----------
  Merge r178644 - [GTK] [WK2] TestWebKitWebView snapshot fails
https://bugs.webkit.org/show_bug.cgi?id=120404

Reviewed by Žan Doberšek.

Rework the test to make sure the snapshot is always created at the
desired size.

* Scripts/run-gtk-tests:
(TestRunner): Unskip /webkit2/WebKitWebView/snapshot.
* TestWebKitAPI/Tests/WebKit2Gtk/TestWebKitWebView.cpp:
(testWebViewSnapshot): Use a fixed size for the document, and
disable scrollbars to make sure the visible area is always the
WebView size.
* TestWebKitAPI/gtk/WebKit2Gtk/WebViewTest.cpp:
(WebViewTest::showInWindowAndWaitUntilMapped): Add optional width
and height parameters to create the window with a given size.
* TestWebKitAPI/gtk/WebKit2Gtk/WebViewTest.h:

Canonical link: https://commits.webkit.org/154760.304@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182390 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: afc4c647cbbdc09bc771924701cef0c7343f861c
      https://github.com/WebKit/WebKit/commit/afc4c647cbbdc09bc771924701cef0c7343f861c
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Tools/ChangeLog
    M Tools/Scripts/run-gtk-tests
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestWebKitWebView.cpp

  Log Message:
  -----------
  Merge r179248 - [GTK] Unit test /webkit2/WebKitWebView/page-visibility from WebKit2Gtk/TestWebKitWebView fails
https://bugs.webkit.org/show_bug.cgi?id=131731

Reviewed by Žan Doberšek.

A web page loaded offscreen is in prerender state not hidden.

* Scripts/run-gtk-tests:
(TestRunner): Unskip /webkit2/WebKitWebView/page-visibility.
* TestWebKitAPI/Tests/WebKit2Gtk/TestWebKitWebView.cpp:
(testWebViewPageVisibility):

Canonical link: https://commits.webkit.org/154760.305@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182391 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 1d5f1082b26bd7358679d322cb1a9159d8dda3de
      https://github.com/WebKit/WebKit/commit/1d5f1082b26bd7358679d322cb1a9159d8dda3de
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/CMakeLists.txt
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/DOMNodeFilterTest.cpp
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/DOMNodeTest.cpp
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/DOMXPathNSResolverTest.cpp
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/FrameTest.cpp
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestDOMNode.cpp
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestDOMNodeFilter.cpp
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestDOMXPathNSResolver.cpp
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestFrame.cpp
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/WebProcessTest.cpp
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/WebProcessTest.h
    R Tools/TestWebKitAPI/gtk/WebKit2Gtk/WebProcessTestRunner.cpp
    R Tools/TestWebKitAPI/gtk/WebKit2Gtk/WebProcessTestRunner.h
    M Tools/TestWebKitAPI/gtk/WebKit2Gtk/WebViewTest.cpp
    M Tools/TestWebKitAPI/gtk/WebKit2Gtk/WebViewTest.h

  Log Message:
  -----------
  Merge r176563 - [GTK] Use custom JavaScript instead of DBus to implement WebProcess tests
https://bugs.webkit.org/show_bug.cgi?id=138834

Reviewed by Sergio Villar Senin.

It makes everyting simpler and the tests run faster too, since we
don't need to spawn the private bus and wait until the DBus name
is registered. The web extension registers a new JavaSCript class
with a status method to run the tests, similar to the DBus
method. In the UI process side, tests use webkit_web_view_run_java_script()
instead of sending a DBus message.

* TestWebKitAPI/Tests/WebKit2Gtk/CMakeLists.txt:
* TestWebKitAPI/Tests/WebKit2Gtk/DOMNodeFilterTest.cpp:
(WebKitDOMNodeFilterTest::create):
(WebKitDOMNodeFilterTest::testTreeWalker):
(WebKitDOMNodeFilterTest::testNodeIterator):
(WebKitDOMNodeFilterTest::webPageFromArgs): Deleted.
(WebKitDOMNodeFilterTest::runTest): Deleted.
* TestWebKitAPI/Tests/WebKit2Gtk/DOMNodeTest.cpp:
(WebKitDOMNodeTest::create):
(WebKitDOMNodeTest::testHierarchyNavigation):
(WebKitDOMNodeTest::testInsertion):
(WebKitDOMNodeTest::testTagNames):
(WebKitDOMNodeTest::webPageFromArgs): Deleted.
(WebKitDOMNodeTest::runTest): Deleted.
* TestWebKitAPI/Tests/WebKit2Gtk/DOMXPathNSResolverTest.cpp:
(WebKitDOMXPathNSResolverTest::create):
(WebKitDOMXPathNSResolverTest::testXPathNSResolverNative):
(WebKitDOMXPathNSResolverTest::testXPathNSResolverCustom):
(WebKitDOMXPathNSResolverTest::webPageFromArgs): Deleted.
(WebKitDOMXPathNSResolverTest::runTest): Deleted.
* TestWebKitAPI/Tests/WebKit2Gtk/FrameTest.cpp:
(WebKitFrameTest::create):
(WebKitFrameTest::testMainFrame):
(WebKitFrameTest::testURI):
(WebKitFrameTest::testJavaScriptContext):
(WebKitFrameTest::webPageFromArgs): Deleted.
(WebKitFrameTest::runTest): Deleted.
* TestWebKitAPI/Tests/WebKit2Gtk/TestDOMNode.cpp:
(testWebKitDOMNodeHierarchyNavigation):
(testWebKitDOMNodeInsertion):
(testWebKitDOMNodeTagNames):
(beforeAll):
(afterAll):
* TestWebKitAPI/Tests/WebKit2Gtk/TestDOMNodeFilter.cpp:
(runTest):
(beforeAll):
(afterAll):
* TestWebKitAPI/Tests/WebKit2Gtk/TestDOMXPathNSResolver.cpp:
(testWebKitDOMXPathNSResolverNative):
(testWebKitDOMXPathNSResolverCustom):
(beforeAll):
(afterAll):
(runTest): Deleted.
* TestWebKitAPI/Tests/WebKit2Gtk/TestFrame.cpp:
(webkitFrameTestRun):
(beforeAll):
(afterAll):
* TestWebKitAPI/Tests/WebKit2Gtk/WebProcessTest.cpp:
(testsMap):
(WebProcessTest::add):
(WebProcessTest::create):
(runTest):
(windowObjectClearedCallback):
(webkit_web_extension_initialize):
(methodCallCallback): Deleted.
(webkit_web_extension_initialize_with_user_data): Deleted.
* TestWebKitAPI/Tests/WebKit2Gtk/WebProcessTest.h:
* TestWebKitAPI/gtk/WebKit2Gtk/WebProcessTestRunner.cpp: Removed.
* TestWebKitAPI/gtk/WebKit2Gtk/WebProcessTestRunner.h: Removed.
* TestWebKitAPI/gtk/WebKit2Gtk/WebViewTest.cpp:
(WebViewTest::runWebProcessTest):
* TestWebKitAPI/gtk/WebKit2Gtk/WebViewTest.h:

Canonical link: https://commits.webkit.org/154760.306@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182392 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: dd10ecd24f7508792aaf99c84c53316ba6210c2f
      https://github.com/WebKit/WebKit/commit/dd10ecd24f7508792aaf99c84c53316ba6210c2f
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/WebProcess/InjectedBundle/API/gtk/WebKitFrame.cpp
    M Source/WebKit2/WebProcess/InjectedBundle/API/gtk/WebKitFramePrivate.h
    M Source/WebKit2/WebProcess/InjectedBundle/API/gtk/WebKitWebPage.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/FrameTest.cpp
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/WebProcessTest.cpp
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/WebProcessTest.h

  Log Message:
  -----------
  Merge r180211 - [GTK] WebKitFrame objects are never released
https://bugs.webkit.org/show_bug.cgi?id=141641

Reviewed by Martin Robinson.

Source/WebKit2:

Use a FrameDestructionObserver derived class to wrap our
WebKitFrame objects and delete them when the frame is destroyed,
instead of using willDestroyFrame callback of WKBundlePageLoaderClient
that has never worked.

* WebProcess/InjectedBundle/API/gtk/WebKitFrame.cpp:
(webkitFrameGetWebFrame):
* WebProcess/InjectedBundle/API/gtk/WebKitFramePrivate.h:
* WebProcess/InjectedBundle/API/gtk/WebKitWebPage.cpp:
(webkitFrameGetOrCreate):
(webkitFrameDestroy):
(webkitWebPageCreate):
(willDestroyFrame): Deleted.

Tools:

Add a way to check GObjects leaks for WebProcess tests and check
WebKitFrame objects are not leaked.

* TestWebKitAPI/Tests/WebKit2Gtk/FrameTest.cpp:
(WebKitFrameTest::testMainFrame):
(WebKitFrameTest::testURI):
(WebKitFrameTest::testJavaScriptContext):
* TestWebKitAPI/Tests/WebKit2Gtk/WebProcessTest.cpp:
(WebProcessTest::assertObjectIsDeletedWhenTestFinishes):
(runTest):
* TestWebKitAPI/Tests/WebKit2Gtk/WebProcessTest.h:

Canonical link: https://commits.webkit.org/154760.307@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182393 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 349c468c17f3f652218e92ae934b95a4faf10b4a
      https://github.com/WebKit/WebKit/commit/349c468c17f3f652218e92ae934b95a4faf10b4a
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/gobject/DOMObjectCache.cpp
    M Source/WebCore/bindings/gobject/DOMObjectCache.h
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/DOMNodeFilterTest.cpp
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/DOMNodeTest.cpp
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/DOMXPathNSResolverTest.cpp
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestDOMNode.cpp

  Log Message:
  -----------
  Merge r180214 - [GTK] GObject DOM bindings object are cached forever
https://bugs.webkit.org/show_bug.cgi?id=141558

Reviewed by Sergio Villar Senin.

Source/WebCore:

Rework the DOMObjectCache to avoid having to manually clear the
objects when the frame is destroyed, using a FrameDestructionObserver
instead. When a new object associated to a Frame is added to the
cache, a FrameDestructionObserver is created for the frame if
needed, and the DOM object is tracked by the observer too. When
the frame is detached from the page all its objects are cleared,
and if the aren't additional references, the object is finalized
and removed from the cache normally.
This patch also simplifies and modernizes the code to make it
easier to read an maintain.

* bindings/gobject/DOMObjectCache.cpp:
(WebKit::DOMObjectCacheData::DOMObjectCacheData): Add constructor
to initialize its members and simplify the callers.
(WebKit::DOMObjectCacheData::clearObject): Remove the references
added by the cache, ensuring the GObject is not finalized until
the method returns.
(WebKit::DOMObjectCacheData::refObject): Adds a reference owned by
the cache.
(WebKit::domObjectCacheFrameObservers): Map a frame to a FrameDestructionObserver.
(WebKit::getOrCreateDOMObjectCacheFrameObserver): Create a new
FrameDestructionObserver for the given Frame or return the
existing one.
(WebKit::domObjects): Map wrapped object to wrapper object.
(WebKit::DOMObjectCache::forget): Remove the wrapped object from
the cache.
(WebKit::DOMObjectCache::get): Return the wrapped object if it is
in the cache, increasing the cache references.
(WebKit::DOMObjectCache::put): Add the wrapper object to the cache
for the given wrapped object. If it's a Node and has a frame add
the node to the FrameDestructionObserver corresponding to the frame.
(WebKit::getFrameFromHandle): Deleted.
(WebKit::weakRefNotify): Deleted.
(WebKit::DOMObjectCache::clearByFrame): Deleted.
(WebKit::DOMObjectCache::~DOMObjectCache): Deleted.
* bindings/gobject/DOMObjectCache.h:

Tools:

Add checks for all DOM objects to ensure they are not leaked. Also
add a dedicated test for the DOM Object Cache.

* TestWebKitAPI/Tests/WebKit2Gtk/DOMNodeFilterTest.cpp:
(WebKitDOMNodeFilterTest::testTreeWalker):
(WebKitDOMNodeFilterTest::testNodeIterator):
* TestWebKitAPI/Tests/WebKit2Gtk/DOMNodeTest.cpp:
(WebKitDOMNodeTest::testHierarchyNavigation):
(WebKitDOMNodeTest::testInsertion):
(WebKitDOMNodeTest::testTagNames):
(WebKitDOMNodeTest::testDOMCache):
(registerTests):
* TestWebKitAPI/Tests/WebKit2Gtk/DOMXPathNSResolverTest.cpp:
(WebKitDOMXPathNSResolverTest::evaluateFooChildTextAndCheckResult):
(WebKitDOMXPathNSResolverTest::testXPathNSResolverNative):
(WebKitDOMXPathNSResolverTest::testXPathNSResolverCustom):
* TestWebKitAPI/Tests/WebKit2Gtk/TestDOMNode.cpp:
(testWebKitDOMObjectCache):
(beforeAll):
* TestWebKitAPI/Tests/WebKit2Gtk/WebExtensionTest.cpp:
(documentLoadedCallback):

Canonical link: https://commits.webkit.org/154760.308@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182394 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 478a3a9ae823a84aa4df05d7a4e581371ed12365
      https://github.com/WebKit/WebKit/commit/478a3a9ae823a84aa4df05d7a4e581371ed12365
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/DOMNodeTest.cpp

  Log Message:
  -----------
  Merge r180215 - Unreviewed. Fix /webkit2/WebKitDOMNode/dom-cache after r180214.

I forgot to add the return of a bool function.

* TestWebKitAPI/Tests/WebKit2Gtk/DOMNodeTest.cpp:
(WebKitDOMNodeTest::testDOMCache):

Canonical link: https://commits.webkit.org/154760.309@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182395 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: d6c6bf4ccc63576c515402a0b28780b76c95970f
      https://github.com/WebKit/WebKit/commit/d6c6bf4ccc63576c515402a0b28780b76c95970f
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/gobject/DOMObjectCache.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestDOMNode.cpp
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/WebProcessTest.cpp

  Log Message:
  -----------
  Merge r181631 - [GTK] WebKitDOM objects leaking
https://bugs.webkit.org/show_bug.cgi?id=118788

Reviewed by Darin Adler and Sergio Villar Senin.

Source/WebCore:

Use a DOMwindowObserver class, derived from DOMWindowProperty to
be notified when the window object is detached from the frame to
clear the DOM objects associated to that frame in that case too.

* bindings/gobject/DOMObjectCache.cpp:

Tools:

Update DOMObjectCache unit test to check that DOM objects are also
released when new contents are loaded in the web view, and the old
document is detached from the frame.

* TestWebKitAPI/Tests/WebKit2Gtk/TestDOMNode.cpp:
(testWebKitDOMObjectCache):
* TestWebKitAPI/Tests/WebKit2Gtk/WebProcessTest.cpp:
(runTest):

Canonical link: https://commits.webkit.org/154760.310@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182396 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: aa1e341db521b474e352253dd9de399844bd95a3
      https://github.com/WebKit/WebKit/commit/aa1e341db521b474e352253dd9de399844bd95a3
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm

  Log Message:
  -----------
  Merge r181643 - [GTK] Wrong transfer annotations used in GObject DOM bindings
https://bugs.webkit.org/show_bug.cgi?id=142780

Reviewed by Gustavo Noronha Silva.

We are using transfer none for all methods returning a GObject DOM
Object. That's not true. Only objects derived from Node are
automatically released by the DOM object cache and can be transfer
none. All other objects are added to the cache only to avoid
creating the same wrapper twice for the same core object, but
caller should release the returned reference.

* bindings/scripts/CodeGeneratorGObject.pm:
(GetTransferTypeForReturnType):
(GenerateFunction):

Canonical link: https://commits.webkit.org/154760.311@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182397 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: db78395e271c0d9194d34293336fa6ce82f37676
      https://github.com/WebKit/WebKit/commit/db78395e271c0d9194d34293336fa6ce82f37676
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/UIProcess/WebPageProxy.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit2/LoadAlternateHTMLStringWithNonDirectoryURL.cpp
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestLoaderClient.cpp

  Log Message:
  -----------
  Merge r180565 - Crash loading local file with WebPageProxy::loadAlternateHTMLString
https://bugs.webkit.org/show_bug.cgi?id=141867

Patch by Michael Catanzaro <mcatanzaro at igalia.com> on 2015-02-24
Reviewed by Anders Carlsson.

Source/WebKit2:

WebPageProxy::loadAlternateHTMLString needs to assume read access to unreachableURL as well
as baseURL, because unreachableURL will get added to the back/forward list, causing us to
crash later on when we notice the unexpected URL received in checkURLReceivedFromWebProcess.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::loadAlternateHTMLString):

Tools:

* TestWebKitAPI/Tests/WebKit2/LoadAlternateHTMLStringWithNonDirectoryURL.cpp:
(TestWebKitAPI::loadAlternateHTMLString): Split most of this test into a function so it can
be shared with the new test.
(TestWebKitAPI::TEST): Add a cross-platform test for this crash.
* TestWebKitAPI/Tests/WebKit2Gtk/TestLoaderClient.cpp: Add a GTK+ test for this crash.
(testLoadAlternateHTMLForLocalPage):
(beforeAll):

Canonical link: https://commits.webkit.org/154760.312@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182398 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: d6b924c0080fa685b64612f04863ddfa2231283d
      https://github.com/WebKit/WebKit/commit/d6b924c0080fa685b64612f04863ddfa2231283d
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestResources.cpp
    M Tools/gtk/jhbuild.modules

  Log Message:
  -----------
  Merge r180927 - [SOUP] Synchronous XMLHttpRequests can time out when we reach the max connections limit
https://bugs.webkit.org/show_bug.cgi?id=141508

Reviewed by Sergio Villar Senin.

Source/WebCore:

Use SOUP_MESSAGE_IGNORE_CONNECTION_LIMITS flag when loading a
synchronous message instead of increasing the maximum number of
connections allowed if the soup version is recent enough.
The current solution of increasing/decreasing the limits doesn't
always work, because connections are not marked as IDLE in libsoup
until the message is unqueued, but we don't wait for the message
to be unqueued to finish our loads in WebKit, we finish them as
soon as we have finished reading the stream. This causes that
synchronous loads keep blocked in the nested main loop until the
timeout of 10 seconds is fired and the load fails.
Also marked WebCoreSynchronousLoader class as final, the virtual
methods as override and removed the unsused method isSynchronousClient.

* platform/network/soup/ResourceHandleSoup.cpp:
(WebCore::createSoupMessageForHandleAndRequest):
(WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
(WebCore::WebCoreSynchronousLoader::isSynchronousClient): Deleted.
(WebCore::WebCoreSynchronousLoader::didReceiveResponse):
(WebCore::WebCoreSynchronousLoader::didReceiveData):
(WebCore::WebCoreSynchronousLoader::didReceiveBuffer):
(WebCore::WebCoreSynchronousLoader::didFinishLoading):
(WebCore::WebCoreSynchronousLoader::didFail):
(WebCore::WebCoreSynchronousLoader::didReceiveAuthenticationChallenge):
(WebCore::WebCoreSynchronousLoader::shouldUseCredentialStorage):

Tools:

Add a unit test to check that synchronous XHRs load even if the
maximum connection limits are reached.

* TestWebKitAPI/Tests/WebKit2Gtk/TestResources.cpp:
(testWebViewSyncRequestOnMaxConns):
(serverCallback):
(beforeAll):
* gtk/jhbuild.modules: Bump libsoup version to 2.49.91.

Canonical link: https://commits.webkit.org/154760.313@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182399 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 7bbd051c42686dcc77375e96bca6d9f00e14e468
      https://github.com/WebKit/WebKit/commit/7bbd051c42686dcc77375e96bca6d9f00e14e468
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestResources.cpp

  Log Message:
  -----------
  Merge r181159 - [GTK] Test /webkit2/WebKitWebView/sync-request-on-max-conns might fail after finished
https://bugs.webkit.org/show_bug.cgi?id=142385

Reviewed by Sergio Villar Senin.

Use stack allocated GMainLoopSources to make sure they are
cancelled automatically if the test finishes before they have
been processed.

* TestWebKitAPI/Tests/WebKit2Gtk/TestResources.cpp:
(testWebViewSyncRequestOnMaxConns):

Canonical link: https://commits.webkit.org/154760.314@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182400 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: c71990d4b0e61dc6e2aa06bbd25460c1b1da32b1
      https://github.com/WebKit/WebKit/commit/c71990d4b0e61dc6e2aa06bbd25460c1b1da32b1
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp

  Log Message:
  -----------
  Merge r181074 - [SOUP] Check TLS errors as soon as they are set in the SoupMessage
https://bugs.webkit.org/show_bug.cgi?id=142244

Reviewed by Sergio Villar Senin.

Source/WebCore:

Connect to the notify::tls-errors signal of SoupMessage to cancel
the load earlier in case of TLS failure, preventing any private
data from being sent to the server before the TLS errors are checked.

* platform/network/soup/ResourceHandleSoup.cpp:
(WebCore::tlsErrorsChangedCallback):
(WebCore::gotHeadersCallback):
(WebCore::createSoupMessageForHandleAndRequest):

Canonical link: https://commits.webkit.org/154760.315@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182401 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: f41507af81bd65d5693bcef6c4cb671c7e85ad89
      https://github.com/WebKit/WebKit/commit/f41507af81bd65d5693bcef6c4cb671c7e85ad89
  Author: Milan Crha <mcrha at redhat.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/gobject/GObjectEventListener.cpp

  Log Message:
  -----------
  Merge r180141 - [GTK] Loading page into WebView shows g_closure_unref warning
https://bugs.webkit.org/show_bug.cgi?id=127474

Patch by Milan Crha <mcrha at redhat.com> on 2015-02-16
Reviewed by Carlos Garcia Campos.

* bindings/gobject/GObjectEventListener.cpp:
(WebCore::GObjectEventListener::gobjectDestroyed):

Canonical link: https://commits.webkit.org/154760.316@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182402 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: cd49bab87e63723b6fa89f7e37d341b8b5db9ebb
      https://github.com/WebKit/WebKit/commit/cd49bab87e63723b6fa89f7e37d341b8b5db9ebb
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp

  Log Message:
  -----------
  Merge r180997 - [GStreamer] the GST_SCHEDULING_FLAG_BANDWIDTH_LIMITED should be wrapped by a ifdef
https://bugs.webkit.org/show_bug.cgi?id=142274

Patch by Philippe Normand <pnormand at igalia.com> on 2015-03-04
Reviewed by Carlos Garcia Campos.

Don't handle scheduling queries if building against versions of
GStreamer older than 1.2.0.

* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(webKitWebSrcQueryWithParent):

Canonical link: https://commits.webkit.org/154760.317@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182403 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 004a501bc6278d146301963e4f6bdcbb1eef288f
      https://github.com/WebKit/WebKit/commit/004a501bc6278d146301963e4f6bdcbb1eef288f
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
    M Source/WebCore/platform/network/soup/SoupNetworkSession.cpp

  Log Message:
  -----------
  Merge r180928 - [SOUP] Use SoupMessage::starting instead of SoupSession::request-started
https://bugs.webkit.org/show_bug.cgi?id=142164

Reviewed by Sergio Villar Senin.

SoupSession::request-started is deprecated in libsoup 2.50. Both
signals are equivalent, but SoupMessage::starting is also emitted
for resources loaded from the disk cache. This fixes web timing
calculations for cached resources, since we were not initializing
m_requestStart.

* platform/network/soup/ResourceHandleSoup.cpp:
(WebCore::startingCallback):
(WebCore::createSoupMessageForHandleAndRequest):
* platform/network/soup/SoupNetworkSession.cpp:
(WebCore::SoupNetworkSession::SoupNetworkSession):

Canonical link: https://commits.webkit.org/154760.318@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182404 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 523058a8b0db9aa0521cdf8ad7e457a559d5802b
      https://github.com/WebKit/WebKit/commit/523058a8b0db9aa0521cdf8ad7e457a559d5802b
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/multicol/crash-when-spanner-gets-moved-around-expected.txt
    A LayoutTests/fast/multicol/crash-when-spanner-gets-moved-around.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp
    M Source/WebCore/rendering/RenderMultiColumnFlowThread.h

  Log Message:
  -----------
  Merge r180328 - REGRESSION(r174761) Dangling spanner pointer in RenderMultiColumnSpannerPlaceholder.
https://bugs.webkit.org/show_bug.cgi?id=138224

Reviewed by Dave Hyatt.

It's wrong to call flowThreadRelativeWillBeRemoved(child).
RenderMultiColumnFlowThread::removeFlowChildInfo() does not mean that the child is actually about to be removed.
Should this introduce any regressions, we need to deal with those separately.

Source/WebCore:

Test: fast/multicol/crash-when-spanner-gets-moved-around.html

* rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::RenderMultiColumnFlowThread::removeFlowChildInfo): Deleted.
* rendering/RenderMultiColumnFlowThread.h:

LayoutTests:

* fast/multicol/crash-when-spanner-gets-moved-around-expected.txt: Added.
* fast/multicol/crash-when-spanner-gets-moved-around.html: Added.

Canonical link: https://commits.webkit.org/154760.319@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182405 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 4d4ff5687acfcfe257b3c6d002cf99f61b9bf460
      https://github.com/WebKit/WebKit/commit/4d4ff5687acfcfe257b3c6d002cf99f61b9bf460
  Author: Simon Fraser <simon.fraser at apple.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/RunLoop.cpp

  Log Message:
  -----------
  Merge r180434 - RunLoop::dispatch() should drop the mutex before calling wakeUp().
https://bugs.webkit.org/show_bug.cgi?id=141820

Reviewed by Alexey Proskuryakov.

RunLoop::wakeUp() calls into CoreFoundation which could take time,
so scope the mutex just to protect m_functionQueue.

* wtf/RunLoop.cpp:
(WTF::RunLoop::dispatch):

Canonical link: https://commits.webkit.org/154760.320@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182407 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e764e14d47ef8135576232ae207b250524397ed3
      https://github.com/WebKit/WebKit/commit/e764e14d47ef8135576232ae207b250524397ed3
  Author: Tomáš Popela <tpopela at redhat.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M ChangeLog
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Merge r180502 - [GTK] Fails to compile with cmake 3.2.x
https://bugs.webkit.org/show_bug.cgi?id=141796

With cmake 3.2.x we have to explicitly ask for X11 otherwise the
X11_X11_LIB variable won't be set thus the X11 linker flags won't be
added and the build will fail.

Patch by Tomas Popela <tpopela at redhat.com> on 2015-02-23
Reviewed by Martin Robinson.

* Source/cmake/OptionsGTK.cmake:

Canonical link: https://commits.webkit.org/154760.321@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182408 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: cc98db44388a2999a33cdbe860b2ebde74e7ee98
      https://github.com/WebKit/WebKit/commit/cc98db44388a2999a33cdbe860b2ebde74e7ee98
  Author: Philippe Normand <philn at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/TrackPrivateBaseGStreamer.cpp

  Log Message:
  -----------
  Merge r180503 - [GStreamer] Redundant track language notifications
https://bugs.webkit.org/show_bug.cgi?id=141908

Reviewed by Žan Doberšek.

Invoke languageChanged only if the language code actually
changed.

* platform/graphics/gstreamer/TrackPrivateBaseGStreamer.cpp:
(WebCore::TrackPrivateBaseGStreamer::notifyTrackOfTagsChanged):

Canonical link: https://commits.webkit.org/154760.322@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182409 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 088a8b5dda9ebb9389829d8bcb4da2f5cbbd58c1
      https://github.com/WebKit/WebKit/commit/088a8b5dda9ebb9389829d8bcb4da2f5cbbd58c1
  Author: Filip Pizlo <fpizlo at apple.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    A Source/JavaScriptCore/tests/stress/regress-141883.js

  Log Message:
  -----------
  Merge r180505 - Crash in DFGFrozenValue
https://bugs.webkit.org/show_bug.cgi?id=141883

Reviewed by Benjamin Poulain.

If a value might be a cell, then we have to have Graph freeze it rather than trying to
create the FrozenValue directly. Creating it directly is just an optimization for when you
know for sure that it cannot be a cell.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* tests/stress/regress-141883.js: Added. Hacked the original test to be faster while still crashing before this fix.

Canonical link: https://commits.webkit.org/154760.323@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182410 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 35d0d2efbb7dbd9713c4f9b94de2c29e336199bb
      https://github.com/WebKit/WebKit/commit/35d0d2efbb7dbd9713c4f9b94de2c29e336199bb
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/regions/region-with-multicolumn-embedded-crash-expected.txt
    A LayoutTests/fast/regions/region-with-multicolumn-embedded-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderObject.cpp

  Log Message:
  -----------
  Merge r180767 - Use after free in WebCore::RenderNamedFlowFragment::restoreRegionObjectsOriginalStyle
https://bugs.webkit.org/show_bug.cgi?id=138366

Reviewed by Dave Hyatt.

This patch ensures that we clean up RenderNamedFlowFragment::m_renderObjectRegionStyle when embedded flow content is getting destroyed.

In m_renderObjectRegionStyle hash map, we store style information about the named flow's descendant children.
When a child is being detached from the tree, it removes itself from this hashmap.
We do it by traversing up on the ancestor chain and call removeFlowChildInfo() on the parent flow.
However in case of embedded flows (for example multicolumn content inside a region), we need to check whether the parent flow
is inside a flow too and continue the cleanup accordingly.

Source/WebCore:

Test: fast/regions/region-with-multicolumn-embedded-crash.html

* rendering/RenderObject.cpp:
(WebCore::RenderObject::removeFromRenderFlowThreadIncludingDescendants):

LayoutTests:

* fast/regions/region-with-multicolumn-embedded-crash-expected.txt: Added.
* fast/regions/region-with-multicolumn-embedded-crash.html: Added.

Canonical link: https://commits.webkit.org/154760.324@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182411 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: e22f904981b4403547678ba932726678dcbbc7ae
      https://github.com/WebKit/WebKit/commit/e22f904981b4403547678ba932726678dcbbc7ae
  Author: Andreas Kling <akling at apple.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
    M Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestException.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNondeterministic.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.h
    M Source/WebCore/bindings/scripts/test/JS/JSattribute.h
    M Source/WebCore/bindings/scripts/test/JS/JSreadonly.h

  Log Message:
  -----------
  Merge r180772 - Use NeverDestroyed for JS wrapper owners.
<https://webkit.org/b/142090>

Reviewed by Chris Dumez.

Using NeverDestroyed puts these objects in BSS which is preferable
since that prevents them from pinning down entire malloc pages forever.

* bindings/scripts/CodeGeneratorJS.pm:
(GenerateHeader): Use NeverDestroyed instead of DEPRECATED_DEFINE_STATIC_LOCAL.

* bindings/scripts/test/JS/*: Rebaseline bindings tests for this change.

Canonical link: https://commits.webkit.org/154760.325@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182412 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 29cf32f85024e2c99ec9d03b6bdec1301ffb43a7
      https://github.com/WebKit/WebKit/commit/29cf32f85024e2c99ec9d03b6bdec1301ffb43a7
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    A Source/JavaScriptCore/API/tests/CompareAndSwapTest.cpp
    M Source/JavaScriptCore/API/tests/testapi.c
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/JavaScriptCore.vcxproj/testapi/testapi.vcxproj
    M Source/JavaScriptCore/JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters
    M Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/Atomics.h

  Log Message:
  -----------
  Merge r181305 - 8-bit version of weakCompareAndSwap() can cause an infinite loop.
https://webkit.org/b/142513>

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

Added a test that exercises the 8-bit CAS from multiple threads.  The threads
will contend to set bits in a large array of bytes using the CAS function.

* API/tests/CompareAndSwapTest.cpp: Added.
(Bitmap::Bitmap):
(Bitmap::numBits):
(Bitmap::clearAll):
(Bitmap::concurrentTestAndSet):
(setBitThreadFunc):
(testCompareAndSwap):
* API/tests/testapi.c:
(main):
* JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
* JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:

Source/WTF:

Presently, Bitmap::concurrentTestAndSet() uses the 8-bit version of
weakCompareAndSwap() (which compares and swaps an uint8_t value).
Bitmap::concurrentTestAndSet() has a loop that checks if a bit in the
byte of interest has been set.  If not, it will call the 8-bit CAS
function to set the bit.

Under the covers, for ARM, the 8-bit CAS function actually works with a
32-bit CAS.  The 8-bit CAS will first fetch the 32-bit value in memory
that should contain the 8-bit value, and check if it contains the
expected byte.  If the value in memory doesn't have the expected byte,
it will return early to its caller.  The expectation is that the caller
will reload the byte from memory and call the 8-bit CAS again.

Unfortunately, this code path that returns early does not have a
compiler fence.  Without a compiler fence, the C++ compiler can
optimize away the reloading of the expected byte value, leaving it
unchanged.  As a result, we'll have a infinite loop here that checks a
value that will never change, and the loop will not terminate until the
value changes.

The fix is to eliminate the early return check in the 8-bit CAS, and
have it always call down to the 32-bit CAS.  The 32-bit CAS has a
compiler fence which will prevent this issue.

* wtf/Atomics.h:
(WTF::weakCompareAndSwap):

Canonical link: https://commits.webkit.org/154760.326@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182413 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 2851f44979b8522efa9a093b635214c263f2c65c
      https://github.com/WebKit/WebKit/commit/2851f44979b8522efa9a093b635214c263f2c65c
  Author: Sebastian Dröge <sebastian at centricular.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.cpp
    M Source/WebCore/platform/audio/gstreamer/AudioFileReaderGStreamer.cpp
    M Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/GStreamerUtilities.cpp
    M Source/WebCore/platform/graphics/gstreamer/GStreamerUtilities.h
    M Source/WebCore/platform/graphics/gstreamer/ImageGStreamer.h

  Log Message:
  -----------
  Merge r181449 - Stop using single-include headers that are only available since GStreamer >= 1.2.

https://bugs.webkit.org/show_bug.cgi?id=142537

Patch by Sebastian Dröge <sebastian at centricular.com> on 2015-03-12
Reviewed by Philippe Normand.

* platform/audio/gstreamer/AudioDestinationGStreamer.cpp:
* platform/audio/gstreamer/AudioFileReaderGStreamer.cpp:
* platform/audio/gstreamer/AudioSourceProviderGStreamer.cpp:
* platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
* platform/graphics/gstreamer/GStreamerUtilities.cpp:
* platform/graphics/gstreamer/GStreamerUtilities.h:
* platform/graphics/gstreamer/ImageGStreamer.h:
Instead of using single-include headers for the GStreamer libraries,
directly include the headers we need. The single-include headers were
only added in 1.2, and this would be the only reason why we would
depend on 1.2.

Canonical link: https://commits.webkit.org/154760.327@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182414 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 9fa5adbada790e6163e363617e11d05c988bd53d
      https://github.com/WebKit/WebKit/commit/9fa5adbada790e6163e363617e11d05c988bd53d
  Author: Brady Eidson <beidson at apple.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/icon/IconController.cpp

  Log Message:
  -----------
  Merge r181565 - URLs visited during private browsing show up in WebpageIcons.db
rdar://problem/11254910 and https://bugs.webkit.org/show_bug.cgi?id=142733

Patch by Sam Weinig. Reviewed by Brady Eidson.

* loader/icon/IconController.cpp:
(WebCore::IconController::startLoader): Bail early here if the page is using an ephemeral session.
(WebCore::IconController::continueLoadWithDecision): Instead of here.

Canonical link: https://commits.webkit.org/154760.328@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182415 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: be1aff03212b939168150a48b39a4ec9e3feda4c
      https://github.com/WebKit/WebKit/commit/be1aff03212b939168150a48b39a4ec9e3feda4c
  Author: Alexey Proskuryakov <ap at apple.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/WebProcess/Plugins/PluginView.cpp

  Log Message:
  -----------
  Merge r181599 - ASSERT(m_plugin) on plugins/snapshotting/snapshot-plugin-not-quite-blocked-by-image.html
https://bugs.webkit.org/show_bug.cgi?id=142637

Reviewed by Dean Jackson.

* WebProcess/Plugins/PluginView.cpp: (WebKit::PluginView::pluginSnapshotTimerFired):
m_plugin can be legitimately null.

Canonical link: https://commits.webkit.org/154760.329@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182416 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 5ee9a0e9fcafeaced13c15ce0189fae94464de1b
      https://github.com/WebKit/WebKit/commit/5ee9a0e9fcafeaced13c15ce0189fae94464de1b
  Author: Joanmarie Diggs <jdiggs at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/platform/gtk/accessibility/no-notification-for-unrendered-iframe-children-expected.txt
    A LayoutTests/platform/gtk/accessibility/no-notification-for-unrendered-iframe-children.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/atk/AXObjectCacheAtk.cpp

  Log Message:
  -----------
  Merge r181600 - AX: Crash viewing http://www.last.fm/
https://bugs.webkit.org/show_bug.cgi?id=142309

Reviewed by Chris Fleizach.

Source/WebCore:

The crash occurs when a not-yet-rendered object emits a children-changed
signal. If an assistive technology is listening, AT-SPI2 will attempt to
create and cache the state set for the child being added and the creation
of the state set assumes a rendered object.

Test: platform/gtk/accessibility/no-notification-for-unrendered-iframe-children.html

* accessibility/atk/AXObjectCacheAtk.cpp:
(WebCore::AXObjectCache::attachWrapper):

LayoutTests:

This test doesn't verify the absence of the crash because the crash seems
to require that an assistive technology is listening for events, and that
AT-SPI2 is caching the tree for that assistive technology -- something we
cannot count on being the case on our bots. (I suspect that the reason non-
assistive technology users of Epiphany were getting hit by this is because
Caribou was listening for events in the background, thus they were AT users
without realizing it. That Caribou issue is in theory now resolved.) What
this test does verify is the absence of children-changed:add accessibility
signals for non-rendered objects, which is the source of the crash given
the aforementioned environment.

* platform/gtk/accessibility/no-notification-for-unrendered-iframe-children-expected.txt: Added.
* platform/gtk/accessibility/no-notification-for-unrendered-iframe-children.html: Added.

Canonical link: https://commits.webkit.org/154760.330@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182417 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: d5b75318940428dd8e47447a5df1cb6be3fe15d2
      https://github.com/WebKit/WebKit/commit/d5b75318940428dd8e47447a5df1cb6be3fe15d2
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp

  Log Message:
  -----------
  Merge r181787 - [GTK] Crash due to empty drag image during drag-and-drop
https://bugs.webkit.org/show_bug.cgi?id=142671

Reviewed by Philippe Normand.

Return early from ImageBuffer constructor if an empty size is
given. This is a speculative fix for a crash while starting a drag
and drop operation, that I haven't been able to reproduce.

* platform/graphics/cairo/ImageBufferCairo.cpp:
(WebCore::ImageBuffer::ImageBuffer):

Canonical link: https://commits.webkit.org/154760.331@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182418 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: cf6e27e4d85d520e1678f967fb181ffe03087299
      https://github.com/WebKit/WebKit/commit/cf6e27e4d85d520e1678f967fb181ffe03087299
  Author: Manuel Rego Casasnovas <rego at igalia.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/css3/flexbox/flex-item-text-background-not-interleaved-expected.html
    A LayoutTests/css3/flexbox/flex-item-text-background-not-interleaved.html
    A LayoutTests/fast/css-grid-layout/grid-item-text-background-not-interleaved-expected.html
    A LayoutTests/fast/css-grid-layout/grid-item-text-background-not-interleaved.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/InlineElementBox.cpp
    M Source/WebCore/rendering/RenderBlock.cpp
    M Source/WebCore/rendering/RenderBlock.h
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderElement.h
    M Source/WebCore/rendering/RenderFlexibleBox.cpp
    M Source/WebCore/rendering/RenderGrid.cpp

  Log Message:
  -----------
  Merge r181691 - Flex and grid items should be painted as inline-blocks
https://bugs.webkit.org/show_bug.cgi?id=142266

Reviewed by Darin Adler.

Source/WebCore:

Based on Blink r157004 by <cbiesinger at chromium.org>.
https://src.chromium.org/viewvc/blink?revision=157004&view=revision

Both flexbox and grid specs define that the painting order of flex/grid
items is the same as inline blocks. See
http://dev.w3.org/csswg/css-flexbox/#painting and
http://dev.w3.org/csswg/css-grid/#z-order.

Extracted inline blocks painting code from InlineElementBox and moved to
a helper method that will be reused for flexboxes and grids.

Tests: css3/flexbox/flex-item-text-background-not-interleaved.html
       fast/css-grid-layout/grid-item-text-background-not-interleaved.html

* rendering/InlineElementBox.cpp:
(WebCore::InlineElementBox::paint): Move code to
RenderElement::paintAsInlineBlock().
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::paintChild): Add new argument to paint children
as inline blocks.
* rendering/RenderBlock.h: Define PaintType enmu and modify paintChild()
signature to add the new argument.
* rendering/RenderElement.cpp:
(WebCore::paintPhase): Paint element in a phase.
(WebCore::RenderElement::paintAsInlineBlock): Code extracted from
InlineElementBox::paint().
* rendering/RenderElement.h: Add new method signature.
* rendering/RenderFlexibleBox.cpp:
(WebCore::RenderFlexibleBox::paintChildren): Call
RenderBlock::paintChild() with the new argument.
* rendering/RenderGrid.cpp:
(WebCore::RenderGrid::paintChildren): Ditto.

LayoutTests:

* css3/flexbox/flex-item-text-background-not-interleaved-expected.html: Added.
* css3/flexbox/flex-item-text-background-not-interleaved.html: Added.
* fast/css-grid-layout/float-not-protruding-into-next-grid-item-expected.html:
Add some vertical space to avoid issues with backgrounds.
* fast/css-grid-layout/float-not-protruding-into-next-grid-item.html:
Ditto.
* fast/css-grid-layout/grid-item-text-background-not-interleaved-expected.html: Added.
* fast/css-grid-layout/grid-item-text-background-not-interleaved.html: Added.

Canonical link: https://commits.webkit.org/154760.332@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182419 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: d1c706ed25ab1ec123747a1a8f2c388f35d5c1fc
      https://github.com/WebKit/WebKit/commit/d1c706ed25ab1ec123747a1a8f2c388f35d5c1fc
  Author: Joseph Pecoraro <pecoraro at apple.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/editing/selection/click-after-last-inline-crash-expected.txt
    A LayoutTests/editing/selection/click-after-last-inline-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RootInlineBox.cpp

  Log Message:
  -----------
  Merge r181773 - Source/WebCore:
REGRESSION (r109593): Clicking after last inline element could cause a crash.
https://bugs.webkit.org/show_bug.cgi?id=142880
rdar://problem/17222294

Reviewed by Ryosuke Niwa.

Test: editing/selection/click-after-last-inline-crash.html

* rendering/RootInlineBox.cpp:
(WebCore::RootInlineBox::closestLeafChildForLogicalLeftPosition):

Canonical link: https://commits.webkit.org/154760.333@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182420 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 516790d34a6b99469b1add5d597a3e28cc9ee821
      https://github.com/WebKit/WebKit/commit/516790d34a6b99469b1add5d597a3e28cc9ee821
  Author: Filip Pizlo <fpizlo at apple.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp
    M Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp
    M Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp

  Log Message:
  -----------
  Merge r181835 - DFG OSR exit shouldn't assume that the frame count for exit is greater than the frame count in DFG
https://bugs.webkit.org/show_bug.cgi?id=142948

Reviewed by Sam Weinig.

It's necessary to ensure that the stack pointer accounts for the extent of our stack usage
since a signal may clobber the area below the stack pointer. When the DFG is executing,
the stack pointer accounts for the DFG's worst-case stack usage. When we OSR exit back to
baseline, we will use a different amount of stack. This is because baseline is a different
compiler. It will make different decisions. So it will use a different amount of stack.

This gets tricky when we are in the process of doing an OSR exit, because we are sort of
incrementally transforming the stack from how it looked in the DFG to how it will look in
baseline. The most conservative approach would be to set the stack pointer to the max of
DFG and baseline.

When this code was written, a reckless assumption was made: that the stack usage in
baseline is always at least as large as the stack usage in DFG. Based on this incorrect
assumption, the code first adjusts the stack pointer to account for the baseline stack
usage. This sort of usually works, because usually baseline does happen to use more stack.
But that's not an invariant. Nobody guarantees this. We will never make any changes that
would make this be guaranteed, because that would be antithetical to how optimizing
compilers work. The DFG should be allowed to use however much stack it decides that it
should use in order to get good performance, and it shouldn't try to guarantee that it
always uses less stack than baseline.

As such, we must always assume that the frame size for DFG execution (i.e.
frameRegisterCount) and the frame size in baseline once we exit (i.e.
requiredRegisterCountForExit) are two independent quantities and they have no
relationship.

Fortunately, though, this code can be made correct by just moving the stack adjustment to
just before we do conversions. This is because we have since changed the OSR exit
algorithm to first lift up all state from the DFG state into a scratch buffer, and then to
drop it out of the scratch buffer and into the stack according to the baseline layout. The
point just before conversions is the point where we have finished reading the DFG frame
and will not read it anymore, and we haven't started writing the baseline frame. So, at
this point it is safe to set the stack pointer to account for the frame size at exit.

This is benign because baseline happens to create larger frames than DFG.

* dfg/DFGOSRExitCompiler32_64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompiler64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompilerCommon.cpp:
(JSC::DFG::adjustAndJumpToTarget):

Canonical link: https://commits.webkit.org/154760.334@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182421 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 0ee4cd549d6e318c405a81e81338251b522c4d1c
      https://github.com/WebKit/WebKit/commit/0ee4cd549d6e318c405a81e81338251b522c4d1c
  Author: Anders Carlsson <andersca at apple.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/mac-wk2/TestExpectations
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/Shared/Plugins/NPObjectMessageReceiver.cpp

  Log Message:
  -----------
  Merge r181864 - Source/WebKit2:
Make platform/mac-wk2/plugins/destroy-during-async-npp-new.html work again.
https://bugs.webkit.org/show_bug.cgi?id=133692
rdar://problem/17255947

Reviewed by Alexey Proskuryakov.

Add plug-in destruction protectors around message receiver code that can call out to NPObjects or JavaScript
where we need the plug-in to stay around after the call.

* Shared/Plugins/NPObjectMessageReceiver.cpp:
(WebKit::NPObjectMessageReceiver::invoke):
(WebKit::NPObjectMessageReceiver::invokeDefault):
(WebKit::NPObjectMessageReceiver::getProperty):
(WebKit::NPObjectMessageReceiver::setProperty):
(WebKit::NPObjectMessageReceiver::construct):

LayoutTests:
Make platform/mac-wk2/plugins/destroy-during-async-npp-new.html work again
https://bugs.webkit.org/show_bug.cgi?id=133692
rdar://problem/17255947

Reviewed by Alexey Proskuryakov.

* platform/mac-wk2/TestExpectations:
Unskip test.

Canonical link: https://commits.webkit.org/154760.335@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182422 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 650fcb4bb8e13ef85d67a59fdd6ba1a271dc9ef8
      https://github.com/WebKit/WebKit/commit/650fcb4bb8e13ef85d67a59fdd6ba1a271dc9ef8
  Author: YunQiang Su <wzssyqa at gmail.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/Platform.h
    M Source/WTF/wtf/dtoa/utils.h

  Log Message:
  -----------
  Merge r178725 - Fix failed to build for Linux/MIPS64EL
https://bugs.webkit.org/show_bug.cgi?id=124370

Patch by YunQiang Su <wzssyqa at gmail.com> on 2015-01-20
Reviewed by Darin Adler.

Add MIPS64EL support.

* wtf/Platform.h:
* wtf/dtoa/utils.h:

Canonical link: https://commits.webkit.org/154760.336@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182425 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: db19ea04c0679a9c36383bf099a2690c072dc63a
      https://github.com/WebKit/WebKit/commit/db19ea04c0679a9c36383bf099a2690c072dc63a
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/http/tests/misc/css-accept-any-type-expected.txt
    M LayoutTests/http/tests/misc/css-accept-any-type.html
    M LayoutTests/http/tests/security/cross-origin-css-expected.txt
    M LayoutTests/http/tests/security/cross-origin-css.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/StyleSheetContents.cpp
    M Source/WebCore/dom/ProcessingInstruction.cpp
    M Source/WebCore/inspector/InspectorPageAgent.cpp
    M Source/WebCore/loader/cache/CachedCSSStyleSheet.cpp
    M Source/WebCore/loader/cache/CachedCSSStyleSheet.h

  Log Message:
  -----------
  Merge r180020 - Drop the quirks-mode exception for CSS MIME types
https://bugs.webkit.org/show_bug.cgi?id=141501

Reviewed by Alexey Proskuryakov.

Source/WebCore:

Drop the quirks-mode exception for CSS MIME types.
This matches Firefox's behavior.

This patch is based on the following Blink revision:
http://src.chromium.org/viewvc/blink?view=revision&revision=189669

Tests:
- http/tests/misc/css-accept-any-type.html
- http/tests/security/cross-origin-css.html

* css/StyleSheetContents.cpp:
(WebCore::StyleSheetContents::parseAuthorStyleSheet):
* dom/ProcessingInstruction.cpp:
(WebCore::ProcessingInstruction::setCSSStyleSheet):
* inspector/InspectorPageAgent.cpp:
(WebCore::InspectorPageAgent::cachedResourceContent):
* loader/cache/CachedCSSStyleSheet.cpp:
(WebCore::CachedCSSStyleSheet::sheetText):
(WebCore::CachedCSSStyleSheet::canUseSheet):
* loader/cache/CachedCSSStyleSheet.h:

LayoutTests:

Update a couple of layout tests now that we dropped the quirks-mode
exception for CSS MIME types.

* http/tests/misc/css-accept-any-type-expected.txt:
* http/tests/misc/css-accept-any-type.html:
* http/tests/security/cross-origin-css-expected.txt:
* http/tests/security/cross-origin-css.html:

Canonical link: https://commits.webkit.org/154760.337@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182426 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 2db5c4984d0ea8f5847ed589a002957cbd158e10
      https://github.com/WebKit/WebKit/commit/2db5c4984d0ea8f5847ed589a002957cbd158e10
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2015-04-06 (Mon, 06 Apr 2015)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation-expected.txt
    A LayoutTests/fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderInline.cpp

  Log Message:
  -----------
  Merge r182051 - Inline continuation code should not take anonymous containing wrapper granted.
https://bugs.webkit.org/show_bug.cgi?id=133312

Reviewed by Dave Hyatt.

It's wrong to assume that when RenderInline is part of an inline continuation, its containing block
is an anonymous wrapper and its sibling might be a block level renderer.
When the inline continuation is no longer needed, for example when the block level renderer that initiated the continuation
is detached from the render tree, the inline renderes still continue to form continuation.(however they no longer require
anonymous wrappers)

Source/WebCore:

Test: fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation.html

* rendering/RenderInline.cpp:
(WebCore::updateStyleOfAnonymousBlockContinuations):
(WebCore::RenderInline::styleDidChange):

LayoutTests:

* fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation-expected.txt: Added.
* fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation.html: Added.

Canonical link: https://commits.webkit.org/154760.338@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182427 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: d8d7a134fa8619256f0e20bf86ed36e265575225
      https://github.com/WebKit/WebKit/commit/d8d7a134fa8619256f0e20bf86ed36e265575225
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2015-04-07 (Tue, 07 Apr 2015)

  Changed paths:
    M CMakeLists.txt
    M ChangeLog
    M Source/JavaScriptCore/CMakeLists.txt
    M Source/JavaScriptCore/ChangeLog

  Log Message:
  -----------
  Merge r182450 - [GTK] Fix HPPA build
https://bugs.webkit.org/show_bug.cgi?id=143453

Reviewed by Darin Adler.

Add HPPA to the list of supported CPUs.

* CMakeLists.txt:

Canonical link: https://commits.webkit.org/154760.339@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182451 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: 1f3bbde37716232311b03faa596443f10314d05e
      https://github.com/WebKit/WebKit/commit/1f3bbde37716232311b03faa596443f10314d05e
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2015-04-07 (Tue, 07 Apr 2015)

  Changed paths:
    M ChangeLog
    M Source/WebKit2/ChangeLog
    M Source/WebKit2/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.6.6 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit2:

* gtk/NEWS: Add release notes for 2.6.6.

Canonical link: https://commits.webkit.org/154760.340@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182453 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: eb34ea80542fc00055b8131a8f631ada8d64d001
      https://github.com/WebKit/WebKit/commit/eb34ea80542fc00055b8131a8f631ada8d64d001
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-08 (Wed, 08 Apr 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/gobject/DOMObjectCache.cpp

  Log Message:
  -----------
  Merge r180216 - Use HashMap::add instead of get/contains + set in DOMObjectCache
https://bugs.webkit.org/show_bug.cgi?id=141558

Rubber-stamped by Žan Doberšek.

* bindings/gobject/DOMObjectCache.cpp:
(WebKit::getOrCreateDOMObjectCacheFrameObserver):
(WebKit::DOMObjectCache::put):

Canonical link: https://commits.webkit.org/154760.341@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182538 268f45cc-cd09-0410-ab3c-d52691b4dbfc


  Commit: bb9defabaa42ca0ddbd109f467dc0e1ec37d906b
      https://github.com/WebKit/WebKit/commit/bb9defabaa42ca0ddbd109f467dc0e1ec37d906b
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2015-04-08 (Wed, 08 Apr 2015)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/gobject/DOMObjectCache.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/DOMNodeTest.cpp
    M Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestWebExtensions.cpp
    M Tools/TestWebKitAPI/gtk/WebKit2Gtk/WebViewTest.cpp
    M Tools/TestWebKitAPI/gtk/WebKit2Gtk/WebViewTest.h

  Log Message:
  -----------
  Merge r182537 - [GTK] Crash in DOMObjectCache when a wrapped object owned by the cache is unreffed by the user
https://bugs.webkit.org/show_bug.cgi?id=143521

Reviewed by Martin Robinson.

This is a case we claim to support, but it only works if the
object has only one reference. In that case, when the user unrefs
it, the weak ref notify callback removes the object from the
cache. However, if the object has more than one ref, the cache
doesn't know the user unreffed it, and when clearing the cache we
try to remove more references than what the object actually has,
causing a crash in g_object_unref.

* bindings/gobject/DOMObjectCache.cpp:
(WebKit::DOMObjectCacheData::clearObject):

Canonical link: https://commits.webkit.org/154760.342@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182539 268f45cc-cd09-0410-ab3c-d52691b4dbfc


Compare: https://github.com/WebKit/WebKit/compare/1d77e9300ed3%5E...bb9defabaa42


More information about the webkit-changes mailing list