<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[171377] branches/safari-537.78-branch</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/171377">171377</a></dd>
<dt>Author</dt> <dd>dburkart@apple.com</dd>
<dt>Date</dt> <dd>2014-07-22 17:41:02 -0700 (Tue, 22 Jul 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/169475">r169475</a></pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#branchessafari53778branchLayoutTestsChangeLog">branches/safari-537.78-branch/LayoutTests/ChangeLog</a></li>
<li><a href="#branchessafari53778branchLayoutTestscompositingpluginscompositedpluginhtml">branches/safari-537.78-branch/LayoutTests/compositing/plugins/composited-plugin.html</a></li>
<li><a href="#branchessafari53778branchLayoutTestscompositingpluginsnobackingstorehtml">branches/safari-537.78-branch/LayoutTests/compositing/plugins/no-backing-store.html</a></li>
<li><a href="#branchessafari53778branchLayoutTestsfastdombeforeloadflashbeforeloadhtml">branches/safari-537.78-branch/LayoutTests/fast/dom/beforeload/flash-before-load.html</a></li>
<li><a href="#branchessafari53778branchLayoutTestshttptestssecuritycontentSecurityPolicy11plugintypesnotypedatahtml">branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/plugintypes-notype-data.html</a></li>
<li><a href="#branchessafari53778branchLayoutTestshttptestssecuritycontentSecurityPolicy11plugintypesnourlblockedhtml">branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/plugintypes-nourl-blocked.html</a></li>
<li><a href="#branchessafari53778branchLayoutTestshttptestssecuritycontentSecurityPolicyobjectsrcnourlallowedhtml">branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-no-url-allowed.html</a></li>
<li><a href="#branchessafari53778branchLayoutTestshttptestssecuritycontentSecurityPolicyobjectsrcnourlblockedhtml">branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-no-url-blocked.html</a></li>
<li><a href="#branchessafari53778branchLayoutTestshttptestssecuritycontentSecurityPolicyobjectsrcnoneallowedhtml">branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-none-allowed.html</a></li>
<li><a href="#branchessafari53778branchLayoutTestshttptestssecuritycontentSecurityPolicyobjectsrcnoneblockedhtml">branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-none-blocked.html</a></li>
<li><a href="#branchessafari53778branchLayoutTestshttptestssecuritycontentSecurityPolicyresourcesmultipleiframeplugintestjs">branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/resources/multiple-iframe-plugin-test.js</a></li>
<li><a href="#branchessafari53778branchLayoutTestshttptestssecuritymixedContentinsecureplugininiframehtml">branches/safari-537.78-branch/LayoutTests/http/tests/security/mixedContent/insecure-plugin-in-iframe.html</a></li>
<li><a href="#branchessafari53778branchLayoutTestsplatformmacpluginssupportscarboneventmodelhtml">branches/safari-537.78-branch/LayoutTests/platform/mac/plugins/supports-carbon-event-model.html</a></li>
<li><a href="#branchessafari53778branchLayoutTestsplatformmacpluginstestpluginonnewonpainthtml">branches/safari-537.78-branch/LayoutTests/platform/mac/plugins/testplugin-onnew-onpaint.html</a></li>
<li><a href="#branchessafari53778branchLayoutTestspluginsgetuseragentwithnullnppfromnppnewhtml">branches/safari-537.78-branch/LayoutTests/plugins/get-user-agent-with-null-npp-from-npp-new.html</a></li>
<li><a href="#branchessafari53778branchLayoutTestspluginsmouseclickpluginclearsselectionhtml">branches/safari-537.78-branch/LayoutTests/plugins/mouse-click-plugin-clears-selection.html</a></li>
<li><a href="#branchessafari53778branchLayoutTestspluginsnetscapepluginmapdatatosrchtml">branches/safari-537.78-branch/LayoutTests/plugins/netscape-plugin-map-data-to-src.html</a></li>
<li><a href="#branchessafari53778branchLayoutTestspluginsnomimewithvalidextensionhtml">branches/safari-537.78-branch/LayoutTests/plugins/no-mime-with-valid-extension.html</a></li>
<li><a href="#branchessafari53778branchLayoutTestspluginsplugininitiatepopupwindowhtml">branches/safari-537.78-branch/LayoutTests/plugins/plugin-initiate-popup-window.html</a></li>
<li><a href="#branchessafari53778branchLayoutTestspluginswindowless_plugin_paint_testhtml">branches/safari-537.78-branch/LayoutTests/plugins/windowless_plugin_paint_test.html</a></li>
<li><a href="#branchessafari53778branchSourceWebCoreChangeLog">branches/safari-537.78-branch/Source/WebCore/ChangeLog</a></li>
<li><a href="#branchessafari53778branchSourceWebCoreWebCoreexpin">branches/safari-537.78-branch/Source/WebCore/WebCore.exp.in</a></li>
<li><a href="#branchessafari53778branchSourceWebCoredomDocumentcpp">branches/safari-537.78-branch/Source/WebCore/dom/Document.cpp</a></li>
<li><a href="#branchessafari53778branchSourceWebCoredomDocumenth">branches/safari-537.78-branch/Source/WebCore/dom/Document.h</a></li>
<li><a href="#branchessafari53778branchSourceWebCorehtmlHTMLAppletElementcpp">branches/safari-537.78-branch/Source/WebCore/html/HTMLAppletElement.cpp</a></li>
<li><a href="#branchessafari53778branchSourceWebCorehtmlHTMLEmbedElementcpp">branches/safari-537.78-branch/Source/WebCore/html/HTMLEmbedElement.cpp</a></li>
<li><a href="#branchessafari53778branchSourceWebCorehtmlHTMLObjectElementcpp">branches/safari-537.78-branch/Source/WebCore/html/HTMLObjectElement.cpp</a></li>
<li><a href="#branchessafari53778branchSourceWebCorepageFrameViewcpp">branches/safari-537.78-branch/Source/WebCore/page/FrameView.cpp</a></li>
<li><a href="#branchessafari53778branchSourceWebCorepageFrameViewh">branches/safari-537.78-branch/Source/WebCore/page/FrameView.h</a></li>
<li><a href="#branchessafari53778branchSourceWebCoretestingInternalscpp">branches/safari-537.78-branch/Source/WebCore/testing/Internals.cpp</a></li>
<li><a href="#branchessafari53778branchSourceWebCoretestingInternalsh">branches/safari-537.78-branch/Source/WebCore/testing/Internals.h</a></li>
<li><a href="#branchessafari53778branchSourceWebCoretestingInternalsidl">branches/safari-537.78-branch/Source/WebCore/testing/Internals.idl</a></li>
<li><a href="#branchessafari53778branchSourceWebKitChangeLog">branches/safari-537.78-branch/Source/WebKit/ChangeLog</a></li>
<li><a href="#branchessafari53778branchSourceWebKitWebKitvcxprojWebKitExportGeneratorWebKitExportsdefin">branches/safari-537.78-branch/Source/WebKit/WebKit.vcxproj/WebKitExportGenerator/WebKitExports.def.in</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchessafari53778branchLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/ChangeLog (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/ChangeLog        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/ChangeLog        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -1,3 +1,45 @@
</span><ins>+2014-07-22  Dana Burkart  &lt;dburkart@apple.com&gt;
+
+        Merge r169475
+
+    2014-05-28  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
+
+            Roll r168668 back in.
+
+            &lt;https://bugs.webkit.org/show_bug.cgi?id=132621&gt;
+
+            Reviewed by Brent Fulgham.
+
+            * compositing/plugins/composited-plugin.html:
+            * compositing/plugins/no-backing-store.html:
+            * fast/dom/beforeload/flash-before-load.html:
+            * fast/events/beforeload-assertion-expected.txt: Added.
+            * fast/events/beforeload-assertion.html: Added.
+            * fast/events/beforeload-iframe-crash-expected.txt: Added.
+            * fast/events/beforeload-iframe-crash.html: Added.
+            * fast/events/beforeload-input-time-crash-expected.txt: Added.
+            * fast/events/beforeload-input-time-crash.html: Added.
+            * http/tests/security/contentSecurityPolicy/1.1/plugintypes-notype-data.html:
+            * http/tests/security/contentSecurityPolicy/1.1/plugintypes-nourl-blocked.html:
+            * http/tests/security/contentSecurityPolicy/object-src-no-url-allowed.html:
+            * http/tests/security/contentSecurityPolicy/object-src-no-url-blocked.html:
+            * http/tests/security/contentSecurityPolicy/object-src-none-allowed.html:
+            * http/tests/security/contentSecurityPolicy/object-src-none-blocked.html:
+            * http/tests/security/contentSecurityPolicy/resources/multiple-iframe-plugin-test.js:
+            (testImpl.iframe.onload):
+            (testImpl):
+            * http/tests/security/mixedContent/insecure-plugin-in-iframe.html:
+            * platform/mac/plugins/supports-carbon-event-model.html:
+            * platform/mac/plugins/testplugin-onnew-onpaint.html:
+            * plugins/get-user-agent-with-null-npp-from-npp-new.html:
+            * plugins/mouse-click-plugin-clears-selection.html:
+            * plugins/netscape-plugin-map-data-to-src.html:
+            * plugins/no-mime-with-valid-extension.html:
+            * plugins/plugin-initiate-popup-window.html:
+            * plugins/windowless_plugin_paint_test.html:
+            * resources/plugin.js: Added.
+            (runAfterPluginLoad):
+
</ins><span class="cx"> 2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Merge r170946
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestscompositingpluginscompositedpluginhtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/compositing/plugins/composited-plugin.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/compositing/plugins/composited-plugin.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/compositing/plugins/composited-plugin.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -1,6 +1,8 @@
</span><span class="cx"> &lt;!DOCTYPE html&gt;
</span><span class="cx"> &lt;html&gt;
</span><span class="cx"> &lt;body&gt;
</span><ins>+  &lt;script src=&quot;../../resources/plugin.js&quot;&gt;&lt;/script&gt;
+  &lt;script&gt;runAfterPluginLoad(null, NotifyDone);&lt;/script&gt;
</ins><span class="cx">   &lt;embed type=&quot;application/x-webkit-test-netscape&quot; drawingmodel=&quot;coreanimation&quot;&gt;
</span><span class="cx"> &lt;/body&gt;
</span><span class="cx"> &lt;/html&gt;
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestscompositingpluginsnobackingstorehtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/compositing/plugins/no-backing-store.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/compositing/plugins/no-backing-store.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/compositing/plugins/no-backing-store.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -6,12 +6,13 @@
</span><span class="cx">       margin: 10px;
</span><span class="cx">     }
</span><span class="cx">   &lt;/style&gt;
</span><ins>+  &lt;script src=&quot;../../resources/plugin.js&quot;&gt;&lt;/script&gt;
</ins><span class="cx">   &lt;script type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;
</span><del>-    if (window.testRunner) {
</del><ins>+    if (window.testRunner)
</ins><span class="cx">         testRunner.dumpAsText();
</span><del>-        testRunner.waitUntilDone();
-    }
</del><span class="cx"> 
</span><ins>+    runAfterPluginLoad(doTest, DoNotNotifyDone);
+
</ins><span class="cx">     function doTest()
</span><span class="cx">     {
</span><span class="cx">         // Need to wait for compositing layers to be updated. FIXME remove.
</span><span class="lines">@@ -22,7 +23,6 @@
</span><span class="cx">             }
</span><span class="cx">         }, 0)
</span><span class="cx">     }
</span><del>-    window.addEventListener('load', doTest, false);
</del><span class="cx">   &lt;/script&gt;
</span><span class="cx"> &lt;/head&gt;
</span><span class="cx"> &lt;body&gt;
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestsfastdombeforeloadflashbeforeloadhtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/fast/dom/beforeload/flash-before-load.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/fast/dom/beforeload/flash-before-load.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/fast/dom/beforeload/flash-before-load.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -4,9 +4,12 @@
</span><span class="cx"> &lt;/head&gt;
</span><span class="cx"> &lt;body&gt;
</span><span class="cx"> &lt;div id=&quot;console&quot;&gt;&lt;/div&gt;
</span><ins>+&lt;script src=&quot;../../../resources/plugin.js&quot;&gt;&lt;/script&gt;
</ins><span class="cx"> &lt;script&gt;
</span><del>-if (window.testRunner)
-    testRunner.dumpAsText();
</del><ins>+    if (window.testRunner)
+        testRunner.dumpAsText();
+
+    runAfterPluginLoad(null, NotifyDone);
</ins><span class="cx"> &lt;/script&gt;
</span><span class="cx"> 
</span><span class="cx"> &lt;object id=&quot;plugin&quot; onbeforeload=&quot;return false&quot; type=&quot;application/x-shockwave-flash&quot; data=&quot;../../../plugins/resources/simple_blank.swf&quot;
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestshttptestssecuritycontentSecurityPolicy11plugintypesnotypedatahtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/plugintypes-notype-data.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/plugintypes-notype-data.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/plugintypes-notype-data.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -1,11 +1,14 @@
</span><span class="cx"> &lt;!DOCTYPE html&gt;                                                                                                                                                                                
</span><span class="cx"> &lt;html&gt;
</span><span class="cx"> &lt;head&gt;
</span><ins>+&lt;script src=&quot;/js-test-resources/plugin.js&quot;&gt;&lt;/script&gt;
</ins><span class="cx"> &lt;script&gt;
</span><del>-if (window.testRunner) {
-    testRunner.dumpAsText();
-    testRunner.dumpChildFramesAsText();
-}
</del><ins>+    if (window.testRunner) {
+        testRunner.dumpAsText();
+        testRunner.dumpChildFramesAsText();
+    }
+
+    runAfterPluginLoad(null, NotifyDone);
</ins><span class="cx"> &lt;/script&gt;
</span><span class="cx"> &lt;script src=&quot;/plugins/resources/mock-plugin-logger.js&quot;&gt;&lt;/script&gt;
</span><span class="cx"> &lt;meta http-equiv=&quot;X-WebKit-CSP&quot; content=&quot;plugin-types application/x-invalid-type&quot;&gt;
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestshttptestssecuritycontentSecurityPolicy11plugintypesnourlblockedhtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/plugintypes-nourl-blocked.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/plugintypes-nourl-blocked.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/plugintypes-nourl-blocked.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -1,9 +1,12 @@
</span><span class="cx"> &lt;!DOCTYPE html&gt;
</span><span class="cx"> &lt;html&gt;
</span><span class="cx"> &lt;head&gt;
</span><ins>+&lt;script src=&quot;/js-test-resources/plugin.js&quot;&gt;&lt;/script&gt;
</ins><span class="cx"> &lt;script&gt;
</span><del>-if (window.testRunner)
-    testRunner.dumpAsText();
</del><ins>+    if (window.testRunner)
+        testRunner.dumpAsText();
+
+    runAfterPluginLoad(null, NotifyDone);
</ins><span class="cx"> &lt;/script&gt;
</span><span class="cx"> &lt;meta http-equiv=&quot;X-WebKit-CSP&quot; content=&quot;plugin-types text/plain&quot;&gt;
</span><span class="cx"> &lt;/head&gt;
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestshttptestssecuritycontentSecurityPolicyobjectsrcnourlallowedhtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-no-url-allowed.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-no-url-allowed.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-no-url-allowed.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -1,9 +1,12 @@
</span><span class="cx"> &lt;!DOCTYPE html&gt;
</span><span class="cx"> &lt;html&gt;
</span><span class="cx"> &lt;head&gt;
</span><ins>+&lt;script src=&quot;/js-test-resources/plugin.js&quot;&gt;&lt;/script&gt;
</ins><span class="cx"> &lt;script&gt;
</span><del>-if (window.testRunner)
-  testRunner.dumpAsText();
</del><ins>+    if (window.testRunner)
+        testRunner.dumpAsText();
+
+    runAfterPluginLoad(null, NotifyDone);
</ins><span class="cx"> &lt;/script&gt;
</span><span class="cx"> &lt;meta http-equiv=&quot;Content-Security-Policy&quot; content=&quot;object-src 'self'&quot;&gt;
</span><span class="cx"> &lt;/head&gt;
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestshttptestssecuritycontentSecurityPolicyobjectsrcnourlblockedhtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-no-url-blocked.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-no-url-blocked.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-no-url-blocked.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -1,9 +1,12 @@
</span><span class="cx"> &lt;!DOCTYPE html&gt;
</span><span class="cx"> &lt;html&gt;
</span><span class="cx"> &lt;head&gt;
</span><ins>+&lt;script src=&quot;/js-test-resources/plugin.js&quot;&gt;&lt;/script&gt;
</ins><span class="cx"> &lt;script&gt;
</span><del>-if (window.testRunner)
-  testRunner.dumpAsText();
</del><ins>+    if (window.testRunner)
+        testRunner.dumpAsText();
+
+    runAfterPluginLoad(null, NotifyDone);
</ins><span class="cx"> &lt;/script&gt;
</span><span class="cx"> &lt;meta http-equiv=&quot;Content-Security-Policy&quot; content=&quot;object-src 'none'&quot;&gt;
</span><span class="cx"> &lt;/head&gt;
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestshttptestssecuritycontentSecurityPolicyobjectsrcnoneallowedhtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-none-allowed.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-none-allowed.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-none-allowed.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -1,14 +1,17 @@
</span><span class="cx"> &lt;!DOCTYPE html&gt;
</span><span class="cx"> &lt;html&gt;
</span><span class="cx"> &lt;head&gt;
</span><del>-&lt;script&gt;
-if (window.testRunner) {
-  testRunner.dumpAsText();
-  testRunner.dumpChildFramesAsText();
-}
-&lt;/script&gt;
</del><ins>+&lt;script src=&quot;/js-test-resources/plugin.js&quot;&gt;&lt;/script&gt;
</ins><span class="cx"> &lt;/head&gt;
</span><span class="cx"> &lt;body&gt;
</span><span class="cx">   &lt;iframe src=&quot;http://127.0.0.1:8000/security/contentSecurityPolicy/resources/echo-object-data.pl?plugin=data:application/x-webkit-test-netscape,logifloaded&amp;log=PASS!&amp;csp=img-src%20'none'&quot;&gt;&lt;/iframe&gt;
</span><span class="cx"> &lt;/body&gt;
</span><ins>+&lt;script&gt;
+    if (window.testRunner) {
+        testRunner.dumpAsText();
+        testRunner.dumpChildFramesAsText();
+    }
+
+    runAfterPluginLoad(null, NotifyDone, document.getElementsByTagName(&quot;iframe&quot;)[0]);
+&lt;/script&gt;
</ins><span class="cx"> &lt;/html&gt;
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestshttptestssecuritycontentSecurityPolicyobjectsrcnoneblockedhtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-none-blocked.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-none-blocked.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-none-blocked.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -1,14 +1,17 @@
</span><span class="cx"> &lt;!DOCTYPE html&gt;
</span><span class="cx"> &lt;html&gt;
</span><span class="cx"> &lt;head&gt;
</span><del>-&lt;script&gt;
-if (window.testRunner) {
-  testRunner.dumpAsText();
-  testRunner.dumpChildFramesAsText();
-}
-&lt;/script&gt;
</del><ins>+&lt;script src=&quot;/js-test-resources/plugin.js&quot;&gt;&lt;/script&gt;
</ins><span class="cx"> &lt;/head&gt;
</span><span class="cx"> &lt;body&gt;
</span><span class="cx">   &lt;iframe src=&quot;http://127.0.0.1:8000/security/contentSecurityPolicy/resources/echo-object-data.pl?plugin=data:application/x-webkit-test-netscape,logifloaded&amp;log=FAIL&amp;csp=object-src%20'none'&quot;&gt;&lt;/iframe&gt;
</span><span class="cx"> &lt;/body&gt;
</span><ins>+&lt;script&gt;
+    if (window.testRunner) {
+        testRunner.dumpAsText();
+        testRunner.dumpChildFramesAsText();
+    }
+
+    runAfterPluginLoad(null, NotifyDone, document.getElementsByTagName(&quot;iframe&quot;)[0]);
+&lt;/script&gt;
</ins><span class="cx"> &lt;/html&gt;
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestshttptestssecuritycontentSecurityPolicyresourcesmultipleiframeplugintestjs"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/resources/multiple-iframe-plugin-test.js (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/resources/multiple-iframe-plugin-test.js        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/http/tests/security/contentSecurityPolicy/resources/multiple-iframe-plugin-test.js        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -38,7 +38,11 @@
</span><span class="cx">     else
</span><span class="cx">         iframe.src += &quot;&amp;type=application/x-webkit-test-netscape&quot;;
</span><span class="cx"> 
</span><del>-    iframe.onload = function() { testImpl(experimental); };
</del><ins>+    iframe.onload = function() {
+        if (window.internals)
+            internals.updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks(iframe);
+        testImpl(experimental);
+    };
</ins><span class="cx">     document.body.appendChild(iframe);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestshttptestssecuritymixedContentinsecureplugininiframehtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/http/tests/security/mixedContent/insecure-plugin-in-iframe.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/http/tests/security/mixedContent/insecure-plugin-in-iframe.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/http/tests/security/mixedContent/insecure-plugin-in-iframe.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -3,6 +3,11 @@
</span><span class="cx"> &lt;script&gt;
</span><span class="cx"> if (window.testRunner)
</span><span class="cx">     testRunner.dumpAsText();
</span><ins>+
+onload = function() {
+    if (window.internals)
+        internals.updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks(document.querySelector('iframe'));
+};
</ins><span class="cx"> &lt;/script&gt;
</span><span class="cx"> &lt;p&gt;This test loads a secure iframe that loads an insecure plugin.  We should
</span><span class="cx"> get a mixed content callback because the insecure plug-in can script the secure
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestsplatformmacpluginssupportscarboneventmodelhtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/platform/mac/plugins/supports-carbon-event-model.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/platform/mac/plugins/supports-carbon-event-model.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/platform/mac/plugins/supports-carbon-event-model.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -1,6 +1,9 @@
</span><ins>+&lt;script src=&quot;../../../resources/plugin.js&quot;&gt;&lt;/script&gt;
</ins><span class="cx"> &lt;script&gt;
</span><del>-if (window.testRunner)
-    testRunner.dumpAsText();
</del><ins>+    if (window.testRunner)
+        testRunner.dumpAsText();
+
+    runAfterPluginLoad(null, NotifyDone);
</ins><span class="cx"> &lt;/script&gt;
</span><span class="cx"> 
</span><span class="cx"> &lt;embed id=&quot;testPlugin&quot; 
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestsplatformmacpluginstestpluginonnewonpainthtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/platform/mac/plugins/testplugin-onnew-onpaint.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/platform/mac/plugins/testplugin-onnew-onpaint.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/platform/mac/plugins/testplugin-onnew-onpaint.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -2,6 +2,7 @@
</span><span class="cx"> 
</span><span class="cx"> &lt;html&gt;
</span><span class="cx"> &lt;head&gt;
</span><ins>+    &lt;script src=&quot;../../../resources/plugin.js&quot;&gt;&lt;/script&gt;
</ins><span class="cx">     &lt;script type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;
</span><span class="cx">         if (window.testRunner)
</span><span class="cx">             testRunner.dumpAsText();
</span><span class="lines">@@ -25,6 +26,8 @@
</span><span class="cx">                 didPaint = true;
</span><span class="cx">             }
</span><span class="cx">         }
</span><ins>+
+        runAfterPluginLoad(null, NotifyDone);
</ins><span class="cx">     &lt;/script&gt;
</span><span class="cx"> &lt;/head&gt;
</span><span class="cx"> &lt;body&gt;
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestspluginsgetuseragentwithnullnppfromnppnewhtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/plugins/get-user-agent-with-null-npp-from-npp-new.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/plugins/get-user-agent-with-null-npp-from-npp-new.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/plugins/get-user-agent-with-null-npp-from-npp-new.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -1,9 +1,11 @@
</span><span class="cx"> &lt;!DOCTYPE html&gt;
</span><span class="cx"> &lt;html&gt;
</span><span class="cx"> &lt;head&gt;
</span><ins>+    &lt;script src=&quot;../resources/plugin.js&quot;&gt;&lt;/script&gt;
</ins><span class="cx">     &lt;script&gt;
</span><span class="cx">         if (window.testRunner)
</span><span class="cx">             testRunner.dumpAsText();
</span><ins>+        runAfterPluginLoad(null, NotifyDone);
</ins><span class="cx">     &lt;/script&gt;
</span><span class="cx"> &lt;/head&gt;
</span><span class="cx"> &lt;body&gt;
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestspluginsmouseclickpluginclearsselectionhtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/plugins/mouse-click-plugin-clears-selection.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/plugins/mouse-click-plugin-clears-selection.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/plugins/mouse-click-plugin-clears-selection.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -1,8 +1,9 @@
</span><span class="cx"> &lt;html&gt;
</span><span class="cx"> &lt;head&gt;
</span><ins>+&lt;script src=&quot;../resources/plugin.js&quot;&gt;&lt;/script&gt;
</ins><span class="cx"> &lt;script&gt;
</span><span class="cx"> 
</span><del>-function runTest() {
</del><ins>+runAfterPluginLoad(function() {
</ins><span class="cx">     inputElement = document.getElementById('frame');
</span><span class="cx">     inputElement.focus();
</span><span class="cx">     inputElement.select();
</span><span class="lines">@@ -14,10 +15,10 @@
</span><span class="cx">         eventSender.mouseDown();
</span><span class="cx">         eventSender.mouseUp();
</span><span class="cx">     }
</span><del>-}
</del><ins>+}, NotifyDone);
</ins><span class="cx"> &lt;/script&gt;
</span><span class="cx"> &lt;/head&gt;
</span><del>-&lt;body onload=&quot;runTest();&quot;&gt;
</del><ins>+&lt;body&gt;
</ins><span class="cx"> &lt;embed id=&quot;plg&quot; type=&quot;application/x-webkit-test-netscape&quot; width=&quot;100&quot; height=&quot;100&quot; windowedplugin=&quot;false&quot;&gt;&lt;/embed&gt;&lt;br&gt;
</span><span class="cx"> &lt;input id=&quot;frame&quot; value=&quot;hello&quot;/&gt;
</span><span class="cx"> &lt;div id=&quot;output&quot;&gt;&lt;/div&gt;
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestspluginsnetscapepluginmapdatatosrchtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/plugins/netscape-plugin-map-data-to-src.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/plugins/netscape-plugin-map-data-to-src.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/plugins/netscape-plugin-map-data-to-src.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -1,8 +1,10 @@
</span><span class="cx"> &lt;html&gt;
</span><span class="cx"> &lt;head&gt;
</span><ins>+&lt;script src=&quot;../resources/plugin.js&quot;&gt;&lt;/script&gt;
</ins><span class="cx"> &lt;script&gt;
</span><span class="cx">     if (window.testRunner)
</span><span class="cx">         testRunner.dumpAsText();
</span><ins>+    runAfterPluginLoad(null, NotifyDone);
</ins><span class="cx"> &lt;/script&gt;
</span><span class="cx"> &lt;body style=&quot;margin:0px;overflow:hidden&quot;&gt;
</span><span class="cx"> &lt;object name=&quot;testPlugin&quot; type=&quot;application/x-webkit-test-netscape&quot; logSrc=&quot;true&quot; data=&quot;blah&quot;&gt;
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestspluginsnomimewithvalidextensionhtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/plugins/no-mime-with-valid-extension.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/plugins/no-mime-with-valid-extension.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/plugins/no-mime-with-valid-extension.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -1,8 +1,8 @@
</span><ins>+&lt;script src=&quot;../resources/plugin.js&quot;&gt;&lt;/script&gt;
</ins><span class="cx"> &lt;script&gt;
</span><del>-    if (window.testRunner) {
</del><ins>+    if (window.testRunner)
</ins><span class="cx">         testRunner.dumpAsText();
</span><del>-        testRunner.waitUntilDone();
-    }
</del><ins>+    runAfterPluginLoad(null, NotifyDone);
</ins><span class="cx"> &lt;/script&gt;
</span><span class="cx"> &lt;p&gt;
</span><span class="cx"> This test checks that &lt;a href=&quot;https://bugs.webkit.org/show_bug.cgi?id=50657&quot;&gt;bug 50568&lt;/a&gt;
</span><span class="lines">@@ -12,8 +12,4 @@
</span><span class="cx"> attribute.
</span><span class="cx"> &lt;/p&gt;
</span><span class="cx"> &lt;!-- Embed tag with missing type=&quot;&quot; parameter --&gt;
</span><del>-&lt;embed id=&quot;plugin&quot; name=&quot;plugin&quot; src=&quot;resources/test.testnetscape&quot; logSrc=&quot;1&quot;&gt;
-&lt;script&gt;
-    if (window.testRunner)
-        testRunner.notifyDone();
-&lt;/script&gt;
</del><ins>+&lt;embed id=&quot;plugin&quot; name=&quot;plugin&quot; src=&quot;resources/test.testnetscape&quot; logSrc=&quot;1&quot;&gt;
</ins><span class="cx">\ No newline at end of file
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestspluginsplugininitiatepopupwindowhtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/plugins/plugin-initiate-popup-window.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/plugins/plugin-initiate-popup-window.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/plugins/plugin-initiate-popup-window.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -64,7 +64,7 @@
</span><span class="cx"> }
</span><span class="cx"> &lt;/script&gt;
</span><span class="cx"> &lt;/head&gt;
</span><del>-&lt;body onload=&quot;window.setTimeout(test, 0);&quot;&gt;
</del><ins>+&lt;body onload=&quot;internals.updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks(); test();&quot;&gt;
</ins><span class="cx"> &lt;embed type=&quot;application/x-webkit-test-netscape&quot; width=100 height=40 evaluatescript=&quot;mouse::popup_by_mousedown()&quot; windowedplugin=&quot;false&quot;&gt;&lt;/embed&gt;&lt;br&gt;
</span><span class="cx"> &lt;embed type=&quot;application/x-webkit-test-netscape&quot; width=100 height=40 evaluatescript=&quot;key::popup_by_keydown()&quot; windowedplugin=&quot;false&quot;&gt;&lt;/embed&gt;&lt;br&gt;
</span><span class="cx"> Specify a script and a mouse/keyboard event to the plugin. The specified script will be evaluated in the browser when the specified event is received by the plugin. The test is for bug https://bugs.webkit.org/show_bug.cgi?id=41292.&lt;br&gt;
</span></span></pre></div>
<a id="branchessafari53778branchLayoutTestspluginswindowless_plugin_paint_testhtml"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/LayoutTests/plugins/windowless_plugin_paint_test.html (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/LayoutTests/plugins/windowless_plugin_paint_test.html        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/LayoutTests/plugins/windowless_plugin_paint_test.html        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -14,6 +14,8 @@
</span><span class="cx">         var pluginDiv = document.getElementById(&quot;pluginDiv&quot;);
</span><span class="cx">         // Create the plugin in the middle of the page.
</span><span class="cx">         pluginDiv.innerHTML = &quot;&lt;embed id=\&quot;testPlugin\&quot; type=\&quot;application/x-webkit-test-netscape\&quot; width=\&quot;200\&quot; height=\&quot;200\&quot; onpaintevent=\&quot;didPaint()\&quot; windowedPlugin=\&quot;false\&quot;&gt;&lt;/embed&gt;&quot;;
</span><ins>+        if (window.internals)
+            internals.updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks();
</ins><span class="cx">         testRunner.displayInvalidatedRegion();
</span><span class="cx">       }
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchessafari53778branchSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/Source/WebCore/ChangeLog (171376 => 171377)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/Source/WebCore/ChangeLog        2014-07-23 00:36:13 UTC (rev 171376)
+++ branches/safari-537.78-branch/Source/WebCore/ChangeLog        2014-07-23 00:41:02 UTC (rev 171377)
</span><span class="lines">@@ -25,35767 +25,51342 @@
</span><span class="cx">             (WebCore::RenderIFrame::isSeamless):
</span><span class="cx">             (WebCore::RenderIFrame::flattenFrame):
</span><span class="cx"> 
</span><del>-2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+2014-05-28  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r170946
</del><ins>+        Roll r168668 back in.
</ins><span class="cx"> 
</span><del>-    2014-07-08  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</del><ins>+        &lt;https://bugs.webkit.org/show_bug.cgi?id=132621&gt;
</ins><span class="cx"> 
</span><del>-            Fix flaky loading tests
-            https://bugs.webkit.org/show_bug.cgi?id=133696
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-            Reviewed by Ryosuke Niwa.
</del><ins>+        Tests: fast/events/beforeload-assertion.html
+               fast/events/beforeload-iframe-crash.html
+               fast/events/beforeload-input-time-crash.html
</ins><span class="cx"> 
</span><del>-            In some cases, the Frame may be destroyed while the loader is
-            initializing. Make sure we don't delete it too early.
</del><ins>+        * WebCore.exp.in:
+        * dom/Document.cpp:
+        (WebCore::Document::updateLayoutIgnorePendingStylesheets):
+        * dom/Document.h:
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::renderWidgetForJSBindings):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::updateEmbeddedObjectsTimerFired):
+        (WebCore::FrameView::flushAnyPendingPostLayoutTasks):
+        (WebCore::FrameView::performPostLayoutTasks):
+        * page/FrameView.h:
+        * testing/Internals.cpp:
+        (WebCore::Internals::updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks):
+        * testing/Internals.h:
+        * testing/Internals.idl:
</ins><span class="cx"> 
</span><del>-            * loader/FrameLoader.cpp:
-            (WebCore::FrameLoader::init):
</del><ins>+2014-05-29  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        Support -apple-system-font on OS X
+        https://bugs.webkit.org/show_bug.cgi?id=133382
</ins><span class="cx"> 
</span><del>-        Merge r170135
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-    2014-06-11  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</del><ins>+        Guard on both family names: &quot;-apple-system-font&quot; and &quot;-webkit-system-font&quot;
</ins><span class="cx"> 
</span><del>-            Fix flaky beforeload tests
-            https://bugs.webkit.org/show_bug.cgi?id=133685
</del><ins>+        Test: platform/mac/fast/text/systemFont.html
</ins><span class="cx"> 
</span><del>-            Reviewed by David Kilzer.
</del><ins>+        * platform/mac/WebFontCache.mm:
+        (+[WebFontCache internalFontWithFamily:traits:weight:size:]):
</ins><span class="cx"> 
</span><del>-            * loader/FrameLoader.cpp:
-            (WebCore::FrameLoader::loadURL):
</del><ins>+2014-05-29  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        Loading &lt;object&gt; from WebArchive crashes
+        https://bugs.webkit.org/show_bug.cgi?id=133386
+        &lt;rdar://problem/13345509&gt;
</ins><span class="cx"> 
</span><del>-        Merge r170513
</del><ins>+        Reviewed by Brady Eidson.
</ins><span class="cx"> 
</span><del>-    2014-06-26  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        Test: webarchive/loading/object.html
</ins><span class="cx"> 
</span><del>-            [Win] Always NULL-terminate the string in createUTF8String()
-            &lt;http://webkit.org/b/134353&gt;
-            &lt;rdar://problem/17471783&gt;
</del><ins>+        This (a) fixes the crash, and (b) avoids the crash.
</ins><span class="cx"> 
</span><del>-            Reviewed by Brent Fulgham.
</del><ins>+        * loader/DocumentLoader.cpp: (WebCore::DocumentLoader::continueAfterContentPolicy):
+        Some types of substitute data - such as WebArchive - don't contain HTTP result codes,
+        so let's not drop to &lt;object&gt; fallback content when status is 0.
+        And if the load somehow failed anyway, don't crash by trying to deliver substitute data
+        to a finished loader.
</ins><span class="cx"> 
</span><del>-            * plugins/PluginView.cpp:
-            (WebCore::createUTF8String): Pull out CString length into local
-            variable.  Switch to use memcpy.  Always NULL-terminate the
-            string.
</del><ins>+2014-05-29  Alex Christensen  &lt;achristensen@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        [iOS WebGL] Fix depth buffer clearing issue.
+        https://bugs.webkit.org/show_bug.cgi?id=133388
</ins><span class="cx"> 
</span><del>-        Merge r170028
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-    2014-06-16  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        No new tests, but this fixes webgl/1.0.1/conformance/canvas/buffer-preserve-test.html.
</ins><span class="cx"> 
</span><del>-            AX: Safari crashed once in WebCore::AccessibilityObject::ariaIsHidden
-            https://bugs.webkit.org/show_bug.cgi?id=133825
</del><ins>+        * platform/graphics/mac/WebGLLayer.mm:
+        (-[WebGLLayer display]):
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        (WebCore::GraphicsContext3D::prepareTexture):
+        Moved marking the layer as composited from the mac-only prepareTexture to
+        the end of [WebGLLayer display] which is called by mac and iOS.
</ins><span class="cx"> 
</span><del>-            Reviewed by Enrica Casucci.
</del><ins>+2014-05-29  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Sometimes asking accessibilityIsIgnored() will cause a newObject to be detached immediately after its created. 
-            The creation function holds a reference with RefPtr as long as it lives, but when that method returns, the object goes away.
</del><ins>+        Perserve caption selection in fullscreen.
+        https://bugs.webkit.org/show_bug.cgi?id=133350
</ins><span class="cx"> 
</span><del>-            With that out of the way, I saw the same backtrace lead to updateLayoutIgnorePendingStylesheets being called while still inLayout.
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-            I tried my best but could not create a reproducible layout test.
</del><ins>+        Use the logic from the inline player to calculate the selected caption index.
</ins><span class="cx"> 
</span><del>-            * accessibility/AXObjectCache.cpp:
-            (WebCore::AXObjectCache::getOrCreate):
-            * accessibility/AccessibilityObject.cpp:
-            (WebCore::AccessibilityObject::updateBackingStore):
</del><ins>+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::mediaControlsHost):
+        Expose mediaControlsHost() for use by WebVideoFullscreenModelMediaElement.
</ins><span class="cx"> 
</span><del>-2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        * platform/ios/WebVideoFullscreenModelMediaElement.mm:
+        (WebVideoFullscreenModelMediaElement::updateLegibleOptions):
+        Use logic from buildCaptionsMenu from mediaControlsApple.js.
</ins><span class="cx"> 
</span><del>-        Merge r170026
</del><ins>+2014-05-29  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2014-06-16  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        Use correct version of requiresFullscreenForVideoPlayback().
+        https://bugs.webkit.org/show_bug.cgi?id=133331
</ins><span class="cx"> 
</span><del>-            AX: Crash at WebCore::AXObjectCache::textChanged
-            https://bugs.webkit.org/show_bug.cgi?id=133873
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-            Reviewed by Enrica Casucci.
</del><ins>+        Test: media/video-fullscreeen-only-controls.html
</ins><span class="cx"> 
</span><del>-            This looks like a very similar problem to 
-            https://bugs.webkit.org/show_bug.cgi?id=133825
</del><ins>+        Update the last place not yet using m_mediaSession-&gt;requiresFullscreenForVideoPlayback.
</ins><span class="cx"> 
</span><del>-            The object is being created and deallocated almost right away because calling accessibilityIsIgnored triggers
-            a deferred layout that invalidates the associated render element.
</del><ins>+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseAttribute):
+        switch to media session version for requriesFullscreenForVideoPlayback.
</ins><span class="cx"> 
</span><del>-            Despite my best efforts, I could not come up with a way to reproduce this in a layout test.
</del><ins>+2014-05-29  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-            * accessibility/AXObjectCache.cpp:
-            (WebCore::AXObjectCache::getOrCreate):
</del><ins>+        [GTK] Add support for HiDPI icons
+        https://bugs.webkit.org/show_bug.cgi?id=133377
</ins><span class="cx"> 
</span><del>-2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        Merge r169849
</del><ins>+        Use the GTK+ missing icon at 16 or 32 size depending on the device
+        scale factor.
</ins><span class="cx"> 
</span><del>-    2014-06-11  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::loadMissingImageIconFromTheme):
+        (WebCore::Image::loadPlatformResource):
</ins><span class="cx"> 
</span><del>-            WindowFeatures arguments shoud ignore invalid characters in values
-            &lt;http://webkit.org/b/133703&gt;
-            &lt;rdar://problem/17254118&gt;
</del><ins>+2014-05-29  Owen Taylor  &lt;otaylor@redhat.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Andy Estes.
</del><ins>+        [GTK] Add HighDPI support for non-accelerated compositing contents
+        https://bugs.webkit.org/show_bug.cgi?id=131562
</ins><span class="cx"> 
</span><del>-            Test: fast/dom/Window/window-property-invalid-characters-ignored.html
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-            * page/WindowFeatures.cpp:
-            (WebCore::WindowFeatures::WindowFeatures): Set |length| based on
-            |buffer|, not |features|.  Switch to using a for loop.  Switch
-            to unsigned types since we are working with positive offsets
-            into a String.
</del><ins>+        No new tests. This will be tested once we have the proper dependencies in the WebKit testing
+        JHBuild.
</ins><span class="cx"> 
</span><del>-2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        * platform/cairo/WidgetBackingStore.h:
+        (WebCore::WidgetBackingStore::WidgetBackingStore): Accept a device scale argument.
+        * platform/cairo/WidgetBackingStoreCairo.cpp: Use the device scale argument to make the surface the proper size and set the surface device scale.
+        * platform/cairo/WidgetBackingStoreCairo.h: Accept a device scale argument.
+        * platform/graphics/cairo/CairoUtilities.cpp: Add a new helper to set the device scale if Cairo built against is new enough.
+        * platform/graphics/cairo/CairoUtilities.h:
+        * platform/gtk/GtkVersioning.h: Add the HAVE_GTK_SCALE_FACTOR macro.
+        * platform/gtk/WidgetBackingStoreGtkX11.cpp: Use the device scale argument to make the surface the proper size and set the surface device scale.
+        * platform/gtk/WidgetBackingStoreGtkX11.h: Accept a device scale argument.
</ins><span class="cx"> 
</span><del>-        Merge r169848
</del><ins>+2014-05-28  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2014-06-11  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        Captions during HLS playback flash/are difficult to readily
+        https://bugs.webkit.org/show_bug.cgi?id=133365
+        &lt;rdar://problem/16584132&gt;
</ins><span class="cx"> 
</span><del>-            Viewport arguments should ignore invalid characters in values
-            &lt;http://webkit.org/b/133555&gt;
-            &lt;rdar://problem/17179650&gt;
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-            Reviewed by Daniel Bates.
</del><ins>+        Correct two problems:
+        1. Add new logic to handle cues that are identical to existing cues, except
+           that they cover a slightly later moment in playback. For example, a cue
+           encoding device might emit a cue at 24 fps, with many of the cues containing
+           the same content but covering only 1/24th of a second.
+           
+           Rather than hiding and displaying our cues at the cue encoding rate, we should
+           simply continue to display the same cue as long as the content is unchanged.
+        2. The cue &quot;isEqual&quot; logic for TextTrackCueGeneric improperly short-circuited the
+           VTTCue isEqual logic. This was done to avoid a false failure due to the cue
+           type being 'generic' rather than 'vtt', but incorrectly treated cues with
+           non-matching text as equal.
</ins><span class="cx"> 
</span><del>-            Test: fast/viewport/viewport-warnings-7.html
</del><ins>+        * html/track/DataCue.cpp:
+        (WebCore::DataCue::cueContentsMatch): Move cue comparison code to new method that
+        doesn't check that the 'type' of the cue is identical.
+        (WebCore::DataCue::isEqual): Modified to use new 'cueContentsMatch' method.
+        (WebCore::DataCue::isStartOfCue): Confirms cues match except for start and end times.
+        * html/track/DataCue.h:
+        * html/track/TextTrack.cpp:
+        (WebCore::TextTrack::hasCue): Modify to check if a new cue is simply a continuation
+        of an existing cue.
+        * html/track/TextTrackCue.cpp:
+        (WebCore::TextTrackCue::cueContentsMatch): New method containing the equality code
+        that used to live in 'isEqual'.
+        (WebCore::TextTrackCue::isEqual): Modified to use new 'cueContentsMatch' method.
+        (WebCore::TextTrackCue::isStartOfCue): Confirms cues match except for start and
+        end times.
+        * html/track/TextTrackCue.h:
+        * html/track/TextTrackCueGeneric.cpp:
+        (WebCore::TextTrackCueGeneric::cueContentsMatch): New method containing the equality
+        code that used to live in 'isEqual'.
+        (WebCore::TextTrackCueGeneric::isEqual): Modified to use new 'cueContentsMatch' method.
+        (WebCore::TextTrackCueGeneric::isStartOfCue): Confirms cues match except for start and
+        end times.
+        * html/track/TextTrackCueGeneric.h:
+        * html/track/VTTCue.cpp:
+        (WebCore::VTTCue::cueContentsMatch): New method containing the equality code that
+        used to live in 'isEqual'.
+        (WebCore::VTTCue::isEqual): Modified to use new 'cueContentsMatch' method.
+        (WebCore::VTTCue::isStartOfCue): Confirms cues match except for start and end times.
+        * html/track/VTTCue.h:
</ins><span class="cx"> 
</span><del>-            * dom/Document.cpp:
-            (WebCore::Document::processArguments): Set |length| based on
-            |buffer|, not |features|.  Switch to using a for loop.  Switch
-            to unsigned types since we are working with positive offsets
-            into a String.
</del><ins>+2014-05-28  Oliver Hunt  &lt;oliver@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        Whoops, update bindings tests results.
</ins><span class="cx"> 
</span><del>-        Merge r169726
</del><ins>+2014-05-28  Oliver Hunt  &lt;oliver@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2014-06-09  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Make DOM properties exposed as instance properties use the base object instead of |this|
+        https://bugs.webkit.org/show_bug.cgi?id=133353
</ins><span class="cx"> 
</span><del>-            Properly reset UStringSearch object in SearchBuffer constructor.
-            https://bugs.webkit.org/show_bug.cgi?id=133662
-            &lt;rdar://problem/17240136&gt;
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-            Reviewed by Tim Horton.
</del><ins>+        Make the bindings generator emit code that uses the base object for
+        a property, rather than the this object. This means that attributes
+        that we need to be treated as instance properties will match their old
+        instance-based behaviour.
</ins><span class="cx"> 
</span><del>-            * editing/TextIterator.cpp: (WebCore::SearchBuffer::~SearchBuffer):
</del><ins>+        * bindings/scripts/CodeGeneratorJS.pm:
+        (InterfaceRequiresAttributesOnInstanceForCompatibility):
+        (InterfaceRequiresAttributesOnInstance):
+        (GetCastingHelperForBaseObject):
+        (GenerateImplementation):
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
+        (WebCore::jsTestActiveDOMObjectExcitingAttr):
+        * bindings/scripts/test/JS/JSTestException.cpp:
+        (WebCore::jsTestExceptionName):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::jsTestInterfaceImplementsStr3):
+        (WebCore::jsTestInterfaceSupplementalStr3):
+        (WebCore::setJSTestInterfaceConstructorImplementsStaticAttr):
+        (WebCore::setJSTestInterfaceImplementsStr2):
+        (WebCore::setJSTestInterfaceImplementsStr3):
+        (WebCore::setJSTestInterfaceImplementsNode):
+        (WebCore::setJSTestInterfaceConstructorSupplementalStaticAttr):
+        (WebCore::setJSTestInterfaceSupplementalStr2):
+        (WebCore::setJSTestInterfaceSupplementalStr3):
+        (WebCore::setJSTestInterfaceSupplementalNode):
+        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
+        (WebCore::setJSTestNondeterministicNondeterministicWriteableAttr):
+        (WebCore::setJSTestNondeterministicNondeterministicExceptionAttr):
+        (WebCore::setJSTestNondeterministicNondeterministicGetterExceptionAttr):
+        (WebCore::setJSTestNondeterministicNondeterministicSetterExceptionAttr):
+        (WebCore::setJSTestSerializedScriptValueInterfaceCachedValue):
+        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
+        (WebCore::jsTestTypedefsConstructorTestSubObj):
+        (WebCore::setJSTestTypedefsUnsignedLongLongAttr):
+        (WebCore::setJSTestTypedefsImmutableSerializedScriptValue):
+        (WebCore::setJSTestTypedefsAttrWithGetterException):
+        (WebCore::setJSTestTypedefsAttrWithSetterException):
+        (WebCore::setJSTestTypedefsStringAttrWithGetterException):
+        (WebCore::setJSTestTypedefsStringAttrWithSetterException):
</ins><span class="cx"> 
</span><del>-2014-07-18  Dana Burkart  &lt;dburkart@apple.com&gt;
</del><ins>+2014-05-28  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r169318
</del><ins>+        [iOS WK2] Improve behavior of position:fixed inside accelerated overflow-scroll
+        https://bugs.webkit.org/show_bug.cgi?id=133352
</ins><span class="cx"> 
</span><del>-    2014-05-25  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-            Crash in WebCore::TextResourceDecoder::checkForCSSCharset
-            &lt;http://webkit.org/b/133257&gt;
-            &lt;rdar://problem/17027109&gt;
</del><ins>+        When adjusting layers inside accelerated overflow-scroll, pass a delta
+        down to descendant nodes. Fix behavior of sticky nodes inside fixed nodes
+        inside overflow scroll (sticky should only be affected if the parent node
+        is a scrolling node).
</ins><span class="cx"> 
</span><del>-            Reviewed by Alexey Proskuryakov.
</del><ins>+        * page/scrolling/mac/ScrollingTreeFixedNode.mm:
+        (WebCore::ScrollingTreeFixedNode::updateLayersAfterAncestorChange): Just remove
+        some .get()
+        * page/scrolling/mac/ScrollingTreeStickyNode.mm:
+        (WebCore::ScrollingTreeStickyNode::updateLayersAfterAncestorChange): Remove .get()s.
+        We never care about the cumulative delta here, because sticky nodes only respond to
+        changes in their direct scrolling ancestors. Only adjust the layer if the parent
+        is a scrolling node.
</ins><span class="cx"> 
</span><del>-            Test: fast/encoding/css-charset-missing-semi-colon-and-newline.html
</del><ins>+2014-05-27  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * loader/TextResourceDecoder.cpp:
-            (WebCore::TextResourceDecoder::checkForCSSCharset): Add early
-            return.
</del><ins>+        AX: WebKit does not recognize ARIA 1.1 tables
+        https://bugs.webkit.org/show_bug.cgi?id=133163
</ins><span class="cx"> 
</span><del>-2014-05-30  Dana Burkart  &lt;dburkart@apple.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Supplementary build fix for &lt;rdar://problem/16848509&gt;, borrowed from &lt;rdar://problem/16701806&gt;.
</del><ins>+        The AXObjectCache code that determines which object to create based on the role needs to be token fallback aware.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+        Test: accessibility/table-fallback-roles-expose-element-attributes.html
</ins><span class="cx"> 
</span><del>-2014-05-29  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</del><ins>+        * accessibility/AXObjectCache.cpp:
+        (WebCore::nodeHasRole):
</ins><span class="cx"> 
</span><del>-        Build fix for Mavericks
</del><ins>+2014-05-28  Radu Stavila  &lt;stavila@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+        REGRESSION (r168046): Invalid layout in multicol
+        https://bugs.webkit.org/show_bug.cgi?id=133322
</ins><span class="cx"> 
</span><del>-2014-05-29  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Build fix
</del><ins>+        In some situations, deleting the line boxes of a multicol element causes the line to region
+        link to become invalid.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+        Test: fast/multicol/newmulticol/multicol-inside-multicol.html
</ins><span class="cx"> 
</span><del>-2014-05-27  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</del><ins>+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::clearLinesToRegionMap):
+        (WebCore::RenderFlowThread::deleteLines):
+        (WebCore::RenderFlowThread::willBeDestroyed):
+        * rendering/RenderFlowThread.h:
</ins><span class="cx"> 
</span><del>-        Workaround for &lt;rdar://problem/16848509&gt;
</del><ins>+2014-05-28  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Kilzer.
</del><ins>+        Remove DocumentThreadableLoaderClient.h
+        https://bugs.webkit.org/show_bug.cgi?id=133341
</ins><span class="cx"> 
</span><del>-        * platform/network/mac/ResourceRequestMac.mm:
-        (WebCore::ResourceRequest::doUpdatePlatformRequest):
</del><ins>+        Reviewed by Gyuyoung Kim.
</ins><span class="cx"> 
</span><del>-2014-05-27  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        DocumentThreadableLoaderClient is not used anymore.
</ins><span class="cx"> 
</span><del>-        Fix for &lt;rdar://problem/17020210&gt;
-        Fix by Jon Honeycutt.
</del><ins>+        * WebCore.order:
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::redirectReceived):
+        * loader/DocumentThreadableLoaderClient.h: Removed.
+        * loader/ThreadableLoaderClient.h:
+        (WebCore::ThreadableLoaderClient::isDocumentThreadableLoaderClient): Deleted.
+
+2014-05-28  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
+
+        Unreviewed. Update GObject DOM bindings symbols file after r169017.
+
+        * bindings/gobject/webkitdom.symbols: Add webkit_dom_navigator_get_hardware_concurrency.
+
+2014-05-28  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
+
+        REGRESSION(r168868): [GTK] Element.offset* client* scroll* API changed
+        https://bugs.webkit.org/show_bug.cgi?id=133313
+
+        Reviewed by Philippe Normand.
+
+        Keep old API that uses long also for GObject bindings.
+
+        * dom/Element.idl:
+
+2014-05-27  Commit Queue  &lt;commit-queue@webkit.org&gt;
+
+        Unreviewed, rolling out r169400.
+        https://bugs.webkit.org/show_bug.cgi?id=133338
+
+        Broke the iOS build in
+        LocalizedDateCache::calculateMaximumWidth() (Requested by smfr
+        on #webkit).
+
+        Reverted changeset:
+
+        &quot;SVG TextRuns do not always get RenderingContexts&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=133198
+        http://trac.webkit.org/changeset/169400
+
+2014-05-27  Timothy Horton  &lt;timothy_horton@apple.com&gt;
+
+        REGRESSION (Margin tiles): Background gradient on dom.spec.whatwg.org is very slow to render
+        https://bugs.webkit.org/show_bug.cgi?id=133335
+        &lt;rdar://problem/17011392&gt;
+
+        Reviewed by Simon Fraser.
+
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::drawTiled):
+        Make cross-platform and use some iOS code which avoids patterned drawing when the pattern buffer
+        would be very large. Instead, it calls draw() repeatedly over the pattern space, avoiding the allocation
+        of a huge (in the case of bug 133335, nearly 2GB) buffer.
+
+2014-05-27  Simon Fraser  &lt;simon.fraser@apple.com&gt;
+
+        [iOS WK2] Fix behavior of position:sticky inside accelerated overflow-scroll
+        https://bugs.webkit.org/show_bug.cgi?id=133334
+        &lt;rdar://problem/16462535&gt;
+
+        Reviewed by Tim Horton.
+
+        When the scroll position changes in an accelerated overflow-scroll element, we have
+        to update child nodes in the scrolling tree for position:sticky. That requires a
+        more generic ability to update the scrolling tree after some arbitrary zoom or
+        scroll. To do this, we need to know the current fixed position rect, rather than
+        having it passed in.
</ins><span class="cx">         
</span><ins>+        So make the fixed position rect available from ScrollingTree, and make it possible
+        to get the current scrollPosition() from any ScrollingTreeScrollingNode.
+        
+        Also, implement updateLayersAfterDelegatedScroll() in ScrollingTreeOverflowScrollingNodeIOS,
+        and have it update descendant layers.
+        
+        Finally, fix ScrollingTreeOverflowScrollingNode to use the correct rectangle for its
+        constraints math, using the scroll position of the parent node if appropriate.
+
+        * page/scrolling/ScrollingTree.h:
+        * page/scrolling/ScrollingTreeScrollingNode.h:
+        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.mm:
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateChildNodesAfterScroll):
+        * page/scrolling/ios/ScrollingTreeIOS.cpp:
+        (WebCore::ScrollingTreeIOS::fixedPositionRect):
+        * page/scrolling/ios/ScrollingTreeIOS.h:
+        * page/scrolling/mac/ScrollingTreeStickyNode.mm:
+        (WebCore::ScrollingTreeStickyNode::updateLayersAfterAncestorChange):
+
+2014-05-27  Simon Fraser  &lt;simon.fraser@apple.com&gt;
+
+        Do some renaming in the scrolling tree
+        https://bugs.webkit.org/show_bug.cgi?id=133333
+
+        Reviewed by Tim Horton.
+
+        Rename ScrollingTreeNode::parentScrollPositionDidChange() to updateLayersAfterAncestorChange()
+        since this goes deep and to indicate that it's about layer updating.
+        
+        Also rename the &quot;viewportRect&quot; parameter to &quot;fixedPositionRect&quot;, since on iOS
+        this is the custom fixed-position rect that changes on zooming.
+
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::viewportChangedViaDelegatedScrolling):
+        * page/scrolling/ScrollingTree.h:
+        * page/scrolling/ScrollingTreeFrameScrollingNode.h:
+        * page/scrolling/ScrollingTreeNode.h:
+        * page/scrolling/ScrollingTreeScrollingNode.h:
+        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.h:
+        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.mm:
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateLayersAfterViewportChange):
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateChildNodesAfterScroll):
+        * page/scrolling/mac/ScrollingTreeFixedNode.h:
+        * page/scrolling/mac/ScrollingTreeFixedNode.mm:
+        (WebCore::ScrollingTreeFixedNode::updateLayersAfterAncestorChange):
+        (WebCore::ScrollingTreeFixedNode::parentScrollPositionDidChange): Deleted.
+        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.h:
+        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollLayerPosition):
+        * page/scrolling/mac/ScrollingTreeStickyNode.h:
+        * page/scrolling/mac/ScrollingTreeStickyNode.mm:
+        (WebCore::ScrollingTreeStickyNode::updateLayersAfterAncestorChange):
+        (WebCore::ScrollingTreeStickyNode::parentScrollPositionDidChange): Deleted.
+
+2014-05-27  Simon Fraser  &lt;simon.fraser@apple.com&gt;
+
+        Instantiate a ScrollingTreeMac on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=133332
+
+        Reviewed by Tim Horton.
+
+        Mac previously instantiated a ThreadedScrollingTree, but this has no platform
+        knowledge. To support future expansion, create a ScrollingTreeMac subclass and
+        instantiate that on Mac.
+        
+        Also protect ScrollingCoordinatorMac in PLATFORM(MAC) #ifdefs and remove it from the
+        EXCLUDED_SOURCE_FILE_NAMES list in the xcconfig file, following general trends.
+
+        * Configurations/WebCore.xcconfig:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/scrolling/ThreadedScrollingTree.cpp:
+        (WebCore::ThreadedScrollingTree::create): Deleted.
+        * page/scrolling/ThreadedScrollingTree.h:
+        * page/scrolling/mac/ScrollingCoordinatorMac.h:
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+        (WebCore::ScrollingCoordinatorMac::ScrollingCoordinatorMac):
+        * page/scrolling/mac/ScrollingTreeMac.cpp: Copied from Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.h.
+        (ScrollingTreeMac::create):
+        (ScrollingTreeMac::ScrollingTreeMac):
+        * page/scrolling/mac/ScrollingTreeMac.h: Copied from Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.h.
+
+2014-05-27  Simon Fraser  &lt;simon.fraser@apple.com&gt;
+
+        Prepare for position:sticky support inside accelerated overflow-scroll with WK2
+        https://bugs.webkit.org/show_bug.cgi?id=133329
+
+        Reviewed by Tim Horton.
+
+        RenderLayerCompositor::computeStickyViewportConstraints() was always using
+        the viewport rect as the constraining rect for sticky position. This is not
+        correct when inside overflow:scroll.
+        
+        Refactor code in RenderBoxModelObject to make getting the rect easy, and use
+        it to compute the constraints.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::constrainingRectForStickyPosition):
+        (WebCore::RenderBoxModelObject::stickyPositionOffset):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeStickyViewportConstraints):
+
+2014-05-27  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
+
+        vw/vh units used as font/line-height values don't scale with the viewport
+        https://bugs.webkit.org/show_bug.cgi?id=87846
+
+        Reviewed by Darin Adler.
+
+        This patch moves the resolution of viewport units to style recalc
+        time. Currently viewport units are left unresolved during style
+        recalcs, which leads to many problems with viewport units. Moving the
+        resolution will fix these problems, as well as reduce the plumbing
+        that goes on.
+
+        This patch touches a lot of files since the valueForLength functions
+        no longer need a RenderView. The interesting changes are in:
+
+        - CSSToLengthConversionData -&gt; CSSPrimitiveValue: for moving
+            resolution to style recalc time.
+        - Length / LengthFunctions: no longer needs to know about viewport
+            units.
+        - FrameView -&gt; Document -&gt; StyleResolver: for scheduling style recalcs
+            upon resize
+
+        Note that getComputedStyle will now return pixel values when viewport
+        units are used. This behavior matches Firefox and the css3-cascade
+        spec.
+
+        This is based on a Blink patch by timloh@chromium.org.
+
+        Tests: css3/viewport-percentage-lengths/viewport-percentage-lengths-anonymous-block.html
+               css3/viewport-percentage-lengths/viewport-percentage-lengths-calc.html
+               css3/viewport-percentage-lengths/viewport-percentage-lengths-percent-size-child.html
+               css3/viewport-percentage-lengths/viewport-percentage-lengths-relative-font-size.html
+               css3/viewport-percentage-lengths/viewport-percentage-lengths-resize.html
+
+        * WebCore.exp.in: Remove RenderView argument to floatValueForLength.
+        * accessibility/atk/WebKitAccessibleInterfaceText.cpp: 
+        (getAttributeSetForAccessibilityObject): Remove RenderView argument.
+        * css/BasicShapeFunctions.cpp:
+        (WebCore::convertToLength): Ditto.
+        (WebCore::floatValueForCenterCoordinate): Ditto.
+        * css/BasicShapeFunctions.h: Ditto.
+        * css/CSSCalculationValue.cpp:
+        (WebCore::unitCategory): Remove special handling for viewport units,
+            as they get resolved to pixels.
+        (WebCore::createCSS): Ditto.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::positionOffsetValue): Remove RendewView argument.
+        (WebCore::getBorderRadiusCornerValues): Remove handling of viewport
+            units, as they are already resolve to pixels here.
+        (WebCore::getBorderRadiusCornerValue): Remove RenderView argument.
+        (WebCore::getBorderRadiusShorthandValue): Ditto.
+        (WebCore::specifiedValueForGridTrackBreadth): Remove handling of
+            viewport units, as they are already resolved to pixels here.
+        (WebCore::specifiedValueForGridTrackSize): Remove RenderView argument.
+        (WebCore::valueForGridTrackList): Ditto.
+        (WebCore::lineHeightFromStyle): Ditto.
+        (WebCore::ComputedStyleExtractor::propertyValue): Ditto.
+        * css/CSSGradientValue.cpp:
+        (WebCore::CSSLinearGradientValue::createGradient): Pass RenderView to
+            CSSToLengthConversionData constructor.
+        (WebCore::CSSRadialGradientValue::createGradient): Ditto.
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::unitCategory): Remove handling of
+            viewport units, as they get resolved to pixels.
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Ditto.
+        (WebCore::CSSPrimitiveValue::init): Ditto.
+        (WebCore::CSSPrimitiveValue::computeLengthDouble): Resolve viewport
+            units to pixels.
+        (WebCore::CSSPrimitiveValue::canonicalUnitTypeForCategory): Remove
+        handling of viewport units, since they get resolved to pixels.
+        (WebCore::CSSPrimitiveValue::viewportPercentageLength): Deleted.
+        * css/CSSPrimitiveValue.h:
+        (WebCore::CSSPrimitiveValue::isLength): Remove special handling of
+            viewport units, since they get resolved to pixels.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::convertToLength): Ditto.
+        * css/CSSToLengthConversionData.cpp:
+        (WebCore::CSSToLengthConversionData::viewportWidthFactor): Caclulate
+            conversion factor for viewport units to pixels. Note this does not
+            set hasViewportUnits on the RenderStyle if computing the font
+            size, because in the font size case, the RenderStyle is the
+            parent's style, not the current renderer's style.
+        (WebCore::CSSToLengthConversionData::viewportHeightFactor): Ditto.
+        (WebCore::CSSToLengthConversionData::viewportMinFactor): Ditto.
+        (WebCore::CSSToLengthConversionData::viewportMaxFactor): Ditto.
+        * css/CSSToLengthConversionData.h:
+        (WebCore::CSSToLengthConversionData::CSSToLengthConversionData): Add
+            RenderView parameter, and make RenderStyle non-const so that
+            hasViewportUnits can be set on the Style..
+        (WebCore::CSSToLengthConversionData::style): style is now non-const.
+        (WebCore::CSSToLengthConversionData::copyWithAdjustedZoom): Handle
+            RenderView argument.
+        * css/CSSToStyleMap.cpp:
+        (WebCore::CSSToStyleMap::mapFillXPosition): Remove handling of
+            viewport units, as they are already resolved to pixels here.
+        (WebCore::CSSToStyleMap::mapFillYPosition): Ditto.
+        * css/DeprecatedStyleBuilder.cpp:
+        (WebCore::ApplyPropertyLength::applyValue): Ditto.
+        (WebCore::ApplyPropertyBorderRadius::applyValue): Ditto.
+        (WebCore::ApplyPropertyComputeLength::applyValue): Ditto.
+        (WebCore::ApplyPropertyFontSize::applyValue): Ditto.
+        (WebCore::ApplyPropertyLineHeight::applyValue): Ditto.
+        (WebCore::ApplyPropertyLineHeightForIOSTextAutosizing::applyValue): Ditto.
+        (WebCore::ApplyPropertyWordSpacing::applyValue): Ditto.
+        (WebCore::ApplyPropertyVerticalAlign::applyValue): Ditto.
+        (WebCore::ApplyPropertyTextIndent::applyValue): Ditto.
+        * css/LengthFunctions.cpp:
+        (WebCore::minimumIntValueForLength): Remove RenderView argument.
+        (WebCore::intValueForLength): Remove RenderView argument and
+            roundPecentages.
+        (WebCore::minimumValueForLength): Remove RenderView argument, and
+            special handling of viewport units.
+        (WebCore::valueForLength): Ditto.
+        (WebCore::floatValueForLength): Ditto.
+        (WebCore::floatSizeForLengthSize): Remove RenderView argument.
+        * css/LengthFunctions.h: Ditto.
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::MediaQueryEvaluator::eval): Add RenderView argument for
+            CSSToLengthConversionData constuctor.
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::State::clear): Change to 0 arg constructor
+            for CSSToLengthConversionData.
+        (WebCore::StyleResolver::State::updateConversionData): In order to get
+            the RenderView, we need to have a valid Element set on the state.
+            Since this means that we need to set the conversion data in more
+            places, move the contruction of conversion data into this helper
+            method.
+        (WebCore::StyleResolver::State::initElement): Make sure conversion
+            data is up to date.
+        (WebCore::StyleResolver::State::initForStyleResolve): Ditto.
+        (WebCore::StyleResolver::State::setStyle): When the style is set, we
+            need to make sure to update the conversion data.
+        (WebCore::StyleResolver::styleForElement): If the style has viewport
+            units, flage the document so that we can make sure to recalc the
+            viewport unit values when the viewport is resized.
+        (WebCore::StyleResolver::pseudoStyleForElement): Ditto.
+        (WebCore::StyleResolver::updateFont): Make sure the font having
+            viewport units updates the style.
+        (WebCore::StyleResolver::convertToIntLength): Remove handling of
+        viewport units, as they are resolved to pixels.
+        (WebCore::StyleResolver::convertToFloatLength): Ditto.
+        (WebCore::StyleResolver::clearCachedPropertiesAffectedByViewportUnits):
+            Invalidate the matched properties cache for styles with viewport
+            units when the viewport is resized.
+        (WebCore::createGridTrackBreadth): Remove handling of viewport units,
+            as they are resolved to pixels.
+        (WebCore::StyleResolver::applyProperty): Ditto.
+        (WebCore::StyleResolver::hasMediaQueriesAffectedByViewportChange):
+            Rename to be less confusing, since it has nothing to do with
+            viewport units.
+        (WebCore::StyleResolver::createFilterOperations): Remove handling of
+            viewport units, as they are resolved to pixels.
+        (WebCore::StyleResolver::affectedByViewportChange): Deleted.
+        (WebCore::StyleResolver::viewportPercentageValue): Deleted.
+        * css/StyleResolver.h:
+        (WebCore::StyleResolver::State::State): C++11 cleanup: 0 -&gt; nullptr.
+        (WebCore::StyleResolver::State::setFontSizeHasViewportUnits): Set if
+            the font size is specified in viewport units.
+        (WebCore::StyleResolver::State::fontSizeHasViewportUnits): Ditto.
+        (WebCore::StyleResolver::State::setStyle): Deleted.
+        * css/TransformFunctions.cpp:
+        (WebCore::convertToFloatLength): Remove handling of viewport units,
+            since they are resolved to pixels.
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Add flag to determine if some style in
+            the document has viewport units.
+        (WebCore::Document::pageSizeAndMarginsInPixels): Remove RenderView
+            argument.
+        (WebCore::Document::updateViewportUnitsOnResize): Mark elements with
+            viewport units for style recalc when the viewport size has
+            changed.
+        * dom/Document.h:
+        (WebCore::Document::setHasStyleWithViewportUnits): Flag to determine
+            if some style in the document has viewport units.
+        (WebCore::Document::hasStyleWithViewportUnits): Ditto.
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::getRegion): Remove RenderView argument.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout): When the viewport is resized, call
+            updateViewportUnitsOnResize on the document.
+        * platform/Length.h:
+        (WebCore::Length::isSpecified): Remove handling of viewport units,
+            since they are now resolved to pixels.
+        (WebCore::Length::viewportPercentageLength): Deleted.
+        (WebCore::Length::isViewportPercentage): Deleted.
+        * rendering/ClipPathOperation.h:
+        (WebCore::ShapeClipPathOperation::pathForReferenceRect): Remove
+            RenderView argument.
+        (WebCore::BoxClipPathOperation::pathForReferenceRect): Ditto.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateBlockChildDirtyBitsBeforeLayout): Remove
+            handling of viewport units, since they get updated by
+            updateViewportUnitsOnResize when the viewport is resized.
+        (WebCore::RenderBlock::nodeAtPoint): Remove RenderView argument.
+        (WebCore::RenderBlock::lineHeight): Ditto.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintBoxDecorations): Remove RenderView argument.
+        (WebCore::RenderBox::computeContentAndScrollbarLogicalHeightUsing):
+            Remove handling of viewport units, as they are resolved to pixels.
+        (WebCore::RenderBox::computePercentageLogicalHeight): Ditto.
+        (WebCore::RenderBox::computeReplacedLogicalWidthUsing): Ditto.
+        (WebCore::RenderBox::computeReplacedLogicalHeightUsing): Ditto.
+        (WebCore::RenderBox::hasViewportPercentageLogicalHeight): Deleted.
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::getBackgroundRoundedRect): Remove
+            RenderView argument.
+        (WebCore::RenderBoxModelObject::calculateFillTileSize): Remove
+            handling of viewport units, as they are resolved to pixels.
+        (WebCore::computeBorderImageSide): Remove RenderView argument.
+        (WebCore::RenderBoxModelObject::paintNinePieceImage): Ditto.
+        (WebCore::RenderBoxModelObject::paintBorder): Ditto.
+        (WebCore::RenderBoxModelObject::paintBoxShadow): Ditto.
+        * rendering/RenderElement.cpp:
+        (WebCore::RenderElement::repaintAfterLayoutIfNeeded): Ditto.
+        * rendering/RenderElement.h:
+        (WebCore::RenderElement::valueForLength): Remove unused
+            roundPercentages argument.
+        (WebCore::RenderElement::minimumValueForLength): Remove unused
+            RoundPercentages and RenderView arguments.
+        * rendering/RenderGrid.cpp:
+        (WebCore::RenderGrid::layoutGridItems): Remove handling of viewport
+            units as they are resolved to pixels.
+        * rendering/RenderInline.cpp:
+        (WebCore::computeMargin): Ditto.
+        (WebCore::RenderInline::lineHeight): Remove RenderView argument.
</ins><span class="cx">         * rendering/RenderLayer.cpp:
</span><del>-        (WebCore::RenderLayer::filterNeedsRepaint):
</del><ins>+        (WebCore::RenderLayer::setupClipPath): Ditto.
+        * rendering/RenderLineBreak.cpp:
+        (WebCore::RenderLineBreak::lineHeight): Ditto.
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::calcScrollbarThicknessUsing): Ditto.
+        (WebCore::RenderScrollbarPart::computeScrollbarWidth): Ditto.
+        (WebCore::RenderScrollbarPart::computeScrollbarHeight): Ditto.
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::convertStyleLogicalHeightToComputedHeight):
+            Remove handling of viewport units, since they are resolved to
+            pixels.
+        (WebCore::RenderTable::computePreferredLogicalWidths): Now that
+            viewport unit values are resolved to pixels at style recalc time,
+            no special checking is needed to handle them, so update the
+            comment to reflect that.
+        * rendering/RenderThemeIOS.mm:
+        (WebCore::applyCommonButtonPaddingToStyle): Add RenderView argument to
+            CSSToLengthConversionData constructor.
+        (WebCore::RenderThemeIOS::adjustButtonStyle): Ditto.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMenuListButtonGradients): Remove
+            RenderView argument.
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::layout): Remove handling of viewport units,
+            since they are resolved to pixels.
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::ascentAndDescentForBox): Remove RenderView
+            argument.
+        * rendering/shapes/Shape.cpp:
+        (WebCore::Shape::createShape): Remove RenderView argument.
+        * rendering/shapes/Shape.h:
+        * rendering/shapes/ShapeOutsideInfo.cpp:
+        (WebCore::ShapeOutsideInfo::computedShape): Ditto.
+        * rendering/style/BasicShapes.cpp:
+        (WebCore::BasicShapeCircle::floatValueForRadiusInBox): Ditto.
+        (WebCore::BasicShapeCircle::path): Ditto.
+        (WebCore::BasicShapeEllipse::floatValueForRadiusInBox): Ditto.
+        (WebCore::BasicShapeEllipse::path): Ditto.
+        (WebCore::BasicShapePolygon::path): Ditto.
+        (WebCore::floatSizeForLengthSize): Ditto.
+        (WebCore::BasicShapeInset::path): Ditto.
+        * rendering/style/BasicShapes.h:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::calcRadiiFor): Ditto.
+        (WebCore::RenderStyle::getRoundedBorderFor): Ditto.
+        (WebCore::RenderStyle::computedLineHeight): Remove handling of
+            viewport units since they are resolved to pixels.
+        * rendering/style/RenderStyle.h:
+        (WebCore::RenderStyle::setHasViewportUnits): Set if this style has
+        a property set with viewport units.
+        (WebCore::RenderStyle::hasViewportUnits): Ditto.
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::resolveLengthAttributeForSVG): Remove RenderView argument.
+        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth): Ditto.
+        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight): Ditto.
+        * rendering/svg/SVGRenderingContext.cpp:
+        (WebCore::SVGRenderingContext::prepareToRenderSVGContent): Ditto.
</ins><span class="cx"> 
</span><del>-2014-05-23  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+2014-05-27  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-    Rollout r169219
</del><ins>+        [CSS Shapes] serialization of the computed value should omit the default radii
+        https://bugs.webkit.org/show_bug.cgi?id=132747
</ins><span class="cx"> 
</span><del>-2014-05-23  Dana Burkart  &lt;dburkart@apple.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Merge r165862
</del><ins>+        We should omit closest-side value, whereever is possible. Specification:
+        http://www.w3.org/TR/2014/CR-css-shapes-1-20140320/#basic-shape-computed-values 
+        This change aligns the behavior to the specification.
</ins><span class="cx"> 
</span><del>-        2014-03-18  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</del><ins>+        Added new test cases for the shape-outside parsing tests.
</ins><span class="cx"> 
</span><del>-                Unify &lt;media&gt; element callback registration and unregistration
-                https://bugs.webkit.org/show_bug.cgi?id=130417
</del><ins>+        * css/CSSBasicShapes.cpp:
+        (WebCore::buildCircleString):
+        (WebCore::CSSBasicShapeCircle::cssText):
+        (WebCore::CSSBasicShapeEllipse::cssText):
</ins><span class="cx"> 
</span><del>-                Reviewed by Eric Carlson.
</del><ins>+2014-05-27  Commit Queue  &lt;commit-queue@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-                * html/HTMLMediaElement.cpp:
-                (WebCore::HTMLMediaElement::HTMLMediaElement):
-                (WebCore::HTMLMediaElement::~HTMLMediaElement):
-                (WebCore::HTMLMediaElement::registerWithDocument):
-                (WebCore::HTMLMediaElement::unregisterWithDocument):
-                (WebCore::HTMLMediaElement::didMoveToNewDocument):
-                * html/HTMLMediaElement.h:
</del><ins>+        Unreviewed, rolling out r169399.
+        https://bugs.webkit.org/show_bug.cgi?id=133326
</ins><span class="cx"> 
</span><del>-2014-05-23  Dana Burkart  &lt;dburkart@apple.com&gt;
</del><ins>+        Causes assertion failures in tests.  See
+        http://build.webkit.org/results/Apple%20Mavericks%20Debug%20WK1%20(Tests)/r169399%20(5622)/results.html
+        (Requested by mlam on #webkit).
</ins><span class="cx"> 
</span><del>-        Merge r160847
</del><ins>+        Reverted changeset:
</ins><span class="cx"> 
</span><del>-    2013-12-19  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        &quot;Caret's screen position does not update during an overflow
+        scroll&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=133256
+        http://trac.webkit.org/changeset/169399
</ins><span class="cx"> 
</span><del>-            overflowchanged event could cause a crash
-            https://bugs.webkit.org/show_bug.cgi?id=125978
</del><ins>+2014-05-27  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Tim Horton.
</del><ins>+        Lists styled with SVG fonts are not rendered as expected
+        https://bugs.webkit.org/show_bug.cgi?id=133198
</ins><span class="cx"> 
</span><del>-            Made the event asynchrnous by re-using Document's event queuing ability. Also removed
-            the infrastructure to queue up events in FrameView.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-            Test: fast/events/overflowchanged-inside-selection-collapse-crash.html
</del><ins>+        There were a couple places in RenderListMarker and RenderMenuList that were
+        implicitly creating TextRuns by passing a String to a function which
+        expected a TextRun. Because TextRun has a constructor which takes a single
+        String and isn't marked explicit, TextRuns were being created without
+        any of the associated code that initializes the TextRun (such as creating
+        a RenderingContext if necessary).
</ins><span class="cx"> 
</span><del>-            * dom/Document.cpp:
-            (WebCore::Document::recalcStyle):
-            (WebCore::Document::enqueueOverflowEvent):
-            * dom/Document.h:
-            * page/FrameView.cpp:
-            (WebCore::FrameView::FrameView):
-            (WebCore::FrameView::~FrameView):
-            (WebCore::FrameView::layout):
-            (WebCore::FrameView::performPostLayoutTasks):
-            (WebCore::FrameView::updateOverflowStatus):
-            * page/FrameView.h:
-            * rendering/RenderBlock.cpp:
-            (WebCore::OverflowEventDispatcher::~OverflowEventDispatcher):
-            * rendering/RenderLayer.cpp:
-            (WebCore::RenderLayer::scrollRectToVisible):
-            * rendering/RenderMarquee.cpp:
-            (WebCore::RenderMarquee::start):
</del><ins>+        This patch marks the aforementioned constructor as &quot;explicit&quot; to discourage
+        such behavior in the future.
</ins><span class="cx"> 
</span><del>-2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        Test: svg/custom/list-items-with-svg-font-family.html
</ins><span class="cx"> 
</span><del>-        Merge r168915
</del><ins>+        * platform/graphics/TextRun.h:
+        (WebCore::TextRun::TextRun): Mark constructors as explicit.
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::computePreferredLogicalWidths): Call
+        RenderBlock::constructTextRun.
+        (WebCore::RenderListMarker::getRelativeMarkerRect): Ditto.
+        * rendering/RenderMenuList.cpp:
+        (RenderMenuList::updateOptionsWidth): Ditto.
</ins><span class="cx"> 
</span><del>-    2014-05-15  Daniel Bates  &lt;dabates@apple.com&gt;
</del><ins>+2014-05-23  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            SVG element may reference arbitrary DOM element before running its insertion logic
-            https://bugs.webkit.org/show_bug.cgi?id=132757
-            &lt;rdar://problem/15703817&gt;
</del><ins>+        Caret's screen position does not update during an overflow scroll
+        https://bugs.webkit.org/show_bug.cgi?id=133256
</ins><span class="cx"> 
</span><del>-            Reviewed by Ryosuke Niwa.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-            Fixes an issue where an SVG element may reference an arbitrary DOM element e before e finished being
-            inserted in the tree.
</del><ins>+        During a scroll, we set a flag which caret position is gated on, but we never
+        actually invalidate the caret's position. This patch does so.
</ins><span class="cx"> 
</span><del>-            Currently when an SVG element A is inserted into a document we use document.getElementById() to find the
-            element B it references (if any). If A is inserted before B and B has the same id as a later element in
-            the document then A can find B before B is notified that its been inserted into the document (i.e. before
-            Element::insertedFrom() is called on B). Instead, A should call document.getElementById() only after
-            cessation of the insertion operation that inserted it to ensure that all inserted nodes (including B)
-            processed their insertion-specific logic.
</del><ins>+        Test: editing/input/caret-position-during-scroll.html
</ins><span class="cx"> 
</span><del>-            Tests: svg/custom/reparent-animate-element.html
-                   svg/custom/reparent-feimage-element.html
-                   svg/custom/reparent-mpath-element.html
-                   svg/custom/reparent-textpath-element.html
-                   svg/custom/reparent-tref-element.html
-                   svg/custom/reparent-use-element.html
</del><ins>+        * editing/FrameSelection.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollTo):
</ins><span class="cx"> 
</span><del>-            * svg/SVGFEImageElement.cpp:
-            (WebCore::SVGFEImageElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-            we are called back to resolve our target element (i.e. call SVGFEImageElement::buildPendingResources())
-            after the subtree we're in is inserted.
-            (WebCore::SVGFEImageElement::didNotifySubtreeInsertions): Added; turns around and calls SVGFEImageElement::buildPendingResources().
-            * svg/SVGFEImageElement.h:
-            * svg/SVGMPathElement.cpp:
-            (WebCore::SVGMPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-            we are called back to resolve our target element (i.e. call SVGMPathElement::buildPendingResources())
-            after the subtree we're in is inserted.
-            (WebCore::SVGMPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGMPathElement::buildPendingResources().
-            * svg/SVGMPathElement.h:
-            * svg/SVGTRefElement.cpp:
-            (WebCore::SVGTRefElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-            we are called back to resolve our target element (i.e. call SVGTRefElement::buildPendingResources())
-            after the subtree we're in is inserted.
-            (WebCore::SVGTRefElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTRefElement::buildPendingResources().
-            * svg/SVGTRefElement.h:
-            * svg/SVGTextPathElement.cpp:
-            (WebCore::SVGTextPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-            we are called back to resolve our target element (i.e. call SVGTextPathElement::buildPendingResources())
-            after the subtree we're in is inserted.
-            (WebCore::SVGTextPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTextPathElement::buildPendingResources().
-            * svg/SVGTextPathElement.h:
-            * svg/SVGUseElement.cpp:
-            (WebCore::SVGUseElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-            we are called back to resolve our target element (i.e. call SVGUseElement::buildPendingResources()) after its subtree is
-            inserted.
-            (WebCore::SVGUseElement::didNotifySubtreeInsertions): Added; turns around and calls SVGUseElement::buildPendingResources().
-            * svg/SVGUseElement.h:
-            * svg/animation/SVGSMILElement.cpp:
-            (WebCore::SVGSMILElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-            we are called back to resolve our target element (i.e. call SVGSMILElement::buildPendingResources())
-            after the subtree we're in is inserted.
-            (WebCore::SVGSMILElement::didNotifySubtreeInsertions): Added; turns around and calls SVGSMILElement::buildPendingResources().
-            * svg/animation/SVGSMILElement.h:
</del><ins>+2014-05-27  Timothy Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</del><ins>+        Turn on the LayerPool for iOS
+        https://bugs.webkit.org/show_bug.cgi?id=133299
</ins><span class="cx"> 
</span><del>-        Merge r169007
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-    2014-05-17  Maciej Stachowiak  &lt;mjs@apple.com&gt;
</del><ins>+        * Configurations/WebCore.xcconfig:
+        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
+        (WebCore::MemoryPressureHandler::platformReleaseMemory):
+        * platform/graphics/ca/mac/TileController.mm:
+        (WebCore::TileController::createTileLayer):
+        * platform/graphics/ca/mac/TileGrid.mm:
+        (WebCore::TileGrid::removeTiles):
+        Turn on the LayerPool for iOS.
+        We've used this on Mac for a long time, and the WebKit1
+        (&quot;legacy&quot;) iOS TileCache also had a similar pool.
+        This helps a good bit with flashiness while scrolling.
</ins><span class="cx"> 
</span><del>-            Don't attempt to update id or name for nodes that are already removed
-            https://bugs.webkit.org/show_bug.cgi?id=133041
</del><ins>+2014-05-27  David Hyatt  &lt;hyatt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Sam Weinig.
</del><ins>+        REGRESSION: Audio volume scrubber does not show volume level thumb
+        &lt;rdar://problem/16902004&gt;
+        https://bugs.webkit.org/show_bug.cgi?id=133310
</ins><span class="cx"> 
</span><del>-            Tests: fast/dom/remove-element-with-id-that-was-inserted-on-DOMNodeRemoved.html
-                   fast/dom/remove-element-with-name-that-was-inserted-on-DOMNodeRemoved.html
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-            * dom/Element.cpp:
-            (WebCore::Element::removedFrom): Skip updating ids and names for an element not
-            in a treescope, as we already do for elements not in a document.
</del><ins>+        This was just a silly mistake on my part with the setting of the pagination
+        layers. Layers inside transforms are supposed to clear out their pagination
+        status based off their ancestor containing block layers, and not off the
+        enclosing pagination layer.
+        
+        Added fast/multicol/pagination/nested-transforms.html
</ins><span class="cx"> 
</span><del>-2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updatePagination):
</ins><span class="cx"> 
</span><del>-        Merge r168636
</del><ins>+2014-05-27  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2014-05-12  Martin Hock  &lt;mhock@apple.com&gt;
</del><ins>+        [Mac] media controls should prevent 'click' events from reaching the page
+        https://bugs.webkit.org/show_bug.cgi?id=133268
</ins><span class="cx"> 
</span><del>-            Disallow drag and drop of non-displayable resources.
-            https://bugs.webkit.org/show_bug.cgi?id=132745
-            &lt;rdar://problem/10562662&gt;
</del><ins>+        Reviewed by Jer Noble.
</ins><span class="cx"> 
</span><del>-            Reviewed by Alexey Proskuryakov.
</del><ins>+        Test: media/media-controls-cancel-events.html
</ins><span class="cx"> 
</span><del>-            Test: http/tests/security/drag-drop-local-file.html
</del><ins>+        * Modules/mediacontrols/mediaControlsApple.js:
+        (Controller.prototype.handleEvent): Allow event handler to cancel event default action.
+        (Controller.prototype.handleRewindButtonClicked): Cancel event default.
+        (Controller.prototype.handlePlayButtonClicked): Ditto.
+        (Controller.prototype.handleMuteButtonClicked): Ditto.
+        (Controller.prototype.handleMinButtonClicked): Ditto.
+        (Controller.prototype.handleCaptionButtonClicked): Ditto.
+        (Controller.prototype.handleFullscreenButtonClicked): Ditto.
+        * Modules/mediacontrols/mediaControlsiOS.js:
+        (ControllerIOS.prototype.handlePlayButtonTouchEnd): Ditto.
+        (ControllerIOS.prototype.handlePlayButtonTouchCancel): Ditto.
+        (ControllerIOS.prototype.handleFullscreenTouchEnd): Ditto.
+        (ControllerIOS.prototype.handleFullscreenTouchCancel): Ditto.
+        (ControllerIOS.prototype.handleStartPlaybackButtonTouchEnd): Ditto.
+        (ControllerIOS.prototype.handleStartPlaybackButtonTouchCancel): Ditto.
+        (ControllerIOS.prototype.handleWirelessPickerButtonClicked): Ditto.
</ins><span class="cx"> 
</span><del>-            * page/DragController.cpp:
-            (WebCore::DragController::startDrag):
</del><ins>+2014-05-27  Jon Lee  &lt;jonlee@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        Fix Mavericks bots from r169383.
+        https://bugs.webkit.org/show_bug.cgi?id=133311
</ins><span class="cx"> 
</span><del>-        Merge r166741
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-    2014-04-02  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.h: Update #ifdef to check for ENABLE(MEDIA_SOURCE).
+        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm: Ditto.
</ins><span class="cx"> 
</span><del>-            Harden FilterOperation type casting
-            https://bugs.webkit.org/show_bug.cgi?id=131142
</del><ins>+2014-05-27  Radu Stavila  &lt;stavila@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Sam Weinig.
</del><ins>+        REGRESSION (r168046): Incorrect handling of multicol spanner
+        https://bugs.webkit.org/show_bug.cgi?id=133249
</ins><span class="cx"> 
</span><del>-            DefaultFilterOperation had an error-prone behavior where it set the base class
-            OperationType to the type of some other filter class, but overrode isDefault(). 
-            This made it very easy to write incorrect code that casted incorrectly based on type().
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-            Fix by making adding a DEFAULT filter operation type, and storing the represented
-            type on DefaultFilterOperation().
</del><ins>+        When removing the child of an object, the removeChild method should return the next element
+        following the one being deleted. This will ensure that proper iteration and destruction of
+        an object's children is possible.
</ins><span class="cx"> 
</span><del>-            Also remove the OperationType argument for constructors of FilterOperations that
-            can only be of one type, to avoid possible mistakes.
</del><ins>+        No new tests added. This is because the test that triggers this issue also triggers
+        another assertion, in RenderMultiColumnSet::requiresBalancing(). However, that is a totally
+        separate problem and will be handled in a separate bug: https://bugs.webkit.org/show_bug.cgi?id=133309
</ins><span class="cx"> 
</span><del>-            Make the type cast macros a bit more normal, and use them in a few places.
</del><ins>+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockFlow.cpp:
+        (WebCore::RenderBlockFlow::removeChild):
+        * rendering/RenderBlockFlow.h:
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::removeChild):
+        * rendering/RenderButton.h:
+        * rendering/RenderElement.cpp:
+        (WebCore::RenderElement::removeChild):
+        (WebCore::RenderElement::removeChildInternal):
+        * rendering/RenderElement.h:
+        * rendering/RenderMenuList.cpp:
+        (RenderMenuList::removeChild):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderMultiColumnFlowThread.cpp:
+        (WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted):
+        * rendering/RenderRuby.cpp:
+        (WebCore::RenderRubyAsInline::removeChild):
+        (WebCore::RenderRubyAsBlock::removeChild):
+        * rendering/RenderRuby.h:
+        * rendering/RenderRubyRun.cpp:
+        (WebCore::RenderRubyRun::removeChild):
+        * rendering/RenderRubyRun.h:
+        * rendering/mathml/RenderMathMLScripts.cpp:
+        (WebCore::RenderMathMLScripts::removeChildInternal):
+        (WebCore::RenderMathMLScripts::removeChild):
+        (WebCore::RenderMathMLScriptsWrapper::removeChildInternal):
+        (WebCore::RenderMathMLScriptsWrapper::removeChild):
+        * rendering/mathml/RenderMathMLScripts.h:
+        * rendering/svg/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::removeChild):
+        * rendering/svg/RenderSVGContainer.h:
+        * rendering/svg/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::removeChild):
+        * rendering/svg/RenderSVGInline.h:
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::removeChild):
+        * rendering/svg/RenderSVGRoot.h:
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::removeChild):
+        * rendering/svg/RenderSVGText.h:
</ins><span class="cx"> 
</span><del>-            Fixed PlatformCAFiltersMac to handle the default filter case more cleanly.
</del><ins>+2014-05-27  Jon Lee  &lt;jonlee@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * WebCore.exp.in:
-            * css/CSSComputedStyleDeclaration.cpp:
-            (WebCore::ComputedStyleExtractor::valueForFilter):
-            * css/StyleResolver.cpp:
-            (WebCore::StyleResolver::createFilterOperations):
-            * platform/graphics/ca/PlatformCAFilters.h:
-            * platform/graphics/ca/mac/PlatformCAFiltersMac.mm:
-            (PlatformCAFilters::filterValueForOperation):
-            (PlatformCAFilters::colorMatrixValueForFilter):
-            * platform/graphics/filters/FilterOperation.cpp:
-            (WebCore::DefaultFilterOperation::operator==):
-            (WebCore::ReferenceFilterOperation::ReferenceFilterOperation):
-            (WebCore::ReferenceFilterOperation::operator==):
-            (WebCore::BlurFilterOperation::operator==):
-            (WebCore::BlurFilterOperation::blend):
-            (WebCore::DropShadowFilterOperation::operator==):
-            (WebCore::DropShadowFilterOperation::blend):
-            * platform/graphics/filters/FilterOperation.h:
-            (WebCore::FilterOperation::blend):
-            (WebCore::FilterOperation::type):
-            (WebCore::FilterOperation::isBasicColorMatrixFilterOperation):
-            (WebCore::FilterOperation::isBasicComponentTransferFilterOperation):
-            (WebCore::FilterOperation::isSameType):
-            (WebCore::DefaultFilterOperation::create):
-            (WebCore::DefaultFilterOperation::representedType):
-            (WebCore::DefaultFilterOperation::DefaultFilterOperation):
-            (WebCore::ReferenceFilterOperation::create):
-            (WebCore::BlurFilterOperation::create):
-            (WebCore::BlurFilterOperation::BlurFilterOperation):
-            (WebCore::DropShadowFilterOperation::create):
-            (WebCore::DropShadowFilterOperation::DropShadowFilterOperation):
-            (WebCore::FilterOperation::isDefault): Deleted.
-            * platform/graphics/filters/FilterOperations.cpp:
-            (WebCore::FilterOperations::outsets):
-            * rendering/FilterEffectRenderer.cpp:
-            (WebCore::FilterEffectRenderer::build):
-            * rendering/RenderLayerFilterInfo.cpp:
-            (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
</del><ins>+        Update ENABLE(MEDIA_SOURCE) on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=133141
</ins><span class="cx"> 
</span><del>-2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Merge r167851
</del><ins>+        * Configurations/FeatureDefines.xcconfig:
</ins><span class="cx"> 
</span><del>-    2014-04-26  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+2014-05-27  Tibor Meszaros  &lt;tmeszaros.u-szeged@partner.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-            Frame and page lifetime fixes in WebCore::createWindow
-            https://bugs.webkit.org/show_bug.cgi?id=132089
</del><ins>+        Remove BLOB guards
+        https://bugs.webkit.org/show_bug.cgi?id=132863
</ins><span class="cx"> 
</span><del>-            Reviewed by Sam Weinig.
</del><ins>+        Reviewed by Csaba Osztrogonác.
</ins><span class="cx"> 
</span><del>-            Speculative fix because I was unable to reproduce the crash that was
-            reported with the test case attached to this bug.
</del><ins>+        * Configurations/FeatureDefines.xcconfig:
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::WebSocketChannel):
+        (WebCore::WebSocketChannel::didFail):
+        (WebCore::WebSocketChannel::processOutgoingFrameQueue):
+        (WebCore::WebSocketChannel::abortOutgoingFrameQueue):
+        * Modules/websockets/WebSocketChannel.h:
+        * WebCore.exp.in:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * bindings/js/JSBlobCustom.cpp:
+        (WebCore::JSBlobConstructor::constructJSBlob):
+        * bindings/js/JSFileReaderCustom.cpp:
+        * dom/DOMExceptions.in:
+        * dom/EventTargetFactory.in:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::publicURLManager):
+        * dom/ScriptExecutionContext.h:
+        * fileapi/AsyncFileStream.cpp:
+        * fileapi/AsyncFileStream.h:
+        * fileapi/Blob.cpp:
+        (WebCore::Blob::Blob):
+        * fileapi/Blob.h:
+        (WebCore::Blob::slice):
+        * fileapi/Blob.idl:
+        * fileapi/FileError.h:
+        * fileapi/FileError.idl:
+        * fileapi/FileException.cpp:
+        * fileapi/FileException.h:
+        * fileapi/FileException.idl:
+        * fileapi/FileReader.cpp:
+        * fileapi/FileReader.h:
+        * fileapi/FileReader.idl:
+        * fileapi/FileReaderLoader.cpp:
+        * fileapi/FileReaderLoader.h:
+        * fileapi/FileReaderLoaderClient.h:
+        * fileapi/FileReaderSync.cpp:
+        * fileapi/FileReaderSync.h:
+        * fileapi/FileReaderSync.idl:
+        * fileapi/FileThread.cpp:
+        * fileapi/FileThread.h:
+        * fileapi/ThreadableBlobRegistry.cpp:
+        (WebCore::ThreadableBlobRegistry::registerFileBlobURL): Deleted.
+        (WebCore::ThreadableBlobRegistry::registerBlobURL): Deleted.
+        (WebCore::ThreadableBlobRegistry::registerBlobURLForSlice): Deleted.
+        (WebCore::ThreadableBlobRegistry::unregisterBlobURL): Deleted.
+        (WebCore::ThreadableBlobRegistry::blobSize): Deleted.
+        (WebCore::ThreadableBlobRegistry::getCachedOrigin): Deleted.
+        * fileapi/WebKitBlobBuilder.cpp:
+        (WebCore::BlobBuilder::append):
+        * fileapi/WebKitBlobBuilder.h:
+        * html/DOMURL.cpp:
+        * html/DOMURL.h:
+        * html/DOMURL.idl:
+        * html/PublicURLManager.cpp:
+        * html/PublicURLManager.h:
+        * loader/LoaderStrategy.cpp:
+        (WebCore::LoaderStrategy::createBlobRegistry):
+        * loader/LoaderStrategy.h:
+        * page/DOMWindow.idl:
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::shouldUseInnerURL):
+        (WebCore::getCachedOrigin):
+        * platform/FileStream.cpp:
+        * platform/FileStream.h:
+        * platform/FileStreamClient.h:
+        * platform/SchemeRegistry.cpp:
+        (WebCore::canDisplayOnlyIfCanRequestSchemes):
+        * platform/network/BlobRegistry.cpp:
+        * platform/network/BlobRegistryImpl.cpp:
+        * platform/network/BlobResourceHandle.cpp:
+        * platform/network/BlobResourceHandle.h:
+        * platform/network/FormData.cpp:
+        (WebCore::FormData::deepCopy):
+        (WebCore::FormData::appendFile):
+        (WebCore::FormData::appendBlob):
+        (WebCore::FormData::appendKeyValuePairItems):
+        (WebCore::FormData::resolveBlobReferences):
+        (WebCore::encodeElement):
+        (WebCore::decodeElement):
+        * platform/network/FormData.h:
+        (WebCore::FormDataElement::FormDataElement):
+        (WebCore::operator==):
+        * platform/network/cf/FormDataStreamCFNet.cpp:
+        (WebCore::closeCurrentStream):
+        (WebCore::advanceCurrentStream):
+        (WebCore::formCreate):
+        (WebCore::formRead):
+        (WebCore::setHTTPBody):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::getFormElementsCount):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::addEncodedBlobToSoupMessageBody):
+        (WebCore::addFormElementsToSoupMessage):
+        * workers/WorkerGlobalScope.idl:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
+        (WebCore::XMLHttpRequest::createRequest):
</ins><span class="cx"> 
</span><del>-            * loader/FrameLoader.cpp:
-            (WebCore::createWindow): Changed code to remove the assumption that calls
-            out will not destroy the page or frame. Use RefPtr for the frame, and
-            added early exits if frame-&gt;page() becomes null at any point before we
-            use a page pointer.
</del><ins>+2014-05-27  Zsolt Borbely  &lt;zsborbely.u-szeged@partner.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</del><ins>+        Allow building CMake based ports with WEB_REPLAY
+        https://bugs.webkit.org/show_bug.cgi?id=133154
</ins><span class="cx"> 
</span><del>-        Merge r168641
</del><ins>+        Reviewed by Csaba Osztrogonác.
</ins><span class="cx"> 
</span><del>-    2014-05-09  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+        * CMakeLists.txt:
</ins><span class="cx"> 
</span><del>-            REGRESSION (r167818): editing/inserting/typing-space-to-trigger-smart-link.html fails on WebKit1 bots
</del><ins>+2014-05-27  Adrian Perez de Castro  &lt;aperez@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-            &lt;https://bugs.webkit.org/show_bug.cgi?id=132207&gt;
-            &lt;rdar://problem/16730393&gt;
</del><ins>+        [GStreamer] Add missing &lt;wtf/MathExtras.h&gt; header
+        https://bugs.webkit.org/show_bug.cgi?id=133236
</ins><span class="cx"> 
</span><del>-            Reverts the previous workaround in favor of a more specific fix for the
-            null dereference.
</del><ins>+        Reviewed by Philippe Normand.
</ins><span class="cx"> 
</span><del>-            Reviewed by Darin Adler.
</del><ins>+        In some configurations, not including &lt;wtf/MathExtras.h&gt; will cause
+        errors about undefined functions. In particular, this happens in
+        Linux with glibc 2.19 and compiling with Clang. Having the header
+        included is the correct thing to do anyway.
</ins><span class="cx"> 
</span><del>-            * editing/ApplyStyleCommand.cpp:
-            (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange):
-            Check whether the run's start and end are still in the document, as
-            removeConflictingInlineStyleFromRun() may have removed them.
</del><ins>+        * platform/graphics/gstreamer/GStreamerUtilities.cpp:
+        Include &lt;wtf/MathExtras.h&gt;
</ins><span class="cx"> 
</span><del>-            * editing/CompositeEditCommand.cpp:
-            (WebCore::CompositeEditCommand::apply):
-            Reverted previous workaround.
-            (WebCore::ApplyEditCommand::ReentrancyGuard::isRecursiveCall): Deleted.
-            (WebCore::ApplyEditCommand::ReentrancyGuard::Scope::Scope): Deleted.
-            (WebCore::ApplyEditCommand::ReentrancyGuard::Scope::~Scope): Deleted.
</del><ins>+2014-05-27  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        Setting up OrderIterator shouldn't require an extra Vector
+        https://bugs.webkit.org/show_bug.cgi?id=119061
</ins><span class="cx"> 
</span><del>-        Merge r167635
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-    2014-04-21  Dan Bernstein  &lt;mitz@apple.com&gt;
</del><ins>+        From Blink r153971 by &lt;jchaffraix@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-            WebCore part of &lt;rdar://problem/16631323&gt; Page::setDefersLoading doesn’t do anything when using the Network process
-            https://bugs.webkit.org/show_bug.cgi?id=131939
</del><ins>+        This patches reuse the OrderIterator's Vector. It provides a helper class OrderIteratorPopulator, used for
+        manipulating the Vector directly. Which allows to consolidate the code into a single implementation across
+        flexbox and grid.
</ins><span class="cx"> 
</span><del>-            Reviewed by David Kilzer.
</del><ins>+        No new tests, already covered by current tests.
</ins><span class="cx"> 
</span><del>-            * WebCore.exp.in: Exported WebCore::ResourceHandle::setDefersLoading.
</del><ins>+        * rendering/OrderIterator.cpp:
+        (WebCore::OrderIteratorPopulator::~OrderIteratorPopulator): Reset OrderIterator and call
+        removeDuplicatedOrderValues().
+        (WebCore::OrderIteratorPopulator::removeDuplicatedOrderValues): Sorts the Vector and removes the duplicated
+        order values.
+        (WebCore::OrderIteratorPopulator::collectChild): Collect order value information from child.
+        (WebCore::OrderIterator::setOrderValues): Deleted.
+        * rendering/OrderIterator.h:
+        (WebCore::OrderIteratorPopulator::OrderIteratorPopulator): Add helper class to manipulate OrderValues Vector.
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock): Remove unneeded code related to old OrderValues vector.
+        (WebCore::RenderFlexibleBox::prepareOrderIteratorAndMargins): Populate OrderIterator using collectChild().
+        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes): Deleted.
+        * rendering/RenderFlexibleBox.h: Rename computeMainAxisPreferredSizes() to prepareOrderIteratorAndMargins().
+        * rendering/RenderGrid.cpp:
+        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator): Populate OrderIterator using collectChild().
</ins><span class="cx"> 
</span><del>-            * loader/ResourceLoadScheduler.cpp:
-            (WebCore::ResourceLoadScheduler::setDefersLoading): Added a no-op implementation.
-            * loader/ResourceLoadScheduler.h: Declared new virtual member function setDefersLoading.
</del><ins>+2014-05-26  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * loader/ResourceLoader.cpp:
-            (WebCore::ResourceLoader::setDefersLoading): Added a call to the above function.
</del><ins>+        [wk2] RemoteLayerBackingStore front buffers should be purgeable when unparented
+        https://bugs.webkit.org/show_bug.cgi?id=133020
+        &lt;rdar://problem/16521736&gt;
</ins><span class="cx"> 
</span><del>-2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Merge r167818
</del><ins>+        * WebCore.exp.in:
+        * platform/graphics/cg/IOSurfacePool.cpp:
+        (WebCore::IOSurfacePool::willAddSurface):
+        * platform/graphics/cocoa/IOSurface.h:
+        * platform/graphics/cocoa/IOSurface.mm:
+        (IOSurface::releaseGraphicsContext):
+        Rename clearGraphicsContext to releaseGraphicsContext for clarity.
</ins><span class="cx"> 
</span><del>-    2014-04-23  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+2014-05-26  Philip Rogers  &lt;pdr@google.com&gt;
</ins><span class="cx"> 
</span><del>-            Crash applying editing commands from iframe onload event
</del><ins>+        Remove special case for transparent SVG root layers
+        https://bugs.webkit.org/show_bug.cgi?id=116856
</ins><span class="cx"> 
</span><del>-            &lt;https://bugs.webkit.org/show_bug.cgi?id=132103&gt;
-            &lt;rdar://problem/15696351&gt;
</del><ins>+        Reviewed by Dirk Schulze.
</ins><span class="cx"> 
</span><del>-            This patch merges the Chromium bug workaround from
-            &lt;http://src.chromium.org/viewvc/blink?revision=162080&amp;view=revision&gt;,
-            which prevents reentrancy in CompositeEditCommand::apply().
</del><ins>+        This patch removes a special case from RenderLayer for root SVG layers
+        with opacity. Instead of checking whether a composited layer exists in
+        SVGRenderingContext::prepareToRenderSVGContent we now exclude the root
+        SVG renderobject from the opacity checks in prepareToRenderSVGContent.
</ins><span class="cx"> 
</span><del>-            Reviewed by Darin Adler.
</del><ins>+        This is a merge of https://src.chromium.org/viewvc/blink?view=rev&amp;revision=174102
+        by Philip Rogers &lt;pdr@chromium.org&gt;.
</ins><span class="cx"> 
</span><del>-            Test: editing/apply-style-iframe-crash.html
</del><ins>+        No new tests as this is covered by svg/custom/composited-svg-with-opacity.html.
</ins><span class="cx"> 
</span><del>-            * editing/CompositeEditCommand.cpp:
-            (WebCore::HTMLNames::ReentrancyGuard::isRecursiveCall):
-            (WebCore::HTMLNames::ReentrancyGuard::Scope::Scope):
-            (WebCore::HTMLNames::ReentrancyGuard::Scope::~Scope):
-            (WebCore::CompositeEditCommand::apply):
-            If this is a recursive call, return early.
</del><ins>+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::isTransparent): Deleted.
+        * rendering/RenderLayer.h:
+        * rendering/svg/SVGRenderingContext.cpp:
+        (WebCore::SVGRenderingContext::prepareToRenderSVGContent):
+            The opacity case for root svg renderers is now handled by
+            RenderLayer.
</ins><span class="cx"> 
</span><del>-2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</del><ins>+2014-05-26  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r167264
</del><ins>+        CSS JIT: Fix build error raised when CSS_SELECTOR_JIT_DEBUGGING is 1
+        https://bugs.webkit.org/show_bug.cgi?id=133266
</ins><span class="cx"> 
</span><del>-    2014-04-14  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-            Use after free in WebCore::CachedResourceHandleBase::~CachedResourceHandleBase / WebCore::removeDetachedChildrenInContainer
-            https://bugs.webkit.org/show_bug.cgi?id=131169
</del><ins>+        When CSS_SELECTOR_JIT_DEBUGGING is 1, build erros occur on x86_64.
</ins><span class="cx"> 
</span><del>-            Reviewed by Eric Carlson.
</del><ins>+        * cssjit/SelectorCompiler.cpp:
+        (WebCore::SelectorCompiler::SelectorCodeGenerator::generatePrologue):
+        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateEpilogue):
</ins><span class="cx"> 
</span><del>-            Invalidate the WebCoreAVFResourceLoader owned by MediaPlayerPrivateAVFoundationObjC
-            in its destructor, to prevent a private function being called in response to the
-            WebCoreAVFResourceLoader being stopped.
</del><ins>+2014-05-26  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-            (WebCore::MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC):
-            * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.h:
-            * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
-            (WebCore::WebCoreAVFResourceLoader::invalidate):
</del><ins>+        Fix the quirks mode selector matching of the pseudo classes :hover and :active
+        https://bugs.webkit.org/show_bug.cgi?id=133063
</ins><span class="cx"> 
</span><del>-2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Merge r166628
</del><ins>+        Our implementation of the quirks mode of :active and :hover was very wrong. The only
+        thing it was doing is verify the pseudo class is not the first selector of a fragment
+        (which was conveniently the only thing that was tested :)).
</ins><span class="cx"> 
</span><del>-    2014-04-13  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        Since those pseudo class were only checking for the order of the filters, something like
+            #target:hover
+        would succeed because :hover is not the first simple selector, while
+            :hover#target
+        would fail.
</ins><span class="cx"> 
</span><del>-            userVisibleString should not try to &quot;encode&quot; host names
-            https://bugs.webkit.org/show_bug.cgi?id=131587
-            rdar://problem/14686849
</del><ins>+        That behavior is also a problem for the CSS JIT as it is an implementation detail of SelectorChecker
+        and compiling something like that with our out-of-order matching would be nonsense.
</ins><span class="cx"> 
</span><del>-            Reviewed by Alexey Proskuryakov.
</del><ins>+        This patch update the implementation to follow http://quirks.spec.whatwg.org/#the-:active-and-:hover-quirk
+        Basically, the only cases that do not work in quirks mode are selectors composed only of &quot;*, :hover and :active&quot;.
</ins><span class="cx"> 
</span><del>-            * WebCore.exp.in: Updated for WebCoreNSURLExtras argument type changes.
</del><ins>+        To implement this behavior, I needed to be able to inspect a complete selector fragment, including
+        what is before and after :hover/:active.
+        To do that, I replaced the boolean isSubSelector by a pointer to the first selector of the fragment.
+        When we need to match :active/:hover in quirks mode, we just go over all the selectors in the fragment
+        to find one of the qualifying match type.
</ins><span class="cx"> 
</span><del>-            * platform/mac/WebCoreNSURLExtras.h: Removed unneeded code to make this
-            Objective-C++ header compile in plain C++ files, which we never need to do.
-            Added missing argument name, baseURL, and changed mysterious CFIndex arguments
-            to the correct type, CFURLComponentType.
</del><ins>+        Tests: fast/selectors/active-hover-quirks.html
+               fast/selectors/active-quirks.html
+               fast/selectors/hover-quirks.html
</ins><span class="cx"> 
</span><del>-            * platform/mac/WebCoreNSURLExtras.mm:
-            (WebCore::isLookalikeCharacter): Removed the inline keyword from this, and added
-            more lookalike characters from the Mozilla list referenced here.
-            (WebCore::URLByTruncatingOneCharacterBeforeComponent): Updated argument type.
-            (WebCore::dataForURLComponentType): Ditto.
-            (WebCore::userVisibleString): Only call mapHostNames if host name decoding is
-            needed; no encoding here.
</del><ins>+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::matchRecursively):
+        (WebCore::canMatchHoverOrActiveInQuirksMode):
+        (WebCore::SelectorChecker::checkOne):
+        * css/SelectorChecker.h:
+        (WebCore::SelectorChecker::SelectorCheckingContext::SelectorCheckingContext):
</ins><span class="cx"> 
</span><del>-2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</del><ins>+2014-05-26  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r166628
</del><ins>+        Split the call to adjustForLocalZoom out into a separate expression.
+        https://bugs.webkit.org/show_bug.cgi?id=133286
</ins><span class="cx"> 
</span><del>-    2014-04-01  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-            Crash in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients
</del><ins>+        This patch ensures that adjustForLocalZoom() always gets called before we look at
+        zoomFactor's value. (and not rely on the undefined behavior of the order of function argument evaluation)
</ins><span class="cx"> 
</span><del>-            &lt;https://bugs.webkit.org/show_bug.cgi?id=121887&gt;
-            &lt;rdar://problem/15073043&gt;
</del><ins>+        * dom/Element.cpp:
+        (WebCore::Element::offsetLeft):
+        (WebCore::Element::offsetTop):
</ins><span class="cx"> 
</span><del>-            Reviewed by Dean Jackson.
</del><ins>+2014-05-26  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Test: svg/filters/first-letter-crash.html
</del><ins>+        Class name matching should use ASCII case-insensitive matching, not Unicode case folding
+        https://bugs.webkit.org/show_bug.cgi?id=133292
</ins><span class="cx"> 
</span><del>-            * rendering/FilterEffectRenderer.cpp:
-            (WebCore::FilterEffectRenderer::buildReferenceFilter):
-            Added a null check to prevent crashes for anonymous RenderObjects.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-            * rendering/RenderLayer.cpp:
-            (WebCore::RenderLayer::filterNeedsRepaint):
-            Get the enclosing element, if there is one, and recalculate its style.
-            We use the enclosing element so that we recalculate style for the
-            ancestor of an anonymous RenderElement.
-            (WebCore::RenderLayer::enclosingElement):
-            Remove an assertion; we may now reach this condition if loading a
-            cached SVG document results in RenderLayer::filterNeedsRepaint() being
-            called before the object has been inserted into the render tree.
</del><ins>+        Tests: fast/dom/getElementsByClassName/ASCII-case-insensitive.html
+               fast/dom/getElementsByClassName/case-sensitive.html
</ins><span class="cx"> 
</span><del>-            * rendering/RenderLayerFilterInfo.cpp:
-            (WebCore::RenderLayer::FilterInfo::notifyFinished):
-            Tell the RenderLayer that the filter needs repainting.
-            (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
-            Get the Element from the renderer rather than asking the renderer's
-            Element, which will be null for anonymous RenderObjects.
</del><ins>+        * dom/SpaceSplitString.cpp:
+        (WebCore::hasNonASCIIOrUpper): Deleted.
+        (WebCore::tokenizeSpaceSplitString): Use a for loop instead of while.
+        (WebCore::spaceSplitStringTable): Renamed from sharedDataMap; the new name is supposed
+        to help us see the analogy with the atomic string table.
+        (WebCore::SpaceSplitString::set): Removed unneeded special case for null and preflight
+        since AtomicString::convertToASCIILowercase now handles both of those. Changed to call
+        convertToASCIILowercase instead of foldCase, since we don't want to fold non-ASCII.
+        (WebCore::SpaceSplitString::spaceSplitStringContainsValue): Ditto.
+        (WebCore::SpaceSplitStringData::create): Marked this inline since it's only called in
+        one place and that place is in this file. Also used auto a bit and used get instead of
+        find since the value type is a simple pointer.
+        (WebCore::SpaceSplitStringData::destroy): Removed unneeded check for null. We never
+        create any SpaceSplitStringData with empty strings, and a null is a kind of empty string.
</ins><span class="cx"> 
</span><del>-            * rendering/RenderLayerFilterInfo.h:
-            Removed declaration for the old workaround function, layerElement().
</del><ins>+        * dom/SpaceSplitString.h: Removed some unneeded includes and some unneeded uses of the
+        inline keyword. Changed types from size_t to unsigned in a couple places; we had a mix
+        of the types and there was no reason to use size_t there.
</ins><span class="cx"> 
</span><del>-2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</del><ins>+2014-05-26  Javier Fernandez  &lt;jfernandez@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r165206
</del><ins>+        [CSS Grid Layout] Implementation of the &quot;grid&quot; shorthand.
+        https://bugs.webkit.org/show_bug.cgi?id=132122
</ins><span class="cx"> 
</span><del>-    2014-03-05  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-            Invalid cast in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients()
</del><ins>+        The grid property is a shorthand that sets all of the explicit
+        grid properties (grid-template-rows, grid-template-columns, and
+        grid-template-areas) as well as all the implicit grid properties
+        (grid-auto-rows, grid-auto-columns, and grid-auto-flow) in a
+        single declaration
</ins><span class="cx"> 
</span><del>-            &lt;https://bugs.webkit.org/show_bug.cgi?id=121887&gt;
-            &lt;rdar://problem/15073043&gt;
</del><ins>+        Notice that either explicit or implicit grid can be specified,
+        assigning the initial values to the omitted properties.
</ins><span class="cx"> 
</span><del>-            Clang appears to be optimizing out a branch in RenderObject::node()
-            when compiling RenderLayer::FilterInfo::updateReferenceFilterClients().
-            We'll work around this by factoring out the code in question into a
-            separate member function marked NEVER_INLINE.
</del><ins>+        Test: fast/css-grid-layout/grid-shorthand-get-set.html
</ins><span class="cx"> 
</span><del>-            No test possible due to &lt;https://bugs.webkit.org/show_bug.cgi?id=129757&gt;.
</del><ins>+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::ComputedStyleExtractor::propertyValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseGridShorthand):
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in:
+        * css/StylePropertyShorthand.cpp:
+        (WebCore::webkitGridShorthand):
+        * css/StylePropertyShorthand.h:
</ins><span class="cx"> 
</span><del>-            Reviewed by David Kilzer.
</del><ins>+2014-05-26  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * rendering/RenderLayerFilterInfo.cpp:
-            (WebCore::RenderLayer::FilterInfo::layerElement):
-            Code moved from updateReferenceFilterClients(). Returns the Element*
-            for m_layer.
-            (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
-            Use layerElement().
</del><ins>+        Subpixel layout: Legacy Element.offset* client* return values are invalid in certain cases.
+        https://bugs.webkit.org/show_bug.cgi?id=133272
</ins><span class="cx"> 
</span><del>-            * rendering/RenderLayerFilterInfo.h:
-            Declared layerElement().
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        Element.offset* client* functions applied various rounding strategies on the return values before r168868.
+        (for example, offsetLeft/Top either floored through implicit integer arithmetics or rounded explicitly depending
+        whether the zoom scale was 1. see http://trac.webkit.org/changeset/168868/trunk/Source/WebCore/dom/Element.cpp for details)
+        This patch mimics the legacy behavior by either rounding or flooring the return value.
</ins><span class="cx"> 
</span><del>-        Merge r164950
</del><ins>+        Not testable (legacy switch is not exposed)
</ins><span class="cx"> 
</span><del>-    2014-03-02  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        * dom/Element.cpp:
+        (WebCore::adjustForLocalZoom):
+        (WebCore::convertToNonSubpixelValueIfNeeded):
+        (WebCore::Element::offsetLeft):
+        (WebCore::Element::offsetTop):
</ins><span class="cx"> 
</span><del>-            Add protected casting to FilterOperation classes.
-            https://bugs.webkit.org/show_bug.cgi?id=124062
</del><ins>+2014-05-26  Michał Pakuła vel Rutka  &lt;m.pakula@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Sam Weinig.
</del><ins>+        [EFL] Input fields and text areas are not rendered correctly after r167771
+        https://bugs.webkit.org/show_bug.cgi?id=133181
</ins><span class="cx"> 
</span><del>-            Use the type cast macro generators to produce some toFilterOperation-style
-            functions, and then use them in our PlatformCA filter code.
</del><ins>+        Reviewed by Gyuyoung Kim.
</ins><span class="cx"> 
</span><del>-            Test: css3/filters/animation-from-initial-values-with-color-matrix.html
</del><ins>+        r167771 changed arguments of RenderTheme two virtual method arguments which were not reflected
+        in changes in derived classes, which caused parent method to be called. Arguments in derived class
+        were updated, also 'override' specifiers were added to all virtual methods to prevent similar errors.
</ins><span class="cx"> 
</span><del>-            * platform/graphics/ca/mac/PlatformCAFiltersMac.mm: Use the toFilterOperation methods, in
-            some cases removing the unnecessary double cast.
-            (PlatformCAFilters::filterValueForOperation):
-            (PlatformCAFilters::colorMatrixValueForFilter):
-            * platform/graphics/filters/FilterOperation.cpp:
-            (WebCore::BasicColorMatrixFilterOperation::blend):
-            (WebCore::BasicColorMatrixFilterOperation::operator==): Move this to the .cpp file so it can use the casting methods.
-            (WebCore::BasicComponentTransferFilterOperation::blend):
-            (WebCore::BasicComponentTransferFilterOperation::operator==): Ditto.
-            * platform/graphics/filters/FilterOperation.h: Add the casting macros.
</del><ins>+        Already covered by fast/forms/textarea-placeholder-wrapping.html
</ins><span class="cx"> 
</span><del>-2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::paintTextField):
+        (WebCore::RenderThemeEfl::paintTextArea):
+        * platform/efl/RenderThemeEfl.h:
+        (WebCore::RenderThemeEfl::supportsHover):
+        (WebCore::RenderThemeEfl::supportsControlTints):
</ins><span class="cx"> 
</span><del>-        Merge r157816
</del><ins>+2014-05-20  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-10-22  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        [CSS Grid Layout] Children of grid containers must be turned into grid items
+        https://bugs.webkit.org/show_bug.cgi?id=132991
</ins><span class="cx"> 
</span><del>-            GammaFilterOperation seems to be dead code
-            https://bugs.webkit.org/show_bug.cgi?id=123173
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-            Reviewed by Simon Fraser.
</del><ins>+        From Blink r150472 by &lt;jchaffraix@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-            * platform/graphics/filters/FilterOperation.cpp:
-            * platform/graphics/filters/FilterOperation.h:
-            Remove dead code.
</del><ins>+        According to specs each child of a grid container must become a
+        grid item meaning that grid items are grid level boxes and thus,
+        do not participate in the block formatting context but in the grid
+        formatting one.
</ins><span class="cx"> 
</span><del>-2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        This change updates the grid items' 'display' property after style
+        resolution so that we match the specification (see section 4. Grid
+        Items). The spec basically instructs us to compute the value of
+        'display' by applying the table in CSS2.1 Chapter 9.7
+        http://www.w3.org/TR/CSS2/visuren.html#dis-pos-flo
</ins><span class="cx"> 
</span><del>-        Merge r155315
</del><ins>+        Test: fast/css-grid-layout/grid-item-display.html
</ins><span class="cx"> 
</span><del>-    2013-09-08  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        * css/StyleResolver.cpp:
+        (WebCore::isDisplayGridBox):
+        (WebCore::StyleResolver::adjustRenderStyle):
</ins><span class="cx"> 
</span><del>-            FrameView::scheduleEvent() is over-engineered.
-            &lt;https://webkit.org/b/121004&gt;
</del><ins>+2014-05-26  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Antti Koivisto.
</del><ins>+        Remove Vector copies in ShorthandPropertyWrapper implementation and use
+        https://bugs.webkit.org/show_bug.cgi?id=133265
</ins><span class="cx"> 
</span><del>-            Remove gratuitous FrameActionScheduler class that was really only being used
-            to defer the occassional &quot;overflowchanged&quot; event until layout had finished.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-            * CMakeLists.txt:
-            * GNUmakefile.list.am:
-            * Target.pri:
-            * WebCore.vcxproj/WebCore.vcxproj:
-            * WebCore.vcxproj/WebCore.vcxproj.filters:
-            * WebCore.xcodeproj/project.pbxproj:
-            * page/FrameActionScheduler.cpp:
-            * page/FrameActionScheduler.h:
</del><ins>+        * page/animation/CSSPropertyAnimation.cpp:
+        (WebCore::ShorthandPropertyWrapper::ShorthandPropertyWrapper): Move the passed-in Vector
+        into the member variable instead of using Vector&lt;&gt;::swap().
+        (WebCore::ShorthandPropertyWrapper::propertyWrappers): Return a const reference of the member
+        variable instead of a const value.
+        (WebCore::CSSPropertyAnimationWrapperMap::CSSPropertyAnimationWrapperMap): Move the Vector
+        object into the ShorthandProperthyWrapper constructor.
+        (WebCore::gatherEnclosingShorthandProperties): Deploy a range-based for-loop.
</ins><span class="cx"> 
</span><del>-                Removed FrameActionScheduler.
</del><ins>+2014-05-26  Tanay C  &lt;tanay.c@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-            * page/FrameView.h:
-            * page/FrameView.cpp:
-            (WebCore::FrameView::FrameView):
-            (WebCore::FrameView::~FrameView):
-            (WebCore::FrameView::layout):
-            (WebCore::FrameView::ScheduledEvent::ScheduledEvent):
-            (WebCore::FrameView::scheduleEvent):
-            (WebCore::FrameView::pauseScheduledEvents):
-            (WebCore::FrameView::resumeScheduledEvents):
-            (WebCore::FrameView::performPostLayoutTasks):
-            (WebCore::FrameView::updateOverflowStatus):
</del><ins>+        [EFL] Fix build error in blob.cpp after r168435
+        https://bugs.webkit.org/show_bug.cgi?id=132678
</ins><span class="cx"> 
</span><del>-                Replaced it with a Vector&lt;ScheduledEvent&gt; and a suppression counter.
-                A ScheduledEvent is just a { Node, Event } pair.
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-2014-05-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        * fileapi/Blob.cpp:
+        (WebCore::Blob::size): Using isInBound to check range of local var
+        actualsize to resolve build error
</ins><span class="cx"> 
</span><del>-        erge r169098
</del><ins>+2014-05-25  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-09-19  Bear Travis  &lt;betravis@adobe.com&gt;
</del><ins>+        [EFL] Remove TileCairo and TiledBackingStoreBackendCairo
+        https://bugs.webkit.org/show_bug.cgi?id=133274
</ins><span class="cx"> 
</span><del>-            CSS_SHAPES not supported on AppleWin port
-            https://bugs.webkit.org/show_bug.cgi?id=118810
</del><ins>+        Reviewed by Gyuyoung Kim.
</ins><span class="cx"> 
</span><del>-            Reviewed by Brent Fulgham.
</del><ins>+        Now, TiledBackingStore is only used for CoordinatedGraphics and the EFL port.
+        CoordinatedGraphics does not use TileCairo and TiledBackingStoreBackendCairo.
</ins><span class="cx"> 
</span><del>-            Enabling fast/shapes on windows.
</del><ins>+        This patch removed them and refactored related files.
</ins><span class="cx"> 
</span><del>-            * WebCore.vcxproj/WebCore.vcxproj: Add missing shape includes.
-            * WebCore.vcxproj/WebCoreCommon.props: Include shapes source folder.
-            * WebCore.vcxproj/copyForwardingHeaders.cmd: Copy shapes headers.
-            * css/CSSPropertyNames.in: Tweak to ensure shapes properties are regenerated.
</del><ins>+        * PlatformEfl.cmake:
+        * PlatformGTK.cmake:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::TiledBackingStore): Deleted.
+        * platform/graphics/TiledBackingStore.h:
+        * platform/graphics/TiledBackingStoreBackend.h:
+        * platform/graphics/cairo/TileCairo.cpp: Removed.
+        * platform/graphics/cairo/TiledBackingStoreBackendCairo.cpp: Removed.
</ins><span class="cx"> 
</span><del>-2014-05-08  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+2014-05-25  Jinwoo Song  &lt;jinwoo7.song@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Rollout r168034.
</del><ins>+        setData() of DataTransfer has a void return type
+        https://bugs.webkit.org/show_bug.cgi?id=133108
</ins><span class="cx"> 
</span><del>-2014-05-07  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-    Rollout r168104
</del><ins>+        According to HTML5 spec, setData() of DataTranfer interface does not return value.
+        http://www.w3.org/TR/html/editing.html#the-datatransfer-interface
</ins><span class="cx"> 
</span><del>-2014-05-05  Andy Estes  &lt;aestes@apple.com&gt;
</del><ins>+        Test: editing/pasteboard/set_data_typeof_return.html
</ins><span class="cx"> 
</span><del>-        Fix the Mountain Lion build.
</del><ins>+        * dom/DataTransfer.cpp:
+        (WebCore::DataTransfer::setData):
+        * dom/DataTransfer.h:
+        * dom/DataTransfer.idl:
+        * platform/Pasteboard.h:
+        * platform/efl/PasteboardEfl.cpp:
+        (WebCore::Pasteboard::writeString):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeString):
+        * platform/ios/PasteboardIOS.mm:
+        (WebCore::Pasteboard::writeString):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeString):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeString):
</ins><span class="cx"> 
</span><del>-        Some versions of Clang on Mountain Lion do not set __cplusplus to 201103L when compiling with -std=gnu++11,
-        which causes CF_ENUMs to be weakly-typed. Detect this case and export the correct symbols.
</del><ins>+2014-05-25  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        On Lion, CFURLComponentType is not defined using CF_ENUM, so it will always be a weakly-typed enum.
</del><ins>+        [iOS][WK2] Use ScrollView's scrollOffset as the unobscuredContentRect
+        https://bugs.webkit.org/show_bug.cgi?id=133262
</ins><span class="cx"> 
</span><ins>+        Reviewed by Simon Fraser.
+
+        Since VisibleContentRect was fixed, we were no longer sending scroll events when updating the scrollOffset
+        when updating the visible content rects. The reason is that the scrollOffset was defined as the top left of the
+        VisibleContentRect, and as such was already at the end position after updating the unobscured rect.
+
+        This patch split the unobscuredContentRect in unobscuredContentSize (updated live on zoom) and the position defined
+        by the ScrollView's scrollOffset (updated when scrolling).
+
</ins><span class="cx">         * WebCore.exp.in:
</span><ins>+        * platform/ScrollView.h:
+        * platform/ios/ScrollViewIOS.mm:
+        (WebCore::ScrollView::unobscuredContentRect):
+        (WebCore::ScrollView::setUnobscuredContentSize):
+        (WebCore::ScrollView::setUnobscuredContentRect): Deleted.
</ins><span class="cx"> 
</span><del>-2014-05-03  Babak Shafiei  &lt;bshafiei@apple.com&gt;
</del><ins>+2014-05-25  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Follow-up fix for the merge of r167480.
-        
-        Rubber stamped by Tim Horton.
</del><ins>+        Add type-checked casts for TransformOperations
+        &lt;http://webkit.org/b/133217&gt;
</ins><span class="cx"> 
</span><del>-        * platform/KURL.cpp:
-        (WebCore::KURL::host): Return empty string instead of null string.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-2014-05-02  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::validateTransformOperations):
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::getTransformFunctionValue):
+        - Switch to type-checked casts.
</ins><span class="cx"> 
</span><del>-        Merge r166420.
</del><ins>+        * platform/graphics/transforms/IdentityTransformOperation.h:
+        * platform/graphics/transforms/Matrix3DTransformOperation.h:
+        * platform/graphics/transforms/MatrixTransformOperation.h:
+        * platform/graphics/transforms/PerspectiveTransformOperation.h:
+        * platform/graphics/transforms/RotateTransformOperation.h:
+        * platform/graphics/transforms/ScaleTransformOperation.h:
+        * platform/graphics/transforms/SkewTransformOperation.h:
+        * platform/graphics/transforms/TranslateTransformOperation.h:
+        - Add 'final' to class declaration.
+        - Add 'override' to overridden methods.
+        - Add type-checked cast via TRANSFORMOPERATION_TYPE_CASTS macro.
+        - Move implementation of operator==(const TransformOperation&amp;)
+          from header to source file so it is able to use a type-checked
+          cast, and switch back to using a reference instead of a
+          pointer.
+        - Add or update ASSERT in private constructor to check for
+          correct OperationType in classes that represent multiple
+          types.
</ins><span class="cx"> 
</span><del>-    2014-03-28  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
-    
-            Clear SVGInlineTextBox fragments when the text changes.
-            https://bugs.webkit.org/show_bug.cgi?id=130879
-    
-            Reviewed by Darin Adler.
-    
-            Ported from Blink: https://src.chromium.org/viewvc/blink?revision=150456&amp;view=revision
-    
-            This patch modifies SVGInlineTextBox::dirtyLineBoxes to clear all
-            following text boxes when invoked. Typically this method is called
-            when the underlying text string changes, and that change needs to
-            be propagated to all the boxes that use the text beyond the point
-            where the text is first modified.
-            
-            Also cleans up final function keywords for SVGRootInlineBox.
-    
-            Test: svg/custom/unicode-in-tspan-multi-svg-crash.html
-    
-            * rendering/InlineTextBox.h: Added (non-recursive) dirtyOwnLineBoxes() function
-            (WebCore::InlineTextBox::dirtyOwnLineBoxes): Calls dirtyLineBoxes()
-            * rendering/svg/SVGInlineTextBox.h: Added (non-recursive) dirtyOwnLineBoxes() function
-            (WebCore::SVGInlineTextBox::dirtyOwnLineBoxes):
-            * rendering/svg/SVGInlineTextBox.cpp:
-            (WebCore::SVGInlineTextBox::dirtyOwnLineBoxes): Non-recursive part of dirtyLineBoxes()
-            (WebCore::SVGInlineTextBox::dirtyLineBoxes): Calls dirtyOwnLineBoxes() in a loop
-            * rendering/svg/SVGRootInlineBox.h:
-    
-2014-05-02  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * platform/graphics/transforms/Matrix3DTransformOperation.cpp:
+        (WebCore::Matrix3DTransformOperation::operator==): Added.
</ins><span class="cx"> 
</span><del>-        Merge r165053.
</del><ins>+        * platform/graphics/transforms/MatrixTransformOperation.cpp:
+        (WebCore::Matrix3DTransformOperation::operator==): Added.
+        (WebCore::MatrixTransformOperation::blend):
+        - Switch to type-checked casts and use a reference.
</ins><span class="cx"> 
</span><del>-    2014-03-03  David Kilzer  &lt;ddkilzer@apple.com&gt;
-    
-            SVGPropertyTearOffs should detachChildren before deleting its value.
-            &lt;http://webkit.org/b/129618&gt;
-            &lt;rdar://problem/15661617&gt;
-    
-            Reviewed by Maciej Stachowiak.
-    
-            Merged from Blink (patch by kouhei@chromium.org):
-            https://src.chromium.org/viewvc/blink?revision=158563&amp;view=revision
-            http://crbug.com/296276
-    
-            Test: svg/transforms/svg-matrix-tearoff-crash.html
-    
-            NOTE: The test does not reproduce a crash on WebKit using
-            JavaScriptCore.
-    
-            * svg/properties/SVGPropertyTearOff.h:
-            (WebCore::SVGPropertyTearOff::setValue):
-            (WebCore::SVGPropertyTearOff::~SVGPropertyTearOff):
-            - Call detachChildren() if m_value is a copy.  The original
-              Blink patch did not modify the destructor code path, although
-              that seems obvious via code inspection.
-    
-2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * platform/graphics/transforms/PerspectiveTransformOperation.cpp:
+        (WebCore::Matrix3DTransformOperation::operator==): Added.
+        (WebCore::PerspectiveTransformOperation::blend):
+        * platform/graphics/transforms/RotateTransformOperation.cpp:
+        (WebCore::Matrix3DTransformOperation::operator==): Added.
+        (WebCore::RotateTransformOperation::blend):
+        * platform/graphics/transforms/ScaleTransformOperation.cpp:
+        (WebCore::Matrix3DTransformOperation::operator==): Added.
+        (WebCore::ScaleTransformOperation::blend):
+        * platform/graphics/transforms/SkewTransformOperation.cpp:
+        (WebCore::Matrix3DTransformOperation::operator==): Added.
+        (WebCore::SkewTransformOperation::blend):
+        * platform/graphics/transforms/TranslateTransformOperation.cpp:
+        (WebCore::Matrix3DTransformOperation::operator==): Added.
+        (WebCore::TranslateTransformOperation::blend):
+        - Switch to type-checked casts.
</ins><span class="cx"> 
</span><del>-        Merge r164917.
</del><ins>+        * platform/graphics/transforms/TransformOperation.h:
+        (WebCore::TransformOperation::isRotateTransformOperationType):
+        (WebCore::TransformOperation::isScaleTransformOperationType):
+        (WebCore::TransformOperation::isSkewTransformOperationType):
+        (WebCore::TransformOperation::isTranslateTransformOperationType):
+        - Add type-checking methods used in constructors and type-checked
+          casts.
+        - Define TRANSFORMOPERATION_TYPE_CASTS macro used by subclasses.
</ins><span class="cx"> 
</span><del>-    2014-03-01  David Kilzer  &lt;ddkilzer@apple.com&gt;
-    
-            Fix lifetime handling of SVGPropertyTearOffs
-            &lt;http://webkit.org/b/129211&gt;
-            &lt;rdar://problem/15696025&gt;
-    
-            Reviewed by Maciej Stachowiak.
-    
-            Merged from Blink (patch by Ojan Vafai):
-            https://src.chromium.org/viewvc/blink?revision=157801&amp;view=revision
-            http://crbug.com/288771
-    
-                -Replace SVGStaticPropertyWithParentTearOff with SVGMatrixTearOff
-                since it's only used in that one place. This means we can get rid
-                of the templatizing and the method pointer.
-                -Change SVGPropertyTearOff to keep track of it's child tearoffs
-                and call detachWrapper on its child tearoffs when it's destroyed
-                or when it's wrapper is detached.
-                -Have SVGPropertyTearOff hold WeakPtrs to the child tearoffs
-                to avoid having a cycle.
-    
-            Test: svg/transforms/svg-matrix-tearoff-crash.html
-    
-            * GNUmakefile.list.am:
-            * WebCore.vcxproj/WebCore.vcxproj:
-            * WebCore.vcxproj/WebCore.vcxproj.filters:
-            * WebCore.xcodeproj/project.pbxproj:
-            * bindings/scripts/CodeGeneratorJS.pm:
-            (NativeToJSValue):
-            * svg/properties/SVGMatrixTearOff.h: Renamed from Source/WebCore/svg/properties/SVGStaticPropertyWithParentTearOff.h.
-            (WebCore::SVGMatrixTearOff::create):
-            (WebCore::SVGMatrixTearOff::commitChange):
-            (WebCore::SVGMatrixTearOff::SVGMatrixTearOff):
-            * svg/properties/SVGPropertyTearOff.h:
-            (WebCore::SVGPropertyTearOff::addChild):
-            (WebCore::SVGPropertyTearOff::detachChildren):
-    
-2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+2014-05-25  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r167295.
</del><ins>+        Crash in WebCore::TextResourceDecoder::checkForCSSCharset
+        &lt;http://webkit.org/b/133257&gt;
+        &lt;rdar://problem/17027109&gt;
</ins><span class="cx"> 
</span><del>-    2014-04-14  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
-    
-            Assertion failure under FEImage::determineAbsolutePaintRect()
-    
-            &lt;https://bugs.webkit.org/show_bug.cgi?id=131660&gt;
-            &lt;rdar://problem/15669294&gt;
-    
-            This patch merges Chromium r149536 (see
-            &lt;https://chromiumcodereview.appspot.com/14701012&gt;), which moves
-            m_absoluteTransform out of SVGFilter and into the base Filter class, so
-            that it isn't necessary to cast a Filter to SVGFilter to get the
-            absolute transform.
-    
-            Reviewed by Geoffrey Garen.
-    
-            Test: svg/filters/feImage-filter-assertion.html
-    
-            * platform/graphics/filters/Filter.h:
-            (WebCore::Filter::Filter):
-            Changed to take the absolute transform.
-            (WebCore::Filter::absoluteTransform):
-            Moved from SVGFilter.
-            (WebCore::Filter::mapAbsolutePointToLocalPoint):
-            Ditto.
-    
-            * rendering/FilterEffectRenderer.cpp:
-            (WebCore::FilterEffectRenderer::FilterEffectRenderer):
-            Pass a default AffineTransform() to the Filter base class.
-    
-            * svg/graphics/filters/SVGFEImage.cpp:
-            (WebCore::FEImage::determineAbsolutePaintRect):
-            Use the Filter without casting it to SVGFilter.
-            (WebCore::FEImage::platformApplySoftware):
-            Ditto.
-    
-            * svg/graphics/filters/SVGFilter.cpp:
-            (WebCore::SVGFilter::SVGFilter):
-            Pass the transform to the base class, and remove initialization of a
-            removed member var.
-    
-            * svg/graphics/filters/SVGFilter.h:
-            Member var moved to Filter.h.
-    
-2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        Merge r166736.
</del><ins>+        Test: fast/encoding/css-charset-missing-semi-colon-and-newline.html
</ins><span class="cx"> 
</span><del>-    2014-04-03  David Hyatt  &lt;hyatt@apple.com&gt;
-    
-            Continuations casting issue.
-            https://bugs.webkit.org/show_bug.cgi?id=130057
-            &lt;rdar://problem/16283406&gt;
-    
-            Reviewed by Simon Fraser.
-    
-            The code to update relative positioned anonymous block continuations should not
-            have assumed that all siblings were RenderBlocks. Make the code smarter and
-            make it bail when it hits something that isn't part of the block continuation
-            chain.
-    
-            Added fast/block/continuation-crash.html
-    
-            * rendering/RenderInline.cpp:
-            (WebCore::updateStyleOfAnonymousBlockContinuations):
-    
-2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * loader/TextResourceDecoder.cpp:
+        (WebCore::TextResourceDecoder::checkForCSSCharset): Add early
+        return.
</ins><span class="cx"> 
</span><del>-        Merge r167480.
</del><ins>+2014-05-24  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2014-04-17  Darin Adler  &lt;darin@apple.com&gt;
-    
-            origin spoofing possible (HTTP Origin, postMessage event.origin) due to inappropriate URL escape sequence decoding
-            https://bugs.webkit.org/show_bug.cgi?id=131837
-            rdar://problem/15211936
-    
-            Reviewed by Anders Carlsson and Dave Hyatt.
-    
-            Tests: fast/dom/DOMURL/parsing.html
-                   fast/dom/HTMLAnchorElement/anchor-element-href-parsing.html
-    
-            * platform/URL.cpp:
-            (WebCore::URL::host): Removed unnecessary call to decodeURLEscapeSequences, which caused
-            problems and was not needed.
-    
-2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        [Mac] preload AVAssetTrack properties before asking for them
+        https://bugs.webkit.org/show_bug.cgi?id=133240
</ins><span class="cx"> 
</span><del>-        Merge r167524.
</del><ins>+        Reviewed by Jer Noble.
</ins><span class="cx"> 
</span><del>-    2014-04-18  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
-    
-            Harden RenderInline::inlineElementContinuation()
-    
-            &lt;https://bugs.webkit.org/show_bug.cgi?id=131858&gt;
-    
-            Reviewed by Sam Weinig.
-    
-            No new tests, as there are no known cases of this happening.
-    
-            * rendering/RenderInline.cpp:
-            (WebCore::RenderInline::inlineElementContinuation):
-            Return nullptr if the continuation is neither a RenderInline nor a
-            RenderBlock.
-    
-2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::assetTrackMetadataKeyNames): Add preferredTransform and naturalSize to the list
+            of properties we preload.
</ins><span class="cx"> 
</span><del>-        Merge r167672.
</del><ins>+2014-05-24  Zsolt Borbely  &lt;zsborbely.u-szeged@partner.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-    2014-04-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-    
-            Check (rather than assume) element is a RenderTableSection before using it
-            https://bugs.webkit.org/show_bug.cgi?id=121858
-    
-            Reviewed by David Kilzer.
-    
-            Test: fast/table/table-insert-object-before-td-crash.html
-    
-            * rendering/RenderTable.cpp:
-            (WebCore::RenderTable::addChild): Check that lastBox is a table section before
-            using the node as if it was one.
-    
-2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Remove one of the CSSProperty constructor
+        https://bugs.webkit.org/show_bug.cgi?id=131094
</ins><span class="cx"> 
</span><del>-        Merge r167569 (committing on behalf of Dana Burkart.)
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-    2014-04-19  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Remove one of the CSSProperty constructor, because it is obsolete.
</ins><span class="cx"> 
</span><del>-            Crashes in HTMLFormElement::submit.
-            https://bugs.webkit.org/show_bug.cgi?id=131910
-            &lt;rdar://problem/15661790&gt;
</del><ins>+        * css/CSSProperty.h:
+        (WebCore::CSSProperty::CSSProperty): Deleted.
+        * css/StyleProperties.h:
+        (WebCore::StyleProperties::PropertyReference::toCSSProperty):
</ins><span class="cx"> 
</span><del>-            Based on a patch by Kent Tamura.
</del><ins>+2014-05-23  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Anders Carlsson.
</del><ins>+        Rename ScrollingTreeScrollingNode's m_scrollPosition to make it clear that it's the value committed from the state tree
+        https://bugs.webkit.org/show_bug.cgi?id=133254
</ins><span class="cx"> 
</span><del>-            Tests: fast/forms/form-submission-crash-2.html
-                  fast/forms/form-submission-crash.html
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-            Code that executes arbitrary JS needs to protect objects that it uses afterwards.
</del><ins>+        Make ScrollingTreeScrollingNode::scrollPosition() pure virtual, and rename
+        the member variable and associated getter to make it clear that they relate
+        to the last committed scroll position.
</ins><span class="cx"> 
</span><del>-            * html/HTMLFormElement.cpp:
-            (WebCore::HTMLFormElement::prepareForSubmission):
-            (WebCore::HTMLFormElement::submit):
-            * loader/FrameLoader.cpp:
-            (WebCore::FrameLoader::submitForm):
</del><ins>+        * page/scrolling/ScrollingTreeScrollingNode.cpp:
+        (WebCore::ScrollingTreeScrollingNode::updateBeforeChildren):
+        * page/scrolling/ScrollingTreeScrollingNode.h:
+        (WebCore::ScrollingTreeScrollingNode::lastCommittedScrollPosition):
+        (WebCore::ScrollingTreeScrollingNode::scrollPosition): Deleted.
</ins><span class="cx"> 
</span><del>-2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+2014-05-23  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r166650.
</del><ins>+        Share some more ScrollingTreeScrollingNode code
+        https://bugs.webkit.org/show_bug.cgi?id=133248
</ins><span class="cx"> 
</span><del>-    2014-04-02  David Kilzer  &lt;ddkilzer@apple.com&gt;
-    
-            Use outermost containing isolate when constructing bidi runs
-            &lt;http://webkit.org/b/131107&gt;
-            &lt;rdar://problem/15690021&gt;
-    
-            Reviewed by Darin Adler.
-    
-            Merged from Blink (patch by jww@chromium.org):
-            https://src.chromium.org/viewvc/blink?revision=157268&amp;view=revision
-            http://crbug.com/279277
-    
-                Update containingIsolate to go back all the way to top
-                isolate from current root, rather than stopping at the first
-                isolate it finds. This works because the current root is
-                always updated with each isolate run.
-    
-            Tests: fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html
-                   fast/text/international/unicode-bidi-isolate-nested-with-removes.html
-    
-            * rendering/InlineIterator.h:
-            (WebCore::highestContainingIsolateWithinRoot):
-            * rendering/RenderBlockLineLayout.cpp:
-            (WebCore::constructBidiRunsForSegment):
-    
-2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-    Rollout r168020.
-    This causes build failures on Lion/ML.  
</del><ins>+        Push scrollBy(), scrollByWithoutContentEdgeConstraints() and setScrollPosition()
+        down to ScrollingTreeFrameScrollingNode.
+        
+        This requires that scrollPosition() return the right thing for each class, so make
+        it virtual. Future patches will reduce the confusion between the committed scroll
+        position and the one derived from layers.
</ins><span class="cx"> 
</span><del>-2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        * page/scrolling/ScrollingTreeFrameScrollingNode.cpp:
+        (WebCore::ScrollingTreeFrameScrollingNode::scrollBy):
+        (WebCore::ScrollingTreeFrameScrollingNode::scrollByWithoutContentEdgeConstraints):
+        (WebCore::ScrollingTreeFrameScrollingNode::setScrollPosition):
+        * page/scrolling/ScrollingTreeFrameScrollingNode.h:
+        * page/scrolling/ScrollingTreeScrollingNode.h:
+        (WebCore::ScrollingTreeScrollingNode::scrollPosition):
+        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.h:
+        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.mm:
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::setScrollPosition): Deleted.
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollBy): Deleted.
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollByWithoutContentEdgeConstraints): Deleted.
+        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.h:
+        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::immediateScrollBy):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::immediateScrollByWithoutContentEdgeConstraints):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollPosition):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollPosition):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollBy): Deleted.
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollByWithoutContentEdgeConstraints): Deleted.
</ins><span class="cx"> 
</span><del>-        Merge r166049
</del><ins>+2014-05-24  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2014-03-21  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        AX: fix coordinate mapping for iOS accessibility
+        https://bugs.webkit.org/show_bug.cgi?id=133188
</ins><span class="cx"> 
</span><del>-            HTMLFrameOwnerElement should obey the SubframeLoadingDisabler when creating subframes
-            &lt;rdar://problem/15675780&gt;
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-            Merge Blink r156744 by Adam Klein.
</del><ins>+        Make WebCore aware of the accessibility point/rect conversion methods.
</ins><span class="cx"> 
</span><del>-            Test: fast/frames/set-iframe-src-in-pagehide-crash.html
</del><ins>+        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
+        (-[WebAccessibilityObjectWrapper convertPointToScreenSpace:]):
+        (-[WebAccessibilityObjectWrapper convertRectToScreenSpace:]):
+        * loader/EmptyClients.h:
+        * page/Chrome.cpp:
+        (WebCore::Chrome::accessibilityScreenToRootView):
+        (WebCore::Chrome::rootViewToAccessibilityScreen):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * platform/HostWindow.h:
</ins><span class="cx"> 
</span><del>-            * loader/SubframeLoader.cpp:
-            (WebCore::SubframeLoader::loadSubframe):
</del><ins>+2014-05-24  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        Subpixel rendering: Non-compositing transforms with subpixel coordinates paint to wrong position.
+        https://bugs.webkit.org/show_bug.cgi?id=133184
+        &lt;rdar://problem/16745606&gt;
</ins><span class="cx"> 
</span><del>-        Merge r167278
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-    2014-04-14  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+        Snapping relative negative coordinate values should produce the same position as if they were
+        positive absolute coordinates.
+        When a child box gets positioned off of its containers towards top/left, its relative coordinates
+        become negative. Pixel snapping those negative values should produce the same
+        final painting position as if the child box was fixed positioned with positive coordinates.
+        Since halfway values always round away from zero, negative and positive halfway values
+        produce opposite rounding direction.
+        This patch ensures that negative halfway values round to the direction as if they were positive.  
</ins><span class="cx"> 
</span><del>-            Assertion failure !node || node-&gt;isElementNode() in
-            WebCore::RenderBlock::inlineElementContinuation
</del><ins>+        Test: fast/layers/hidpi-floor-negative-coordinate-values-to-maintain-rounding-direction.html
</ins><span class="cx"> 
</span><del>-            https://bugs.webkit.org/show_bug.cgi?id=108829
-            &lt;rdar://problem/13666405&gt;
</del><ins>+        * platform/LayoutUnit.h:
+        (WebCore::roundToDevicePixel):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayerByApplyingTransform):
</ins><span class="cx"> 
</span><del>-            I can't reproduce this assertion failure, but there seems to be an
-            invalid assumption in RenderBlock::inlineElementContinuation() that
-            anything with the &quot;isInline()&quot; bit set is a RenderInline.
</del><ins>+2014-05-24  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</ins><span class="cx"> 
</span><del>-            No new test because the test case in the bug does not repro for me.
</del><ins>+        Use size variants and glyph assembly from the MATH data.
+        https://bugs.webkit.org/show_bug.cgi?id=130322
</ins><span class="cx"> 
</span><del>-            Reviewed by Brent Fulgham.
</del><ins>+        Reviewed by Chris Fleizach.
</ins><span class="cx"> 
</span><del>-            * rendering/RenderBlock.cpp:
-            (WebCore::RenderBlock::inlineElementContinuation):
-            Dave Hyatt says that this function should only return RenderInline
-            objects (not non-RenderInline inline objects), so update the checks
-            from isInline() to isRenderInline() before casting with
-            toRenderInline().
</del><ins>+        This patch modifies the RenderMathMLOperator code to use the MATH table
+        when one is provided in the current font on the &lt;math&gt; tag. More
+        precisely, the MathVariants table is used to draw a size variant or
+        a glyph assembly. The displaystyle attribute is not supported yet, so
+        for now large operators are always assumed to be in display style. The
+        MATH support does not work well with all platforms+fonts, so at the
+        moment the default font-family on the &lt;math&gt; is not changed.
</ins><span class="cx"> 
</span><del>-            * rendering/RenderInline.cpp:
-            (WebCore::RenderInline::inlineElementContinuation):
-            Ditto.
</del><ins>+        Tests: mathml/opentype/large-operators-LatinModern.html
+               mathml/opentype/opentype-stretchy.html
+               mathml/opentype/vertical-LatinModern.html
</ins><span class="cx"> 
</span><del>-2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        * css/mathml.css: We only specify the default font-family on the math root, so that people can easily style the mathematics.
+        For now, old fonts without the MATH table are still used as the default.
+        (math):
+        (math, mfenced &gt; *): Deleted.
+        (mo, mfenced): Deleted.
+        * platform/graphics/SimpleFontData.cpp: don't return the math data if the font is loading.
+        (WebCore::SimpleFontData::mathData):
+        * platform/graphics/opentype/OpenTypeMathData.cpp: update #ifdef so that disabling ENABLE_OPENTYPE_MATH won't lead to errors with unused parameters.
+        (WebCore::OpenTypeMathData::OpenTypeMathData):
+        (WebCore::OpenTypeMathData::getMathConstant):
+        (WebCore::OpenTypeMathData::getItalicCorrection):
+        (WebCore::OpenTypeMathData::getMathVariants):
+        * rendering/mathml/RenderMathMLOperator.cpp:
+        (WebCore::RenderMathMLOperator::boundsForGlyph):
+        (WebCore::RenderMathMLOperator::heightForGlyph):
+        (WebCore::RenderMathMLOperator::advanceForGlyph):
+        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths): We handle preferred width of size variants.
+        (WebCore::RenderMathMLOperator::shouldAllowStretching): This function now only returns whether the operator will stretch and no longer has side effect.
+        (WebCore::RenderMathMLOperator::getGlyphAssemblyFallBack): We add a function to convert from the MathVariant table data to the format supported by RenderMathMLOperator.
+        (WebCore::RenderMathMLOperator::getDisplayStyleLargeOperator): We add a function to get the glyph that will be used for large operators in display style.
+        (WebCore::RenderMathMLOperator::findStretchyData): We make this function handle size variants.
+        (WebCore::RenderMathMLOperator::updateStyle): We handle size variants.
+        (WebCore::RenderMathMLOperator::paint): We handle size variants.
+        * rendering/mathml/RenderMathMLOperator.h:
</ins><span class="cx"> 
</span><del>-        Merge r167211
</del><ins>+2014-05-23  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2014-04-13  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        REGRESSION (iOS WebKit2): requestAnimationFrame fires more than once between layer tree commits
+        https://bugs.webkit.org/show_bug.cgi?id=132794
+        &lt;rdar://problem/16877909&gt;
</ins><span class="cx"> 
</span><del>-            userVisibleString should not try to &quot;encode&quot; host names
-            https://bugs.webkit.org/show_bug.cgi?id=131587
-            rdar://problem/14686849
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-            Reviewed by Alexey Proskuryakov.
</del><ins>+        Virtualize DisplayRefreshMonitor so that WebKit2 can implement its own DisplayRefreshMonitor for UI-side compositing views.
+        This allows the synchronization of requestAnimationFrame callbacks with UI-side compositing painting.
</ins><span class="cx"> 
</span><del>-            * WebCore.exp.in: Updated for WebCoreNSURLExtras argument type changes.
</del><ins>+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::graphicsLayerFactory):
+        (WebCore::ChromeClient::createDisplayRefreshMonitor):
+        * platform/graphics/DisplayRefreshMonitorFactory.h: Added.
+        * platform/graphics/GraphicsLayerUpdater.cpp:
+        (WebCore::GraphicsLayerUpdater::createDisplayRefreshMonitor):
+        * platform/graphics/GraphicsLayerUpdater.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::createDisplayRefreshMonitor):
+        * rendering/RenderLayerCompositor.h:
+        Give the ChromeClient a chance to provide us with a custom DisplayRefreshMonitor.
+        If it does not, we'll fall back to making a DisplayRefreshMonitorMac or
+        DisplayRefreshMonitorIOS depending on the platform.
</ins><span class="cx"> 
</span><del>-            * platform/mac/WebCoreNSURLExtras.h: Removed unneeded code to make this
-            Objective-C++ header compile in plain C++ files, which we never need to do.
-            Added missing argument name, baseURL, and changed mysterious CFIndex arguments
-            to the correct type, CFURLComponentType.
</del><ins>+        * dom/ScriptedAnimationController.cpp:
+        * dom/ScriptedAnimationController.h:
+        * platform/graphics/DisplayRefreshMonitor.cpp:
+        * platform/graphics/DisplayRefreshMonitor.h:
+        * platform/graphics/DisplayRefreshMonitorClient.cpp: Added.
+        * platform/graphics/DisplayRefreshMonitorClient.h: Added.
+        * platform/graphics/DisplayRefreshMonitorManager.cpp: Added.
+        * platform/graphics/DisplayRefreshMonitorManager.h: Added.
+        Split DisplayRefreshMonitor.cpp into one file per class.
+        Use references in a few places.
+        Remove some useless comments.
</ins><span class="cx"> 
</span><del>-            * platform/mac/WebCoreNSURLExtras.mm:
-            (WebCore::isLookalikeCharacter): Removed the inline keyword from this, and added
-            more lookalike characters from the Mozilla list referenced here.
-            (WebCore::URLByTruncatingOneCharacterBeforeComponent): Updated argument type.
-            (WebCore::dataForURLComponentType): Ditto.
-            (WebCore::userVisibleString): Only call mapHostNames if host name decoding is
-            needed; no encoding here.
</del><ins>+        * platform/graphics/DisplayRefreshMonitor.cpp:
+        (WebCore::DisplayRefreshMonitor::displayDidRefresh):
+        Use takeAny() and remove a FIXME about it not existing.
</ins><span class="cx"> 
</span><del>-2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        * platform/graphics/DisplayRefreshMonitorClient.cpp: Added.
+        (WebCore::DisplayRefreshMonitorClient::fireDisplayRefreshIfNeeded):
+        Use an early return instead of having the whole function body in an if().
</ins><span class="cx"> 
</span><del>-        Merge r167167
</del><ins>+        * platform/graphics/ios/DisplayRefreshMonitorIOS.h: Added.
+        * platform/graphics/ios/DisplayRefreshMonitorIOS.mm:
+        * platform/graphics/mac/DisplayRefreshMonitorMac.cpp:
+        * platform/graphics/mac/DisplayRefreshMonitorMac.h: Added.
+        Virtualize DisplayRefreshMonitorIOS and DisplayRefreshMonitorMac,
+        and move things specific to each of them out of DisplayRefreshMonitor itself.
</ins><span class="cx"> 
</span><del>-    2014-04-11  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+2014-05-23  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-            Assertion failure changing select element size during focus event
-            dispatch
-            &lt;https://bugs.webkit.org/show_bug.cgi?id=131566&gt;
-            &lt;rdar://problem/16400735&gt;
</del><ins>+        CSS JIT: Apply backtracking optimization to adjacent backtracking
+        https://bugs.webkit.org/show_bug.cgi?id=132951
</ins><span class="cx"> 
</span><del>-            Reviewed by Andy Estes.
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-            Test: fast/forms/select-change-size-during-focus.html
</del><ins>+        Apply the backtracking optimization to the adjacent backtracking.
+        This optimization is already done for the descendant backtracking.
+        We apply this to the adjacent backtracking similarly.
</ins><span class="cx"> 
</span><del>-            * html/HTMLSelectElement.cpp:
-            (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
-            Adopt the fix from Chromium r171216; check that the renderer is still
-            of the expected type, and return early if it is not.
</del><ins>+        Test: fast/selectors/backtracking-adjacent-optimized.html
</ins><span class="cx"> 
</span><del>-2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        * cssjit/SelectorCompiler.cpp:
+        (WebCore::SelectorCompiler::SelectorFragment::SelectorFragment):
+        (WebCore::SelectorCompiler::solveAdjacentBacktrackingActionForDirectAdjacent):
+        (WebCore::SelectorCompiler::solveBacktrackingAction):
+        (WebCore::SelectorCompiler::computeBacktrackingStartOffsetInChain):
+        (WebCore::SelectorCompiler::computeBacktrackingHeightFromDescendant):
+        (WebCore::SelectorCompiler::computeBacktrackingWidthFromIndirectAdjacent):
+        (WebCore::SelectorCompiler::SelectorCodeGenerator::computeBacktrackingInformation):
+        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateIndirectAdjacentTreeWalker):
+        (WebCore::SelectorCompiler::SelectorCodeGenerator::linkFailures):
+        (WebCore::SelectorCompiler::computeBacktrackingStartHeightFromDescendant): Deleted.
</ins><span class="cx"> 
</span><del>-        Merge r167135
</del><ins>+2014-05-23  Alex Christensen  &lt;achristensen@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-    2014-04-10  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        Make CSS JIT run on ARM64.
+        https://bugs.webkit.org/show_bug.cgi?id=133156
</ins><span class="cx"> 
</span><del>-            Heap-use-after-free in WebCore::SpeechSynthesisUtterance::startTime
-            https://bugs.webkit.org/show_bug.cgi?id=131482
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-            Reviewed by David Kilzer.
</del><ins>+        * cssjit/FunctionCall.h:
+        (WebCore::FunctionCall::saveAllocatedRegisters):
+        (WebCore::FunctionCall::restoreAllocatedRegisters):
+        Use StackAllocator's new push and pop functions to push and pop a vector instead of iterating it.
+        * cssjit/RegisterAllocator.h:
+        (WebCore::RegisterAllocator::reserveCalleeSavedRegisters):
+        (WebCore::RegisterAllocator::restoreCalleeSavedRegisters):
+        Return a vector of registers to allocate instead of doing the allocation to make the RegisterAllocator
+        not need to know about the StackAllocator and to use the new vector push and pop functions.
+        (WebCore::RegisterAllocator::~RegisterAllocator):
+        Store RegisterIDs instead of StackReferences to avoid needing to know about the stack.
+        * cssjit/SelectorCompiler.cpp:
+        (WebCore::SelectorCompiler::SelectorCodeGenerator::compile):
+        Removed the requirement for assert to be disabled to print disassembly when debugging css jit.
+        (WebCore::SelectorCompiler::SelectorCodeGenerator::generatePrologue):
+        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateEpilogue):
+        Added to correctly push the link register and frame pointer.
+        This is required if the jit code calls a function on arm64 and helpful for debugging tools on x86_64.
+        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorChecker):
+        Generate the prologue and epilogue which respectively push and pop
+        the link register, frame pointer, and callee saved registers if needed.
+        * cssjit/StackAllocator.h:
+        (WebCore::StackAllocator::push):
+        (WebCore::StackAllocator::pop):
+        Added new vector push and pop functions to use stp and ldb instructions on arm64.
</ins><span class="cx"> 
</span><del>-            Hold onto the utterance until it has time to fire, in case other references have been removed.
</del><ins>+2014-05-23  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Merged from Blink r171077 by &lt;dmazzoni@chromium.org&gt;
</del><ins>+        Hide fullscreen immediately when switching tabs.
+        https://bugs.webkit.org/show_bug.cgi?id=133239
</ins><span class="cx"> 
</span><del>-            Test: platform/mac/fast/speechsynthesis/speech-synthesis-gc-utterance-crash.html
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-            * Modules/speech/SpeechSynthesis.cpp:
-            (WebCore::SpeechSynthesis::handleSpeakingCompleted):
</del><ins>+        This change allows fullscreen to disappear immediately while still cleaning
+        up fullscreen normally.
</ins><span class="cx"> 
</span><del>-2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        * WebCore.exp.in:
+        * platform/ios/WebVideoFullscreenControllerAVKit.h:
+        renamed function to requestHideAndExitFullscreen
</ins><span class="cx"> 
</span><del>-        Merge r167093
</del><ins>+        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
+        renamed function to requestHideAndExitFullscreen
</ins><span class="cx"> 
</span><del>-    2014-04-08  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+        (-[WebVideoFullscreenController requestHideAndExitFullscreen]):
+        rename of requestExitFullscreen that also hides.
</ins><span class="cx"> 
</span><del>-            Assertion failure in WebCore::FlexBoxIterator::next()
-            &lt;https://bugs.webkit.org/show_bug.cgi?id=117176&gt;
-            &lt;rdar://problem/14054549&gt;
</del><ins>+        (-[WebVideoFullscreenController requestExitFullscreen]): Deleted.
+        * platform/ios/WebVideoFullscreenInterfaceAVKit.h: declare requestHideAndExitFullscreen()
+        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
+        (WebVideoFullscreenInterfaceAVKit::requestHideAndExitFullscreen):
+        this hides the window before requesting exitfullscreen from the model.
</ins><span class="cx"> 
</span><del>-            Code added in r115687 began removing anonymous wrappers when children
-            become inline. However, there are some objects, like
-            RenderDeprecatedFlexBox, whose children should always be blocks.
</del><ins>+2014-05-23  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Tim Horton.
</del><ins>+        [iOS] WKPDFView should have a page indicator
+        https://bugs.webkit.org/show_bug.cgi?id=133109
+        &lt;rdar://problem/16383003&gt;
</ins><span class="cx"> 
</span><del>-            * rendering/RenderBlock.h:
-            (WebCore::RenderBlock::canCollapseAnonymousBlockChild):
-            Made public.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-            * rendering/RenderObject.cpp:
-            (WebCore::RenderObject::removeAnonymousWrappersForInlinesIfNecessary):
-            Return early if we can't collapse anonymous block children.
</del><ins>+        * English.lproj/Localizable.strings:
</ins><span class="cx"> 
</span><del>-2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+2014-05-23  Enrica Casucci  &lt;enrica@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r167092
</del><ins>+        Remove invalid ASSERT in wordRangeForPosition.
+        https://bugs.webkit.org/show_bug.cgi?id=133232
</ins><span class="cx"> 
</span><del>-    2014-04-07  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-            Assertion failure, !node || node-&gt;isElementNode(), in
-            WebCore::RenderBlock::clone()
-            &lt;https://bugs.webkit.org/show_bug.cgi?id=110489&gt;
-            &lt;rdar://problem/13666425&gt;
</del><ins>+        In WK2 for iOS this function is called on every selection change.
+        The selection could be set by Javascript in an element that is not visible.
+        In that case we won't be able to create a VisiblePosition therefore wordRangeForPosition
+        should not ASSERT that the VisiblePosition is not null, but rather
+        perform an early return if it is null.
</ins><span class="cx"> 
</span><del>-            Reviewed by Antti Koivisto.
</del><ins>+        * editing/VisibleUnits.cpp:
+        (WebCore::wordRangeFromPosition):
</ins><span class="cx"> 
</span><del>-            We're ending up in RenderBlock::splitBlocks() with |this| ==
-            |fromBlock|.  We then try to climb the ancestor block chain from
-            this-&gt;parent() to |fromBlock|, but this-&gt;parent() is already above
-            |fromBlock|, so we end up climbing up to the RenderView and trying to
-            clone it, causing the assertion failure.
</del><ins>+2014-05-23  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-            Adopt Chromium's mitigation for this from
-            &lt;https://codereview.chromium.org/13852041&gt;. This is not intended as a
-            fix for the underlying issue.
</del><ins>+        [CSS Grid Layout] Use gridRowCount() and gridColumnCount() when possible
+        https://bugs.webkit.org/show_bug.cgi?id=133213
</ins><span class="cx"> 
</span><del>-            Also, fix another issue that occurs with this fuzzed test case that's
-            not handled by the Chromium fix.
</del><ins>+        Reviewed by Sergio Villar Senin.
</ins><span class="cx"> 
</span><del>-            * rendering/RenderBlock.cpp:
-            (WebCore::RenderBlock::splitBlocks):
-            Ensure while we're in the loop that |curr| is a descendant of
-            |fromBlock|. From the Chromium patch:
</del><ins>+        Use gridRowCount() and gridColumnCount() instead of m_grid.size() and
+        m_grid[0].size() to make the code more descriptive and easier to
+        understand.
</ins><span class="cx"> 
</span><del>-                We need to check in every iteration of the loop because
-                moveChildrenTo could have moved |curr|. This is a mitigation and
-                not really a fix against a class of tree craziness.
</del><ins>+        No new tests (No change in behavior).
</ins><span class="cx"> 
</span><del>-            Finally, before moving children from |fromBlock| to |toBlock|, ensure
-            that the children are children of |fromBlock|. If we never entered the
-            loop, they will be siblings of |fromBlock|, not children.
</del><ins>+        * rendering/RenderGrid.cpp:
+        (WebCore::RenderGrid::growGrid):
+        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
</ins><span class="cx"> 
</span><del>-2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+2014-05-23  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r166601
</del><ins>+        REGRESSION (r153917): Chart for the Category Explorer within Quicken Essentials
+        does not draw until you force a redraw
+        https://bugs.webkit.org/show_bug.cgi?id=133228
+        &lt;rdar://problem/15221231&gt;
</ins><span class="cx"> 
</span><del>-    2014-04-01  Daniel Bates  &lt;dabates@apple.com&gt;
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-            RenderQuote must destroy remaining text renderer before first letter renderer
-            https://bugs.webkit.org/show_bug.cgi?id=78023
-            &lt;rdar://problem/10830009&gt;
</del><ins>+        * platform/RuntimeApplicationChecks.cpp: (WebCore::applicationIsQuickenEssentials):
+        * platform/RuntimeApplicationChecks.h:
+        Added a check for Quicken Essentials.
</ins><span class="cx"> 
</span><del>-            Reviewed by Brent Fulgham.
</del><ins>+        * platform/mac/WidgetMac.mm: (WebCore::Widget::paint): Don't do an early return
+        for Quicken Essentials, it depends on drawing to update its layer.
</ins><span class="cx"> 
</span><del>-            Merged from Blink (patch by Abhishek Arya):
-            https://src.chromium.org/viewvc/blink?view=rev&amp;revision=151270
</del><ins>+2014-05-23  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-            Following the fix for &lt;https://bugs.webkit.org/show_bug.cgi?id=114586&gt;, a
-            RenderQuote may have child render objects for the first letter of its text
-            and everything following the first letter so as to support the CSS first-
-            letter property. The latter renderer is responsible for destroying the former
-            on destruction. It's sufficient to reverse the destruction of the children of
-            RenderQuote to ensure that we destroy the remaining text renderer before we
-            destroy the first letter renderer.
</del><ins>+        REGRESSION(r169105): fast/regions/cssom/region-range-for-box-crash.html is more crashy than before
+        https://bugs.webkit.org/show_bug.cgi?id=133124
</ins><span class="cx"> 
</span><del>-            Test: fast/css-generated-content/quote-first-letter-crash.html
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-            * rendering/RenderQuote.cpp:
-            (WebCore::RenderQuote::updateText):
</del><ins>+        When adjusting the end points of a subtree selection in the case of a document
+        with named flows, we have to make sure that we pass the computed end
+        points to the visible selection algorithm only if the end points are
+        part of the same subtree, otherwise assume a selection clear behavior.
</ins><span class="cx"> 
</span><del>-2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        The test fast/regions/cssom/region-range-for-box-crash.html is used to
+        test this behavior.
</ins><span class="cx"> 
</span><del>-        Merge r166457
</del><ins>+        * rendering/SelectionSubtreeRoot.cpp:
+        (WebCore::SelectionSubtreeRoot::adjustForVisibleSelection):
+        (WebCore::SelectionSubtreeRoot::selectionStartEndPositions): Moved to header file.
+        * rendering/SelectionSubtreeRoot.h:
+        (WebCore::SelectionSubtreeRoot::selectionStartEndPositions):
</ins><span class="cx"> 
</span><del>-    2014-03-29  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+2014-05-23  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Preserve selection end positions in directionOfSelection
-            &lt;http://webkit.org/b/104813&gt;
-            &lt;rdar://problem/13666417&gt;
</del><ins>+        reset m_havePreparedToPlay when changing media engines.
+        https://bugs.webkit.org/show_bug.cgi?id=133199
</ins><span class="cx"> 
</span><del>-            Reviewed by Brent Fulgham.
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-            Merged from Blink (patch by kenrb@chromium.org):
-            https://src.chromium.org/viewvc/blink?revision=150621&amp;view=revision
-            http://crbug.com/164263
</del><ins>+        If a play request comes in before the media player is created, m_havePreparedToPlay
+        is set to true. But when the player is created, this prevents the new player from
+        getting the prepare call.
</ins><span class="cx"> 
</span><del>-                VisibleSelection::visibleStart() and VisibleSelection::visibleEnd()
-                can both cause layouts, which has the potential to invalidate any
-                rendertree-based objects. This was causing a problem in
-                FrameSelection::directionOfSelection(), where a reference to a
-                lineBox was being held across a call to visibleEnd().
</del><ins>+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerEngineUpdated): set m_havePreparedToPlay false.
</ins><span class="cx"> 
</span><del>-                This patch ensures that the any layout is completed before linebox
-                references are retrieved.
</del><ins>+2014-05-23  Oliver Hunt  &lt;oliver@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Test: editing/selection/layout-during-move-selection-crash.html
</del><ins>+        Navigator object needs to have properties directly on the instance object
+        https://bugs.webkit.org/show_bug.cgi?id=133221
</ins><span class="cx"> 
</span><del>-            * editing/FrameSelection.cpp:
-            (WebCore::FrameSelection::directionOfSelection):
</del><ins>+        Reviewed by Mark Lam.
</ins><span class="cx"> 
</span><del>-2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        Flag the Navigator object as requiring properties to be on the instance
+        as there were a few compatibility issues when on the prototype.
</ins><span class="cx"> 
</span><del>-        Merge r166428
</del><ins>+        * bindings/scripts/CodeGeneratorJS.pm:
+        (InterfaceRequiresAttributesOnInstance):
</ins><span class="cx"> 
</span><del>-    2014-03-28  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+2014-05-23  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            In some situations, partial layouts of floating elements produce incorrect results.
-            https://bugs.webkit.org/show_bug.cgi?id=122668
</del><ins>+        Switch CSSGradientValue to use more references
+        https://bugs.webkit.org/show_bug.cgi?id=133206
</ins><span class="cx"> 
</span><del>-            Reviewed by David Hyatt.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-            When performing partial layout of float elements and checking if other float
-            elements are encountered, incorrect results were obtained by not checking
-            the size of the existing floats vector.
</del><ins>+        Switch from pointers to references in various places.
</ins><span class="cx"> 
</span><del>-            Test: fast/block/float/floats-in-clean-line-crash.html
</del><ins>+        * css/CSSGradientValue.cpp:
+        (WebCore::CSSGradientValue::image):
+        (WebCore::CSSGradientValue::addStops):
+        (WebCore::positionFromValue):
+        (WebCore::CSSGradientValue::computeEndPoint):
+        (WebCore::CSSLinearGradientValue::createGradient):
+        (WebCore::CSSRadialGradientValue::resolveRadius):
+        (WebCore::CSSRadialGradientValue::createGradient):
+        * css/CSSGradientValue.h:
</ins><span class="cx"> 
</span><del>-            * rendering/RenderBlockLineLayout.cpp:
-            (WebCore::RenderBlockFlow::checkFloatsInCleanLine):
</del><ins>+2014-05-23  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        Subpixel rendering: Make webkit-box-shadow painting subpixel aware.
+        https://bugs.webkit.org/show_bug.cgi?id=133201
+        &lt;rdar://problem/16072830&gt;
</ins><span class="cx"> 
</span><del>-        Merge r166236
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-    2014-03-25  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        This patch enables webkit-box-shadow to be painted on a subpixel position. However, we
+        still truncate -webkit-box-shadow property values. Tracked here: http://webkit.org/b/133202
</ins><span class="cx"> 
</span><del>-            Hold a reference to firstSuccessfulSubmitButton in HTMLFormElement::submit
-            &lt;http://webkit.org/b/130713&gt;
-            &lt;rdar://problem/15661876&gt;
</del><ins>+        Test: fast/box-shadow/hidpi-webkit-box-shadow-subpixel-position.html
</ins><span class="cx"> 
</span><del>-            Reviewed by Darin Adler.
</del><ins>+        * platform/graphics/FloatRoundedRect.cpp:
+        (WebCore::FloatRoundedRect::inflateWithRadii): same as in from RoundedRect.
+        (WebCore::FloatRoundedRect::adjustRadii): same as in from RoundedRect.
+        * platform/graphics/FloatRoundedRect.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
</ins><span class="cx"> 
</span><del>-            Merged from Blink (patch by Ian Beer):
-            http://crbug.com/303657
-            https://src.chromium.org/viewvc/blink?view=rev&amp;revision=158938
</del><ins>+2014-05-22  peavo@outlook.com  &lt;peavo@outlook.com&gt;
</ins><span class="cx"> 
</span><del>-            Test: fast/forms/form-submission-crash-successful-submit-button.html
</del><ins>+        [Curl] Crash when exceeding maximum cache limit.
+        https://bugs.webkit.org/show_bug.cgi?id=133185
</ins><span class="cx"> 
</span><del>-            * html/HTMLFormElement.cpp:
-            (WebCore::HTMLFormElement::submit):
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-2014-03-26  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        When the maximum cache limit is exceeded, I get a crash.
+        This happens when deleting cache entries, because a reference to the url string object in the LRU list
+        is used as a parameter to invalidateCacheEntry(), when called from makeRoomForNewEntry().
+        When the string is removed from the LRU list in makeRoomForNewEntry(), the string is deleted.
+        Next, the string is accessed again to remove the url from the index, and we crash.
</ins><span class="cx"> 
</span><del>-        Merge r160010.
</del><ins>+        This can be fixed by removing the string from the LRU list after it is removed from the index.
</ins><span class="cx"> 
</span><del>-    2013-12-03  László Langó  &lt;lango@inf.u-szeged.hu&gt;
</del><ins>+        Fixing the crash also revealed an infinite loop problem.
+        If the url for some reason only exist in the LRU list, and not in the index,
+        we will inifitely loop in makeRoomForNewEntry(), trying to remove this url from the cache, but never succeeding.
+        This can be fixed by removing the url from the LRU list, also when it's not in the index.
</ins><span class="cx"> 
</span><del>-            ASSERTION FAILED: !value || (value-&gt;isPrimitiveValue()) in WebCore::StyleProperties::getLayeredShorthandValue.
-            https://bugs.webkit.org/show_bug.cgi?id=125146
</del><ins>+        * platform/network/curl/CurlCacheManager.cpp:
+        (WebCore::CurlCacheManager::makeRoomForNewEntry): Avoid infinite loop by checking if there are more cache entries to remove.
+        (WebCore::CurlCacheManager::invalidateCacheEntry): Avoid crash and infinite loop by removing url from LRU list last.
</ins><span class="cx"> 
</span><del>-            Reviewed by Darin Adler.
</del><ins>+2014-05-22  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Do not presume that |yValue| is primitive if |value| is implicit in StylePropertySerializer.
-            An implicit y-value can become explicit if specified as a separate longhand.
-            At the same time, its new value can be non-primitive.
</del><ins>+        Make viewport units work in CSS gradients
+        https://bugs.webkit.org/show_bug.cgi?id=133204
+        &lt;rdar://problem/17012259&gt;
+        
+        Reviewed by Tim Horton.
+        
+        Make viewport percentage lengths work in gradients.
</ins><span class="cx"> 
</span><del>-            Backported from Blink:
-            http://src.chromium.org/viewvc/blink?view=rev&amp;rev=153678
</del><ins>+        Test: fast/gradients/viewport-units-gradient.html
</ins><span class="cx"> 
</span><del>-            Test: fast/css/webkit-mask-crash-implicit.html
</del><ins>+        * css/CSSGradientValue.cpp:
+        (WebCore::CSSGradientValue::addStops):
+        (WebCore::CSSLinearGradientValue::createGradient):
+        (WebCore::CSSRadialGradientValue::createGradient):
+        * css/CSSGradientValue.h:
</ins><span class="cx"> 
</span><del>-            * css/StyleProperties.cpp:
-            (WebCore::StyleProperties::getLayeredShorthandValue):
</del><ins>+2014-05-22  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-26  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        [iOS][WK2] Add support for minimal-ui viewports
+        https://bugs.webkit.org/show_bug.cgi?id=133162
</ins><span class="cx"> 
</span><del>-        Remove extraneous ! from merge of r166304.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-2014-03-26  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Add support for minimal-ui directly into the Viewport configuration.
</ins><span class="cx"> 
</span><del>-        Merge r166304.
</del><ins>+        ViewportConfiguration knows about two kinds of layout size in scrollview coordinates:
+        -normal size
+        -minimal ui size.
</ins><span class="cx"> 
</span><del>-    2014-03-26  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        Initially, the page is initialized with resetMinimalUI() and starts with a normal layout.
</ins><span class="cx"> 
</span><del>-            REGRESSION(r162679): Poster image visible under the video
-            https://bugs.webkit.org/show_bug.cgi?id=130783
</del><ins>+        At any time before the main resource is loaded, the Web page can update its viewport meta tag
+        to include minimal-ui. The viewport configuration is updated immediately to reflect the minimal-ui
+        layout size. Any layout after that takes minimal-ui into account.
</ins><span class="cx"> 
</span><del>-            Reviewed by Simon Fraser.
</del><ins>+        * WebCore.exp.in:
+        * css/LengthFunctions.cpp:
+        (WebCore::minimumValueForLength):
+        (WebCore::floatValueForLength):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::viewportPercentageValue):
+        * dom/ViewportArguments.h:
+        (WebCore::ViewportArguments::operator==):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setViewportSizeForCSSViewportUnits):
+        (WebCore::FrameView::viewportSizeForCSSViewportUnits):
+        (WebCore::FrameView::setViewportSize): Deleted.
+        (WebCore::FrameView::viewportSize): Deleted.
+        * page/FrameView.h:
+        * page/ViewportConfiguration.cpp:
+        (WebCore::ViewportConfiguration::ViewportConfiguration):
+        (WebCore::ViewportConfiguration::setMinimumLayoutSize):
+        (WebCore::ViewportConfiguration::setMinimumLayoutSizeForMinimalUI):
+        (WebCore::ViewportConfiguration::activeMinimumLayoutSizeInScrollViewCoordinates):
+        (WebCore::ViewportConfiguration::resetMinimalUI):
+        (WebCore::ViewportConfiguration::pageWillRenderFirstFrame):
+        (WebCore::ViewportConfiguration::initialScale):
+        (WebCore::ViewportConfiguration::minimumScale):
+        (WebCore::ViewportConfiguration::updateConfiguration):
+        (WebCore::ViewportConfiguration::layoutWidth):
+        (WebCore::ViewportConfiguration::layoutHeight):
+        (WebCore::ViewportConfiguration::description):
+        * page/ViewportConfiguration.h:
+        (WebCore::ViewportConfiguration::minimumLayoutSizeForMinimalUI):
+        (WebCore::ViewportConfiguration::usesMinimalUI):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::viewportSizeForCSSViewportUnits):
+        (WebCore::RenderView::viewportSize): Deleted.
+        * rendering/RenderView.h:
</ins><span class="cx"> 
</span><del>-            In the listed revision, we started checking for isRenderImage()
-            instead of isImage(). RenderMedias return 'true' for the first
-            but 'false' for the second. Change the if() statement to check
-            for isRenderMedia() in addition to !isRenderImage().
</del><ins>+2014-05-22  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-            * rendering/RenderLayerBacking.cpp:
-            (WebCore::RenderLayerBacking::isDirectlyCompositedImage):
</del><ins>+        Can't type in status in facebook.com on iOS Safari because keyboard disappears
+        https://bugs.webkit.org/show_bug.cgi?id=133196
</ins><span class="cx"> 
</span><del>-2014-03-24  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        Remove a commented line of code introduced by r166104.
</del><ins>+        Fixed the bug by rolling out r156252.
</ins><span class="cx"> 
</span><del>-        Reviewed by Babak Shafiei.
</del><ins>+        When the user taps on the status on facebook.com, the page focuses a textarea,
+        which is then made momentarily invisible by setting display:none.
+        The page then removes display:none later and expects the textarea to be still focused.
</ins><span class="cx"> 
</span><del>-        A line was commented out when it should have been deleted. This patch
-        corrects that oversight.
</del><ins>+        With r156252, the focus is removed after the page sets display:none and the keyboard disappears.
+        Since the focus is never reset on the textarea, the user can never type in anything.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::location):
</del><ins>+        The specification may need to change here given that this (rather odd) behavior/expectation exists
+        on one of the most popular websites on the Web.
</ins><span class="cx"> 
</span><del>-2014-03-22  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::updateLayout):
+        (WebCore::Document::resetHiddenFocusElementSoon): Deleted.
+        (WebCore::Document::resetHiddenFocusElementTimer): Deleted.
+        * dom/Document.h:
</ins><span class="cx"> 
</span><del>-        Finish merge of r160065. The changes from Source/WebCore/rendering/RenderView.cpp were incorrectly
-        omitted from the original merge in r165142.
</del><ins>+2014-05-22  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-12-03  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
-    
-            Potential crash in RenderView::selectionBounds and RenderView::repaintSelection
-            https://bugs.webkit.org/show_bug.cgi?id=125207
-    
-            Reviewed by Simon Fraser.
-            
-            Merge https://chromium.googlesource.com/chromium/blink/+/f9e6e288a5aa959f05c374806121aaf0fc52d440
-    
-            Update style in FrameSelection instead of RenderView's member functions. These are the last two
-            member functions of RenderView that updates the style.
-    
-            * editing/FrameSelection.cpp:
-            (WebCore::FrameSelection::focusedOrActiveStateChanged):
-            (WebCore::FrameSelection::bounds):
-            * rendering/RenderView.cpp:
-            (WebCore::RenderView::selectionBounds):
-            (WebCore::RenderView::repaintSelection):
-    
-2014-03-21  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        http/tests/security/xss-DENIED-xsl-document-redirect.xml fails with NetworkProcess
+        https://bugs.webkit.org/show_bug.cgi?id=132523
</ins><span class="cx"> 
</span><del>-        Merge r166090.
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-    2014-03-21  Oliver Hunt  &lt;oliver@apple.com&gt;
-    
-            Fix a crash when assigning an object to document.location
-            https://bugs.webkit.org/show_bug.cgi?id=130213
-    
-            Reviewed by Geoffrey Garen.
-    
-            Convert location to string before we make use the document.
-            This prevents us from attempting to navigate a frame that
-            has already been removed.
-    
-            Test: fast/dom/navigation-with-sideeffects-crash.html
-    
-            * bindings/js/JSDocumentCustom.cpp:
-            (WebCore::JSDocument::location):
-            (WebCore::JSDocument::setLocation):
-    
-2014-03-20  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        We should not manufacture a response in the event of an error during a
+        synchronous XHR. In addition, this test removes two places that are
+        sensitive to such a manufactured response.
</ins><span class="cx"> 
</span><del>-        Merge r165821.
</del><ins>+        Updates test expectations.
</ins><span class="cx"> 
</span><del>-    2014-03-18  Antti Koivisto  &lt;antti@apple.com&gt;
-    
-            Mutating rules returned by getMatchedCSSRules can result in crash
-            https://bugs.webkit.org/show_bug.cgi?id=130209
-    
-            Reviewed by Andreas Kling.
-            
-            The non-standard getMatchedCSSRules API returns CSSStyleRule objects that don't
-            have parent stylesheet pointer (as we don't know which sheet the rule originated from).
-            Mutating the rule via such wrapper can lead to crashes later as we fail to invalidate
-            the underlying stylesheet.
-            
-            Fix by disallowing mutation of style rules that don't have parent sheet pointer. CSSStyleRule
-            has two mutable properties selectorText and style. The latter gives back CSSStyleDeclaration.
-            This patch disallows mutations in both cases for CSSStyleRules that don't have parent stylesheet
-            pointer.
-            
-            While it is technically possible to have CSSRules that are legitimately disconnected
-            from stylesheet (by removing rule from sheet while holding a reference to it) it never
-            makes sense to mutate such rule as there is no way to do anything with it afterwards.
-    
-            Tests: fast/css/getMatchedCSSProperties-rule-mutation.html
-                   fast/css/getMatchedCSSRules-crash.html
-    
-            * css/CSSStyleRule.cpp:
-            (WebCore::CSSStyleRule::setSelectorText):
-    
-                Bail out if parent stylesheet is null.
-    
-            * css/PropertySetCSSStyleDeclaration.cpp:
-            (WebCore::PropertySetCSSStyleDeclaration::setCssText):
-            (WebCore::PropertySetCSSStyleDeclaration::setProperty):
-            (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
-            (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
-            
-                Allow StyleRuleCSSStyleDeclaration subclass cancel the mutation via
-                boolean return value from willMutate.
-    
-            (WebCore::StyleRuleCSSStyleDeclaration::willMutate):
-            
-                Disallow mutation if the owning CSSStyleRule is null or has null stylesheet.
-    
-            (WebCore::StyleRuleCSSStyleDeclaration::didMutate):
-            
-                We never get here with null rule or stylesheet anymore.
-    
-            * css/PropertySetCSSStyleDeclaration.h:
-            (WebCore::PropertySetCSSStyleDeclaration::willMutate):
-    
-2014-03-20  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::loadRequest): Don't inspect a
+        loader response if there is an error
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::platformLoadResourceSynchronously): Do not
+        manufacture a response
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::platformLoadResourceSynchronously): Do not
+        manufacture a response
+        * xml/XSLTProcessorLibxslt.cpp:
+        (WebCore::docLoaderFunc): Only use the response's URL if no error
+        occurred.
</ins><span class="cx"> 
</span><del>-        Merge r165921.
</del><ins>+2014-05-22  Myles C. Maxfield  &lt;litherum@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-    2014-03-19  Antti Koivisto  &lt;antti@apple.com&gt;
-    
-            Crash with long selector list
-            https://bugs.webkit.org/show_bug.cgi?id=123006
-    
-            Reviewed by Andreas Kling.
-    
-            Test: fast/css/long-selector-list-crash.html
-    
-            * css/CSSSelectorList.cpp:
-            (WebCore::CSSSelectorList::CSSSelectorList):
-            (WebCore::CSSSelectorList::adoptSelectorVector):
-            (WebCore::CSSSelectorList::operator=):
-            * css/StyleRule.cpp:
-            (WebCore::StyleRule::create):
-    
-                Add a bunch of asserts.
-    
-            (WebCore::StyleRule::splitIntoMultipleRulesWithMaximumSelectorComponentCount):
-            
-                This could produce a zero-length selector list.
-    
-2014-03-18  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        Unreviewed typo fix.
</ins><span class="cx"> 
</span><del>-        Unreviewed Win64 build fix; explicit operators are not valid in VS2010.
</del><ins>+        Reviewed by NOBODY.
</ins><span class="cx"> 
</span><del>-        With the 'explicit bool' operator removed, just test weakThis.get() explicitly.
</del><ins>+        No new tests.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::checkPlayability):
</del><ins>+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::dashesForIntersectionsWithRect): Accidentally said run.length() instead of glyphBuffer.size().
</ins><span class="cx"> 
</span><del>-2014-03-18  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+2014-05-22  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r165478.
</del><ins>+        [iOS WebKit2] Web process should try to shrink its memory footprint when going into background.
+        &lt;https://webkit.org/b/133197&gt;
+        &lt;rdar://problem/17011561&gt;
</ins><span class="cx"> 
</span><del>-    2014-03-12  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        Make releaseMemory() public so we can call it from the process-will-suspend callback.
</ins><span class="cx"> 
</span><del>-            [Mac] Crash when running media/fallback.html test in MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification()
-            https://bugs.webkit.org/show_bug.cgi?id=130136
</del><ins>+        Reviewed by Gavin Barraclough.
</ins><span class="cx"> 
</span><del>-            Reviewed by Eric Carlson.
</del><ins>+        * WebCore.exp.in:
+        * platform/MemoryPressureHandler.h:
</ins><span class="cx"> 
</span><del>-            MediaPlayerPrivateAVFoundation is trying to lock its m_queueMutex from an async thread after
-            while being destroyed in the main thread. To resolve this race condition, redispatch from
-            the async thread to the main thread, and use a WeakPtr to determine whether the object has
-            been destroyed or not.
</del><ins>+2014-05-22  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-            (WebCore::MediaPlayerPrivateAVFoundationObjC::checkPlayability):
</del><ins>+        Hook up a setting for showing detailed logging during memory pressure relief.
+        &lt;https://webkit.org/b/133194&gt;
</ins><span class="cx"> 
</span><del>-2014-03-18  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Make the pressure relief logger opt-in. Also make it flush memory back to the
+        OS (for both malloc and FastMalloc) to get more accurate numbers at each step.
</ins><span class="cx"> 
</span><del>-        Follow-up fix for the merge of r163579.
</del><ins>+        Reviewed by Gavin Barraclough.
</ins><span class="cx"> 
</span><del>-    2014-03-17  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</del><ins>+        * WebCore.exp.in:
+        * platform/MemoryPressureHandler.cpp:
+        * platform/MemoryPressureHandler.h:
+        (WebCore::MemoryPressureHandler::ReliefLogger::ReliefLogger):
+        (WebCore::MemoryPressureHandler::ReliefLogger::~ReliefLogger):
+        (WebCore::MemoryPressureHandler::ReliefLogger::setLoggingEnabled):
+        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
+        (WebCore::MemoryPressureHandler::ReliefLogger::platformMemoryUsage):
</ins><span class="cx"> 
</span><del>-            Merge parts from Blink CLs 169865acce3b6bc85ac1adf07b2798aaf9aad67a and 04f613e7f0c35f444d5a9bd42da55c69df65cf64 that weren't merged to trunk
-            &lt;rdar://problem/16307742&gt;
</del><ins>+2014-05-22  Brady Eidson  &lt;beidson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Unreviewed Layout Test fix.
</del><ins>+        Don't scan for phone numbers in editable regions
+        &lt;rdar://problem/16949846&gt; and https://bugs.webkit.org/show_bug.cgi?id=133192
</ins><span class="cx"> 
</span><del>-            * html/parser/HTMLConstructionSite.cpp:
-            (WebCore::insert):
-            (WebCore::executeInsertTask):
-            (WebCore::executeReparentTask):
-            (WebCore::executeInsertAlreadyParsedChildTask):
</del><ins>+        Reviewed by Enrica Casucci.
</ins><span class="cx"> 
</span><del>-2014-03-17  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        No new tests (Currently untested WK2-only feature)
</ins><span class="cx"> 
</span><del>-        Merge r165753.
</del><ins>+        * editing/Editor.cpp:
+        (WebCore::Editor::scanRangeForTelephoneNumbers): Skip the range if the Node is editable.
</ins><span class="cx"> 
</span><del>-    2014-03-16  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-    
-            Provide preference to enable additional AVFoundation options
-            https://bugs.webkit.org/show_bug.cgi?id=130275
-    
-            Reviewed by Eric Carlson.
-    
-            * html/HTMLMediaElement.cpp:
-            (WebCore::HTMLMediaElement::doesHaveAttribute): Added.
-            * html/HTMLMediaElement.h:
-            * page/Settings.in: Add new attribute.
-            * platform/graphics/MediaPlayer.cpp:
-            (WebCore::MediaPlayer::doesHaveAttribute): Added stub to call private player object's
-            implementation of doesHaveAttribute.
-            * platform/graphics/MediaPlayer.h:
-            (WebCore::MediaPlayerClient::doesHaveAttribute):
-            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
-            (WebCore::MediaPlayerPrivateAVFoundationCF::AVFWrapper::createAssetForURL): Check the &lt;media&gt; object,
-            and notify AVFoundationCF to use URI option if relevant.
-            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-            (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL): Check the &lt;media&gt; object,
-            and notify AVFoundation to use URI option if relevant.
-    
-2014-03-17  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+2014-05-22  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r165583.
</del><ins>+        Captions layout incorrectly in fullscreen.
+        https://bugs.webkit.org/show_bug.cgi?id=133175
</ins><span class="cx"> 
</span><del>-    2014-03-13  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-            Web Inspector: Network.loadResource should include the response status code
-            https://bugs.webkit.org/show_bug.cgi?id=130216
</del><ins>+        When doing layout for fullscreen, geometry should be absolute so it is not influenced
+        by the rest of the page. This change adds style for CSSPropertyPosition, CSSPropertyLeft,
+        and CSSPropertyTop.
</ins><span class="cx"> 
</span><del>-            Reviewed by Timothy Hatcher.
</del><ins>+        * html/shadow/MediaControlElements.cpp:
+        (WebCore::MediaControlTextTrackContainerElement::updateDisplay):
+        Refactor style changes into updateStyleForTextTrackRepresentation().
+        (WebCore::MediaControlTextTrackContainerElement::updateTimerFired):
+        Refactor style changes into updateStyleForTextTrackRepresentation().
+        (WebCore::MediaControlTextTrackContainerElement::clearTextTrackRepresentation):
+        Refactor style changes into updateStyleForTextTrackRepresentation().
+        (WebCore::MediaControlTextTrackContainerElement::updateStyleForTextTrackRepresentation):
+        Consolidate style changes here. Include the two existing and three new style changes.
+        * html/shadow/MediaControlElements.h:
+        Declare updateStyleForTextTrackRepresentation().
</ins><span class="cx"> 
</span><del>-            * inspector/InspectorResourceAgent.cpp:
-            Record and send the http status code.
</del><ins>+2014-05-22  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * inspector/protocol/Network.json:
-            Include status code property in the success callback.
</del><ins>+        REGRESSION (r155977): Very stuttery 3D css animation on jtechcommunications.com
+        https://bugs.webkit.org/show_bug.cgi?id=133179
+        &lt;rdar://problem/16864666&gt;
</ins><span class="cx"> 
</span><del>-2014-03-17  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Merge r165582.
</del><ins>+        Revert code added in r155977 to try to pick a good contentsScale for layers
+        based on a root-relative transform. This resulted in pages with too much 
+        backing store, and too many cases where layers repainted during animations,
+        causing stutter.
</ins><span class="cx"> 
</span><del>-    2014-03-13  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::flushCompositingState):
+        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
+        (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers):
+        (WebCore::GraphicsLayerCA::updateContentsOpaque):
+        (WebCore::GraphicsLayerCA::updateAnimations):
+        (WebCore::GraphicsLayerCA::appendToUncommittedAnimations):
+        (WebCore::GraphicsLayerCA::setTransformAnimationEndpoints):
+        (WebCore::GraphicsLayerCA::setTransformAnimationKeyframes):
+        (WebCore::GraphicsLayerCA::updateContentsScale):
+        (WebCore::clampedContentsScaleForScale): Deleted.
+        (WebCore::maxScaleFromTransform): Deleted.
+        (WebCore::GraphicsLayerCA::updateRootRelativeScale): Deleted.
+        (WebCore::GraphicsLayerCA::getTransformFromAnimationsWithMaxScaleImpact): Deleted.
+        * platform/graphics/ca/GraphicsLayerCA.h:
</ins><span class="cx"> 
</span><del>-            Web Inspector: Network.loadResource XHR crash if page reloaded while request is ongoing
-            https://bugs.webkit.org/show_bug.cgi?id=130211
</del><ins>+2014-05-22  Martin Hock  &lt;mhock@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Timothy Hatcher.
</del><ins>+        [iOS] Enable -apple-system- styled elements to respond to system font size changes.
+        https://bugs.webkit.org/show_bug.cgi?id=133186
+        &lt;rdar://problem/16583782&gt;
</ins><span class="cx"> 
</span><del>-            Merged from Blink with changes, (patch by vsevik@chromium.org):
-            http://src.chromium.org/viewvc/blink?view=revision&amp;revision=152712
</del><ins>+        Reviewed by Enrica Casucci.
</ins><span class="cx"> 
</span><del>-            Using an XMLHttpRequest to download resources had a few issues. Being an
-            Active DOM Object the load could be paused. Without an extra retain,
-            when the load was cancelled (e.g. a page reload) the XHR would get
-            destructed and could cause a crash if the list of active DOM objects
-            was actively being iterated.
</del><ins>+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderThemeIOS.h:
+        * rendering/RenderThemeIOS.mm:
+        (WebCore::_contentSizeCategory):
+        (WebCore::RenderThemeIOS::contentSizeCategory):
+        (WebCore::RenderThemeIOS::setContentSizeCategory):
</ins><span class="cx"> 
</span><del>-            Switch to a DocumentThreadableLoader to manage the load ourselves.
-            This still uses the Memory cache, but we have a little more control.
</del><ins>+2014-05-22  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * inspector/InspectorResourceAgent.h:
-            * inspector/InspectorResourceAgent.cpp:
-            (WebCore::InspectorResourceAgent::InspectorResourceAgent):
-            (WebCore::InspectorResourceAgent::loadResource):
-            Switch from XHR to DocumentThreadableLoader.
</del><ins>+        [MSE] Stored samples are not freed when SourceBuffer is removed from MediaSource
+        https://bugs.webkit.org/show_bug.cgi?id=133174
</ins><span class="cx"> 
</span><del>-            * xml/XMLHttpRequest.h:
-            * xml/XMLHttpRequest.cpp:
-            (WebCore::XMLHttpRequest::XMLHttpRequest):
-            (WebCore::XMLHttpRequest::createRequest):
-            (WebCore::XMLHttpRequest::sendForInspector):
-            Remove the now unnecessary XHR sendForInspector path.
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-2014-03-17  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Clear out stored MediaSamples from SourceBuffer's TrackBuffer storage when
+        aborting loading. Also, report the memory cost of those samples, so that the
+        SourceBuffer will be GCd more readily.
</ins><span class="cx"> 
</span><del>-        Merge r165548.
</del><ins>+        Add a mechanism for reporting the size of a MediaSample:
+        * Modules/mediasource/SourceBuffer.h:
+        * platform/MediaSample.h:
+        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
+        * platform/mock/mediasource/MockSourceBufferPrivate.cpp:
</ins><span class="cx"> 
</span><del>-    2014-03-13  Andreas Kling  &lt;akling@apple.com&gt;
-    
-            Don't send synchronous resize events when FrameView has auto-sizing enabled.
-            &lt;https://webkit.org/b/130198&gt;
-            &lt;rdar://problem/15991333&gt;
-    
-            Reviewed by Dan Bernstein.
-    
-            * page/FrameView.cpp:
-            (WebCore::FrameView::sendResizeEventIfNeeded):
-    
-2014-03-17  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Track the memory usage of a SampleMap when adding and removing samples, as well
+        as allowing the SampleMap to be cleared wholesale:
+        * Modules/mediasource/SampleMap.cpp:
+        (WebCore::SampleMap::clear): Release all stored MediaSamples.
+        (WebCore::SampleMap::addSample): Update m_totalSize.
+        (WebCore::SampleMap::removeSample): Ditto.
+        * Modules/mediasource/SampleMap.h:
+        (WebCore::SampleMap::SampleMap): Initialize m_totalSize.
+        (WebCore::SampleMap::sizeInBytes): Simple accessor.
</ins><span class="cx"> 
</span><del>-        Reverse merge r165286.
</del><ins>+        Clear the stored samples when loading is aborted, and report the extra memory
+        cost
+        * Modules/mediasource/SourceBuffer.cpp:
+        (WebCore::SourceBuffer::SourceBuffer): Initialize m_reportedExtraMemoryCost.
+        (WebCore::SourceBuffer::removedFromMediaSource): Clear all stored samples.
+        (WebCore::SourceBuffer::sourceBufferPrivateAppendComplete): Call reportExtraMemoryCost().
+        (WebCore::SourceBuffer::reportExtraMemoryCost): Inform the vm of the new
+            extra memory cost incurred by the object.
</ins><span class="cx"> 
</span><del>-    2014-03-07  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+2014-05-22  Enrica Casucci  &lt;enrica@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Merge r165206.
</del><ins>+        REGRESSION (WebKit2): Keyboard should have Search button in duckduckgo.com.
+        https://bugs.webkit.org/show_bug.cgi?id=133183
+        &lt;rdar://problem/17004207&gt;
</ins><span class="cx"> 
</span><del>-        2014-03-05  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+        Reviewed by Geoff Garen.
</ins><span class="cx"> 
</span><del>-                Invalid cast in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients()
</del><ins>+        Adding new export.
</ins><span class="cx"> 
</span><del>-                &lt;https://bugs.webkit.org/show_bug.cgi?id=121887&gt;
-                &lt;rdar://problem/15073043&gt;
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-                Clang appears to be optimizing out a branch in RenderObject::node()
-                when compiling RenderLayer::FilterInfo::updateReferenceFilterClients().
-                We'll work around this by factoring out the code in question into a
-                separate member function marked NEVER_INLINE.
</del><ins>+2014-05-22  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-                No test possible due to &lt;https://bugs.webkit.org/show_bug.cgi?id=129757&gt;.
</del><ins>+        REGRESSION(r163712): [GTK] Misspelling and grammar underline marks are no longer drawn
+        https://bugs.webkit.org/show_bug.cgi?id=133047
</ins><span class="cx"> 
</span><del>-                Reviewed by David Kilzer.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-                * rendering/RenderLayerFilterInfo.cpp:
-                (WebCore::RenderLayer::FilterInfo::layerElement):
-                Code moved from updateReferenceFilterClients(). Returns the Element*
-                for m_layer.
-                (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
-                Use layerElement().
</del><ins>+        Change two conditions changed by mistake in r163712.
</ins><span class="cx"> 
</span><del>-                * rendering/RenderLayerFilterInfo.h:
-                Declared layerElement().
</del><ins>+        * editing/TextCheckingHelper.cpp:
+        (WebCore::findMisspellings): Enter the loop also when wordStart is 0.
+        (WebCore::TextCheckingHelper::findFirstMisspelling): Skip the work
+        when the text is a single character. Also reworked it to use a for
+        loop to improve the readability.
</ins><span class="cx"> 
</span><del>-2014-03-12  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+2014-05-22  Piotr Grad  &lt;p.grad@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r165331.
</del><ins>+        Video is resumed with old playback rate.
+        https://bugs.webkit.org/show_bug.cgi?id=132905
</ins><span class="cx"> 
</span><del>-    2014-03-10  Timothy Hatcher  &lt;timothy@apple.com&gt;
</del><ins>+        Reviewed by Philippe Normand.
</ins><span class="cx"> 
</span><del>-            Load source maps and their resources asynchronously.
</del><ins>+        Setting '0' playback rate is causing pipeline to pause.
+        GStreamer player impl. exposed this information to upper layers but it should not.
+        Solution is to hidden such situation behind m_playbackRatePause flag.
</ins><span class="cx"> 
</span><del>-            https://bugs.webkit.org/show_bug.cgi?id=112071
</del><ins>+        Test: media/video-paused-0-rate.html
</ins><span class="cx"> 
</span><del>-            Reviewed by Joseph Pecoraro.
</del><ins>+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
+        (WebCore::MediaPlayerPrivateGStreamer::play):
+        (WebCore::MediaPlayerPrivateGStreamer::pause):
+        (WebCore::MediaPlayerPrivateGStreamer::doSeek):
+        (WebCore::MediaPlayerPrivateGStreamer::updatePlaybackRate):
+        (WebCore::MediaPlayerPrivateGStreamer::paused):
+        (WebCore::MediaPlayerPrivateGStreamer::setRate):
+        (WebCore::MediaPlayerPrivateGStreamer::updateStates):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
</ins><span class="cx"> 
</span><del>-            * inspector/InspectorPageAgent.cpp:
-            (WebCore::InspectorPageAgent::buildObjectForFrameTree):
-            Honor the hiddenFromInspector flag.
</del><ins>+2014-05-22  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * inspector/InspectorResourceAgent.cpp:
-            (WebCore::InspectorResourceAgent::willSendRequest):
-            (WebCore::InspectorResourceAgent::markResourceAsCached):
-            (WebCore::InspectorResourceAgent::didReceiveResponse):
-            (WebCore::InspectorResourceAgent::didReceiveData):
-            (WebCore::InspectorResourceAgent::didFinishLoading):
-            (WebCore::InspectorResourceAgent::didFailLoading):
-            (WebCore::InspectorResourceAgent::replayXHR):
-            (WebCore::InspectorResourceAgent::loadResource):
-            * inspector/InspectorResourceAgent.h:
-            Honor the hiddenFromInspector flag by keeping track of
-            hidden identifiers in a HashSet.
</del><ins>+        Text markers don't paint on simple lines
+        https://bugs.webkit.org/show_bug.cgi?id=133177
</ins><span class="cx"> 
</span><del>-            * inspector/protocol/Network.json:
-            (Network.loadResource): Added.
</del><ins>+        Reviewed by Anders Carlsson.
+        
+        Marker painting code does not yet support simple lines.
</ins><span class="cx"> 
</span><del>-            * platform/network/ResourceRequestBase.h:
-            (WebCore::ResourceRequestBase::hiddenFromInspector): Added.
-            (WebCore::ResourceRequestBase::setHiddenFromInspector): Added.
-            (WebCore::ResourceRequestBase::ResourceRequestBase):
-            Add a flag to hide the request from the Inspector.
</del><ins>+        Tests: fast/text/mark-matches-rendering-simple-lines.html
+               fast/text/mark-matches-rendering.html
</ins><span class="cx"> 
</span><del>-            * xml/XMLHttpRequest.cpp:
-            (WebCore::XMLHttpRequest::XMLHttpRequest):
-            (WebCore::XMLHttpRequest::sendForInspector): Added.
-            (WebCore::XMLHttpRequest::sendForInspectorXHRReplay): Renamed.
-            (WebCore::XMLHttpRequest::createRequest):
-            * xml/XMLHttpRequest.h:
-            Make Inspector loads allow cross-origins and hide their request
-            from the Inspector itself.
</del><ins>+        * dom/DocumentMarkerController.cpp:
+        (WebCore::DocumentMarkerController::addMarker):
+        
+            Force text blocks with markers to use line boxes.
</ins><span class="cx"> 
</span><del>-2014-03-10  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        * testing/Internals.cpp:
+        (WebCore::Internals::setMarkedTextMatchesAreHighlighted):
+        
+            Expose this so we can make reftests for marker rendering.
</ins><span class="cx"> 
</span><del>-        [Win] Build fix after r165379.
</del><ins>+        * testing/Internals.h:
+        * testing/Internals.idl:
</ins><span class="cx"> 
</span><del>-        * bindings/js/SerializedScriptValue.cpp:
-        (WebCore::SerializedScriptValue::SerializedScriptValue): Revert to older-style C++ iteration
-        for Windows compatibility. This can be reverted when we use VS2013 on this branch.
</del><ins>+2014-05-22  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-07  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        [CSS Grid Layout] Guard RenderObject::isRenderGrid() method
+        https://bugs.webkit.org/show_bug.cgi?id=132380
</ins><span class="cx"> 
</span><del>-        Merge r162972 and r163007.
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-    2014-03-07  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        Guard RenderObject::isRenderGrid() method under ENABLE_CSS_GRID_LAYOUT compilation flag.
</ins><span class="cx"> 
</span><del>-            ASSERT_WITH_SECURITY_IMPLICATION in WebCore::InlineTextBox::paint
-            https://bugs.webkit.org/show_bug.cgi?id=114586
</del><ins>+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeLogicalWidthInRegion):
+        * rendering/RenderObject.h:
</ins><span class="cx"> 
</span><del>-            Reviewed by Dave Hyatt.
</del><ins>+2014-05-21  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Taken mostly from https://chromium.googlesource.com/chromium/blink/+/cb2297db16f2e9328cb4dd8b552093d6b22340a8
</del><ins>+        REGRESSION(r167870): Crash in simple line layout code with :after
+        https://bugs.webkit.org/show_bug.cgi?id=133155
+        &lt;rdar://problem/16977696&gt;
</ins><span class="cx"> 
</span><del>-            If RenderQuote is a subclass of RenderObject, it can't be split by the first-letter CSS pseudoclass.
-            Instead, we should make it a subclass of RenderElement, so that it can be split properly.
</del><ins>+        Reviewed by Darin Adler.
+        
+        Fix https://bugs.webkit.org/show_bug.cgi?id=132241 in a safer way.
+        The underline behavior is tested by the existing fast/text/simple-lines-hover-underline.html
</ins><span class="cx"> 
</span><del>-            Test: fast/css-generated-content/quote-first-letter.html
</del><ins>+        Test: fast/text/simple-lines-hover-after.html
</ins><span class="cx"> 
</span><del>-            * dom/PseudoElement.cpp:
-            (WebCore::PseudoElement::didRecalcStyle):
-            * rendering/RenderQuote.cpp:
-            (WebCore::RenderQuote::RenderQuote):
-            (WebCore::RenderQuote::willBeDestroyed):
-            (WebCore::RenderQuote::willBeRemovedFromTree):
-            (WebCore::RenderQuote::styleDidChange):
-            (WebCore::RenderQuote::updateText):
-            (WebCore::RenderQuote::computeText):
-            (WebCore::RenderQuote::updateDepth):
-            * rendering/RenderQuote.h:
-            * rendering/style/ContentData.cpp:
-            (WebCore::QuoteContentData::createContentRenderer):
</del><ins>+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::invalidateLineLayoutPath): Deleted.
</ins><span class="cx"> 
</span><del>-2014-03-10  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+            Move to RenderBlockFlow.
</ins><span class="cx"> 
</span><del>-        Merge r165339.
</del><ins>+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::invalidateLineLayoutPath):
+        * rendering/RenderBlockFlow.cpp:
+        (WebCore::RenderBlockFlow::styleDidChange):
+        
+            Invalidate layout if style changes in a manner that makes us ineligible to use the simple line layout path.
</ins><span class="cx"> 
</span><del>-    2014-03-08  Oliver Hunt  &lt;oliver@apple.com&gt;
</del><ins>+        (WebCore::RenderBlockFlow::invalidateLineLayoutPath):
+        
+            Drop the simple line layout on path invalidation if it exists. It may not be valid anymore.
+            Also invalidate the layout if this happens so we'll reconstruct the lines later.
</ins><span class="cx"> 
</span><del>-            SerializedScriptValue may move Identifiers between worlds
-            https://bugs.webkit.org/show_bug.cgi?id=129979
</del><ins>+        (WebCore::RenderBlockFlow::simpleLineLayout): Deleted.
+        (WebCore::RenderBlockFlow::ensureLineBoxes):
+        (WebCore::RenderBlockFlow::createLineBoxes): Deleted.
+                
+            Revert some of the changes made it r167870.
</ins><span class="cx"> 
</span><del>-            Reviewed by Andreas Kling.
</del><ins>+        * rendering/RenderBlockFlow.h:
+        (WebCore::RenderBlockFlow::simpleLineLayout):
+        
+            Add strong validity assert.
</ins><span class="cx"> 
</span><del>-            Test: fast/workers/worker-copy-shared-blob-url.html
</del><ins>+2014-05-21  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Don't use Strings to store blob URLs as String's may be Identifiers
-            and they can only exist in one world/thread at a time.
</del><ins>+        [iOS] two media control button strings are not localized
+        https://bugs.webkit.org/show_bug.cgi?id=133160
</ins><span class="cx"> 
</span><del>-            * Modules/indexeddb/IDBObjectStore.cpp:
-            (WebCore::IDBObjectStore::put):
-            * bindings/js/SerializedScriptValue.cpp:
-            (WebCore::CloneDeserializer::deserializeString):
-            (WebCore::SerializedScriptValue::addBlobURL):
-            (WebCore::SerializedScriptValue::SerializedScriptValue):
-            * bindings/js/SerializedScriptValue.h:
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-2014-03-07  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * English.lproj/mediaControlsLocalizedStrings.js:
</ins><span class="cx"> 
</span><del>-        Merge r165138.
</del><ins>+2014-05-21  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2014-03-05  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        [iOS] Update some of the media controls buttons to be bigger
+        https://bugs.webkit.org/show_bug.cgi?id=133158
+        &lt;rdar://problem/16475828&gt;
</ins><span class="cx"> 
</span><del>-            Fix crash in CompositeEditCommand::cloneParagraphUnderNewElement()
-            &lt;http://webkit.org/b/129751&gt;
-            &lt;rdar://problem/16237965&gt;
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-            Reviewed by Jon Honeycutt.
</del><ins>+        The buttons in the media controls on iOS are too small
+        to be comfortably pressed. Make them the size of the controls
+        panel and the expected iOS button size (44x44px).
</ins><span class="cx"> 
</span><del>-            Merged from Blink (patch by Yuta Kitamura):
-            https://src.chromium.org/viewvc/blink?revision=168160&amp;view=revision
-            http://crbug.com/345005
</del><ins>+        The artwork for the buttons now includes the padding. I've
+        added a file from which you can edit the artwork, then
+        copy it into the CSS (because editing directly in CSS is
+        a huge pain).
</ins><span class="cx"> 
</span><del>-                The root cause is CompositeEditCommand::moveParagraphWithClones() passing
-                two positions |start| and |end| which do not follow the document order,
-                i.e. in some situations |start| is located after |end| because of
-                the difference in affinity.
</del><ins>+        So far just the play/pause and fullscreen button have been
+        updated. There will be a follow-up patch to fix the remaining
+        buttons and the scrubber.
</ins><span class="cx"> 
</span><del>-                This patch fixes this crash by normalizing |end| to |start| in such situations.
-                It also adds an ASSERT that checks the relationship between |start| and |end|.
</del><ins>+        * Modules/mediacontrols/assets-apple-iOS.svg: Added.
+        * Modules/mediacontrols/mediaControlsiOS.css:
+        (audio::-webkit-media-controls-panel):
+        (audio::-webkit-media-controls-fullscreen-button):
+        (audio::-webkit-media-controls-play-button):
+        (audio::-webkit-media-controls-play-button:active):
+        (audio::-webkit-media-controls-play-button.paused):
+        (audio::-webkit-media-controls-fullscreen-button:active):
+        (@media only screen and (-webkit-min-device-pixel-ratio: 2)): Deleted.
</ins><span class="cx"> 
</span><del>-            Test: editing/execCommand/format-block-crash.html
</del><ins>+2014-05-21  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * editing/CompositeEditCommand.cpp:
-            (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
-            (WebCore::CompositeEditCommand::moveParagraphWithClones):
-            * editing/CompositeEditCommand.h:
</del><ins>+        Garbage when rubber-banding at the right edge of a page zoomed to non-integral scale.
+        https://bugs.webkit.org/show_bug.cgi?id=133139
+        &lt;rdar://problem/16503353&gt;
</ins><span class="cx"> 
</span><del>-2014-03-07  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Merge r164876.
</del><ins>+        Do not pixel align the root content layer. The alignment code expands the graphics's layer size
+        which makes the right and bottom tiles bigger than the content.
+        Painting the body's background color produces pixel cracks, because the content can not
+        fill the expanded tiles completely.
</ins><span class="cx"> 
</span><del>-    2014-02-28  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</del><ins>+        Not testable.
</ins><span class="cx"> 
</span><del>-            Properly clear m_logicallyLastRun to remove use-after-free possibility
-            https://bugs.webkit.org/show_bug.cgi?id=129489
</del><ins>+        * platform/graphics/GraphicsLayerClient.h:
+        (WebCore::GraphicsLayerClient::needsPixelAligment):
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::updateGeometry):
+        (WebCore::GraphicsLayerCA::computePixelAlignment):
+        * platform/graphics/ca/mac/TileGrid.mm:
+        (WebCore::TileGrid::rectForTileIndex):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::needsPixelAligment):
+        * rendering/RenderLayerBacking.h:
</ins><span class="cx"> 
</span><del>-            Reviewed by David Hyatt.
</del><ins>+2014-05-21  Radu Stavila  &lt;stavila@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-            A use-after-free issue was caught in Blink because m_logicallyLastRun
-            is not cleared when the item it points to is deleted. Clearing it
-            turns the use-after-free into a segfault, and prevents any future
-            use-after-frees from happening.
</del><ins>+        REGRESSION (r168046): Invalid layout in WebCore::RenderBox::containingBlockLogicalWidthForPositioned
+        https://bugs.webkit.org/show_bug.cgi?id=132933
</ins><span class="cx"> 
</span><del>-            * platform/text/BidiRunList.h:
-            (WebCore::BidiRunList&lt;Run&gt;::deleteRuns):
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2014-03-07  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Invalid layout is performed when calling containingBlockLogicalWidthForPositioned for a RenderTableSection object.
</ins><span class="cx"> 
</span><del>-        Merge r165206.
</del><ins>+        Test: fast/multicol/newmulticol/table-section-crash.html
</ins><span class="cx"> 
</span><del>-    2014-03-05  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::containingBlockLogicalWidthForPositioned):
</ins><span class="cx"> 
</span><del>-            Invalid cast in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients()
</del><ins>+2014-05-21  Simon Pena  &lt;simon.pena@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-            &lt;https://bugs.webkit.org/show_bug.cgi?id=121887&gt;
-            &lt;rdar://problem/15073043&gt;
</del><ins>+        [EFL] Ensure EGLOffScreenContext::initialize calls platformMakeCurrent on the surface
+        https://bugs.webkit.org/show_bug.cgi?id=124832
</ins><span class="cx"> 
</span><del>-            Clang appears to be optimizing out a branch in RenderObject::node()
-            when compiling RenderLayer::FilterInfo::updateReferenceFilterClients().
-            We'll work around this by factoring out the code in question into a
-            separate member function marked NEVER_INLINE.
</del><ins>+        Reviewed by Antonio Gomes.
</ins><span class="cx"> 
</span><del>-            No test possible due to &lt;https://bugs.webkit.org/show_bug.cgi?id=129757&gt;.
</del><ins>+        The original code was only calling platformMakeCurrent when the
+        GL_EXT_robustness extension is supported: the alternate code path
+        would only create a context, but it wouldn't make that context
+        current. This patch ensures platformMakeCurrent is also called for
+        the alternate code path, and, if it fails to make the context
+        current, will destroy the context. Effectively, this makes both
+        code paths behave in the same way.
</ins><span class="cx"> 
</span><del>-            Reviewed by David Kilzer.
</del><ins>+        * platform/graphics/surfaces/egl/EGLContext.cpp:
+        (WebCore::EGLOffScreenContext::initialize):
</ins><span class="cx"> 
</span><del>-            * rendering/RenderLayerFilterInfo.cpp:
-            (WebCore::RenderLayer::FilterInfo::layerElement):
-            Code moved from updateReferenceFilterClients(). Returns the Element*
-            for m_layer.
-            (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
-            Use layerElement().
</del><ins>+2014-05-20  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * rendering/RenderLayerFilterInfo.h:
-            Declared layerElement().
</del><ins>+        [Mac] DataCues do not work properly when rewinding video
+        https://bugs.webkit.org/show_bug.cgi?id=133138
+        &lt;rdar://problem/16979086&gt;
</ins><span class="cx"> 
</span><del>-2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Merge r164249.
</del><ins>+        Make the TrackPrivateBase responsible for knowing if a type of track needs a non-zero
+        startTimeVariance value.
</ins><span class="cx"> 
</span><del>-    2014-02-17  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        Also, correct a bug in the equality test for DataCue objects.
</ins><span class="cx"> 
</span><del>-            AX: Invalid cast in WebCore::AccessibilityTable::isDataTable (CRBug 280352)
-            &lt;https://webkit.org/b/128925&gt;
-            &lt;rdar://problem/16087351&gt;
</del><ins>+        * html/track/DataCue.cpp:
+        (WebCore::DataCue::isEqual): Handle the JSValue data types consistently, so that we don't attempt
+        to compare a JSNull against a default JSValue object.
+        * html/track/InbandTextTrack.cpp:
+        (WebCore::InbandTextTrack::startTimeVariance): Added.
+        * html/track/InbandTextTrack.h:
+        * html/track/TextTrack.cpp:
+        (WebCore::TextTrack::hasCue): Use new startTimeVariance method location.
+        * html/track/TextTrack.h:
+        (WebCore::TextTrack::startTimeVariance): Added.
+        * html/track/TextTrackCue.cpp:
+        (WebCore::TextTrackCue::hasEquivalentStartTime): Use new startTimeVariance location.
+        * html/track/TextTrackCue.h:
+        (WebCore::TextTrackCue::startTimeVariance): Deleted.
+        * html/track/TextTrackCueGeneric.h:
+        * platform/graphics/TrackPrivateBase.h:
+        (WebCore::TrackPrivateBase::startTimeVariance): Added.
+        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.h:
</ins><span class="cx"> 
</span><del>-            Merged from Blink (patch by Dominic Mazzoni):
-            https://src.chromium.org/viewvc/blink?revision=159711&amp;view=revision
</del><ins>+2014-05-20  Mark Hahnenberg  &lt;mhahnenberg@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Oliver Hunt.
</del><ins>+        Watchdog timer should be lazily allocated
+        https://bugs.webkit.org/show_bug.cgi?id=133135
</ins><span class="cx"> 
</span><del>-            Don't cast to a table cell element unless we are sure it is one.
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-            Test: accessibility/display-table-cell-causes-crash.html
</del><ins>+        No new tests.
</ins><span class="cx"> 
</span><del>-            * accessibility/AccessibilityTable.cpp:
-            (WebCore::AccessibilityTable::isDataTable):
</del><ins>+        We incur a noticeable amount of overhead on some benchmarks due to checking if the Watchdog ever fired. 
+        There is no reason to do this checking if we never activated the Watchdog, which can only be done through 
+        JSContextGroupSetExecutionTimeLimit or JSContextGroupClearExecutionTimeLimit. 
</ins><span class="cx"> 
</span><del>-2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        By allocating the Watchdog lazily on the VM we can avoid all of the associated overhead when we don't use 
+        these two API functions (which is true of most clients).
</ins><span class="cx"> 
</span><del>-        Merge r159489.
</del><ins>+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::scheduleExecutionTermination):
+        (WebCore::WorkerScriptController::isExecutionTerminating):
</ins><span class="cx"> 
</span><del>-    2013-11-19  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+2014-05-20  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Add more assertions with security implications in DocumentOrderedMap
-            https://bugs.webkit.org/show_bug.cgi?id=124559
</del><ins>+        [Mac] Allow popup menus to override default appearance
+        https://bugs.webkit.org/show_bug.cgi?id=133129
</ins><span class="cx"> 
</span><del>-            Reviewed by Antti Koivisto.
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-            Assert that newly added elements and existing elements in the document ordered map are in the same tree scope
-            as the document ordered map. Also exit early if we're about to add an element in a wrong document to the map.
-            We don't exit early in get() because the damage has already been done at that point (the element may have been
-            deleted already).
</del><ins>+        WebKitSystemInterface's WKPopupMenu has a flag to hide
+        the arrows at the end of a popup-menu (e.g. &lt;select&gt;).
+        Expose that via adding a hasDefaultAppearance flag to
+        PopupMenuStyle, which then passes it on to WKSI.
</ins><span class="cx"> 
</span><del>-            * dom/Document.cpp:
-            (WebCore::Document::addImageElementByLowercasedUsemap):
-            * dom/DocumentOrderedMap.cpp:
-            (WebCore::DocumentOrderedMap::add): Assert that the newly added element is in the current tree scope.
-            Also exit early if either the element is not in the tree scope or not in the right document.
-            While this doesn't make the function completely fault safe, it'll catch when we try to add a detached node.
-            (WebCore::DocumentOrderedMap::remove): Convert existing assertions to ones with security implication.
-            (WebCore::DocumentOrderedMap::get): Assert with security implication that the element we're about to return
-            is in the current tree scope. The element may have already been deleted if we ever hit these assertions.
-            (WebCore::DocumentOrderedMap::getAllElementsById):  Convert an existing assertion to an assertion with security
-            implication.
-            * dom/DocumentOrderedMap.h:
-            * dom/TreeScope.cpp:
-            (WebCore::TreeScope::addElementById):
-            (WebCore::TreeScope::addElementByName):
-            (WebCore::TreeScope::addImageMap):
-            (WebCore::TreeScope::addLabel):
-            * html/HTMLDocument.cpp:
-            (WebCore::HTMLDocument::addDocumentNamedItem):
-            (WebCore::HTMLDocument::addWindowNamedItem):
-            * html/HTMLImageElement.cpp:
-            (WebCore::HTMLImageElement::insertedInto): Set InTreeScope flag before calling addImageElementByLowercasedUsemap.
-            * html/HTMLMapElement.cpp:
-            (WebCore::HTMLMapElement::insertedInto): Ditto for addImageMap.
</del><ins>+        * platform/PopupMenuStyle.h:
+        (WebCore::PopupMenuStyle::PopupMenuStyle): New flag in constructor.
+        (WebCore::PopupMenuStyle::hasDefaultAppearance): New flag.
+        * platform/mac/WebCoreSystemInterface.h: wkPopupMenu signature has changed to accept
+        the new flag.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+        * rendering/RenderMenuList.cpp:
+        (RenderMenuList::itemStyle): Pass in true as default appearance when creating
+        the PopupMenuStyle. We don't need it.
+        (RenderMenuList::menuStyle): In this case we pass in the negated value of
+        style().hasAppearance(), which indicates if we are overriding the built-in drawing.
+        * rendering/RenderSearchField.cpp:
+        (WebCore::RenderSearchField::menuStyle): Use true as the default value.
</ins><span class="cx"> 
</span><del>-2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+2014-05-20  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r165145.
</del><ins>+        [Mac] do not deactivate an audio session that has running I/O
+        https://bugs.webkit.org/show_bug.cgi?id=133127
</ins><span class="cx"> 
</span><del>-    2014-03-05  Daniel Bates  &lt;dabates@apple.com&gt;
-                And Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Reviewed by Jer Noble.
</ins><span class="cx"> 
</span><del>-            ASSERT(newestManifest) fails in WebCore::ApplicationCacheGroup::didFinishLoadingManifest()
-            https://bugs.webkit.org/show_bug.cgi?id=129753
-            &lt;rdar://problem/12069835&gt;
</del><ins>+        * page/Settings.h:
+        (WebCore::Settings::setShouldManageAudioSessionCategory): Renamed from setShouldManageAudioSession.
+        (WebCore::Settings::shouldManageAudioSessionCategory): Renamed from shouldManageAudioSession.
+        (WebCore::Settings::setShouldManageAudioSession): Deleted.
+        (WebCore::Settings::shouldManageAudioSession): Deleted.
</ins><span class="cx"> 
</span><del>-            Reviewed by Alexey Proskuryakov.
</del><ins>+        * platform/audio/mac/MediaSessionManagerMac.cpp:
+        (MediaSessionManager::updateSessionState): Don't deactivate the session if there are any
+            Video or Audio sessions.
</ins><span class="cx"> 
</span><del>-            Fixes an issue where an assertion failure would occur when visiting a web site whose on-disk
-            app cache doesn't contain a manifest resource.
</del><ins>+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::assetStatus): Drive-by change to log errors 
+            returned by -statusOfValueForKey:error: in debug builds.
</ins><span class="cx"> 
</span><del>-            For some reason an app cache for a web site may be partially written to disk. In particular, the
-            app cache may only contain a CacheGroups entry. That is, the manifest resource and origin records
-            may not be persisted to disk. From looking over the code, we're unclear how such a situation can occur
-            and hence have been unable to create such an app cache. We were able to reproduce this issue using
-            an app cache database file that was provided by a person that was affected by this issue.
</del><ins>+2014-05-20  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            No test included because it's not straightforward to write a test for this change.
</del><ins>+        REGRESSION: All non-mainframe scrollbars don't paint after r169065
+        https://bugs.webkit.org/show_bug.cgi?id=133132
+        -and corresponding-
+        &lt;rdar://problem/16968850&gt;
</ins><span class="cx"> 
</span><del>-            * loader/appcache/ApplicationCacheGroup.cpp:
-            (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete): Assert that m_cacheBeingUpdated-&gt;manifestResource()
-            is non-null. Currently we only document this assumption in a code comment. Also separated a single assertion
-            expression into two assertion expressions to make it straightforward to identify the failing sub-expression
-            on failure.
-            * loader/appcache/ApplicationCacheStorage.cpp:
-            (WebCore::ApplicationCacheStorage::store): Modified to call ApplicationCacheStorage::deleteCacheGroupRecord()
-            to remove a cache group and associated cache records (if applicable) before inserting a cache group entry.
-            This replacement approach will ultimately repair incomplete app cache data for people affected by this bug.
-            (WebCore::ApplicationCacheStorage::loadCache): Log an error and return nullptr if the cache we loaded doesn't
-            have a manifest resource.
-            (WebCore::ApplicationCacheStorage::deleteCacheGroupRecord): Added.
-            (WebCore::ApplicationCacheStorage::deleteCacheGroup): Extracted deletion logic for cache group record into
-            ApplicationCacheStorage::deleteCacheGroupRecord().
-            * loader/appcache/ApplicationCacheStorage.h:
</del><ins>+        Reviewed by Geoff Garen.
</ins><span class="cx"> 
</span><del>-2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        We should not universally return true here. This feature will only work for 
+        scrollbars with layers.
+        * platform/ScrollableArea.h:
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::supportsUpdateOnSecondaryThread):
</ins><span class="cx"> 
</span><del>-        Merge r156716.
</del><ins>+2014-05-20  Daniel Bates  &lt;dabates@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-10-01  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        Element within flattened frame may update its scroll state during the layout phase of the wrong RenderView
+        https://bugs.webkit.org/show_bug.cgi?id=133013
+        &lt;rdar://problem/16760154&gt;
</ins><span class="cx"> 
</span><del>-            Center misspelling dots across width of word
-            https://bugs.webkit.org/show_bug.cgi?id=122046
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-            Reviewed by Darin Adler.
</del><ins>+        Fixes an issue where the scroll state of an element may be updated during the layout of the wrong
+        RenderView. In particular, the scroll state of an element inside a CSS flex box in a flattened
+        frame f is updated during the layout of the RenderView associated with the parent frame of f instead
+        of during the layout of the RenderView associated with f.
</ins><span class="cx"> 
</span><del>-            Test: editing/spelling/spelling.html
</del><ins>+        The layout machinery assumes that the scroll state of each scrollable element is updated before the
+        completion of layout for its associated RenderView. Currently we have logic to defer updating the scroll
+        state of a scrollable element until completion of recursive layout. For a page with a flattened frame, we
+        defer such updates until completion of layout for all RenderViews along the ancestor frame hierarchy of
+        each flattened frame regardless of the RenderView associated with the element that originated the
+        deferred scroll state request. Instead, only the RenderView associated with the element that deferred its
+        scroll state update should dispatch the scroll state update.
</ins><span class="cx"> 
</span><del>-            * platform/graphics/GraphicsContext.h:
-            * platform/graphics/mac/GraphicsContextMac.mm:
-            (WebCore::GraphicsContext::drawLineForDocumentMarker):
</del><ins>+        Tests: fast/frames/flattening/scrollable-flexbox-inside-iframe-with-zero-height-and-needs-full-repaint-crash.html
+               fast/frames/flattening/scrollable-flexbox-inside-iframe-with-zero-height-assertion-failure.html
</ins><span class="cx"> 
</span><del>-2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * rendering/RenderBlock.cpp: Removed WTF::-prefix in typedef definition for ContinuationOutlineTableMap.
+        (WebCore::UpdateScrollInfoAfterLayoutTransaction::UpdateScrollInfoAfterLayoutTransaction): Added; a struct
+        that represents a RenderView v, nested transaction count, and a list of RenderBlocks in v that will need
+        to have their scroll state updated.
+        (WebCore::updateScrollInfoAfterLayoutTransactionStack): Added; returns the global stack of transactions.
+        (WebCore::RenderBlock::willBeDestroyed): Call removeFromUpdateScrollInfoAfterLayoutTransaction(), which
+        was formerly named as removeFromDelayedUpdateScrollInfoSet.
+        (WebCore::currentUpdateScrollInfoAfterLayoutTransaction): Added; returns the top-most transaction in the
+        global stack.
+        (WebCore::RenderBlock::beginUpdateScrollInfoAfterLayoutTransaction): Modified as appropriate to make use
+        of the global stack of transactions; formerly named startDelayUpdateScrollInfo.
+        (WebCore::RenderBlock::endAndCommitUpdateScrollInfoAfterLayoutTransaction): Modified as appropriate to
+        make use of the global stack of transactions; formerly named finishDelayUpdateScrollInfo.
+        (WebCore::RenderBlock::removeFromUpdateScrollInfoAfterLayoutTransaction): Modified as appropriate to make
+        use of the global stack of transactions; formerly named removeFromDelayedUpdateScrollInfoSet.
+        (WebCore::RenderBlock::updateScrollInfoAfterLayout): Modified as appropriate to make use of the global
+        stack of transactions.
+        (WebCore::RenderBlock::layout): Ditto.
+        (WebCore::RenderBlock::startDelayUpdateScrollInfo): Deleted.
+        (WebCore::RenderBlock::finishDelayUpdateScrollInfo): Deleted.
+        (WebCore::RenderBlock::removeFromDelayedUpdateScrollInfoSet): Deleted.
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockFlow.cpp:
+        (WebCore::RenderBlockFlow::willBeDestroyed): Call removeFromUpdateScrollInfoAfterLayoutTransaction(), which
+        was formerly named removeFromDelayedUpdateScrollInfoSet.
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox): Call {begin, end}UpdateScrollInfoAfterLayoutTransaction(),
+        which was formerly named {start, end}DelayUpdateScrollInfo.
+        (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox): Ditto.
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock): Ditto.
</ins><span class="cx"> 
</span><del>-        Merge r153788.
</del><ins>+2014-05-20  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-08-07  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        REGRESSION (r169065): Mountain Lion run-api-tests failures: ASSERTION FAILED: 
+        Uncaught exception - -[NSRegularLegacyScrollerImp setPresentationValue:]: 
+        unrecognized selector sent to instance 0x7ff51aa38000
+        https://bugs.webkit.org/show_bug.cgi?id=133121
</ins><span class="cx"> 
</span><del>-            2.5% regression on page cycler moz
-            https://bugs.webkit.org/show_bug.cgi?id=102822
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-            Reviewed by Andreas Kling.
</del><ins>+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::setPaintCharacteristicsForScrollbar):
</ins><span class="cx"> 
</span><del>-            DocumentStyleSheetCollection::invalidateInjectedStyleSheetCache() triggers a style recalc for quirks mode
-            documents in the beginning of document parsing via Document::setCompatibilityMode. This often coalesces 
-            with style recalc triggered by stylesheet loading. However on very simple documents it can generate genuinely
-            unnecessary work.
</del><ins>+2014-05-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * dom/DocumentStyleSheetCollection.cpp:
-            (WebCore::DocumentStyleSheetCollection::invalidateInjectedStyleSheetCache):
-            
-                Check that we actually have cached injected stylesheets before triggering style recalc.
-                
-            * page/PageGroup.cpp:
-            (WebCore::PageGroup::addUserStyleSheetToWorld):
-            (WebCore::PageGroup::removeUserStyleSheetFromWorld):
-            (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
-            (WebCore::PageGroup::removeAllUserContent):
-            
-                Fix a misspelling.
</del><ins>+        REGRESSION (r169063) Fixed and sticky nodes misplaced on scrolling sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=133106
+        &lt;rdar://problem/16967648&gt;
</ins><span class="cx"> 
</span><del>-            (WebCore::PageGroup::invalidateInjectedStyleSheetCacheInAllFrames):
-            
-                Always invalidate style when user sheets change since we don't do that in
-                DocumentStyleSheetCollection::invalidateInjectedStyleSheetCache anymore.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-            * page/PageGroup.h:
</del><ins>+        Fix regression from r169063. That commit removed scrolledContentsLayers from 
+        frame scrolling nodes, but they do actually use them.
+        
+        So put them back; not in the base class, because they have a somewhat different
+        meaning for overflow scrolling and frame scrolling.
</ins><span class="cx"> 
</span><del>-2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * WebCore.exp.in:
+        * page/scrolling/AsyncScrollingCoordinator.cpp:
+        (WebCore::AsyncScrollingCoordinator::frameViewRootLayerDidChange):
+        (WebCore::AsyncScrollingCoordinator::updateFrameScrollingNode):
+        * page/scrolling/AsyncScrollingCoordinator.h:
+        * page/scrolling/ScrollingCoordinator.h:
+        (WebCore::ScrollingCoordinator::updateFrameScrollingNode):
+        * page/scrolling/ScrollingStateFrameScrollingNode.cpp:
+        (WebCore::ScrollingStateFrameScrollingNode::ScrollingStateFrameScrollingNode):
+        (WebCore::ScrollingStateFrameScrollingNode::setScrolledContentsLayer):
+        * page/scrolling/ScrollingStateFrameScrollingNode.h:
+        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateScrollCoordinatedLayer):
</ins><span class="cx"> 
</span><del>-        Merge r155071.
</del><ins>+2014-05-20  Radu Stavila  &lt;stavila@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-09-04  Pratik Solanki  &lt;psolanki@apple.com&gt;
</del><ins>+        REGRESSION: [CSS Regions] Content flowed directly into the flow thread that ends up in the second region is not properly repainted
+        https://bugs.webkit.org/show_bug.cgi?id=133111
</ins><span class="cx"> 
</span><del>-            Document::updateHoverActiveState() should allow for deferred style recalcs
-            https://bugs.webkit.org/show_bug.cgi?id=120700
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-            Reviewed by Simon Fraser.
</del><ins>+        When computing the repaint rect of an element flowed into a flow thread, if the element is flowed directly into
+        the flow thread (meaning its containing block is the flow thread itself), the region's position within the flow
+        must no longer be taken into consideration, because its already included in the element's |topLeft|.
</ins><span class="cx"> 
</span><del>-            Add an extra argument to Document::updateHoverActiveState() to specify if a style recalc
-            should be done. The default value keeps the current behavior of doing a style recalc. iOS
-            touch handling code will pass in DeferRecalcStyleIfNeeded to avoid the work.
</del><ins>+        Test: fast/regions/hover-element-flowed-second-region.html
</ins><span class="cx"> 
</span><del>-            No new tests because no functional changes.
</del><ins>+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeRectForRepaint):
</ins><span class="cx"> 
</span><del>-            * dom/Document.cpp:
-            (WebCore::Document::updateHoverActiveState):
-            * dom/Document.h:
</del><ins>+2014-05-20  Alex Christensen  &lt;achristensen@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Fix web timing assertion failure.
+        https://bugs.webkit.org/show_bug.cgi?id=133094
+        &lt;rdar://problem/16966032&gt;
</ins><span class="cx"> 
</span><del>-        Merge r158802.
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-    2013-11-06  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::getConnectionTimingData):
+        Set requestStart and responseStart to 0 instead of -1 to match the 
+        ResourceLoadTiming constructor and prevent the assertion failure in
+        PerformanceTiming::responseStart.
</ins><span class="cx"> 
</span><del>-            Crash in SliderThumbElement::dragFrom
-            https://bugs.webkit.org/show_bug.cgi?id=123873
</del><ins>+2014-05-20  Prashant Hiremath  &lt;hiremathprashants@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Sam Weinig.
</del><ins>+        Only set title on SVG documents
+        https://bugs.webkit.org/show_bug.cgi?id=133068
</ins><span class="cx"> 
</span><del>-            Moved Ref.
</del><ins>+        Reviewed by Dirk Schulze.
</ins><span class="cx"> 
</span><del>-            * html/RangeInputType.cpp:
-            (WebCore::RangeInputType::handleMouseDownEvent):
-            * html/shadow/SliderThumbElement.cpp:
-            (WebCore::SliderThumbElement::dragFrom):
</del><ins>+        Test: svg/custom/html_document_set_title.html
</ins><span class="cx"> 
</span><del>-2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * svg/SVGTitleElement.cpp:
+        (WebCore::SVGTitleElement::insertedInto):
+        (WebCore::SVGTitleElement::removedFrom):
+        (WebCore::SVGTitleElement::childrenChanged):
</ins><span class="cx"> 
</span><del>-        Merge r158724.
</del><ins>+2014-05-20  peavo@outlook.com  &lt;peavo@outlook.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-11-05  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        [Curl] Invalid content in cache file, causes broken rendering.
+        https://bugs.webkit.org/show_bug.cgi?id=133069
</ins><span class="cx"> 
</span><del>-            Use-after-free in SliderThumbElement::dragFrom
-            https://bugs.webkit.org/show_bug.cgi?id=123873
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-            Reviewed by Andreas Kling.
</del><ins>+        When data for a url is received as multiple parts, the cache file for the url is truncated when opened for writing,
+        and will only contain the last part of data received.
+        This is fixed by only opening the file once, and close it after all data has been received.
</ins><span class="cx"> 
</span><del>-            Ref the SliderThumbElement since it could go away inside dragFrom.
</del><ins>+        * platform/network/curl/CurlCacheEntry.cpp:
+        (WebCore::CurlCacheEntry::CurlCacheEntry): Initialize cache file handle member.
+        (WebCore::CurlCacheEntry::~CurlCacheEntry): Close cache file.
+        (WebCore::CurlCacheEntry::saveCachedData): Only open cache file once to avoid truncating.
+        (WebCore::CurlCacheEntry::didFail): Close cache file.
+        (WebCore::CurlCacheEntry::didFinishLoading): Ditto.
+        (WebCore::CurlCacheEntry::openContentFile): Added method to open cache file.
+        (WebCore::CurlCacheEntry::closeContentFile): Added method to close cache file.
+        * platform/network/curl/CurlCacheEntry.h: Added file handle member, and methods to open and close cache file.
</ins><span class="cx"> 
</span><del>-            Test: fast/forms/range/range-type-change-onchange-2.html
</del><ins>+2014-05-20  Radu Stavila  &lt;stavila@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-            * html/RangeInputType.cpp:
-            (WebCore::RangeInputType::handleMouseDownEvent):
</del><ins>+        [CSS Regions] Block incorrectly sized when containing an unsplittable box
+        https://bugs.webkit.org/show_bug.cgi?id=132601
</ins><span class="cx"> 
</span><del>-2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Merge r163599.
</del><ins>+        When laying out elements in a region, when an inline element is encountered
+        the size of its parent must not be increased beyond the bottom of the current region,
+        unless if its the last region. This will ensure that the next sibling of the
+        inline element is correctly laid out at the top of the next region, instead
+        of leaving an empty space equal to the height of the overflow, as it did until now.
</ins><span class="cx"> 
</span><del>-    2014-02-06  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</del><ins>+        Tests: fast/regions/inline-block-inside-anonymous-overflow.html
+               fast/regions/inline-block-overflow.html
</ins><span class="cx"> 
</span><del>-            loadSubframe can return null in SubframeLoader::loadOrRedirectSubframe
-            https://bugs.webkit.org/show_bug.cgi?id=128344
</del><ins>+        * rendering/RenderBlockFlow.cpp:
+        (WebCore::RenderBlockFlow::adjustLinePositionForPagination):
+        (WebCore::RenderBlockFlow::hasNextPage):
+        * rendering/RenderBlockFlow.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange):
+        (WebCore::RenderBlockFlow::linkToEndLineIfNeeded):
+        (WebCore::RenderBlockFlow::determineStartPosition):
+        (WebCore::RenderBlockFlow::checkPaginationAndFloatsAtEndLine):
</ins><span class="cx"> 
</span><del>-            Reviewed by Ryosuke Niwa.
</del><ins>+2014-05-20  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-            * loader/SubframeLoader.cpp:
-            (WebCore::SubframeLoader::loadOrRedirectSubframe):
</del><ins>+        [CSS Regions] Crash while painting block selection gaps in regions
+        https://bugs.webkit.org/show_bug.cgi?id=132720
</ins><span class="cx"> 
</span><del>-2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        Merge r164170.
</del><ins>+        The fix for WebKit bug https://bugs.webkit.org/show_bug.cgi?id=131511
+        allowed selection highlight to match the DOM selection when the start
+        and end point of the selection were in different flow threads. In order
+        to enable that, the selection was performed separately on view and
+        render flow threads, considered selection subtrees.
</ins><span class="cx"> 
</span><del>-    2014-02-15  Renata Hodovan  &lt;rhodovan.u-szeged@partner.samsung.com&gt;
</del><ins>+        However, the start and end points for each selection subtree were computed
+        by means of Range class but it is not always possible to construct a valid
+        Range from two pairs of RenderObjects and offsets.
</ins><span class="cx"> 
</span><del>-            ASSERT_WITH_SECURITY_IMPLICATION in WebCore::toElement
-            https://bugs.webkit.org/show_bug.cgi?id=128810
</del><ins>+        This patch keeps the substrees approach but instead of storing the endpoints
+        for each subtree in a Range and continuously extending the Range, it stores them
+        using the already available SelectionSubtreeRoot class. After the end points are
+        computed for each subtree and before processing the subtree selection, the end points
+        are adjusted in a similar fashion as the one used in FrameSelection::updateAppearance(),
+        to make sure we are passing the same expected information to the method implementing
+        the visible selection processing.
</ins><span class="cx"> 
</span><del>-            Reviewed by Ryosuke Niwa.
</del><ins>+        Test: fast/regions/selection-gaps-paint-crash.html
</ins><span class="cx"> 
</span><del>-            Make CompositeEditCommand::cloneParagraphUnderNewElement() to work when |outerNode|
-            doesn't contain |start|.
</del><ins>+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::splitSelectionBetweenSubtrees):
+        * rendering/SelectionSubtreeRoot.cpp:
+        (WebCore::SelectionSubtreeRoot::adjustForVisibleSelection):
+        * rendering/SelectionSubtreeRoot.h:
+        (WebCore::SelectionSubtreeRoot::selectionClear):
</ins><span class="cx"> 
</span><del>-            Before this patch, CompositeEditCommand::cloneParagraphUnderNewElement() tried to copy
-            ancestry nodes from |start| to Document node when |start| position isn't in |outerNode|. This
-            patch changes CompositeEditCommand::cloneParagraphUnderNewElement() to copy |start| to
-            |outerNode| only if |outerNode| contains |start| position.
</del><ins>+2014-05-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Merged from Blink https://src.chromium.org/viewvc/blink?revision=161762&amp;view=revision by yosin@chromium.org.
</del><ins>+        Scrolling pages with large TiledBacking content layers creates way too many tiles
+        https://bugs.webkit.org/show_bug.cgi?id=133101
</ins><span class="cx"> 
</span><del>-            Test: editing/execCommand/indent-with-uneditable-crash.html
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-            * editing/CompositeEditCommand.cpp:
-            (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
</del><ins>+        Fix the GraphicsLayerCA::adjustTiledLayerVisibleRect() logic to avoid making giant rects if the old
+        and new visible rects don't overlap.
</ins><span class="cx"> 
</span><del>-2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * platform/graphics/TiledBacking.h:
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::adjustTiledLayerVisibleRect):
+        * platform/graphics/ca/mac/TileController.h:
</ins><span class="cx"> 
</span><del>-        Merge r160065.
</del><ins>+2014-05-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-12-03  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        Correctly maintain the &quot;isInWindow&quot; state for all TiledBackings
+        https://bugs.webkit.org/show_bug.cgi?id=133095
</ins><span class="cx"> 
</span><del>-            Potential crash in RenderView::selectionBounds and RenderView::repaintSelection
-            https://bugs.webkit.org/show_bug.cgi?id=125207
</del><ins>+        Reviewed by Tim Horton.
+        
+        We never updated the &quot;isInWindow&quot; state for TiledBacking that wasn't the RenderView's
+        backing. Fix it by having RenderLayerCompositor::setIsInWindow() recurse through all
+        layers (if necessary), updating their state. Also set the state on newly created
+        TiledBackings.
</ins><span class="cx"> 
</span><del>-            Reviewed by Simon Fraser.
-            
-            Merge https://chromium.googlesource.com/chromium/blink/+/f9e6e288a5aa959f05c374806121aaf0fc52d440
</del><ins>+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::layerTiledBackingUsageChanged):
+        (WebCore::RenderLayerCompositor::setIsInWindowForLayerIncludingDescendants):
+        (WebCore::RenderLayerCompositor::setIsInWindow):
+        (WebCore::RenderLayerCompositor::pageTiledBacking): Deleted.
+        * rendering/RenderLayerCompositor.h:
</ins><span class="cx"> 
</span><del>-            Update style in FrameSelection instead of RenderView's member functions. These are the last two
-            member functions of RenderView that updates the style.
</del><ins>+2014-05-19  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * editing/FrameSelection.cpp:
-            (WebCore::FrameSelection::focusedOrActiveStateChanged):
-            (WebCore::FrameSelection::bounds):
-            * rendering/RenderView.cpp:
-            (WebCore::RenderView::selectionBounds):
-            (WebCore::RenderView::repaintSelection):
</del><ins>+        [iOS] Use status display for live streams
+        https://bugs.webkit.org/show_bug.cgi?id=133097
</ins><span class="cx"> 
</span><del>-2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Merge r164367.
</del><ins>+        Follow-on from https://bugs.webkit.org/show_bug.cgi?id=131390
+        Allow the iOS controls to use the status display field.
</ins><span class="cx"> 
</span><del>-    2014-02-19  Daniel Bates  &lt;dabates@apple.com&gt;
</del><ins>+        * Modules/mediacontrols/mediaControlsiOS.js:
+        (ControllerIOS.prototype.configureInlineControls): Live streams should
+        not have a timeline or rewind button.
</ins><span class="cx"> 
</span><del>-            Do not dispatch change event twice in single step action
-            https://bugs.webkit.org/show_bug.cgi?id=116936
-            &lt;rdar://problem/16086828&gt;
</del><ins>+2014-05-19  Myles C. Maxfield  &lt;litherum@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Ryosuke Niwa.
</del><ins>+        Text decorations do not contribute to visual overflow
+        https://bugs.webkit.org/show_bug.cgi?id=132773
</ins><span class="cx"> 
</span><del>-            Merged from Blink (patch by Kent Tamura):
-            https://src.chromium.org/viewvc/blink?view=rev&amp;revision=151175
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-            Test: fast/forms/number/number-type-update-by-change-event.html
</del><ins>+        This patch creates a function, visualOverflowForDecorations, which computes
+        how much visual overflow to add around a text box due to text decorations. Most of the time,
+        text decorations are fully contained within the text box, so the result is usually 0.
</ins><span class="cx"> 
</span><del>-            * html/InputType.cpp:
-            (WebCore::InputType::stepUpFromRenderer):
</del><ins>+        This function exists within style/InlineTextBoxStyle.cpp, which is an added file. This is
+        so that it can be called from setLogicalWidthForTextRun() inside RenderBlockLineLayout.cpp
+        and from RenderStyle::changeAffectsVisualOverflow(). The former case passes in the full
+        InlineTextBox and the latter case just passes in a RenderStyle (because the InlineTextBox
+        is unavailable.)
</ins><span class="cx"> 
</span><del>-2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        This patch also modifies RenderTableSection::spannedColumns() to fix an off-by-one error
+        that was causing table borders to not be drawn when they existed right on the edge of
+        a repaint rect.
</ins><span class="cx"> 
</span><del>-        Merge r164204.
</del><ins>+        Tests: fast/css3-text/css3-text-decoration/repaint/underline-outside-of-layout-rect.html
+        Tests: fast/repaint/border-collapse-table-off-by-one-expected.html
</ins><span class="cx"> 
</span><del>-    2014-02-16  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        * WebCore.vcxproj/WebCore.vcxproj: Adding reference to new InlineTextBoxStyle.cpp file
+        * WebCore.vcxproj/WebCore.vcxproj.filters: Adding reference to new InlineTextBoxStyle files
+        * WebCore.xcodeproj/project.pbxproj: Adding reference to new InlineTextBoxStyle files
+        * rendering/InlineTextBox.cpp:
+        (WebCore::computeUnderlineOffset): Moved to InlineTextBox.cpp
+        (WebCore::getWavyStrokeParameters): Moved to InlineTextBox.cpp
+        (WebCore::InlineTextBox::paintDecoration): Update to use newly refactored functions
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::setLogicalWidthForTextRun): Call visualOverflowForDecorations()
+        * rendering/RenderTableSection.cpp:
+        * rendering/RenderTableSelection.cpp: Fix off-by-one error when the boundary of a repaint
+        rect lies exactly on top of a table column position
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::changeAffectsVisualOverflow): Inspects shadows and text decorations
+        (WebCore::RenderStyle::changeRequiresLayout): Calls changeAffectsVisualOverflow()
+        (WebCore::RenderStyle::changeRequiresRepaintIfTextOrBorderOrOutline): Moved code from here
+        to changeAffectsVisualOverflow().
+        * rendering/style/RenderStyle.h: Function signature
+        * style/InlineTextBoxStyle.cpp: Added.
+        (WebCore::computeUnderlineOffset): Moved from InlineTextBox.cpp
+        (WebCore::getWavyStrokeParameters): Moved from InlineTextBox.cpp
+        (WebCore::extendIntToFloat): Convenience function for dealing with the fact that
+        underline bounding boxes use floats and GlyphOverflow uses ints
+        (WebCore::visualOverflowForDecorations): Given
+        vertical overflow bounds, possibly extend those to include location of
+        decorations.
+        * style/InlineTextBoxStyle.h: Added. Function signatures.
+        (WebCore::textDecorationStrokeThickness): Refactored from InlineTextBox.cpp
+        (WebCore::wavyOffsetFromDecoration): Refactored from InlineTextBox.cpp
+        * platform/graphics/Font.h:
+        (WebCore::GlyphOverflow::isEmpty): Convenience function
+        (WebCore::GlyphOverflow::extendTo): Convenience function
</ins><span class="cx"> 
</span><del>-            Ensure that removing an iframe from the DOM tree disconnects its Frame.
-            &lt;https://webkit.org/b/128889&gt;
-            &lt;rdar://problem/15671221&gt;
</del><ins>+2014-05-19  Alex Christensen  &lt;achristensen@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-            Merged from Blink (patch by Adam Klein):
-            https://src.chromium.org/viewvc/blink?revision=156174&amp;view=revision
</del><ins>+        Unreviewed build fix after r169082
</ins><span class="cx"> 
</span><del>-            SubframeLoadingDisabler wasn't catching the case when an &lt;iframe&gt; was,
-            in its unload handler, removed and re-added to the same parent.
-            Fix this by using a count of SubframeLoadingDisablers that are on the
-            stack for a given root, rather than a simple boolean.
</del><ins>+        * platform/network/ResourceHandle.h:
+        Added NSDictionary declaration.
</ins><span class="cx"> 
</span><del>-            Test: fast/frames/reattach-in-unload.html
</del><ins>+2014-05-19  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * html/HTMLFrameOwnerElement.h:
-            (WebCore::SubframeLoadingDisabler::disabledSubtreeRoots):
</del><ins>+        REGRESSION: Standalone images need to take topContentInset into account
+        https://bugs.webkit.org/show_bug.cgi?id=133092
+        -and corresponding-
+        &lt;rdar://problem/16945791&gt;
</ins><span class="cx"> 
</span><del>-2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Merge r157957.
</del><ins>+        The FrameView’s size is accurate in terms of the NSWindow size, but that is not 
+        really what the ImageDocument code is looking for here. The ImageDocument wants to 
+        know the size of the unobscured viewport area. We should use visibleSize() for 
+        that.
+        * html/ImageDocument.cpp:
+        (WebCore::ImageDocument::scale):
+        (WebCore::ImageDocument::imageFitsInWindow):
+        (WebCore::ImageDocument::imageClicked):
</ins><span class="cx"> 
</span><del>-    2013-10-24  Daniel Bates  &lt;dabates@apple.com&gt;
</del><ins>+2014-05-19  Alex Christensen  &lt;achristensen@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-            Crash in WebCore::NavigationScheduler::startTimer()
-            https://bugs.webkit.org/show_bug.cgi?id=123288
-            &lt;rdar://problem/14055644&gt;
</del><ins>+        Collect web timing data on iOS.
+        https://bugs.webkit.org/show_bug.cgi?id=133075
</ins><span class="cx"> 
</span><del>-            Reviewed by Alexey Proskuryakov.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-            Currently NavigationScheduler::startTimer() synchronously notifies the client
-            before the Web Inspector of a scheduled redirect. If a client cancels this
-            redirect then NavigationScheduler::m_redirect will become null and we'll
-            subsequently crash when informing the Web Inspector of this formerly scheduled
-            redirect. Instead, NavigationScheduler::startTimer() should notify the Web
-            Inspector before it notifies the client of a scheduled redirect.
</del><ins>+        * platform/network/ResourceHandle.h:
+        Added setCollectsTimingData wrapper and getConnectionTimingData declarations.
+        getConnectionTimingData with a dictionary parameter is a private helper function.
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        Call setCollectsTimingData wrapper when creating a connection to ensure that timing data is collected.
+        * platform/network/cf/ResourceHandleCFURLConnectionDelegate.cpp:
+        (WebCore::ResourceHandleCFURLConnectionDelegate::didReceiveResponseCallback):
+        * platform/network/cf/ResourceHandleCFURLConnectionDelegate.h:
+        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:
+        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveResponse):
+        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.h:
+        * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.cpp:
+        (WebCore::SynchronousResourceHandleCFURLConnectionDelegate::didReceiveResponse):
+        * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.h:
+        Pass the CFURLConnectionRef to didReceiveResponse to get timing data from.
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::getConnectionTimingData):
+        Moved from getTimingData to compile regardless of using CFNetwork and added wrapper with CFDictionaryRef.
+        (WebCore::ResourceHandle::setCollectsTimingData):
+        Added wrapper to call objc function from c++.
+        (WebCore::ResourceHandle::getTimingData):
+        Renamed to getConnectionTimingData.
+        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
+        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveResponse:]):
+        Updated function name from getTimingData to getConnectionTimingData.
</ins><span class="cx"> 
</span><del>-            As a side benefit of this change, the Web Inspector is notified of a scheduled
-            redirect before being notified of it being canceled when a client chooses to cancel
-            a scheduled redirect.
</del><ins>+2014-05-19  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * loader/NavigationScheduler.cpp:
-            (WebCore::NavigationScheduler::startTimer):
</del><ins>+        AX: VoiceOver sees the WebArea out of order when topContentInset is used
+        https://bugs.webkit.org/show_bug.cgi?id=133091
</ins><span class="cx"> 
</span><del>-2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Merge r153829
</del><ins>+        Modify the scroll view's frame so that it recognizes the content inset.
+        This is needed so that when VoiceOver sorts elements to create an ordering,
+        the web area is not ordered at the top of the screen.
</ins><span class="cx"> 
</span><del>-    2013-08-08  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        Test: platform/mac-wk2/accessibility/content-inset-scrollview-frame.html
</ins><span class="cx"> 
</span><del>-            Inserting multiple rules into an empty style sheet should avoid style recalc if possible.
-            &lt;http://webkit.org/b/119568&gt;
</del><ins>+        * accessibility/AccessibilityScrollView.cpp:
+        (WebCore::AccessibilityScrollView::elementRect):
</ins><span class="cx"> 
</span><del>-            Reviewed by Antti Koivisto.
</del><ins>+2014-05-19  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            As a follow-up to &lt;http://webkit.org/b/119475&gt;, where I added a hack for inserting
-            a single rule into an empty style sheet, this broadens the optimization to support
-            any number of rules.
</del><ins>+        Scrollbars display incorrectly after switching between fast and slow scrolling 
+        mode, affects Find and real sites
+        https://bugs.webkit.org/show_bug.cgi?id=133077
+        -and corresponding-
+        &lt;rdar://problem/16888608&gt;
</ins><span class="cx"> 
</span><del>-            This optimizes the scenario where a style sheet is added to the DOM and then populated
-            rule-by-rule via CSSOM insertRule()/addRule() calls. Previously we'd do a full style
-            recalc for this case, but now we'll treat it the same as a full sheet added at once.
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-            * css/CSSStyleSheet.h:
-            * css/CSSStyleSheet.cpp:
-            (WebCore::CSSStyleSheet::willMutateRules):
</del><ins>+        We should always return true here when updating on the secondary thread is 
+        supported. It does not need to be gated on whether we are actively taking 
+        advantage of that support at this moment.
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::supportsUpdateOnSecondaryThread):
</ins><span class="cx"> 
</span><del>-                Made willMutateRules() return whether the style sheet contents were cloned by the
-                copy-on-write mechanism.
</del><ins>+        Always update the presentationValue whenever we update the doubleValue just to 
+        keep them in sync.
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::setPaintCharacteristicsForScrollbar):
</ins><span class="cx"> 
</span><del>-            * dom/Document.h:
-            (WebCore::CSSStyleSheet::didMutateRules):
-            (WebCore::CSSStyleSheet::insertRule):
</del><ins>+2014-05-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-                Replaced the InsertionIntoEmptySheet mutation type by a general RuleInsertion.
-                The mutation callback checks if we're inserting into a rule that's not (yet) part
-                of the document's active sheet set. In that case, we defer doing the style sheet
-                until all the insertions are done (or something forces us to style+layout.)
</del><ins>+        Split scrolling tree ScrollingNodes into FrameScrollingNodes and OverflowScrollingNodes
+        https://bugs.webkit.org/show_bug.cgi?id=133022
</ins><span class="cx"> 
</span><del>-                Note that this optimization only happens if the style sheet had a single client.
-                Shared style sheets that just got cloned before mutation may have pointers into
-                them from the Document's StyleResolver, so we're forced to do an immediate sheet
-                update in that case.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-            (WebCore::CSSStyleSheet::RuleMutationScope::RuleMutationScope):
-            (WebCore::CSSStyleSheet::RuleMutationScope::~RuleMutationScope):
</del><ins>+        In both the scrolling state tree and the scrolling tree, split the &quot;scrolling nodes&quot;
+        into FrameScrolling and OverflowScrolling nodes.
+        
+        Move what was the &quot;viewportSize&quot; property onto the base class for the scrolling
+        nodes, calling it &quot;scrollableAreaSize&quot;.
+        
+        Make minimum/maximumScrollPosition() virtual so we can share more code (and there
+        is more code sharing to be done in future).
</ins><span class="cx"> 
</span><del>-                Moved these out-of-line.
</del><ins>+        * Configurations/WebCore.xcconfig: Remove ScrollingStateScrollingNodeMac.mm and ScrollingTreeScrollingNodeMac.mm
+        from the list, using #ifdefs in the file instead.
+        * WebCore.exp.in: Lots of exports.
+        * WebCore.xcodeproj/project.pbxproj: New files.
+        * page/scrolling/AsyncScrollingCoordinator.cpp:
+        (WebCore::AsyncScrollingCoordinator::frameViewLayoutUpdated):
+        (WebCore::AsyncScrollingCoordinator::frameViewRootLayerDidChange):
+        (WebCore::AsyncScrollingCoordinator::updateFrameScrollingNode):
+        (WebCore::AsyncScrollingCoordinator::updateOverflowScrollingNode):
+        (WebCore::AsyncScrollingCoordinator::recomputeWheelEventHandlerCountForFrameView):
+        (WebCore::AsyncScrollingCoordinator::updateScrollingNode): Deleted.
+        (WebCore::AsyncScrollingCoordinator::setScrollbarPaintersFromScrollbarsForNode): Deleted.
+        This tiny function didn't need to exist.
+        * page/scrolling/AsyncScrollingCoordinator.h:
+        * page/scrolling/ScrollingCoordinator.h:
+        (WebCore::ScrollingCoordinator::updateFrameScrollingNode):
+        (WebCore::ScrollingCoordinator::updateOverflowScrollingNode):
+        (WebCore::ScrollingCoordinator::updateScrollingNode): Deleted.
+        * page/scrolling/ScrollingStateFrameScrollingNode.cpp: Copied from Source/WebCore/page/scrolling/ScrollingStateScrollingNode.cpp.
+        (WebCore::ScrollingStateFrameScrollingNode::create):
+        (WebCore::ScrollingStateFrameScrollingNode::ScrollingStateFrameScrollingNode):
+        (WebCore::ScrollingStateFrameScrollingNode::~ScrollingStateFrameScrollingNode):
+        (WebCore::ScrollingStateFrameScrollingNode::clone):
+        (WebCore::ScrollingStateFrameScrollingNode::setFrameScaleFactor):
+        (WebCore::ScrollingStateFrameScrollingNode::setNonFastScrollableRegion):
+        (WebCore::ScrollingStateFrameScrollingNode::setWheelEventHandlerCount):
+        (WebCore::ScrollingStateFrameScrollingNode::setSynchronousScrollingReasons):
+        (WebCore::ScrollingStateFrameScrollingNode::setScrollBehaviorForFixedElements):
+        (WebCore::ScrollingStateFrameScrollingNode::setHeaderHeight):
+        (WebCore::ScrollingStateFrameScrollingNode::setFooterHeight):
+        (WebCore::ScrollingStateFrameScrollingNode::setTopContentInset):
+        (WebCore::ScrollingStateFrameScrollingNode::setCounterScrollingLayer):
+        (WebCore::ScrollingStateFrameScrollingNode::setInsetClipLayer):
+        (WebCore::ScrollingStateFrameScrollingNode::setContentShadowLayer):
+        (WebCore::ScrollingStateFrameScrollingNode::setHeaderLayer):
+        (WebCore::ScrollingStateFrameScrollingNode::setFooterLayer):
+        (WebCore::ScrollingStateFrameScrollingNode::setScrollbarPaintersFromScrollbars):
+        (WebCore::ScrollingStateFrameScrollingNode::dumpProperties):
+        * page/scrolling/ScrollingStateFrameScrollingNode.h: Copied from Source/WebCore/page/scrolling/ScrollingStateScrollingNode.h.
+        * page/scrolling/ScrollingStateNode.h:
+        (WebCore::LayerRepresentation::layerID):
+        (WebCore::ScrollingStateNode::isFrameScrollingNode):
+        (WebCore::ScrollingStateNode::isOverflowScrollingNode):
+        * page/scrolling/ScrollingStateOverflowScrollingNode.cpp: Added.
+        (WebCore::ScrollingStateOverflowScrollingNode::create):
+        (WebCore::ScrollingStateOverflowScrollingNode::ScrollingStateOverflowScrollingNode):
+        (WebCore::ScrollingStateOverflowScrollingNode::~ScrollingStateOverflowScrollingNode):
+        (WebCore::ScrollingStateOverflowScrollingNode::clone):
+        (WebCore::ScrollingStateOverflowScrollingNode::setScrolledContentsLayer):
+        (WebCore::ScrollingStateOverflowScrollingNode::dumpProperties):
+        * page/scrolling/ScrollingStateOverflowScrollingNode.h: Copied from Source/WebCore/page/scrolling/mac/ScrollingStateScrollingNodeMac.mm.
+        (WebCore::ScrollingStateOverflowScrollingNode::scrolledContentsLayer):
+        * page/scrolling/ScrollingStateScrollingNode.cpp:
+        (WebCore::ScrollingStateScrollingNode::ScrollingStateScrollingNode):
+        (WebCore::ScrollingStateScrollingNode::setScrollableAreaSize):
+        (WebCore::ScrollingStateScrollingNode::setTotalContentsSize):
+        (WebCore::ScrollingStateScrollingNode::dumpProperties):
+        (WebCore::ScrollingStateScrollingNode::create): Deleted.
+        (WebCore::ScrollingStateScrollingNode::clone): Deleted.
+        (WebCore::ScrollingStateScrollingNode::setViewportSize): Deleted.
+        (WebCore::ScrollingStateScrollingNode::setFrameScaleFactor): Deleted.
+        (WebCore::ScrollingStateScrollingNode::setNonFastScrollableRegion): Deleted.
+        (WebCore::ScrollingStateScrollingNode::setWheelEventHandlerCount): Deleted.
+        (WebCore::ScrollingStateScrollingNode::setSynchronousScrollingReasons): Deleted.
+        (WebCore::ScrollingStateScrollingNode::setScrollBehaviorForFixedElements): Deleted.
+        (WebCore::ScrollingStateScrollingNode::setHeaderHeight): Deleted.
+        (WebCore::ScrollingStateScrollingNode::setFooterHeight): Deleted.
+        (WebCore::ScrollingStateScrollingNode::setTopContentInset): Deleted.
+        (WebCore::ScrollingStateScrollingNode::setScrolledContentsLayer): Deleted.
+        (WebCore::ScrollingStateScrollingNode::setCounterScrollingLayer): Deleted.
+        (WebCore::ScrollingStateScrollingNode::setInsetClipLayer): Deleted.
+        (WebCore::ScrollingStateScrollingNode::setContentShadowLayer): Deleted.
+        (WebCore::ScrollingStateScrollingNode::setHeaderLayer): Deleted.
+        (WebCore::ScrollingStateScrollingNode::setFooterLayer): Deleted.
+        (WebCore::ScrollingStateScrollingNode::setScrollbarPaintersFromScrollbars): Deleted.
+        * page/scrolling/ScrollingStateScrollingNode.h:
+        (WebCore::ScrollingStateScrollingNode::scrollableAreaSize):
+        (WebCore::ScrollingStateScrollingNode::totalContentsSize):
+        * page/scrolling/ScrollingStateTree.cpp:
+        (WebCore::ScrollingStateTree::attachNode):
+        (WebCore::ScrollingStateTree::commit):
+        * page/scrolling/ScrollingStateTree.h:
+        (WebCore::ScrollingStateTree::rootStateNode):
+        (WebCore::ScrollingStateTree::setRootStateNode):
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::commitNewTreeState):
+        * page/scrolling/ScrollingTreeFrameScrollingNode.cpp: Added.
+        (WebCore::ScrollingTreeFrameScrollingNode::ScrollingTreeFrameScrollingNode):
+        (WebCore::ScrollingTreeFrameScrollingNode::~ScrollingTreeFrameScrollingNode):
+        (WebCore::ScrollingTreeFrameScrollingNode::updateBeforeChildren):
+        * page/scrolling/ScrollingTreeFrameScrollingNode.h: Copied from Source/WebCore/page/scrolling/ScrollingTreeScrollingNode.h.
+        (WebCore::ScrollingTreeFrameScrollingNode::updateLayersAfterDelegatedScroll):
+        (WebCore::ScrollingTreeFrameScrollingNode::synchronousScrollingReasons):
+        (WebCore::ScrollingTreeFrameScrollingNode::shouldUpdateScrollLayerPositionSynchronously):
+        (WebCore::ScrollingTreeFrameScrollingNode::frameScaleFactor):
+        (WebCore::ScrollingTreeFrameScrollingNode::headerHeight):
+        (WebCore::ScrollingTreeFrameScrollingNode::footerHeight):
+        (WebCore::ScrollingTreeFrameScrollingNode::topContentInset):
+        (WebCore::ScrollingTreeFrameScrollingNode::scrollBehaviorForFixedElements):
+        * page/scrolling/ScrollingTreeNode.h:
+        (WebCore::ScrollingTreeNode::isFrameScrollingNode):
+        (WebCore::ScrollingTreeNode::isOverflowScrollingNode):
+        * page/scrolling/ScrollingTreeOverflowScrollingNode.cpp: Copied from Source/WebKit2/UIProcess/Scrolling/ios/ScrollingTreeOverflowScrollingNodeIOS.h.
+        (WebCore::ScrollingTreeOverflowScrollingNode::ScrollingTreeOverflowScrollingNode):
+        (WebCore::ScrollingTreeOverflowScrollingNode::~ScrollingTreeOverflowScrollingNode):
+        * page/scrolling/ScrollingTreeOverflowScrollingNode.h: Copied from Source/WebKit2/UIProcess/Scrolling/ios/ScrollingTreeOverflowScrollingNodeIOS.h.
+        * page/scrolling/ScrollingTreeScrollingNode.cpp:
+        (WebCore::ScrollingTreeScrollingNode::ScrollingTreeScrollingNode):
+        (WebCore::ScrollingTreeScrollingNode::updateBeforeChildren):
+        (WebCore::ScrollingTreeScrollingNode::updateAfterChildren):
+        (WebCore::ScrollingTreeScrollingNode::setScrollPosition):
+        (WebCore::ScrollingTreeScrollingNode::setScrollPositionWithoutContentEdgeConstraints):
+        (WebCore::ScrollingTreeScrollingNode::minimumScrollPosition):
+        (WebCore::ScrollingTreeScrollingNode::maximumScrollPosition):
+        * page/scrolling/ScrollingTreeScrollingNode.h:
+        (WebCore::ScrollingTreeScrollingNode::scrollableAreaSize):
+        (WebCore::ScrollingTreeScrollingNode::totalContentsSize):
+        (WebCore::ScrollingTreeScrollingNode::totalContentsSizeForRubberBand):
+        (WebCore::ScrollingTreeScrollingNode::setTotalContentsSizeForRubberBand):
+        (WebCore::ScrollingTreeScrollingNode::synchronousScrollingReasons): Deleted.
+        (WebCore::ScrollingTreeScrollingNode::shouldUpdateScrollLayerPositionSynchronously): Deleted.
+        (WebCore::ScrollingTreeScrollingNode::viewportSize): Deleted.
+        (WebCore::ScrollingTreeScrollingNode::frameScaleFactor): Deleted.
+        (WebCore::ScrollingTreeScrollingNode::headerHeight): Deleted.
+        (WebCore::ScrollingTreeScrollingNode::footerHeight): Deleted.
+        (WebCore::ScrollingTreeScrollingNode::scrollBehaviorForFixedElements): Deleted.
+        (WebCore::ScrollingTreeScrollingNode::topContentInset): Deleted.
+        * page/scrolling/ios/ScrollingCoordinatorIOS.mm:
+        (WebCore::ScrollingCoordinatorIOS::createScrollingTreeNode):
+        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.h: Renamed from Source/WebCore/page/scrolling/ios/ScrollingTreeScrollingNodeIOS.h.
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollLayer):
+        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.mm: Renamed from Source/WebCore/page/scrolling/ios/ScrollingTreeScrollingNodeIOS.mm.
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::create):
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::ScrollingTreeFrameScrollingNodeIOS):
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::~ScrollingTreeFrameScrollingNodeIOS):
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateBeforeChildren):
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateAfterChildren):
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollPosition):
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::setScrollPosition):
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::setScrollPositionWithoutContentEdgeConstraints):
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::setScrollLayerPosition):
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateLayersAfterViewportChange):
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateLayersAfterDelegatedScroll):
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateChildNodesAfterScroll):
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::minimumScrollPosition):
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::maximumScrollPosition):
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollBy):
+        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollByWithoutContentEdgeConstraints):
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+        (WebCore::ScrollingCoordinatorMac::createScrollingTreeNode):
+        * page/scrolling/mac/ScrollingStateFrameScrollingNodeMac.mm: Renamed from Source/WebCore/page/scrolling/mac/ScrollingStateScrollingNodeMac.mm.
+        (WebCore::ScrollingStateFrameScrollingNode::setScrollbarPaintersFromScrollbars):
+        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.h: Renamed from Source/WebCore/page/scrolling/mac/ScrollingTreeScrollingNodeMac.h.
+        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm: Renamed from Source/WebCore/page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm.
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::create):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::ScrollingTreeFrameScrollingNodeMac):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::~ScrollingTreeFrameScrollingNodeMac):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateAfterChildren):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::handleWheelEvent):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::allowsHorizontalStretching):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::allowsVerticalStretching):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::stretchAmount):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::pinnedInDirection):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::canScrollHorizontally):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::canScrollVertically):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::shouldRubberBandInDirection):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::absoluteScrollPosition):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::immediateScrollBy):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::immediateScrollByWithoutContentEdgeConstraints):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::startSnapRubberbandTimer):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::stopSnapRubberbandTimer):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::adjustScrollPositionToBoundsIfNecessary):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollPosition):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollPosition):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollPositionWithoutContentEdgeConstraints):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollLayerPosition):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateLayersAfterViewportChange):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::minimumScrollPosition):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::maximumScrollPosition):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollBy):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollByWithoutContentEdgeConstraints):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateMainFramePinState):
+        (WebCore::ScrollingTreeFrameScrollingNodeMac::logExposedUnfilledArea):
+        (WebCore::logThreadedScrollingMode):
+        (WebCore::logWheelEventHandlerCountChanged):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateScrollCoordinatedLayer):
</ins><span class="cx"> 
</span><del>-            (WebCore::CSSStyleSheet::didMutateRuleFromCSSStyleDeclaration):
-            * css/PropertySetCSSStyleDeclaration.cpp:
-            (WebCore::StyleRuleCSSStyleDeclaration::didMutate):
</del><ins>+2014-05-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-                Made a separate mutation callback for CSSStyleDeclaration since its needs are
-                so simple compared to the mutation callback from CSSStyleSheet. Seems better
-                than adding yet another mode to the enum.
</del><ins>+        Images missing sometimes with composited clipping layers
+        https://bugs.webkit.org/show_bug.cgi?id=133065
+        &lt;rdar://problem/15224559&gt;
</ins><span class="cx"> 
</span><del>-            * dom/Document.cpp:
-            (WebCore::Document::Document):
-            (WebCore::Document::recalcStyle):
-            (WebCore::Document::styleResolverChanged):
-            (WebCore::Document::optimizedStyleSheetUpdateTimerFired):
-            (WebCore::Document::scheduleOptimizedStyleSheetUpdate):
</del><ins>+        Reviewed by Beth Dakin.
+        
+        When support for solid colors on layers was added, a layer was considered a candidate
+        for the solid color optimization without regard to whether it had descendent layers
+        with &quot;paintsIntoCompositedAncestor&quot; requirements.
+        
+        Fix hasVisibleNonCompositingDescendantLayers(), renaming it to isPaintDestinationForDescendentLayers()
+        and having it take into account whether descendent layers need to paint into an
+        ancestor.
+        
+        Also, this test has to happen after those descendent layers have had their
+        compositing state updated, so move the isSimpleContainerCompositingLayer() to
+        a new updateAfterDescendents() function which is called from the various
+        places we do compositing-udpate-tree-walks.
</ins><span class="cx"> 
</span><del>-                Added mechanism to defer doing a RecalcStyleIfNeeded.
</del><ins>+        Test: compositing/backing/solid-color-with-paints-into-ancestor.html
</ins><span class="cx"> 
</span><del>-            (WebCore::Document::updateStyleIfNeeded):
</del><ins>+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGeometry):
+        (WebCore::RenderLayerBacking::updateAfterDescendents):
+        (WebCore::RenderLayerBacking::paintsChildren):
+        (WebCore::compositedWithOwnBackingStore):
+        (WebCore::descendentLayerPaintsIntoAncestor):
+        (WebCore::RenderLayerBacking::isPaintDestinationForDescendentLayers):
+        (WebCore::hasVisibleNonCompositingDescendant): Deleted.
+        (WebCore::RenderLayerBacking::hasVisibleNonCompositingDescendantLayers): Deleted.
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::updateLayerTreeGeometry):
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry):
</ins><span class="cx"> 
</span><del>-                Synchronize the optimized style sheet update if there's one scheduled.
-                This ensures that stuff like layout-dependent property access won't operate
-                on stale style.
</del><ins>+2014-05-19  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * dom/DocumentStyleSheetCollection.h:
-            (WebCore::DocumentStyleSheetCollection::pendingUpdateType):
-            (WebCore::DocumentStyleSheetCollection::setPendingUpdateType):
-            (WebCore::DocumentStyleSheetCollection::flushPendingUpdates):
-            * dom/DocumentStyleSheetCollection.cpp:
-            (WebCore::DocumentStyleSheetCollection::DocumentStyleSheetCollection):
-            (WebCore::DocumentStyleSheetCollection::updateActiveStyleSheets):
</del><ins>+        REGRESSION (r133351, sub-pixel layout): Right-to-left block with text-overflow: ellipsis truncates prematurely (breaks facebook.com Hebrew UI)
+        https://bugs.webkit.org/show_bug.cgi?id=112227
</ins><span class="cx"> 
</span><del>-                Have DSSC track the kind of style sheet update it needs to do (instead of just
-                a boolean &quot;needs update.&quot;) This is used by Document::recalcStyle() to make sure
-                the right kind of update happens if there's one scheduled.
</del><ins>+        Reviewed by Maciej Stachowiak.
</ins><span class="cx"> 
</span><del>-            (WebCore::DocumentStyleSheetCollection::activeStyleSheetsContains):
</del><ins>+        This patch removes unnecessary integral snapping of inlines at layout time.
</ins><span class="cx"> 
</span><del>-                Added helper to check if a CSSStyleSheet is part of the active set.
</del><ins>+        The general rule of thumb of using round/floor/ceil at layout time is to not use them.

+        When some computed values (x, y, width, height) get snapped during layout, while others don't,
+        intersecting/measuring mismatches could occur and they could end up producing visual artifacts such as truncations.
+        This patch also enables iframe content to be positioned on odd device pixel positions on retina displays.
+        
+        Tests: fast/frames/hidpi-position-iframe-on-device-pixel.html
+               fast/inline/hidpi-rtl-text-does-not-fit-line-and-gets-cut-off.html
</ins><span class="cx"> 
</span><del>-2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::pixelSnappedLogicalLeftOffsetForLine): Deleted.
+        (WebCore::RenderBlock::pixelSnappedLogicalRightOffsetForLine): Deleted.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::updateLogicalInlinePositions):
+        (WebCore::RenderBlockFlow::deleteEllipsisLineBoxes):
+        (WebCore::RenderBlockFlow::checkLinesForTextOverflow):
</ins><span class="cx"> 
</span><del>-        Merge r159970.
</del><ins>+2014-05-18  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-12-02  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+        AX: iOS: using AXAttributeCacheEnabler is too slow for every accessibilityElementAtIndex:
+        https://bugs.webkit.org/show_bug.cgi?id=133043
</ins><span class="cx"> 
</span><del>-            Add more CachedPage null checks
-            https://bugs.webkit.org/show_bug.cgi?id=125106
</del><ins>+        Reviewed by Mario Sanchez Prada.
</ins><span class="cx"> 
</span><del>-            Reviewed by Sam Weinig.
</del><ins>+        iOS Accessibility code tries to improve performance by caching attributes when accessing
+        elements through the platform API. However, those API calls can be used very frequently when 
+        iterating elements. Creating the AXAttributeCacheEnabler object and tearing it down is proving
+        to be the hottest code path in samples for accessibility access.
</ins><span class="cx"> 
</span><del>-            Only some functions in PageCache.cpp null-check the CachedPages in HistoryItems.
</del><ins>+        We need to move the logic for enabling/disabling the attribute cache to a level that can make
+        a more informed decision about when to enable/disable.
</ins><span class="cx"> 
</span><del>-            Every part that manipulates the CachedPage should.
</del><ins>+        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
+        (-[WebAccessibilityObjectWrapper enableAttributeCaching]):
+        (-[WebAccessibilityObjectWrapper disableAttributeCaching]):
+        (-[WebAccessibilityObjectWrapper accessibilityElementCount]):
+        (-[WebAccessibilityObjectWrapper accessibilityElementAtIndex:]):
+        (-[WebAccessibilityObjectWrapper indexOfAccessibilityElement:]):
</ins><span class="cx"> 
</span><del>-            * history/PageCache.cpp:
-            (WebCore::PageCache::markPagesForVistedLinkStyleRecalc):
-            (WebCore::PageCache::markPagesForFullStyleRecalc):
-            (WebCore::PageCache::markPagesForDeviceScaleChanged):
-            (WebCore::PageCache::markPagesForCaptionPreferencesChanged):
</del><ins>+2014-05-18  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Use RenderStyle&amp; in more places in RenderLayerBacking
+        https://bugs.webkit.org/show_bug.cgi?id=133061
</ins><span class="cx"> 
</span><del>-        Merge r159986.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-    2013-12-02  Brady Eidson  &lt;beidson@apple.com&gt; 
</del><ins>+        Convert several member functions to use references to RenderStyle rather
+        than pointers. Move canCreateTiledImage() higher in the file (no code
+        changes). Other minor cleanup.
</ins><span class="cx"> 
</span><del>-            Possible crash in ProgressTracker::progressHeartbeatTimerFired(Timer&lt;ProgressTracker&gt;*) 
-            https://bugs.webkit.org/show_bug.cgi?id=125110 
</del><ins>+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createPrimaryGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateOpacity):
+        (WebCore::RenderLayerBacking::updateTransform):
+        (WebCore::RenderLayerBacking::updateFilters):
+        (WebCore::RenderLayerBacking::updateBlendMode):
+        (WebCore::RenderLayerBacking::updateGeometry):
+        (WebCore::hasBoxDecorations):
+        (WebCore::canCreateTiledImage):
+        (WebCore::hasBoxDecorationsOrBackgroundImage):
+        (WebCore::hasPerspectiveOrPreserves3D):
+        (WebCore::supportsDirectBoxDecorationsComposition):
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
+        (WebCore::RenderLayerBacking::contentChanged):
+        (WebCore::RenderLayerBacking::startTransition):
+        * rendering/RenderLayerBacking.h:
</ins><span class="cx"> 
</span><del>-            Reviewed by Darin Adler. 
</del><ins>+2014-05-17  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            FrameLoader::loadProgressingStatusChanged() might be called while the Frame has a null FrameView. 
</del><ins>+        Rename some RenderLayerBacking member functions
+        https://bugs.webkit.org/show_bug.cgi?id=133030
</ins><span class="cx"> 
</span><del>-            It’s unclear how to reproduce, but there’s no harm in a null check. 
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-            * loader/FrameLoader.cpp: 
-            (WebCore::FrameLoader::loadProgressingStatusChanged): 
</del><ins>+        Remove &quot;GraphicsLayer&quot; from some member function names on RenderLayerBacking.
+        
+        No behavior change.
</ins><span class="cx"> 
</span><del>-2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+        (WebCore::AVFWrapper::createAVCFVideoLayer):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateQTKit::createQTMovieLayer):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateClipRects):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        (WebCore::RenderLayerBacking::updateConfiguration):
+        (WebCore::RenderLayerBacking::updateGeometry):
+        (WebCore::RenderLayerBacking::contentChanged):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): Deleted.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Deleted.
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::updateLayerTreeGeometry):
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry):
+        (WebCore::RenderLayerCompositor::attachRootLayer):
</ins><span class="cx"> 
</span><del>-        Merge r159974.
</del><ins>+2014-05-19  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-12-02  Brady Eidson  &lt;beidson@apple.com&gt; 
</del><ins>+        Fix assertion failure with simple line layout debug borders enabled.
</ins><span class="cx"> 
</span><del>-            Possible crash in ProgressTracker::progressHeartbeatTimerFired(Timer&lt;ProgressTracker&gt;*) 
-            https://bugs.webkit.org/show_bug.cgi?id=125110 
</del><ins>+        Rubber-stamped by Andreas Kling.
</ins><span class="cx"> 
</span><del>-            Reviewed by Darin Adler. 
</del><ins>+        * rendering/SimpleLineLayoutFunctions.cpp:
+        (WebCore::SimpleLineLayout::paintDebugBorders): We shoudn't try to paint empty rects.
</ins><span class="cx"> 
</span><del>-            It’s possible to have a null m_originatingProgressFrame when the heartbeat timer fires. 
</del><ins>+2014-05-18  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            On the surface this seems impossible because the only time m_originatingProgressFrame is cleared 
-            out the heartbeat timer is also stopped. 
</del><ins>+        Reduce constructor copypasta in RenderText and RenderElement.
+        &lt;https://webkit.org/b/133056&gt;
</ins><span class="cx"> 
</span><del>-            But there’s likely still a race condition in multi-threaded environments. 
</del><ins>+        Use delegating constructors to remove duplicated initializer lists
+        from the constructors of RenderText and RenderElement.
</ins><span class="cx"> 
</span><del>-            There’s no harm in null-checking m_originatingProgressFrame before accessing its loader. 
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-            * loader/ProgressTracker.cpp: 
-            (WebCore::ProgressTracker::progressHeartbeatTimerFired): 
</del><ins>+        * rendering/RenderElement.cpp:
+        (WebCore::RenderElement::RenderElement):
+        * rendering/RenderElement.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText):
+        * rendering/RenderText.h:
</ins><span class="cx"> 
</span><del>-2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+2014-05-18  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r162063.
</del><ins>+        Crash during scroll when latched
+        https://bugs.webkit.org/show_bug.cgi?id=133064
</ins><span class="cx"> 
</span><del>-    2014-01-15  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-            Suspend resource requests during computedStyle
-            https://bugs.webkit.org/show_bug.cgi?id=127034
</del><ins>+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::platformPrepareForWheelEvents): Prevent dereference of NULL
+        wheelEventTarget argument.
</ins><span class="cx"> 
</span><del>-            Reviewed by Andreas Kling.
</del><ins>+2014-05-18  Svetlana Redchenko  &lt;redchenko@yandex-team.ru&gt;
</ins><span class="cx"> 
</span><del>-            We have some cases where getting computed style leads to crashes in loadPendingImages. 
-            This is probably caused by load callbacks resulting in re-entering WebKit and killing the StyleResolver.
-            
-            As a speculative fix suspend resource loads (and so callbacks) when getting the computed style.
-            We do similar suspension during style recalc for the same reason.
</del><ins>+        Input ::selection pseudo class does not work leading to hidden selection
+        https://bugs.webkit.org/show_bug.cgi?id=38943
</ins><span class="cx"> 
</span><del>-            * dom/Document.cpp:
-            (WebCore::Document::styleForElementIgnoringPendingStylesheets):
-            * loader/ResourceLoadScheduler.h:
-            (WebCore::ResourceLoadScheduler::Suspender::Suspender):
-            (WebCore::ResourceLoadScheduler::Suspender::~Suspender):
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Test: fast/selectors/input-with-selection-pseudo-element.html
</ins><span class="cx"> 
</span><del>-        Merge r158697.
</del><ins>+        When text is selected inside input element, it should change the
+        color and background color according to the ::selection pseudo element.
</ins><span class="cx"> 
</span><del>-    2013-11-05  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::selectionBackgroundColor):
+        (WebCore::RenderObject::selectionColor):
+        (WebCore::RenderObject::selectionPseudoStyle):
+        * rendering/RenderObject.h:
</ins><span class="cx"> 
</span><del>-            Full width semicolon is wrong in vertical text.
-            https://bugs.webkit.org/show_bug.cgi?id=123814
-            &lt;rdar://problem/15312541&gt;
</del><ins>+2014-05-18  Sam Weinig  &lt;sam@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Benjamin Poulain.
</del><ins>+        [WebKit2] Implement ScriptMessageHandlers
+        https://bugs.webkit.org/show_bug.cgi?id=133053
</ins><span class="cx"> 
</span><del>-            The full width semicolon should always be upright.
-            Adding it to the list of characters that should
-            ignore rotation.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-            * platform/graphics/FontGlyphs.cpp:
-            (WebCore::shouldIgnoreRotation):
</del><ins>+        * DerivedSources.make:
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::finishCreation):
+        * bindings/js/JSUserMessageHandlersNamespaceCustom.cpp: Added.
+        (WebCore::JSUserMessageHandlersNamespace::getOwnPropertySlotDelegate):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::shouldHaveWebKitNamespaceForWorld):
+        (WebCore::DOMWindow::webkitNamespace):
+        * page/DOMWindow.h:
+        * page/UserContentController.cpp:
+        (WebCore::UserContentController::addUserMessageHandlerDescriptor):
+        (WebCore::UserContentController::removeUserMessageHandlerDescriptor):
+        * page/UserContentController.h:
+        (WebCore::UserContentController::userMessageHandlerDescriptors):
+        * page/UserMessageHandler.cpp: Added.
+        (WebCore::UserMessageHandler::UserMessageHandler):
+        (WebCore::UserMessageHandler::~UserMessageHandler):
+        (WebCore::UserMessageHandler::postMessage):
+        (WebCore::UserMessageHandler::name):
+        (WebCore::UserMessageHandler::world):
+        * page/UserMessageHandler.h: Added.
+        (WebCore::UserMessageHandler::create):
+        * page/UserMessageHandler.idl: Added.
+        * page/UserMessageHandlerDescriptor.cpp: Added.
+        (WebCore::UserMessageHandlerDescriptor::UserMessageHandlerDescriptor):
+        (WebCore::UserMessageHandlerDescriptor::~UserMessageHandlerDescriptor):
+        (WebCore::UserMessageHandlerDescriptor::name):
+        (WebCore::UserMessageHandlerDescriptor::world):
+        * page/UserMessageHandlerDescriptor.h: Added.
+        (WebCore::UserMessageHandlerDescriptor::Client::~Client):
+        (WebCore::UserMessageHandlerDescriptor::create):
+        (WebCore::UserMessageHandlerDescriptor::client):
+        * page/UserMessageHandlerDescriptorTypes.h: Added.
+        * page/UserMessageHandlersNamespace.cpp: Added.
+        (WebCore::UserMessageHandlersNamespace::UserMessageHandlersNamespace):
+        (WebCore::UserMessageHandlersNamespace::~UserMessageHandlersNamespace):
+        (WebCore::UserMessageHandlersNamespace::handler):
+        * page/UserMessageHandlersNamespace.h: Added.
+        (WebCore::UserMessageHandlersNamespace::create):
+        * page/UserMessageHandlersNamespace.idl: Added.
+        * page/WebKitNamespace.cpp: Added.
+        (WebCore::WebKitNamespace::WebKitNamespace):
+        (WebCore::WebKitNamespace::~WebKitNamespace):
+        (WebCore::WebKitNamespace::messageHandlers):
+        * page/WebKitNamespace.h: Added.
+        (WebCore::WebKitNamespace::create):
+        * page/WebKitNamespace.idl: Added.
</ins><span class="cx"> 
</span><del>-2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+2014-05-18  Maciej Stachowiak  &lt;mjs@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r163465.
</del><ins>+        REGRESSION (r156546): Default media controls are laid out incorrectly when media element is styled with direction:rtl
+        https://bugs.webkit.org/show_bug.cgi?id=132531
+        &lt;rdar://problem/16806267&gt;
+        
+        Reviewed by Mark Rowe.
</ins><span class="cx"> 
</span><del>-    2014-02-04  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        This was already tested by the media/video-rtl.htm reftest, now unskipped.
</ins><span class="cx"> 
</span><del>-            Move characterAt index checks from InlineIterator to RenderText
-            https://bugs.webkit.org/show_bug.cgi?id=128224
</del><ins>+        * Modules/mediacontrols/mediaControlsApple.css:
+        (audio::-webkit-media-controls-panel): Add missing direction: ltr
</ins><span class="cx"> 
</span><del>-            Reviewed by Simon Fraser.
</del><ins>+2014-05-18  Rik Cabanier  &lt;cabanier@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-            Move characterAt index checks from InlineIterator to RenderText
-            so that all RenderText calls are covered. Few safe instances are
-            now covered with uncheckedCharacterAt.
</del><ins>+        support for navigator.hardwareConcurrency
+        https://bugs.webkit.org/show_bug.cgi?id=132588
</ins><span class="cx"> 
</span><del>-            Merged from Blink:
-            http://src.chromium.org/viewvc/blink?view=revision&amp;revision=150830
</del><ins>+        Reviewed by Filip Pizlo.
</ins><span class="cx"> 
</span><del>-            Test: fast/text/character-at-crash.html
</del><ins>+        Added a new API that returns the number of CPU cores up to 8.
</ins><span class="cx"> 
</span><del>-            * rendering/InlineIterator.h:
-            (WebCore::InlineIterator::characterAt):
-            * rendering/RenderText.cpp:
-            (WebCore::RenderText::computePreferredLogicalWidths):
-            * rendering/RenderText.h:
-            (WebCore::RenderText::operator[]):
-            (WebCore::RenderText::uncheckedCharacterAt):
-            (WebCore::RenderText::characterAt):
</del><ins>+        Test: fast/dom/navigator-hardwareConcurrency.html
</ins><span class="cx"> 
</span><del>-2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * Configurations/FeatureDefines.xcconfig:
+        * page/Navigator.cpp:
+        (WebCore::Navigator::hardwareConcurrency):
+        * page/Navigator.h:
+        * page/Navigator.idl:
</ins><span class="cx"> 
</span><del>-        Merge r164933.
</del><ins>+2014-05-18  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2014-03-01  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        Fix iOS build.
</ins><span class="cx"> 
</span><del>-        Ensure keySplines is valid in SMIL animations
-        &lt;http://webkit.org/b/129547&gt;
-        &lt;rdar://problem/15676128&gt;
</del><ins>+        * WebCore.exp.in:
+        Move UserContentController symbols to the right place.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2014-05-18  Jon Lee  &lt;jonlee@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by Philip Rogers):
-        https://src.chromium.org/viewvc/blink?revision=156452&amp;view=revision
-        http://crbug.com/276111
</del><ins>+        Build fix for r169006.
</ins><span class="cx"> 
</span><del>-            This patch fixes a crash in SMIL animations when keySplines are not
-            specified. The SMIL spec is clear on this:
-            http://www.w3.org/TR/2001/REC-smil-animation-20010904/#AnimFuncCalcMode
-            &quot;If there are any errors in the keyTimes specification (bad values,
-            too many or too few values), the animation will have no effect.&quot;
</del><ins>+        Unreviewed.
</ins><span class="cx"> 
</span><del>-            This patch simply checks that keyTimes is not empty. Previously,
-            splinesCount was set to be m_keySplines.size() + 1 in
-            SVGAnimationElement.cpp; this patch changes splinesCount to be equal
-            to m_keySplines.size() to make the logic easier to follow and to
-            match other checks in SVGAnimationElement::startedActiveInterval.
</del><ins>+        * loader/ResourceLoader.h: Return didCreateQuickLookHandle() to public.
</ins><span class="cx"> 
</span><del>-        Test: svg/animations/animate-keysplines-crash.html
</del><ins>+2014-05-18  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * svg/SVGAnimationElement.cpp:
-        (WebCore::SVGAnimationElement::startedActiveInterval):
</del><ins>+        REGRESSION (r160259): text-combine glyphs are not rendered
+        https://bugs.webkit.org/show_bug.cgi?id=127324
</ins><span class="cx"> 
</span><del>-2014-03-04  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Reviewed by Andreas Kling.
+        
+        The original text gets overwritten by a change that is supposed to affect rendered text only.
+        Fixed by giving the text update functions well-defined purposes.
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after bad merge of r154146.
-        &lt;rdar://problem/16223155&gt;
</del><ins>+        Test: fast/text/text-combine-rendering.html
</ins><span class="cx"> 
</span><del>-        Two files were ommitted from the prior commit.
</del><ins>+        * rendering/RenderCombineText.cpp:
+        (WebCore::RenderCombineText::styleDidChange):
+        (WebCore::RenderCombineText::setRenderedText):
+        (WebCore::RenderCombineText::combineText):
+        (WebCore::RenderCombineText::setTextInternal): Deleted.
+        * rendering/RenderCombineText.h:
+        * rendering/RenderCounter.cpp:
+        (WebCore::RenderCounter::computePreferredLogicalWidths):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setRenderedText):
+        
+            This function now updates the rendered text but does not change the original.
+            Get the original text by calling originalText().
</ins><span class="cx"> 
</span><del>-        * platform/win/WebCoreBundleWin.cpp: Added.
-        (WebCore::createWebKitBundle):
-        (WebCore::webKitBundle):
-        * platform/win/WebCoreBundleWin.h: Added.
</del><ins>+        (WebCore::RenderText::setText):
+        
+            This the only place original text now changes.
</ins><span class="cx"> 
</span><del>-2014-03-03  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        (WebCore::RenderText::setTextInternal): Deleted.
+        
+            Renamed to setRenderedText.
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix.
-        &lt;rdar://problem/16197002&gt;
</del><ins>+        * rendering/RenderText.h:
+        * rendering/svg/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::setRenderedText):
+        (WebCore::RenderSVGInlineText::setTextInternal): Deleted.
+        * rendering/svg/RenderSVGInlineText.h:
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj: Exclude 64-bit assembly code when building
-        32-bit DebugSuffix target.
</del><ins>+2014-05-17  Maciej Stachowiak  &lt;mjs@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-28  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Don't attempt to update id or name for nodes that are already removed
+        https://bugs.webkit.org/show_bug.cgi?id=133041
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix.
-        &lt;rdar://problem/16197002&gt;
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.proj: Remove trailing
-        slash from path names, as this was causing multiple arguments
-        to be concatenated together (the whitespace was getting escaped
-        by the slash.)
</del><ins>+        Tests: fast/dom/remove-element-with-id-that-was-inserted-on-DOMNodeRemoved.html
+               fast/dom/remove-element-with-name-that-was-inserted-on-DOMNodeRemoved.html
</ins><span class="cx"> 
</span><del>-2014-02-25  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        * dom/Element.cpp:
+        (WebCore::Element::removedFrom): Skip updating ids and names for an element not
+        in a treescope, as we already do for elements not in a document.
</ins><span class="cx"> 
</span><del>-        Merge r164660
</del><ins>+2014-05-17  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2014-02-25  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        REGRESSION (NetworkProcess): Trying to use appcache fallback crashes in ApplicationCacheHost::scheduleLoadFallbackResourceFromApplicationCache
+        https://bugs.webkit.org/show_bug.cgi?id=133007
+        &lt;rdar://problem/13702706&gt;
</ins><span class="cx"> 
</span><del>-            [Win] Gracefully recover from missing 'naturalSize' parameter for media
-            https://bugs.webkit.org/show_bug.cgi?id=129278
</del><ins>+        appcache tests often fail on the Mac WebKit2 bot
+        https://bugs.webkit.org/show_bug.cgi?id=82061
</ins><span class="cx"> 
</span><del>-            Reviewed by Eric Carlson.
</del><ins>+        Reviewed by Maciej Stachowiak.
</ins><span class="cx"> 
</span><del>-            * platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h: Add declaration for
-            missing function call.
-            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
-            (WebCore::createMetadataKeyNames):
-            (WebCore::MediaPlayerPrivateAVFoundationCF::assetStatus): Don't treat missing 'naturalSize'
-            as a fatal error.
-            (WebCore::MediaPlayerPrivateAVFoundationCF::tracksChanged): Handle case of asset track
-            not being available yet.
-            (WebCore::MediaPlayerPrivateAVFoundationCF::sizeChanged): If the 'naturalSize' is empty,
-            use the Player Item's 'presentationSize' instead.
-            (WebCore::AVFWrapper::processNotification): Add missing handler for duration changed.
</del><ins>+        Covered by existing tests, which this patch enables.
</ins><span class="cx"> 
</span><del>-2014-02-12  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * WebCore.exp.in: Export ResourceLoader::cancel(const ResourceError&amp;). It used
+        to be virtual, but marking subclasses final has resulted in the compiler calling
+        it directly from WebKitLegacy framework. Seeing that no subclass overrides it,
+        I then made it non-virtual.
+        Also export ApplicationCacheHost functions that are now used from WebKit2.
</ins><span class="cx"> 
</span><del>-        Merge r163579.
</del><ins>+        * loader/ResourceLoader.h: Made the class abstract (as I didn't realize at first
+        that it's always either a SubresourceLoader or a NetscapePlugInStreamLoader).
+        Made ResourceHandleClient functions private, as they should never be called other
+        than via a ResourceHandleClient pointer.
</ins><span class="cx"> 
</span><del>-    2014-02-04  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</del><ins>+        * loader/NetscapePlugInStreamLoader.h:
+        * loader/SubresourceLoader.h:
+        Marked these final.
</ins><span class="cx"> 
</span><del>-            Make adoption agency use the task queue
-            https://bugs.webkit.org/show_bug.cgi?id=109445
</del><ins>+        * loader/ResourceLoader.cpp: (WebCore::ResourceLoader::willSwitchToSubstituteResource):
+        Added a function to be called when switching to a substitute resource. We still
+        need a ResourceLoader at this point, as substitute resource will be delivered through
+        it, but we don't want it to continue its current load.
</ins><span class="cx"> 
</span><del>-            Reviewed by Ryosuke Niwa.
</del><ins>+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::scheduleLoadFallbackResourceFromApplicationCache):
+        Call the ResourceLoader function instead of using handle, which is null when
+        using out of process networking.
</ins><span class="cx"> 
</span><del>-            Tests: fast/parser/adoption-agency-crash-01.html
-                   fast/parser/adoption-agency-crash-02.html
-                   fast/parser/adoption-agency-crash-03.html
</del><ins>+2014-05-17  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * html/parser/HTMLConstructionSite.cpp:
-            (WebCore::insert):
-            (WebCore::executeInsertTask):
-            (WebCore::executeReparentTask):
-            (WebCore::executeInsertAlreadyParsedChildTask):
-            (WebCore::executeTakeAllChildrenTask):
-            (WebCore::executeTask):
-            (WebCore::HTMLConstructionSite::attachLater):
-            (WebCore::HTMLConstructionSite::executeQueuedTasks):
-            (WebCore::HTMLConstructionSite::insertTextNode):
-            (WebCore::HTMLConstructionSite::reparent):
-            (WebCore::HTMLConstructionSite::insertAlreadyParsedChild):
-            (WebCore::HTMLConstructionSite::takeAllChildren):
-            (WebCore::HTMLConstructionSite::fosterParent):
-            * html/parser/HTMLConstructionSite.h:
-            (WebCore::HTMLConstructionSiteTask::HTMLConstructionSiteTask):
-            (WebCore::HTMLConstructionSiteTask::oldParent):
-            * html/parser/HTMLTreeBuilder.cpp:
-            (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
</del><ins>+        We shouldn't make a ScrollingThread on iOS.
+        &lt;https://webkit.org/b/133038&gt;
+        &lt;rdar://problem/16947589&gt;
</ins><span class="cx"> 
</span><del>-2014-02-12  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Don't call ScrollingThred::dispatch() from the pressure relief
+        code on iOS since that will end up instantiating a scrolling thread
+        which we'd otherwise never have.
</ins><span class="cx"> 
</span><del>-        Merge r162820.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-    2014-01-26  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        * platform/MemoryPressureHandler.cpp:
+        (WebCore::MemoryPressureHandler::releaseMemory):
</ins><span class="cx"> 
</span><del>-            Part 2: Assertion failure in WebCore::PseudoElement::didRecalcStyle()
-            &lt;https://bugs.webkit.org/show_bug.cgi?id=126761&gt;
-            &lt;rdar://problem/15793540&gt;
</del><ins>+2014-05-17  Piotr Grad  &lt;p.grad@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Simon Fraser.
</del><ins>+        Setting playback rate on video with media controller is not ignored.
+        https://bugs.webkit.org/show_bug.cgi?id=129048
</ins><span class="cx"> 
</span><del>-            * bindings/objc/DOM.mm:
-            (-[DOMElement image]):
-            (-[DOMElement _imageTIFFRepresentation]):
-            * platform/gtk/PasteboardGtk.cpp:
-            (WebCore::Pasteboard::writeImage):
-            * platform/win/PasteboardWin.cpp:
-            (WebCore::Pasteboard::writeImage):
-            (WebCore::getCachedImage):
-            * rendering/HitTestResult.cpp:
-            (WebCore::HitTestResult::image):
-            - More places where toRenderImage() should be used instead of
-              toImage().
-            - Fixed last two places where static_cast&lt;WebCore::RenderImage*&gt;
-              was being used instead of toRenderImage().
</del><ins>+        Reviewed by Jer Noble.
</ins><span class="cx"> 
</span><del>-2014-02-12  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Replaced queries for m_playbackRate with effectivePlaybackRate()
+        which includes media controller playback rate.
</ins><span class="cx"> 
</span><del>-        Merge r162679.
</del><ins>+        Test: media/video-controller-child-rate.html
</ins><span class="cx"> 
</span><del>-    2014-01-23  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseAttribute):
+        * html/HTMLMediaElement.h:
</ins><span class="cx"> 
</span><del>-            Assertion failure in WebCore::PseudoElement::didRecalcStyle()
-            &lt;https://bugs.webkit.org/show_bug.cgi?id=126761&gt;
-            &lt;rdar://problem/15793540&gt;
</del><ins>+2014-05-16  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Andy Estes.
</del><ins>+        Expose WKUserScript as API
+        https://bugs.webkit.org/show_bug.cgi?id=133017
+        &lt;rdar://problem/16948059&gt;
</ins><span class="cx"> 
</span><del>-            Test: fast/images/animate-list-item-image-assertion.html
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-            * dom/PseudoElement.cpp:
-            (WebCore::PseudoElement::didRecalcStyle):
-            Check isRenderImage() rather than isImage() before casting to
-            RenderImage.
</del><ins>+        * WebCore.exp.in:
+        Export symbols.
</ins><span class="cx"> 
</span><del>-            * editing/ios/EditorIOS.mm:
-            (WebCore::getImage):
-            Ditto.
</del><ins>+        * WebCore.xcodeproj/project.pbxproj:
+        Change UserContentController.h to be a private header.
</ins><span class="cx"> 
</span><del>-            * editing/mac/EditorMac.mm:
-            (WebCore::getImage):
-            Ditto.
</del><ins>+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        Set m_userContentController from the page configuration and add it if it's not null.
</ins><span class="cx"> 
</span><del>-            * html/HTMLImageElement.cpp:
-            (WebCore::HTMLImageElement::parseAttribute):
-            (WebCore::HTMLImageElement::didAttachRenderers):
-            Ditto.
</del><ins>+        * page/Page.h:
+        Add UserContentController to PageClients.
</ins><span class="cx"> 
</span><del>-            * loader/ImageLoader.cpp:
-            (WebCore::ImageLoader::renderImageResource):
-            Ditto.
</del><ins>+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addPage):
+        Only try to add a user content controller if the page doesn't already have one.
</ins><span class="cx"> 
</span><del>-            * page/DragController.cpp:
-            (WebCore::getCachedImage):
-            Ditto.
</del><ins>+        (WebCore::PageGroup::removePage):
+        Only try to remove the user content controller if it's the group one.
</ins><span class="cx"> 
</span><del>-            * rendering/RenderLayerBacking.cpp:
-            (WebCore::RenderLayerBacking::isDirectlyCompositedImage):
-            (WebCore::RenderLayerBacking::updateImageContents):
-            Ditto.
</del><ins>+2014-05-17  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        REGRESSION (r166422): All RenderBox objects grew 104 bytes from adding repaint timers.
+        &lt;https://webkit.org/b/133027&gt;
+        &lt;rdar://problem/16867410&gt;
</ins><span class="cx"> 
</span><del>-        Merge r161925.
</del><ins>+        Instead of storing a rarely-used repaint timer on every RenderBox, store one
+        on the RenderView, and keep a hash set of renderers needing repaint.
</ins><span class="cx"> 
</span><del>-    2014-01-13  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        Renderers get a flag tracking whether they have a pending lazy repaint.
+        This way we can avoid hash lookups in the common case.
</ins><span class="cx"> 
</span><del>-            Highlighting password field then making a Sticky Note via Safari Services exposes password
-            https://bugs.webkit.org/show_bug.cgi?id=126946
</del><ins>+        Also added a static assertion to catch RenderBox growing in the future.
</ins><span class="cx"> 
</span><del>-            Reviewed by Enrica Casucci.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-            Using the Services menu has a slightly different codepath than Editor::copy() does. This
-            patch duplicates the canCopy() check that Editor::copy() does.
</del><ins>+        * rendering/RenderBox.cpp:
+        (WebCore::SameSizeAsRenderBox::~SameSizeAsRenderBox):
+        (WebCore::RenderBox::RenderBox):
+        (WebCore::RenderBox::~RenderBox):
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::layoutOverflowRectForPropagation):
+        * rendering/RenderBox.h:
+        * rendering/RenderElement.cpp:
+        (WebCore::RenderElement::RenderElement):
+        * rendering/RenderElement.h:
+        (WebCore::RenderElement::setRenderBoxNeedsLazyRepaint):
+        (WebCore::RenderElement::renderBoxNeedsLazyRepaint):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::RenderView):
+        (WebCore::RenderView::scheduleLazyRepaint):
+        (WebCore::RenderView::unscheduleLazyRepaint):
+        (WebCore::RenderView::lazyRepaintTimerFired):
+        * rendering/RenderView.h:
</ins><span class="cx"> 
</span><del>-            Testing is not possible because the Services menu is not accessible to our tests.
</del><ins>+2014-05-16  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * editing/mac/EditorMac.mm:
-            (WebCore::Editor::stringSelectionForPasteboard):
-            (WebCore::Editor::stringSelectionForPasteboardWithImageAltText):
-            (WebCore::Editor::dataSelectionForPasteboard):
</del><ins>+        [Mac][MSE] setCurrentTime() goes down fastSeek path in MediaPlayerPrivateMediaSourceAVFObjC.
+        https://bugs.webkit.org/show_bug.cgi?id=133023
</ins><span class="cx"> 
</span><del>-2014-02-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Merge r158739.
</del><ins>+        When seeking a MSE video, do not go down the fastSeekForMediaTime() path if the
+        seek resulted from a setCurrentTime() call. The logic can lead to attempted seeks
+        before buffered ranges.
</ins><span class="cx"> 
</span><del>-    2013-11-06  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
+        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::seekInternal):
+        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.h:
+        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
+        (WebCore::MediaSourcePrivateAVFObjC::seekToTime):
</ins><span class="cx"> 
</span><del>-            Notify nodes removal to Range/Selection after dispatching blur and mutation event
-            https://bugs.webkit.org/show_bug.cgi?id=123880
</del><ins>+2014-05-16  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Andreas Kling.
</del><ins>+        [iOS] ScrollView::visibleContentRectInternal is bypassing the iOS code for unobscuredContentRect
+        https://bugs.webkit.org/show_bug.cgi?id=133008
</ins><span class="cx"> 
</span><del>-            Merge https://chromium.googlesource.com/chromium/blink/+/b60576a0560d14f8757e58d55d37b7cefa48a6ac
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-            In willRemoveChildren in ContainerNode.cpp, call Document::nodeChildrenWillBeRemoved after instead of
-            before dispatching mutation events because we need to update ranges created by those mutation event
-            listeners. willRemoveChild was fixed in r115686.
</del><ins>+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::visibleContentRectInternal):
+        ScrollView::visibleContentRectInternal() was calling the internal implementation of visibleContentRect().
+        That was skipping the iOS implementation and getting the framerect directly. That size is invalid on iOS
+        when the exposed rect and unobscured rect are not the same.
</ins><span class="cx"> 
</span><del>-            Tests: editing/selection/selection-change-in-blur-event-by-remove-children.html
-                   editing/selection/selection-change-in-mutation-event-by-remove-children.html
-                   fast/dom/Range/range-created-during-remove-children.html
</del><ins>+2014-05-16  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * dom/ContainerNode.cpp:
-            (WebCore::willRemoveChildren):
</del><ins>+        [Mac] naturalSize not updated when preload=metadata
+        https://bugs.webkit.org/show_bug.cgi?id=132994
</ins><span class="cx"> 
</span><del>-2014-02-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Merge r158719.
</del><ins>+        Test: media/video-load-preload-metadata-naturalsize.html
</ins><span class="cx"> 
</span><del>-    2013-11-05  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        When preload=metadata, we never create an AVPlayerItem, and therefore never receive a
+        presentationSize KVO. When an AVAsset informs us that its tracks have changed, and there
+        is no AVPlayerItem, recalculate presentation size based on the first video track's natural
+        size.
</ins><span class="cx"> 
</span><del>-            Protect DOM nodes in IndentOutdentCommand::tryIndentingAsListItem()
-            https://bugs.webkit.org/show_bug.cgi?id=123861
</del><ins>+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksChanged):
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
+        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::seekInternal):
</ins><span class="cx"> 
</span><del>-            Reviewed by Benjamin Poulain.
</del><ins>+2014-05-16  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Merge https://chromium.googlesource.com/chromium/blink/+/297442eb539a2b764fdad323de79099a70179186 partially.
</del><ins>+        Remove &quot;region-based columns&quot; prefs
+        https://bugs.webkit.org/show_bug.cgi?id=133006
+        &lt;rdar://problem/16945824&gt;
</ins><span class="cx"> 
</span><del>-            * editing/IndentOutdentCommand.cpp:
-            (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Make selectedListItem, previousList, and nextList
-            RefPtr since they're are used after calling insertNodeBefore.
</del><ins>+        Reviewed by Dave Hyatt.
</ins><span class="cx"> 
</span><del>-2014-02-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Remove &quot;region-based columns&quot; prefs and related code, since this is only
+        way to render columns now.
</ins><span class="cx"> 
</span><del>-        Merge r158058.
</del><ins>+        * page/Settings.in:
</ins><span class="cx"> 
</span><del>-    2013-10-25  Mark Lam  &lt;mark.lam@apple.com&gt;
</del><ins>+2014-05-16  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            DatabaseManager's ProposedDatabases need to be thread-safe.
-            https://bugs.webkit.org/show_bug.cgi?id=123313.
</del><ins>+        Link search area for touch events is too large in some cases
+        https://bugs.webkit.org/show_bug.cgi?id=132988
+        &lt;rdar://problem/16917843&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Geoffrey Garen.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-            No new tests.
</del><ins>+        * page/ios/FrameIOS.mm:
+        (WebCore::Frame::qualifyingNodeAtViewportLocation):
+        
+            - Adjust the search area to screen ppi.
+            - Remove cut-off at scale 1. This made us pick physically far-away elements when zoomed in.
+            
+        * platform/PlatformScreen.h:
+        * platform/ios/PlatformScreenIOS.mm:
+        (WebCore::mobileGestaltFloatValue):
+        (WebCore::screenPPIFactor):
</ins><span class="cx"> 
</span><del>-            * Modules/webdatabase/DatabaseManager.cpp:
-            (WebCore::DatabaseManager::DatabaseManager):
-            (WebCore::DatabaseManager::existingDatabaseContextFor):
-            (WebCore::DatabaseManager::registerDatabaseContext):
-            (WebCore::DatabaseManager::unregisterDatabaseContext):
-            (WebCore::DatabaseManager::didConstructDatabaseContext):
-            (WebCore::DatabaseManager::didDestructDatabaseContext):
-            (WebCore::DatabaseManager::openDatabaseBackend):
-            (WebCore::DatabaseManager::addProposedDatabase):
-            (WebCore::DatabaseManager::removeProposedDatabase):
-            (WebCore::DatabaseManager::fullPathForDatabase):
-            (WebCore::DatabaseManager::detailsForNameAndOrigin):
-            * Modules/webdatabase/DatabaseManager.h:
</del><ins>+            Figure out screens physical PPI relative to a base.
</ins><span class="cx"> 
</span><del>-2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+2014-05-16  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r162486
</del><ins>+        [MSE] Crash at  WebCore::SourceBuffer::~SourceBuffer + 110
+        https://bugs.webkit.org/show_bug.cgi?id=132973
</ins><span class="cx"> 
</span><del>-    2014-01-21  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-            REGRESSION (r161580): Some PDFs render outside their &lt;img&gt;
-            https://bugs.webkit.org/show_bug.cgi?id=127381
-            &lt;rdar://problem/15872168&gt;
</del><ins>+        Change SourceBuffer::m_private into a Ref&lt;&gt;, and add an assertion to
+        SourceBufferPrivateAVFObjC's destructor if its client has not been cleared.
</ins><span class="cx"> 
</span><del>-            Reviewed by Simon Fraser.
</del><ins>+        Eliminate unnecessary churn in MediaSourcePrivateAVFObjC by having the predicate
+        functor take bare pointers, rather than a PassRefPtr.
</ins><span class="cx"> 
</span><del>-            * platform/graphics/cg/PDFDocumentImage.cpp:
-            (WebCore::transformContextForPainting):
-            Only try to make the scale uniform if it isn't already, and use the minimum
-            of the two original scales when doing so, so that it is absolutely certain
-            to fit inside space allocated for the image during layout.
</del><ins>+        The underlying problem seems to be in WebAVStreamDataParserListener. RefPtrs were
+        being created off the main thread to a non-thread safe ref counted class. In some
+        situations, this would result in double decrementing the ref, which would cause an
+        early destruction of the underlying object. Instead replace these RefPtr strong
+        pointers with explicit weak ones. Ensure the parser and its delegate are not freed
+        before the append operation completes by passing strong pointers into the async
+        append operation lambda.
</ins><span class="cx"> 
</span><del>-2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        There were a few places where we weren't null checking m_mediaSource before using it,
+        and at least one place where we weren't clearing m_mediaSource.
</ins><span class="cx"> 
</span><del>-        Merge r158870
</del><ins>+        * Modules/mediasource/SourceBuffer.cpp:
+        (WebCore::SourceBuffer::SourceBuffer): Use Ref instead of RefPtr.
+        (WebCore::SourceBuffer::appendBufferTimerFired): Ditto.
+        * Modules/mediasource/SourceBuffer.h:
+        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
+        (WebCore::MediaSourcePrivateAVFObjCHasAudio): Take a bare pointer, instead of a PassRefPtr.
+        (WebCore::MediaSourcePrivateAVFObjCHasVideo): Ditto.
+        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
+        (WebCore::MediaSourcePrivateAVFObjC::removeSourceBuffer): Clear the back pointer when removing a buffer.
+        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
+        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
+        (-[WebAVStreamDataParserListener initWithParser:parent:WebCore::]): Use WeakPtr instead of RefPtr.
+        (-[WebAVStreamDataParserListener invalidate]): Ditto.
+        (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:]): Ditto.
+        (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:withDiscontinuity:]): Ditto.
+        (-[WebAVStreamDataParserListener streamDataParser:didFailToParseStreamDataWithError:]): Ditto.
+        (-[WebAVStreamDataParserListener streamDataParser:didProvideMediaData:forTrackID:mediaType:flags:]): Ditto.
+        (-[WebAVStreamDataParserListener streamDataParser:didReachEndOfTrackWithTrackID:mediaType:]): Ditto.
+        (-[WebAVStreamDataParserListener streamDataParser:didProvideContentKeyRequestInitializationData:forTrackID:]): Ditto.
+        (WebCore::SourceBufferPrivateAVFObjC::~SourceBufferPrivateAVFObjC):
+        (WebCore::SourceBufferPrivateAVFObjC::append): Ditto.
</ins><span class="cx"> 
</span><del>-    2013-11-07  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+2014-05-16  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Crash in HTMLMediaElement::contextDestroyed
-            https://bugs.webkit.org/show_bug.cgi?id=123963
</del><ins>+        Subpixel rendering: Push named flows in region to device pixel when painting.
+        https://bugs.webkit.org/show_bug.cgi?id=132986
</ins><span class="cx"> 
</span><del>-            Reviewed by Eric Carlson.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-            Merge https://chromium.googlesource.com/chromium/blink/+/177999cdb34b707465670f0feff723922939f278
</del><ins>+        Remove integral rounding when named flow sets the painting offset on the graphics context.
+        Use device pixel snapping instead to ensure that we can paint on odd device pixel positions on retina displays. 
</ins><span class="cx"> 
</span><del>-            * html/HTMLMediaElement.cpp:
-            (WebCore::HTMLMediaElement::~HTMLMediaElement):
</del><ins>+        Test: fast/regions/hidpi-region-with-auto-margin-on-subpixel-position.html
</ins><span class="cx"> 
</span><del>-2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateClipRects):
</ins><span class="cx"> 
</span><del>-        Merge r154036
</del><ins>+2014-05-16  Radu Stavila  &lt;stavila@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-08-12  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        [CSS Regions] Add ASSERT to make sure using the flowThread cache does not return incorrect results
+        https://bugs.webkit.org/show_bug.cgi?id=132906
</ins><span class="cx"> 
</span><del>-            Fix orphan needsLayout state in RenderTextControlSingleLine
-            https://bugs.webkit.org/show_bug.cgi?id=119726
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-            Reviewed by Kent Tamura.
</del><ins>+        If flowThreadContainingBlock() is called on an object which is in a different
+        flow thread than the one currently being laid out, this method will return an incorrect
+        result. I added an assertion for that to make sure we catch and treat any such scenarios.
+        For the moment, this assertion is only validated for regions, as multicol still has some issues.
</ins><span class="cx"> 
</span><del>-            Merge https://chromium.googlesource.com/chromium/blink/+/c0aec52ef348b2be0c882f8646fe3cf537831f59
</del><ins>+        No new tests required.
</ins><span class="cx"> 
</span><del>-            We should mark the renderer for containerElement, which wraps innerTextElement and innerBlockElement
-            in cases of input[type=search] and input[type=number], dirty.
</del><ins>+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::locateFlowThreadContainingBlockNoCache):
+        (WebCore::RenderObject::locateFlowThreadContainingBlock):
+        * rendering/RenderObject.h:
</ins><span class="cx"> 
</span><del>-            * rendering/RenderTextControlSingleLine.cpp:
-            (WebCore::setNeedsLayoutOnAncestors):
-            (WebCore::RenderTextControlSingleLine::layout):
</del><ins>+2014-05-16  Martin Hock  &lt;mhock@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        MemoryCache::addImageToCache should return the result of add().
+        https://bugs.webkit.org/show_bug.cgi?id=132928
+        &lt;rdar://problem/16651547&gt;
</ins><span class="cx"> 
</span><del>-        Merge r156082
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-    2013-09-18  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</del><ins>+        API test: WebKit1.MemoryCacheADdImageToCache (MemoryCacheAddImageToCacheIOS.mm)
</ins><span class="cx"> 
</span><del>-            [CSSRegions] Failed to retrieve named flow ranges for content with inline svg
-            https://bugs.webkit.org/show_bug.cgi?id=121489
</del><ins>+        * loader/cache/MemoryCache.cpp:
+        (WebCore::MemoryCache::addImageToCache):
</ins><span class="cx"> 
</span><del>-            Reviewed by David Hyatt.
</del><ins>+2014-05-16  Andrei Bucur  &lt;abucur@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-            The inline SVG element behaves like a replaced element in HTML context. When computing the ranges
-            that are displayed inside a region for a named flow that contains an inline SVG element, we have
-            to treat the SVG as a replaced and run the checks only for the SVG root element, skipping the
-            other SVG elements inside.
</del><ins>+        [CSS Regions] Reduce the RenderRegion invasiveness in rendering code
+        https://bugs.webkit.org/show_bug.cgi?id=132121
</ins><span class="cx"> 
</span><del>-            Test: fast/regions/get-region-flow-ranges-inline-svg.html
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-            * rendering/RenderNamedFlowThread.cpp:
-            (WebCore::nextNodeInsideContentNode): Add function to retrieve the next node in traversal
-            under the contentNode subtree that should be used for getRanges inspection.
-            (WebCore::RenderNamedFlowThread::getRanges): Replace NodeTravesal::next with nextNodeInsideContentNode.
</del><ins>+        Remove the RenderRegion / RenderNamedFlowFragment parameters and fields from
+        the painting / hit testing data structures and use a stateful approach to
+        correctly handle regions.
</ins><span class="cx"> 
</span><del>-2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        When painting or hit testing, the current flow thread is saved along the current
+        region. They are accessed through the |currentRenderNamedFlowFragment| helper
+        method on RenderObject or RenderLayer.
</ins><span class="cx"> 
</span><del>-        Merge r153507
</del><ins>+        The patch also changes a bunch of 0s to nullptrs.
</ins><span class="cx"> 
</span><del>-    2013-07-30  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        Tests: No new tests, no functional change.
</ins><span class="cx"> 
</span><del>-            Don't post accessibility notification on object in detached document.
-            https://bugs.webkit.org/show_bug.cgi?id=119286
</del><ins>+        * html/shadow/MediaControlElements.cpp:
+        (WebCore::MediaControlTextTrackContainerElement::createTextTrackRepresentationImage):
+        * rendering/HitTestLocation.cpp:
+        (WebCore::HitTestLocation::HitTestLocation):
+        (WebCore::HitTestLocation::operator=):
+        * rendering/HitTestLocation.h:
+        (WebCore::HitTestLocation::region): Deleted.
+        * rendering/HitTestResult.h:
+        * rendering/PaintInfo.h:
+        (WebCore::PaintInfo::PaintInfo):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::selectionGaps):
+        (WebCore::RenderBlock::nodeAtPoint):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::nodeAtPoint):
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::pushContentsClip):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintMaskForTextFillBox):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paint):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::paintLayerContents):
+        (WebCore::RenderLayer::paintLayerByApplyingTransform):
+        (WebCore::RenderLayer::collectFragments):
+        (WebCore::RenderLayer::updatePaintingInfoForFragments):
+        (WebCore::RenderLayer::paintTransformedLayerIntoFragments):
+        (WebCore::RenderLayer::paintBackgroundForFragments):
+        (WebCore::RenderLayer::paintForegroundForFragmentsWithPhase):
+        (WebCore::RenderLayer::paintOutlineForFragments):
+        (WebCore::RenderLayer::paintMaskForFragments):
+        (WebCore::RenderLayer::hitTest):
+        (WebCore::RenderLayer::hitTestFixedLayersInNamedFlows):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::hitTestTransformedLayerInFragments):
+        (WebCore::RenderLayer::mapLayerClipRectsToFragmentationLayer):
+        (WebCore::RenderLayer::calculateClipRects):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateCompositedBounds):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::addToOverlapMap):
+        (WebCore::RenderLayerCompositor::clippedByAncestor):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::currentRenderNamedFlowFragment):
+        * rendering/RenderObject.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::shouldPaint):
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::nodeAtPoint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::nodeAtPoint):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeLayers):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::paint):
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paintReplaced):
</ins><span class="cx"> 
</span><del>-            Reviewed by Ryosuke Niwa.
</del><ins>+2014-05-16  Kiran  &lt;kiran.guduru@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-            Merge https://chromium.googlesource.com/chromium/blink/+/ef9fc9e70202dcf33e5cf2f0f0a2135945ffe17e%5E%21/#F0
</del><ins>+        RTCDtmfSender default values need to be updated.
+        https://bugs.webkit.org/show_bug.cgi?id=132952
</ins><span class="cx"> 
</span><del>-            Don't post accessibility notification on object in detached document.
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-            This can happen if an accessibility notification is queued on a node,
-            then that node is reparented to a different document that's not attached
-            anywhere before the accessibility notification is fired.
</del><ins>+        The default ToneDuration and ToneGap values are modified in the updated spec.
+        So these values need to be updated.
</ins><span class="cx"> 
</span><del>-            * accessibility/AXObjectCache.cpp:
-            (WebCore::AXObjectCache::notificationPostTimerFired):
</del><ins>+        Test: fast/mediastream/RTCPeerConnection-dtmf.html.
</ins><span class="cx"> 
</span><del>-2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        * Modules/mediastream/RTCDTMFSender.cpp:
</ins><span class="cx"> 
</span><del>-        Merge r158676
</del><ins>+2014-05-15  Daniel Bates  &lt;dabates@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-11-05  Daniel Bates  &lt;dabates@apple.com&gt;
</del><ins>+        Attempt to fix the Apple Mavericks Release, Apple MountainLion Release,
+        Apple MountainLion Release (32-bit Build), EFL, and GTK builds following
+        &lt;http://trac.webkit.org/changeset/168921&gt; (https://bugs.webkit.org/show_bug.cgi?id=132669)
</ins><span class="cx"> 
</span><del>-            XSSAuditor should catch reflected srcdoc properties even without a &lt;frame&gt; tag injection
</del><ins>+        * dom/ContainerNode.cpp: Include SVGElement.h for the definition of Node::hasTagName(const SVGQualifiedName&amp;).
</ins><span class="cx"> 
</span><del>-            From Blink r160615 by &lt;tsepez@chromium.org&gt;
-            https://src.chromium.org/viewvc/blink?view=rev&amp;revision=160615
</del><ins>+2014-05-15  Daniel Bates  &lt;dabates@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Test: http/tests/security/xssAuditor/iframe-srcdoc-property-blocked.html
</del><ins>+        ASSERT_NOT_REACHED() in DocumentOrderedMap::get() when removing SVG subtree
+        https://bugs.webkit.org/show_bug.cgi?id=132669
+        &lt;rdar://problem/14931432&gt;
</ins><span class="cx"> 
</span><del>-            * html/parser/XSSAuditor.cpp:
-            (WebCore::XSSAuditor::filterIframeToken):
</del><ins>+        Reviewed by Brent Fulgham and Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-2014-02-05  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Fixes an assertion failure when removing an SVG element with a duplicate id.
</ins><span class="cx"> 
</span><del>-        Merge r154146, r155828, r156145
</del><ins>+        When removing an SVG element with id A we synchronously instruct each element that references A
+        to find the first element with id A, call this N, from the document root and register itself to
+        either receive subsequent notifications from N (say, there is another element with id A) or as
+        waiting for an element with id A (say, N = nullptr; =&gt; we removed the last element with id A from
+        the document). Because the elements that reference A perform this operation synchronously when
+        removing an element they consult an transient state of the DocumentOrderedMap when querying for the
+        element with id A.
+    
+        Without loss of generality, let E, E_1, E_2, and E_3 be elements, where E_1, E_2, E_3 are children
+        of E in that order and E_1.id = E_2.id = A and E_3.href = #A (that is, it references an element
+        with id A). Suppose we remove E then we remove E_1, update DocumentOrderedMap to decrement its count
+        for id A, and notify E_3 to look for an element with id A. This leads to an assertion failure since
+        DocumentOrderedMap expects to find an element with id A, E_2, but cannot find such an element when
+        traversing from the document root because E was unlinked from the document root (i.e. E_2 is in a
+        disjoint subtree).
</ins><span class="cx"> 
</span><del>-    2013-08-15  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Tests: svg/custom/change-id-of-use-during-removal.html
+               svg/custom/remove-subtree-including-path-with-duplicate-id-referenced-by-later-textpath.html
+               svg/custom/remove-subtree-including-text-with-duplicate-id-referenced-by-later-tref.html
+               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-earlier-use.html
+               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-later-animate.html
+               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-later-feimage.html
+               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-later-mpath.html
+               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-later-use.html
+               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-later-use2.html
+               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-use-in-different-subtree.html
+               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-use-with-duplicate-id-in-different-subtree.html
+               svg/custom/remove-use-with-duplicate-id-referenced-by-later-use.html
</ins><span class="cx"> 
</span><del>-            [Windows] Consolidate WebKit Bundle Handling 
-            https://bugs.webkit.org/show_bug.cgi?id=119869 
</del><ins>+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChild): Call SVGDocumentExtensions::rebuildElements() after we remove
+        a DOM subtree so that applicable SVG elements can update their referenced element when the DocumentOrderedMap
+        is in a stable-state.
+        (WebCore::ContainerNode::removeChildren): Ditto.
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::rebuildElements): Added; notifies SVG elements that their href attribute
+        changed so that they query the DocumentOrderedMap for the element they reference by id in their href attribute.
+        (WebCore::SVGDocumentExtensions::clearTargetDependencies): Added; Called from removing
+        an SVG element S from the DOM. Appends all elements that reference the id of S to the end of a Vector of
+        elements to be rebuilt (when SVGDocumentExtensions::rebuildElements() is called) and notifies these elements
+        that have been marked to be rebuilt so that they can invalidate their state (e.g. stop animating).
+        (WebCore::SVGDocumentExtensions::rebuildAllElementReferencesForTarget): Changed to take its argument by reference
+        (since it's always non-null) and simplified logic to synchronously notify SVG updates that their referenced element
+        may have changed. Calling SVGElement::svgAttributeChanged() on an element E should at most remove the dependencies
+        of E.
+        * svg/SVGDocumentExtensions.h:
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::~SVGElement): Substitute &quot;*this&quot; for &quot;this&quot; as SVGDocumentExtensions::rebuildAllElementReferencesForTarget()
+        now takes a reference instead of a pointer.
+        (WebCore::SVGElement::removedFrom): Modified to call SVGDocumentExtensions::clearTargetDependencies().
+        (WebCore::SVGElement::attributeChanged): Substitute &quot;*this&quot; for &quot;this&quot; as SVGDocumentExtensions::rebuildAllElementReferencesForTarget()
+        now takes a reference instead of a pointer.
+        * svg/SVGElement.h:
+        (WebCore::SVGElement::callClearTarget): Added; calls through to private virtual SVGElement::clearTarget().
+        (WebCore::SVGElement::clearTarget): Added.
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::clearTarget): Added.
+        * svg/SVGTRefElement.h:
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::clearTarget): Added.
+        * svg/animation/SVGSMILElement.h:
</ins><span class="cx"> 
</span><del>-            Reviewed by Tim Horton. 
</del><ins>+2014-05-15  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * WebCore.vcxproj/WebCore.vcxproj: Add new WebCoreBundleWin files. 
-            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto. 
-            * platform/network/curl/ResourceHandleManager.cpp: 
-            (WebCore::certificatePath): Use correct bundle handling logic. 
-            * platform/win/LocalizedStringsWin.cpp: Move bundle implementation to 
-            new WebCoreBundleWin.cpp file. 
-            * platform/win/WebCoreBundleWin.cpp: Added. 
-            (WebCore::createWebKitBundle): 
-            (WebCore::webKitBundle): 
-            * platform/win/WebCoreBundleWin.h: Added. 
</del><ins>+        [iOS WK2] When zoomed, fixed elements jump at the start of a scroll, and jump back at the end.
+        https://bugs.webkit.org/show_bug.cgi?id=132978
+        &lt;rdar://problem/16894428&gt;
</ins><span class="cx"> 
</span><del>-2014-02-04  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Build fix after last branch merge.
</del><ins>+        This was the actual cause of the bug; r168560 changed the rect passed in here
+        to be the customFixedPositionRect rather than the unobscured rect, but we
+        used it to call FrameView::rectForViewportConstrainedObjects() which gave back
+        another bogus rect. So just use the rect passed in.
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj: Correct bad merge of media build steps.
</del><ins>+        * page/scrolling/ios/ScrollingTreeScrollingNodeIOS.mm:
+        (WebCore::ScrollingTreeScrollingNodeIOS::updateLayersAfterViewportChange):
</ins><span class="cx"> 
</span><del>-2014-02-03  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+2014-05-15  Daniel Bates  &lt;dabates@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after r162860.
</del><ins>+        SVG element may reference arbitrary DOM element before running its insertion logic
+        https://bugs.webkit.org/show_bug.cgi?id=132757
+        &lt;rdar://problem/15703817&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/MediaPlayer.cpp: Prevent 64-bit build from using QuickTime SDK.
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp: Ditto.
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h: Ditto.
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-2014-01-27  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Fixes an issue where an SVG element may reference an arbitrary DOM element e before e finished being
+        inserted in the tree.
</ins><span class="cx"> 
</span><del>-        Merge r162723.
</del><ins>+        Currently when an SVG element A is inserted into a document we use document.getElementById() to find the
+        element B it references (if any). If A is inserted before B and B has the same id as a later element in
+        the document then A can find B before B is notified that its been inserted into the document (i.e. before
+        Element::insertedFrom() is called on B). Instead, A should call document.getElementById() only after
+        cessation of the insertion operation that inserted it to ensure that all inserted nodes (including B)
+        processed their insertion-specific logic.
</ins><span class="cx"> 
</span><del>-    2014-01-24  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Tests: svg/custom/reparent-animate-element.html
+               svg/custom/reparent-feimage-element.html
+               svg/custom/reparent-mpath-element.html
+               svg/custom/reparent-textpath-element.html
+               svg/custom/reparent-tref-element.html
+               svg/custom/reparent-use-element.html
</ins><span class="cx"> 
</span><del>-            [Win] Convert some NMake files to MSBuild project files 
-            https://bugs.webkit.org/show_bug.cgi?id=127579 
</del><ins>+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+        we are called back to resolve our target element (i.e. call SVGFEImageElement::buildPendingResources())
+        after the subtree we're in is inserted.
+        (WebCore::SVGFEImageElement::didNotifySubtreeInsertions): Added; turns around and calls SVGFEImageElement::buildPendingResources().
+        * svg/SVGFEImageElement.h:
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+        we are called back to resolve our target element (i.e. call SVGMPathElement::buildPendingResources())
+        after the subtree we're in is inserted.
+        (WebCore::SVGMPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGMPathElement::buildPendingResources().
+        * svg/SVGMPathElement.h:
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+        we are called back to resolve our target element (i.e. call SVGTRefElement::buildPendingResources())
+        after the subtree we're in is inserted.
+        (WebCore::SVGTRefElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTRefElement::buildPendingResources().
+        * svg/SVGTRefElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+        we are called back to resolve our target element (i.e. call SVGTextPathElement::buildPendingResources())
+        after the subtree we're in is inserted.
+        (WebCore::SVGTextPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTextPathElement::buildPendingResources().
+        * svg/SVGTextPathElement.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+        we are called back to resolve our target element (i.e. call SVGUseElement::buildPendingResources()) after its subtree is
+        inserted.
+        (WebCore::SVGUseElement::didNotifySubtreeInsertions): Added; turns around and calls SVGUseElement::buildPendingResources().
+        * svg/SVGUseElement.h:
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+        we are called back to resolve our target element (i.e. call SVGSMILElement::buildPendingResources())
+        after the subtree we're in is inserted.
+        (WebCore::SVGSMILElement::didNotifySubtreeInsertions): Added; turns around and calls SVGSMILElement::buildPendingResources().
+        * svg/animation/SVGSMILElement.h:
</ins><span class="cx"> 
</span><del>-            Reviewed by Tim Horton.
</del><ins>+2014-05-15  Mark Hahnenberg  &lt;mhahnenberg@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * WebCore.vcxproj/WebCore.make: Removed.
-            * WebCore.vcxproj/WebCore.proj: Added.
</del><ins>+        JSDOMWindow should not claim HasImpureGetOwnPropertySlot
+        https://bugs.webkit.org/show_bug.cgi?id=132918
</ins><span class="cx"> 
</span><del>-2014-01-27  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after r162631.
</del><ins>+        Tests: js/cached-window-properties.html
+               js/cached-window-prototype-properties.html
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.submit.sln: Do not build QTMovieWin for 64-bit architecture.
</del><ins>+        We now correctly handle the impurity of JSDOMWindow's custom getOwnPropertySlot without needing the 
+        blanket HasImpureGetOwnPropertySlot. We do this through the use of watchpoints and by explicitly forbidding
+        any caching beyond a certain point using PropertySlot::disableCaching. Getting rid of this flag will allow 
+        us to cache many properties/methods on both the JSDOMWindow and its prototype, which are very commonly used 
+        across the web.
</ins><span class="cx"> 
</span><del>-2014-01-23  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertySlot):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (HasComplexGetOwnProperty):
+        (InterfaceRequiresAttributesOnInstance):
+        (InstanceOverridesGetOwnPropertySlot):
+        (GenerateHeader):
</ins><span class="cx"> 
</span><del>-        Merge r154470.
</del><ins>+2014-05-15  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-08-22  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        NetworkProcess crashes at ResourceHandle::continueDidReceiveResponse
+        https://bugs.webkit.org/show_bug.cgi?id=132966
+        &lt;rdar://problem/16373694&gt;
</ins><span class="cx"> 
</span><del>-            compositing/geometry/bounds-ignores-hidden-dynamic.html has incorrect initial rendering
-            https://bugs.webkit.org/show_bug.cgi?id=119825
</del><ins>+        Reviewed by Brady Eidson.
</ins><span class="cx"> 
</span><del>-            Reviewed by Tim Horton.
-            
-            r137526 and some earlier commits attempted to avoid unconditionally
-            repainting layers when their size changes, because this was causing
-            TiledBacking layers to repaint when the document size changed.
-            
-            However, the approach required that we have good information about
-            whether size changes require a repaint, which in some cases is hard
-            to determine, especially when RenderLayer changes affect our
-            decisions about which layers are composited.
-            
-            Fix by pushing the decision about whether to repaint on size change
-            into GraphicsLayer. The default is to repaint on size change,
-            but GraphicsLayer provides a function that can be overridden to
-            modify this behavior; GraphicsLayerCA does so to avoid repaints
-            when layers with TiledBackings get resized.
</del><ins>+        Covered by many fast/files tests.
</ins><span class="cx"> 
</span><del>-            Test: compositing/repaint/repaint-on-layer-grouping-change.html
</del><ins>+        * platform/network/BlobResourceHandle.cpp: (WebCore::BlobResourceHandle::continueDidReceiveResponse):
+        * platform/network/BlobResourceHandle.h:
+        * platform/network/ResourceHandle.h:
+        Don't call delegate's continueDidReceiveResponse when loading a blob:// URL,
+        the delegate is null. On the Mac, we used to lazily create it, which was also wrong,
+        but at least not observable.
</ins><span class="cx"> 
</span><del>-            * WebCore.exp.in: WebKit2 needs GraphicsLayer::setSize, which is no longer inline.
-            * platform/graphics/GraphicsLayer.cpp:
-            (WebCore::GraphicsLayer::setOffsetFromRenderer):
-            (WebCore::GraphicsLayer::setSize):
-            * platform/graphics/GraphicsLayer.h:
-            (WebCore::GraphicsLayer::shouldRepaintOnSizeChange):
-            * platform/graphics/ca/GraphicsLayerCA.cpp:
-            (WebCore::GraphicsLayerCA::shouldRepaintOnSizeChange):
-            * platform/graphics/ca/GraphicsLayerCA.h:
-            * rendering/RenderLayerBacking.h: No longer need m_boundsConstrainedByClipping
-            * rendering/RenderLayerBacking.cpp:
-            (WebCore::RenderLayerBacking::RenderLayerBacking):
-            (WebCore::RenderLayerBacking::updateCompositedBounds):
-            (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): setSize takes
-            care of repainting for us now, so we can remove all the conditional code.
</del><ins>+2014-05-15  Commit Queue  &lt;commit-queue@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-01-23  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Unreviewed, rolling out r168899.
+        https://bugs.webkit.org/show_bug.cgi?id=132965
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after last commit. We haven't completely removed
-        QTMovieWin uses.
</del><ins>+        Broke some compositing regions tests on Mavericks (Requested
+        by mihnea___ on #webkit).
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj: Build for 32-bit.
-        * WebCore.vcxproj/WebCore.submit.sln: Build QTMovieWin for 32-bit.
</del><ins>+        Reverted changeset:
</ins><span class="cx"> 
</span><del>-2014-01-23  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        &quot;[CSS Regions] Reduce the RenderRegion invasiveness in
+        rendering code&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=132121
+        http://trac.webkit.org/changeset/168899
</ins><span class="cx"> 
</span><del>-        Merge r162621
</del><ins>+2014-05-15  Alex Christensen  &lt;achristensen@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-    2014-01-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Add pointer lock to features without enabling it.
+        https://bugs.webkit.org/show_bug.cgi?id=132961
</ins><span class="cx"> 
</span><del>-            [Win] Update project and solution files for 64-bit builds
-            https://bugs.webkit.org/show_bug.cgi?id=127457
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-            Reviewed by Eric Carlson.
</del><ins>+        * Configurations/FeatureDefines.xcconfig:
+        Added ENABLE_POINTER_LOCK to list of features.
+        * WebCore.exp.in:
+        Added linker symbols which differ with pointer lock enabled.
+        * WebCore.xcodeproj/project.pbxproj:
+        Added PointerLockController.cpp to build.
</ins><span class="cx"> 
</span><del>-            * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj: Specify v100 target
-            * WebCore.vcxproj/WebCore.submit.sln: Add x64 targets
-            * WebCore.vcxproj/WebCore.vcxproj: Specify v100 target for all builds
-            on this branch. Also exclude 32-bit specific assembly when building
-            64-bit target, and correct bad merge from branch.
-            * WebCore.vcxproj/WebCore.vcxproj.filters: Correct branch merge
-            * config.h: Handle 64-bit type definitions.
-            * platform/graphics/ca/win/PlatformCAAnimationWin.cpp:
-            (PlatformCAAnimation::setFromValue): Use CGFloat to support 64-bit builds
-            (PlatformCAAnimation::setToValue): Ditto
-            (PlatformCAAnimation::setValues): Ditto
-            * platform/graphics/win/FontCustomPlatformData.cpp:
-            (WebCore::FontCustomPlatformData::fontPlatformData): Add cast to
-            support 32- and 64-bit targets.
-            * platform/graphics/win/GraphicsContextCGWin.cpp:
-            (WebCore::GraphicsContext::drawLineForDocumentMarker): Use CGFloat to
-            support 64-bit builds.
-            * platform/win/PasteboardWin.cpp:
-            (WebCore::Pasteboard::writeURLToDataObject): Specialize std::min to
-            work on 32- and 64-bit code.
-            (WebCore::createGlobalImageFileDescriptor): Ditto
-            * platform/win/StructuredExceptionHandlerSuppressor.cpp:
-            (WebCore::StructuredExceptionHandlerSuppressor::StructuredExceptionHandlerSuppressor):
-            Comment out 32-bit inline assembly.
-            (WebCore::StructuredExceptionHandlerSuppressor::~StructuredExceptionHandlerSuppressor):
-            Ditto
</del><ins>+2014-05-15  Mark Hahnenberg  &lt;mhahnenberg@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-01-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Move subframe name getter lookup later in JSDOMWindow::getOwnPropertySlot
+        https://bugs.webkit.org/show_bug.cgi?id=132922
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix for branch.
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj: Correct merged files.
-        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
-        * platform/graphics/cg/GraphicsContextCG.cpp: Remove work-around implementation (from branch)
-        now that WKSI provides the method.
</del><ins>+        No new tests.
</ins><span class="cx"> 
</span><del>-2014-01-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        In JSDOMWindow::getOwnPropertySlot, we currently look for the property on the JSDOMWindow, 
+        then we search the window's subframes for name getters, then we look in the window's prototype 
+        chain. Apparently we were doing the lookup in this order to be compatible with Mozilla, but 
+        Mozilla no longer implements this behavior. Instead, they do the lookup on the prototype before 
+        looking for subframe name getters. We should change this to match Mozilla. This has the convenient 
+        side effect of allowing us to cache lookups in the window's prototype chain.
</ins><span class="cx"> 
</span><del>-        Merge r154526
</del><ins>+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertySlot):
</ins><span class="cx"> 
</span><del>-    2014-01-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+2014-05-15  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            [Windows] Unreviewed build correction. Need to force environment variable
-            to be escaped when running nmake command.
</del><ins>+        [UI-side compositing] Fix copying animations between layers, and pausing them
+        https://bugs.webkit.org/show_bug.cgi?id=132943
+        &lt;rdar://problem/16906369&amp;16906541&gt;
</ins><span class="cx"> 
</span><del>-            * WebCore.vcxproj/WebCoreGenerated.make:
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-2014-01-09  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Pass the animation key back to animationStarted(), though this isn't used
+        when animations are running in-process.
</ins><span class="cx"> 
</span><del>-        Merge r161568: &lt;rdar://problem/15784802&gt;
</del><ins>+        * platform/graphics/ca/PlatformCALayer.h:
+        * platform/graphics/ca/mac/PlatformCALayerMac.h:
+        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
+        (-[WebAnimationDelegate animationDidStart:]):
+        (PlatformCALayerMac::animationStarted):
+        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
+        (PlatformCALayerWin::animationStarted):
+        * platform/graphics/ca/win/PlatformCALayerWin.h:
</ins><span class="cx"> 
</span><del>-    2014-01-09  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+2014-05-15  Andrei Bucur  &lt;abucur@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-            PDFDocumentImage can be very slow to do the initial paint
-            https://bugs.webkit.org/show_bug.cgi?id=126633
-            &lt;rdar://problem/15770980&gt;
</del><ins>+        [CSS Regions] Reduce the RenderRegion invasiveness in rendering code
+        https://bugs.webkit.org/show_bug.cgi?id=132121
</ins><span class="cx"> 
</span><del>-            Reviewed by Simon Fraser.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-            * platform/graphics/cg/PDFDocumentImage.cpp:
-            (WebCore::PDFDocumentImage::PDFDocumentImage):
-            (WebCore::PDFDocumentImage::size):
-            (WebCore::transformContextForPainting):
-            (WebCore::PDFDocumentImage::computeBoundsForCurrentPage):
-            (WebCore::applyRotationForPainting):
-            (WebCore::PDFDocumentImage::drawPDFPage):
-            * platform/graphics/cg/PDFDocumentImage.h:
-            * platform/graphics/mac/PDFDocumentImageMac.mm:
-            (WebCore::PDFDocumentImage::computeBoundsForCurrentPage):
-            Store rotation from the PDF in degrees, since it can
-            only be 0, 90, 180, or 270, and don't do any trig to
-            perform the rotation, to avoid introducing minor rounding
-            issues in the size.
</del><ins>+        Remove the RenderRegion / RenderNamedFlowFragment parameters and fields from
+        the painting / hit testing data structures and use a stateful approach to
+        correctly handle regions.
</ins><span class="cx"> 
</span><del>-            Once we're going to paint, if the difference between the
-            computed scale for each axis is due only to integer rounding
-            of the image size, use the same scale for both axes, to avoid
-            a CG slow-path which occurs whenever the scale is nonuniform.
</del><ins>+        When painting or hit testing, the current flow thread is saved along the current
+        region. They are accessed through the |currentRenderNamedFlowFragment| helper
+        method on RenderObject or RenderLayer.
</ins><span class="cx"> 
</span><del>-2014-01-07  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        The patch also changes a bunch of 0s to nullptrs.
</ins><span class="cx"> 
</span><del>-        Merge r160479
</del><ins>+        Tests: No new tests, no functional change.
</ins><span class="cx"> 
</span><del>-    2013-12-11  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        * html/shadow/MediaControlElements.cpp:
+        (WebCore::MediaControlTextTrackContainerElement::createTextTrackRepresentationImage):
+        * rendering/HitTestLocation.cpp:
+        (WebCore::HitTestLocation::HitTestLocation):
+        (WebCore::HitTestLocation::operator=):
+        * rendering/HitTestLocation.h:
+        (WebCore::HitTestLocation::region): Deleted.
+        * rendering/HitTestResult.h:
+        * rendering/PaintInfo.h:
+        (WebCore::PaintInfo::PaintInfo):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::selectionGaps):
+        (WebCore::RenderBlock::nodeAtPoint):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::nodeAtPoint):
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::pushContentsClip):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintMaskForTextFillBox):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paint):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::paintLayerContents):
+        (WebCore::RenderLayer::paintLayerByApplyingTransform):
+        (WebCore::RenderLayer::collectFragments):
+        (WebCore::RenderLayer::updatePaintingInfoForFragments):
+        (WebCore::RenderLayer::paintTransformedLayerIntoFragments):
+        (WebCore::RenderLayer::paintBackgroundForFragments):
+        (WebCore::RenderLayer::paintForegroundForFragmentsWithPhase):
+        (WebCore::RenderLayer::paintOutlineForFragments):
+        (WebCore::RenderLayer::paintMaskForFragments):
+        (WebCore::RenderLayer::hitTest):
+        (WebCore::RenderLayer::hitTestFixedLayersInNamedFlows):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::hitTestTransformedLayerInFragments):
+        (WebCore::RenderLayer::mapLayerClipRectsToFragmentationLayer):
+        (WebCore::RenderLayer::calculateClipRects):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateCompositedBounds):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::addToOverlapMap):
+        (WebCore::RenderLayerCompositor::clippedByAncestor):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::currentRenderNamedFlowFragment):
+        * rendering/RenderObject.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::shouldPaint):
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::nodeAtPoint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::nodeAtPoint):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeLayers):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::paint):
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paintReplaced):
</ins><span class="cx"> 
</span><del>-            StylePendingImage needs to correctly manage the CSSValue pointer lifetime
-            https://bugs.webkit.org/show_bug.cgi?id=125468
</del><ins>+2014-05-14  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Andreas Kling.
</del><ins>+        Clean up &quot;has non-zero begin time&quot; terminology in animations
+        https://bugs.webkit.org/show_bug.cgi?id=132942
</ins><span class="cx"> 
</span><del>-            Test: fast/css/pending-image-crash.xhtml
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-            Disconnect the reference counted StylePendingImage from the CSSValue that owns
-            it when it's not needed any more, otherwise we could end up using a pointer
-            that might no longer be valid.
</del><ins>+        Change the &quot;non-zero beginTime&quot; terminology in the platform CA animations
+        code to &quot;explicit beginTime&quot;: this flag really means that we explicitly set
+        the beginTime of the animation, rather than let CA set the beginTime when
+        committing the animation. This flag is used for animations with negative
+        delay, and when pausing.
+        
+        The WKNonZeroBeginTimeFlag key was spread across PlatformCALayerMac and PlatformCAAnimationMac,
+        so hide it behind getter/setter functions.
+        
+        Remove lots of m_layer.get() in PlatformCAAnimationMac.
</ins><span class="cx"> 
</span><del>-            * css/CSSCursorImageValue.cpp:
-            (WebCore::CSSCursorImageValue::detachPendingImage): Added. Calls detachFromCSSValue
-            on the current image if it is a StylePendingImage.
-            (WebCore::CSSCursorImageValue::~CSSCursorImageValue): Call detachPendingImage.
-            (WebCore::CSSCursorImageValue::cachedImage): Call detachPendingImage before changing
-            m_image to a new value.
-            (WebCore::CSSCursorImageValue::clearCachedImage): Ditto.
-            * css/CSSCursorImageValue.h: Added detachPendingImage.
</del><ins>+        * platform/graphics/ca/mac/PlatformCAAnimationMac.h:
+        * platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
+        (WebCore::hasExplicitBeginTime):
+        (WebCore::setHasExplicitBeginTime):
+        (PlatformCAAnimationMac::copy):
+        (PlatformCAAnimationMac::keyPath):
+        (PlatformCAAnimationMac::beginTime):
+        (PlatformCAAnimationMac::setBeginTime):
+        (PlatformCAAnimationMac::duration):
+        (PlatformCAAnimationMac::setDuration):
+        (PlatformCAAnimationMac::speed):
+        (PlatformCAAnimationMac::setSpeed):
+        (PlatformCAAnimationMac::timeOffset):
+        (PlatformCAAnimationMac::setTimeOffset):
+        (PlatformCAAnimationMac::repeatCount):
+        (PlatformCAAnimationMac::setRepeatCount):
+        (PlatformCAAnimationMac::autoreverses):
+        (PlatformCAAnimationMac::setAutoreverses):
+        (PlatformCAAnimationMac::fillMode):
+        (PlatformCAAnimationMac::setFillMode):
+        (PlatformCAAnimationMac::setTimingFunction):
+        (PlatformCAAnimationMac::copyTimingFunctionFrom):
+        (PlatformCAAnimationMac::isRemovedOnCompletion):
+        (PlatformCAAnimationMac::setRemovedOnCompletion):
+        (PlatformCAAnimationMac::isAdditive):
+        (PlatformCAAnimationMac::setAdditive):
+        (PlatformCAAnimationMac::valueFunction):
+        (PlatformCAAnimationMac::setValueFunction):
+        (hasNonZeroBeginTimeFlag): Deleted.
+        (setNonZeroBeginTimeFlag): Deleted.
+        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
+        (-[WebAnimationDelegate animationDidStart:]):
</ins><span class="cx"> 
</span><del>-            * css/CSSImageSetValue.cpp:
-            (WebCore::CSSImageSetValue::detachPendingImage): Added. Calls detachFromCSSValue
-            on the current image set if it is a StylePendingImage.
-            (WebCore::CSSImageSetValue::~CSSImageSetValue): Call detachPendingImage.
-            (WebCore::CSSImageSetValue::cachedImageSet): Call detachPendingImage before changing
-            m_imageSet to a new value.
-            * css/CSSImageSetValue.h: Added detachPendingImage.
</del><ins>+2014-05-15  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-            * css/CSSImageValue.cpp:
-            (WebCore::CSSImageValue::detachPendingImage): Added. Calls detachFromCSSValue on the
-            current image if it is a StylePendingImage.
-            (WebCore::CSSImageValue::~CSSImageValue): Call detachPendingImage.
-            (WebCore::CSSImageValue::cachedImage): Call detachPendingImage before changing m_image
-            to a new value.
-            * css/CSSImageValue.h: Added detachPendingImage.
</del><ins>+        [GTK] Compile all installed resources as GResources
+        https://bugs.webkit.org/show_bug.cgi?id=131099
</ins><span class="cx"> 
</span><del>-            * rendering/style/StylePendingImage.h:
-            (WebCore::StylePendingImage::cssImageValue): Added a null check.
-            (WebCore::StylePendingImage::cssImageGeneratorValue): Added a null check.
-            (WebCore::StylePendingImage::cssCursorImageValue): Added a null check.
-            (WebCore::StylePendingImage::cssImageSetValue): Added a null check.
-            (WebCore::StylePendingImage::detachFromCSSValue): Added. Sets m_value to null since
-            the style is no longer using this StylePendingImage.
-            (WebCore::StylePendingImage::data): Changed to use the &quot;this&quot; pointer since all we
-            need is some arbitrary pointer uniquely identifying the image. Before loading the image,
-            we have no suitable weak identifier, so it suffices to use the unique pointer to each
-            StylePendingImage object. This function is used only in a limited way; it would be nice
-            to find a way to make the code less strange long term.
</del><ins>+        Reviewed by Philippe Normand.
</ins><span class="cx"> 
</span><del>-2013-12-23  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * PlatformGTK.cmake: Do not install the resources.
+        * platform/audio/gtk/AudioBusGtk.cpp:
+        (WebCore::AudioBus::loadPlatformResource): Load the audio resource
+        from GResources and use createBusFromInMemoryAudioFile().
+        * platform/graphics/Image.h: Remove unsued function loadPlatformThemeIcon.
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::loadImageFromGResource): Load the given icon name from GResources.
+        (WebCore::loadResourceSharedBuffer): Use char* instead of CString.
+        (WebCore::loadMissingImageIconFromTheme): Try to load the missing
+        icon from the current GTK icon theme.
+        (WebCore::Image::loadPlatformResource): Call
+        loadMissingImageIconFromTheme for missing icon or
+        loadImageFromGResource for any other icon name.
+        (WebCore::getPathToImageResource): Deleted.
+        (WebCore::getThemeIconFileName): Deleted.
+        (WebCore::loadImageFromFile): Deleted.
+        (WebCore::Image::loadPlatformThemeIcon): Deleted.
</ins><span class="cx"> 
</span><del>-        Merge 161050: &lt;rdar://problem/15754482&gt;
</del><ins>+2014-05-14  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-12-23  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        Tiled scrolling indicator needs to take topContentInset into account
+        https://bugs.webkit.org/show_bug.cgi?id=132940
</ins><span class="cx"> 
</span><del>-            Crash in ReplaceSelectionCommand
-            https://bugs.webkit.org/show_bug.cgi?id=126107
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-            Reviewed by Benjamin Poulain.
</del><ins>+        The tiled scrolling indicator needs to move down by the value of the 
+        topContentInset. This patch makes that happen by caching the topContentInset in 
+        the TileController. This does feel a little silly since there is already a 
+        function called setTiledScrollingIndicatorPosition() on TiledBacking. However, it 
+        was often the case that calling that function had no effect because m_coverageMap 
+        had not yet been created, and then the information was lost. So instead, we cache 
+        the value.
</ins><span class="cx"> 
</span><del>-            Merge https://chromium.googlesource.com/chromium/blink/+/c1ebe5c1e808daf9db5e348a8d0ab32570b9f7a5
-            except the test since it doesn't reproduce the crash in WebKit.
</del><ins>+        Set TiledBacking’s copy of topContentInset whenever it changes for the FrameView.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::topContentInsetDidChange):
</ins><span class="cx"> 
</span><del>-            * editing/ReplaceSelectionCommand.cpp:
-            (WebCore::ReplaceSelectionCommand::doApply):
</del><ins>+        New function to set the inset. Use the inset to position the coverage map.
+        * platform/graphics/TiledBacking.h:
+        * platform/graphics/ca/mac/TileController.h:
+        * platform/graphics/ca/mac/TileController.mm:
+        (WebCore::TileController::TileController):
+        (WebCore::TileController::setTopContentInset):
</ins><span class="cx"> 
</span><del>-2013-12-23  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        When the coverage map is created, consult the value of the inset.
+        * platform/graphics/ca/mac/TileCoverageMap.mm:
+        (WebCore::TileCoverageMap::TileCoverageMap):
</ins><span class="cx"> 
</span><del>-        Merge 161003: &lt;rdar://problem/15719584&gt;
</del><ins>+        Once the backing has been ensured, set the inset.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking):
</ins><span class="cx"> 
</span><del>-    2013-12-23  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+2014-05-14  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            &lt;rdar://problem/15682948&gt; Update copyright strings
</del><ins>+        Merge r1267628 from branch.
+        &lt;rdar://problem/15751219&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Dan Bernstein
</del><ins>+            Pratik Solanki  &lt;psolanki@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * Info.plist:
</del><ins>+            Reviewed by Simon Fraser.&quot;,
</ins><span class="cx"> 
</span><del>-2013-12-19  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+            TileController relied on the tiling mode in TileCache to determine if it should use low-res
+            tiles when zooming. Unfortunately, sometimes the tiling mode gets set to Zooming even though
+            it's actually a pan. Thus we can end up with blurry tiles. Fix this by adding a new flag on
+            TileCache that controls this behavior and have UIKit set it only when we have an actual zoom
+            operation.

+        * platform/ios/LegacyTileCache.h:
+        (WebCore::LegacyTileCache::tileControllerShouldUseLowScaleTiles):
+        (WebCore::LegacyTileCache::setTileControllerShouldUseLowScaleTiles):
+        * platform/ios/LegacyTileCache.mm:
+        (WebCore::LegacyTileCache::LegacyTileCache):
+        * platform/ios/wak/WAKWindow.h:
+        * platform/ios/wak/WAKWindow.mm:
+        (-[WAKWindow setTileControllerShouldUseLowScaleTiles:]):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::contentsScaleMultiplierForNewTiles):
</ins><span class="cx"> 
</span><del>-        Merge r160898: &lt;rdar://problems/15709940&gt;
</del><ins>+2014-05-14  Commit Queue  &lt;commit-queue@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-    2013-12-19  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        Unreviewed, rolling out r168750.
+        https://bugs.webkit.org/show_bug.cgi?id=132935
</ins><span class="cx"> 
</span><del>-            REGRESSION: cnn.com will continue to reveal 1 px of overhang after rubber-banding 
-            at the top
-            https://bugs.webkit.org/show_bug.cgi?id=126054
</del><ins>+        Caused repaint bugs (Requested by weinig on #webkit).
</ins><span class="cx"> 
</span><del>-            Reviewed by Simon Fraser.
</del><ins>+        Reverted changeset:
</ins><span class="cx"> 
</span><del>-            This regression was caused by http://trac.webkit.org/changeset/160791 It turns out 
-            that the line of code I removed was not always a no-op. In some instances, like on 
-            cnn.com, it would ensure that our final scroll position after a rubber-band was 
-            not something within the overhang area. It was still wrong in its assumption that 
-            rubber-band is always bouncing back the spot it originated from. So this patch 
-            continues to ignore the rubber-bands origin, and instead finds the nearest point 
-            that is not in the overhang area, and scrolls to that point instead of the origin.
</del><ins>+        &quot;Text decorations do not contribute to visual overflow&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=132773
+        http://trac.webkit.org/changeset/168750
</ins><span class="cx"> 
</span><del>-            * page/scrolling/mac/ScrollingTreeScrollingNodeMac.h:
-            * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
-            (WebCore::ScrollingTreeScrollingNodeMac::adjustScrollPositionToBoundsIfNecessary):
-            * platform/mac/ScrollAnimatorMac.h:
-            * platform/mac/ScrollAnimatorMac.mm:
-            (WebCore::ScrollAnimatorMac::adjustScrollPositionToBoundsIfNecessary):
-            * platform/mac/ScrollElasticityController.h:
-            * platform/mac/ScrollElasticityController.mm:
-            (WebCore::ScrollElasticityController::snapRubberBandTimerFired):
</del><ins>+2014-05-14  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2013-12-19  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        [New multicolumn] Spin in RenderMultiColumnSet::repaintFlowThreadContent()
+        https://bugs.webkit.org/show_bug.cgi?id=132884
</ins><span class="cx"> 
</span><del>-        Merge r159463: &lt;rdar://problems/15701094&gt;
</del><ins>+        Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-    2013-11-18  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        On iOS, wikipedia pages can hang under RenderMultiColumnSet::repaintFlowThreadContent().
+        It appears that computedColumnHeight is set to 0 in prepareForLayout, but layout never happens
+        on the RenderMultiColumnSet in some cases, leaving the column height set to zero.
+        This caused columnIndexAtOffset() to return bad values, which resulted in very long loops
+        in repaintFlowThreadContent().
+        
+        This fix is a stop-gap.
</ins><span class="cx"> 
</span><del>-            At some scales, opaque compositing layers have garbage pixels around the edges
-            ​https://bugs.webkit.org/show_bug.cgi?id=124541
</del><ins>+        * rendering/RenderMultiColumnSet.cpp:
+        (WebCore::RenderMultiColumnSet::columnIndexAtOffset):
</ins><span class="cx"> 
</span><del>-            Reviewed by Dean Jackson.
</del><ins>+2014-05-14  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Layers get marked as having opaque contents when their background is
-            known to paint the entire layer. However, this failed to take into
-            account two reasons why every pixel may not get painted.
</del><ins>+        Remove FrameView::viewportConstrainedExtentRect, it is unused
+        https://bugs.webkit.org/show_bug.cgi?id=132927
</ins><span class="cx"> 
</span><del>-            First, subpixel layout can result in non-integral RenderLayer
-            bounds, which will get rounded up to an integral GraphicsLayer
-            size. When this happens we may not paint edge pixels.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-            Second, at non-integral scale factors, graphics context scaling
-            may cause us to not paint edge pixels.
</del><ins>+        * page/FrameView.cpp:
+        (WebCore::FrameView::viewportConstrainedExtentRect): Deleted.
+        * page/FrameView.h:
+        Simon replaced this by viewportConstrainedVisibleContentRect, remove the old code.
</ins><span class="cx"> 
</span><del>-            Fix by only marking PlatformCALayers as having opaque contents
-            when the contentsScale of the layer is integral.
</del><ins>+2014-05-14  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Not testable, because we can't guarantee to get garbage pixels
-            in a ref test, and layer dumps show GraphicsLayer's notion of
-            content opaqueness, not the one we set on the PlatformCALayer.
</del><ins>+        Only define MAX_GRID_TRACK_REPETITIONS if CSS_GRID_LAYOUT is enabled.
</ins><span class="cx"> 
</span><del>-            * platform/graphics/ca/GraphicsLayerCA.cpp:
-            (WebCore::isIntegral):
-            (WebCore::clampedContentsScaleForScale):
-            (WebCore::GraphicsLayerCA::updateRootRelativeScale):
-            (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers):
-            (WebCore::GraphicsLayerCA::updateContentsOpaque):
-            (WebCore::GraphicsLayerCA::getTransformFromAnimationsWithMaxScaleImpact):
-            Drive-by typo fix.
-            (WebCore::GraphicsLayerCA::noteChangesForScaleSensitiveProperties):
-            * platform/graphics/ca/GraphicsLayerCA.h:
-            * rendering/RenderLayerBacking.cpp:
-            (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-2013-12-19  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        This was causing -Wunused-const-variable errors.
</ins><span class="cx"> 
</span><del>-        Merge r160791: &lt;rdar://problems/15694289&gt;
</del><ins>+        * css/CSSParser.cpp: Add include guard.
</ins><span class="cx"> 
</span><del>-    2013-12-18  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+2014-05-14  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Starting a momentum scroll while rubber banding can cause scrolling to jump back 
-            when the rubberband snaps
-            https://bugs.webkit.org/show_bug.cgi?id=119507
-            -and corresponding-
-            &lt;rdar://problem/14655893&gt;
</del><ins>+        Tile cache has way too many tiles when pinch-zoomed in
+        https://bugs.webkit.org/show_bug.cgi?id=132929
+        -and corresponding-
+        &lt;rdar://problem/16527172&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Simon Fraser.
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-            This line of code was added with the very first implementation of rubber-banding. 
-            As far as I can tell, it was always a belt-and-suspenders line of code that is a 
-            no-op in all normal rubber-banding. In this J-shaped scrolling case, this line of 
-            code is what causes the bug to occur because this line of code assumes that your 
-            rubber-band is always trying to take you back to the origin. 
-            * platform/mac/ScrollElasticityController.mm:
-            (WebCore::ScrollElasticityController::snapRubberBandTimerFired):
</del><ins>+        This patch makes the margin sizing functions return the set margin size scaled by 
+        the TileGrid's scale. We also need to get rid of the old notion we used to have
+        that margin tiles might be allowed to have a different size than the other tiles. 
+        We don't want that. They should have the normal margin size, but they should
+        affect the overall coverage area.
</ins><span class="cx"> 
</span><del>-2013-12-19  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Scale by the TileGrid's scale.
+        * platform/graphics/ca/mac/TileController.mm:
+        (WebCore::TileController::topMarginHeight):
+        (WebCore::TileController::bottomMarginHeight):
+        (WebCore::TileController::leftMarginWidth):
+        (WebCore::TileController::rightMarginWidth):
</ins><span class="cx"> 
</span><del>-        Merge r160819: &lt;rdar://problems/15701133&gt;
</del><ins>+        Get rid of adjustRectAtTileIndexForMargin() since we do not want to ever do this 
+        adjustment. Use tileSize instead of margin size for all sizing computations.
+        * platform/graphics/ca/mac/TileGrid.h:
+        * platform/graphics/ca/mac/TileGrid.mm:
+        (WebCore::TileGrid::rectForTileIndex):
+        (WebCore::TileGrid::getTileIndexRangeForRect):
+        (WebCore::TileGrid::adjustRectAtTileIndexForMargin): Deleted.
</ins><span class="cx"> 
</span><del>-    2013-12-18  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+2014-05-14  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Crash in WebCore::LogicalSelectionOffsetCaches::LogicalSelectionOffsetCaches
-            https://bugs.webkit.org/show_bug.cgi?id=125970
</del><ins>+        [Mac] Search fields should not use centered look
+        https://bugs.webkit.org/show_bug.cgi?id=132930
+        &lt;rdar://problem/16825842&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Antti Koivisto.
</del><ins>+        Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-            The bug was caused by containingBlockForAbsolutePosition returning a non-RenderBlock render object.
-            Fixed the bug by obtaining its containg block.
</del><ins>+        We need to explicitly set the centeredLook property
+        to NO on modern releases of Mac.
</ins><span class="cx"> 
</span><del>-            Also changed the return type of containingBlockForFixedPosition, containingBlockForAbsolutePosition,
-            containingBlockForObjectInFlow from RenderElement to RenderBlock as all callers of these functions
-            had assumed the return value to be an instance of RenderBlock.
</del><ins>+        * rendering/RenderThemeMac.mm: Declare a new private property and set it to NO.
+        (WebCore::RenderThemeMac::search):
</ins><span class="cx"> 
</span><del>-            Test: svg/text/select-text-inside-non-static-position.html
</del><ins>+2014-05-14  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * rendering/LogicalSelectionOffsetCaches.h:
-            (WebCore::containingBlockForFixedPosition):
-            (WebCore::containingBlockForAbsolutePosition):
-            (WebCore::containingBlockForObjectInFlow):
-            (WebCore::LogicalSelectionOffsetCaches::LogicalSelectionOffsetCaches):
</del><ins>+        Subpixel layout: Change Element.offset* client* scroll* return type to double.
+        https://bugs.webkit.org/show_bug.cgi?id=132895
</ins><span class="cx"> 
</span><del>-2013-12-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Merged patch from &lt;rdar://problems/15474133&gt;.  This patch is a port of r157821.
</del><ins>+        This patch changes Element.offset*, Element.client* and Element.scroll* APIs return
+        type from long to double to match the latest CSSOM View Module spec[1].
+        Element.offset* and Element.client* do return subpixel values from now on.
+        Element.scroll* still return integral values as the scrolling code hasn't adopted to subpixel rendering yet.
</ins><span class="cx"> 
</span><del>-    2013-10-22  Samuel White  &lt;samuel_white@apple.com&gt;
</del><ins>+        subpixelCSSOMElementMetricsEnabled setting is added to be able to turn this feature on/off
+        from WK2 preferences. It toggles the return value from subpixel to floored integral.
+        It does not change layout/rendering behavior.
</ins><span class="cx"> 
</span><del>-            AX: Add paramAttrs to fetch start and end text markers in a given rect.
-            https://bugs.webkit.org/show_bug.cgi?id=122164
</del><ins>+        Reference list of what other browsers do:
+        IE: http://blogs.msdn.com/b/ie/archive/2012/02/17/sub-pixel-rendering-and-the-css-object-model.aspx
+        Blink: http://www.chromestatus.com/features/5497402177880064
+        Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=825607
</ins><span class="cx"> 
</span><del>-            Unreviewed change.
</del><ins>+        [1] http://www.w3.org/TR/2013/WD-cssom-view-20131217/
</ins><span class="cx"> 
</span><del>-            Added ability to fetch end and start text markers inside a given bounds. This gives ScreenReaders
-            like VoiceOver a way to retrieve the text markers for a specified column of page text.
</del><ins>+        Test: cssom/subpixel-offsetleft-top-width-height-values.html
</ins><span class="cx"> 
</span><del>-            Test: platform/mac/accessibility/text-marker-for-bounds.html
</del><ins>+        * dom/Element.cpp:
+        (WebCore::localZoomForRenderer):
+        (WebCore::adjustForLocalZoom):
+        (WebCore::convertToNonSubpixelValueIfNeeded):
+        (WebCore::Element::offsetLeft):
+        (WebCore::Element::offsetTop):
+        (WebCore::Element::offsetWidth):
+        (WebCore::Element::offsetHeight):
+        (WebCore::Element::clientLeft):
+        (WebCore::Element::clientTop):
+        (WebCore::Element::clientWidth):
+        (WebCore::Element::clientHeight):
+        (WebCore::Element::scrollLeft):
+        (WebCore::Element::scrollTop):
+        (WebCore::Element::setScrollLeft):
+        (WebCore::Element::setScrollTop):
+        (WebCore::Element::scrollWidth):
+        (WebCore::Element::scrollHeight):
+        * dom/Element.h:
+        * dom/Element.idl:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::adjustForZoom):
+        (WebCore::HTMLBodyElement::scrollLeft):
+        (WebCore::HTMLBodyElement::setScrollLeft):
+        (WebCore::HTMLBodyElement::scrollTop):
+        (WebCore::HTMLBodyElement::setScrollTop):
+        (WebCore::HTMLBodyElement::scrollHeight):
+        (WebCore::HTMLBodyElement::scrollWidth):
+        * html/HTMLBodyElement.h:
+        * page/Settings.in:
</ins><span class="cx"> 
</span><del>-            * accessibility/AccessibilityObject.cpp:
-            (WebCore::AccessibilityObject::mainFrame):
-            (WebCore::AccessibilityObject::topDocument):
-            (WebCore::AccessibilityObject::visiblePositionForBounds):
-            * accessibility/AccessibilityObject.h:
-            * accessibility/AccessibilityRenderObject.cpp:
-            * accessibility/AccessibilityRenderObject.h:
-            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
-            (-[WebAccessibilityObjectWrapper screenToContents:]):
-            (-[WebAccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
-            (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
</del><ins>+2014-05-14  Brady Eidson  &lt;beidson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2013-12-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        Implement NSSharingServiceDelegate method &quot;transitionImageForShareItem&quot;
+        &lt;rdar://problem/16878020&gt; and https://bugs.webkit.org/show_bug.cgi?id=132911
</ins><span class="cx"> 
</span><del>-        Merge r154513
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-    2013-08-23  Alex Christensen  &lt;achristensen@apple.com&gt;
</del><ins>+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
</ins><span class="cx"> 
</span><del>-            Re-separating Win32 and Win64 builds.
-            https://bugs.webkit.org/show_bug.cgi?id=120178
</del><ins>+2014-05-14  Alex Christensen  &lt;achristensen@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Brent Fulgham.
</del><ins>+        Another unreviewed build fix.
</ins><span class="cx"> 
</span><del>-            * WebCore.vcxproj/WebCoreGenerated.make:
-            * WebCore.vcxproj/WebCoreGeneratedWinCairo.make:
-            Pass PlatformArchitecture as a command line parameter to bash scripts
-            and use PlatformArchitecture to determine which directory to delete
-            while cleaning (obj32 or obj64).
-            * WebCore.vcxproj/WebCoreGeneratedWinCairoCommon.props:
-            Export PlatformArchitecture to be used by make and cmd scripts.
-            * WebCore.vcxproj/build-generated-files.sh:
-            Use PlatformArchitecture from command line to determine which object directory to use (obj32 or obj64).
-            * WebCore.vcxproj/copyForwardingHeaders.cmd:
-            * WebCore.vcxproj/copyWebCoreResourceFiles.cmd:
-            Use PlatformArchitecture to determine which directory to copy to (obj32 or obj64).
</del><ins>+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::getTimingData):
+        Added necessary UNUSED_PARAMs.
</ins><span class="cx"> 
</span><del>-2013-12-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+2014-05-14  Alex Christensen  &lt;achristensen@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Rollout r160469.  Not rolling out from trunk because r160469 was
-        applied on the branch from a patch file.
</del><ins>+        Unreviewed build fix after r168849.
</ins><span class="cx"> 
</span><del>-2013-12-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::getTimingData):
+        Protect use of timing data with ENABLE(WEB_TIMING).
</ins><span class="cx"> 
</span><del>-        Merge r157821
</del><ins>+2014-05-14  Alex Christensen  &lt;achristensen@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-    2013-10-22  Samuel White  &lt;samuel_white@apple.com&gt; 
</del><ins>+        Refactor duplicate code in web timing.
+        https://bugs.webkit.org/show_bug.cgi?id=132917
</ins><span class="cx"> 
</span><del>-            AX: Add paramAttrs to fetch start and end text markers in a given rect. 
-            https://bugs.webkit.org/show_bug.cgi?id=122164 
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-            Reviewed by Chris Fleizach. 
</del><ins>+        * platform/network/ResourceHandle.h:
+        Added getTimingData declaration.
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::getTimingData):
+        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
+        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveResponse:]):
+        Moved duplicate code to ResourceHandle.
</ins><span class="cx"> 
</span><del>-            Added ability to fetch end and start text markers inside a given bounds. This gives ScreenReaders
-            like VoiceOver a way to retrieve the text markers for a specified column of page text.
</del><ins>+2014-05-14  Alex Christensen  &lt;achristensen@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-            Test: platform/mac/accessibility/text-marker-for-bounds.html
</del><ins>+        Use references instead of pointers with ResourceLoadTiming.
+        https://bugs.webkit.org/show_bug.cgi?id=132846
</ins><span class="cx"> 
</span><del>-            * accessibility/AccessibilityObject.cpp:
-            (WebCore::AccessibilityObject::mainFrame):
-            (WebCore::AccessibilityObject::topDocument):
-            (WebCore::AccessibilityObject::visiblePositionForBounds):
-            * accessibility/AccessibilityObject.h:
-            * accessibility/AccessibilityRenderObject.cpp:
-            * accessibility/AccessibilityRenderObject.h:
-            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
-            (-[WebAccessibilityObjectWrapper screenToContents:]):
-            (-[WebAccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
-            (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-2013-12-11  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        * WebCore.exp.in:
+        Removed ResourceResponseBase::setResourceLoadTiming linker symbol.
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::buildObjectForResourceResponse):
+        * page/PerformanceResourceTiming.cpp:
+        (WebCore::PerformanceResourceTiming::domainLookupStart):
+        (WebCore::PerformanceResourceTiming::domainLookupEnd):
+        (WebCore::PerformanceResourceTiming::connectStart):
+        (WebCore::PerformanceResourceTiming::connectEnd):
+        (WebCore::PerformanceResourceTiming::secureConnectionStart):
+        (WebCore::PerformanceResourceTiming::requestStart):
+        Use references instead of pointers.
+        * page/PerformanceResourceTiming.h:
+        Make an instance instead of a RefPtr.
+        * page/PerformanceTiming.cpp:
+        (WebCore::PerformanceTiming::domainLookupStart):
+        (WebCore::PerformanceTiming::domainLookupEnd):
+        (WebCore::PerformanceTiming::connectStart):
+        (WebCore::PerformanceTiming::connectEnd):
+        (WebCore::PerformanceTiming::secureConnectionStart):
+        (WebCore::PerformanceTiming::requestStart):
+        (WebCore::PerformanceTiming::responseStart):
+        Check to see if the loader exists, then use ResourceLoadTiming reference.
+        (WebCore::PerformanceTiming::resourceLoadTiming): Deleted.
+        * page/PerformanceTiming.h:
+        Removed resourceLoadTiming declaration.
+        * platform/network/ResourceLoadTiming.h:
+        (WebCore::ResourceLoadTiming::ResourceLoadTiming):
+        (WebCore::ResourceLoadTiming::operator=):
+        Replaced reference counting with copy constructors.
+        (WebCore::ResourceLoadTiming::create): Deleted.
+        (WebCore::ResourceLoadTiming::deepCopy): Deleted.
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::adopt):
+        (WebCore::ResourceResponseBase::copyData):
+        (WebCore::ResourceResponseBase::resourceLoadTiming):
+        (WebCore::ResourceResponseBase::setResourceLoadTiming):
+        (WebCore::ResourceResponseBase::compare):
+        * platform/network/ResourceResponseBase.h:
+        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
+        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveResponse:]):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::didStartRequest):
+        (WebCore::networkEventCallback):
+        Use references instead of pointers.
</ins><span class="cx"> 
</span><del>-        Merge r159691
</del><ins>+2014-05-14  Commit Queue  &lt;commit-queue@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-    2013-11-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Unreviewed, rolling out r168837.
+        https://bugs.webkit.org/show_bug.cgi?id=132913
</ins><span class="cx"> 
</span><del>-            [Win] Avoid deadlock when interacting with some AVFoundationCF content
-            &lt;rdar://problem/15482977&gt; and https://bugs.webkit.org/show_bug.cgi?id=124752
</del><ins>+        The patch added an assertion which fires on 6 tests (Requested
+        by ap on #webkit).
</ins><span class="cx"> 
</span><del>-            Prevent deadlock caused by conflict over the &quot;mapLock&quot; mutex. Notification handling in the file,
-            which modify assets and make other changes, are required to happen on the main thread. This
-            patch enforces this requirement.
</del><ins>+        Reverted changeset:
</ins><span class="cx"> 
</span><del>-            Reviewed by Eric Carlson.
</del><ins>+        &quot;[CSS Regions] Add ASSERT to make sure using the flowThread
+        cache does not return incorrect results&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=132906
+        http://trac.webkit.org/changeset/168837
</ins><span class="cx"> 
</span><del>-            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
-            (WebCore::NotificationCallbackData::NotificationCallbackData): Added
-            (WebCore::AVFWrapper::processNotification): Moved logic from 'notificationCallback', which was
-            sometimes happening on a background thread.
-            (WebCore::AVFWrapper::notificationCallback): Dispatch calls to main thread.
</del><ins>+2014-05-13  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2013-12-11  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        Revert &quot;Don't dispatch 'beforeload' event inside FrameView::layout()&quot;,
+        commit 84fe8cf6fbe8b5de9a06300ca3ef6d0ffc96948c, and associated
+        follow-up fixes:
</ins><span class="cx"> 
</span><del>-        Merge r159460
</del><ins>+            &quot;platform/mac/plugins/testplugin-onnew-onpaint.html failing after
+                r168668&quot;, commit c17be3bf5127baf94310af4b4b9bf5a57d29aaf4
+            &quot;[Win] Unreviewed build fix after r168668.&quot;, commit
+                4fa470ad12c38ee7d4c114541b6dd321181a8bc9
</ins><span class="cx"> 
</span><del>-    2013-11-18  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+        The original merged patch appears to have caused a regression in
+        fast/dom/HTMLObjectElement/object-as-frame.html.
</ins><span class="cx"> 
</span><del>-            Add a quirk to not respect center text-align when positioning
</del><ins>+        &lt;https://bugs.webkit.org/show_bug.cgi?id=132886&gt;
</ins><span class="cx"> 
</span><del>-            &lt;rdar://problem/15427571&gt;
-            https://bugs.webkit.org/show_bug.cgi?id=124522
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-            Reviewed by Simon Fraser.
</del><ins>+        * WebCore.exp.in:
+        * dom/Document.cpp:
+        (WebCore::Document::updateLayoutIgnorePendingStylesheets):
+        * dom/Document.h:
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::renderWidgetForJSBindings):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::flushAnyPendingPostLayoutTasks):
+        (WebCore::FrameView::performPostLayoutTasks):
+        (WebCore::FrameView::updateEmbeddedObjectsTimerFired): Deleted.
+        * page/FrameView.h:
+        * testing/Internals.cpp:
+        (WebCore::Internals::updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks): Deleted.
+        * testing/Internals.h:
+        * testing/Internals.idl:
</ins><span class="cx"> 
</span><del>-            Added fast/block/legacy-text-align-position-quirk.html
</del><ins>+2014-05-14  Kiran  &lt;kiran.guduru@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-            * page/Settings.in:
-            Add the quirk setting.
</del><ins>+        alidation for getUserMedia() errorCallback is missing.
+        https://bugs.webkit.org/show_bug.cgi?id=132901
</ins><span class="cx"> 
</span><del>-            * rendering/RenderBlockLineLayout.cpp:
-            (WebCore::RenderBlock::startAlignedOffsetForLine):
-            Don't pay attention to center text-align when the quirk is set.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2013-12-10  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        The patch adds the validation for getUserMedia errorCallBack
+        and throws TypeMismatchError.
</ins><span class="cx"> 
</span><del>-        Merge 154333
</del><ins>+        Test: fast/mediastream/getusermedia.html 
</ins><span class="cx"> 
</span><del>-    2013-08-20  Alex Christensen  &lt;achristensen@apple.com&gt;
</del><ins>+        * Modules/mediastream/NavigatorUserMedia.cpp:
+        (WebCore::NavigatorUserMedia::webkitGetUserMedia):
</ins><span class="cx"> 
</span><del>-            Use PlatformArchitecture to distinguish between 32-bit and 64-bit builds on Windows.
-            https://bugs.webkit.org/show_bug.cgi?id=119512
</del><ins>+2014-05-14  Tibor Meszaros  &lt;tmeszaros.u-szeged@partner.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Brent Fulgham.
</del><ins>+        Remove CSS_STICKY_POSITION guards
+        https://bugs.webkit.org/show_bug.cgi?id=132676
</ins><span class="cx"> 
</span><del>-            * WebCore.vcxproj/WebCore.vcxproj:
-            * WebCore.vcxproj/WebCore.vcxproj.filters:
-            * WebCore.vcxproj/WebCoreCommon.props:
-            * WebCore.vcxproj/WebCoreGeneratedCommon.props:
-            * WebCore.vcxproj/WebCoreTestSupport.vcxproj:
-            * WebCore.vcxproj/WebCoreTestSupport.vcxproj.filters:
-            Replaced obj32, bin32, and lib32 with macros for 64-bit build.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-2013-12-10  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * Configurations/FeatureDefines.xcconfig:
+        * css/CSSParser.cpp:
+        (WebCore::isValidKeywordPropertyAndValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EPosition):
+        * css/CSSValueKeywords.in:
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::convertPositionStyle):
</ins><span class="cx"> 
</span><del>-        Merge 152982
</del><ins>+2014-05-14  Radu Stavila  &lt;stavila@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-07-22  Alex Christensen  &lt;achristensen@apple.com&gt;
</del><ins>+        [CSS Regions] Add ASSERT to make sure using the flowThread cache does not return incorrect results
+        https://bugs.webkit.org/show_bug.cgi?id=132906
</ins><span class="cx"> 
</span><del>-            Added assembly files to Windows 64-bit builds.
-            https://bugs.webkit.org/show_bug.cgi?id=118931
</del><ins>+        Reviewed by Andrei Bucur.
</ins><span class="cx"> 
</span><del>-            Reviewed by Brent Fulgham.
</del><ins>+        If flowThreadContainingBlock() is called on an object which is in a different
+        flow thread than the one currently being laid out, this method will return an incorrect
+        result. I added an assertion for that to make sure we catch and treat any such scenarios.
</ins><span class="cx"> 
</span><del>-            * WebCore.vcxproj/WebCore.vcxproj: Added PaintHooks.asm for x64 and enabled MASM.
-            * WebCore.vcxproj/WebCore.vcxproj.filters: Added PaintHooks.asm.
</del><ins>+        No new tests required.
</ins><span class="cx"> 
</span><del>-2013-12-10  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::locateFlowThreadContainingBlockNoCache):
+        (WebCore::RenderObject::locateFlowThreadContainingBlock):
+        * rendering/RenderObject.h:
</ins><span class="cx"> 
</span><del>-        Merge 152921
</del><ins>+2014-05-14  Andrei Bucur  &lt;abucur@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-07-19  Alex Christensen  &lt;achristensen@apple.com&gt;
</del><ins>+        [CSS Regions] Don't relayout when updating the region range unless necessary
+        https://bugs.webkit.org/show_bug.cgi?id=132120
</ins><span class="cx"> 
</span><del>-            Added x64 configuration to Visual Studio build.
-            https://bugs.webkit.org/show_bug.cgi?id=118888
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-            Reviewed by Brent Fulgham.
</del><ins>+        The patch reduces the cases when a relayout is made for boxes that change the region range.
+        This lowers the amount of nested layouts in most cases and produces big layout speedups for trees
+        without overhanging floats.
</ins><span class="cx"> 
</span><del>-            * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj:
-            * WebCore.vcxproj/WebCore.vcxproj:
-            * WebCore.vcxproj/WebCoreGenerated.vcxproj:
-            * WebCore.vcxproj/WebCoreTestSupport.vcxproj:
</del><ins>+        Tests: Major performance improvement with speedups of 50-60% on:
+        Layout/RegionsAuto.html, Layout/RegionsAutoMaxHeight.html and Layout/RegionsFixed.html
</ins><span class="cx"> 
</span><del>-2013-11-20  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateRegionRangeForBoxChild): Ask the child box if it needs a relayout
+        in case its region range changes.
+        * rendering/RenderBlockFlow.cpp:
+        (WebCore::RenderBlockFlow::layoutBlockChild): It's not necessary to do two layouts here because
+        there's no block direction position change between them for the child.
+        (WebCore::RenderBlockFlow::needsLayoutAfterRegionRangeChange): If the block doesn't have floats
+        or if it expands to enclose the floats it doesn't need to relayout after a region range chage.
+        It's not possible for it to have a float inside overflow that must be repositioned using the new
+        range.
+        * rendering/RenderBlockFlow.h:
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::needsLayoutAfterRegionRangeChange): By default don't relayout after a region
+        range change.
</ins><span class="cx"> 
</span><del>-        Merge r159481
</del><ins>+2014-05-14  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-11-18  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        RuleData should ref the StyleRule
+        https://bugs.webkit.org/show_bug.cgi?id=132865
</ins><span class="cx"> 
</span><del>-            use after free in WebCore::DocumentOrderedMap::remove / WebCore::TreeScope::removeElementById
-            https://bugs.webkit.org/show_bug.cgi?id=121324
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-            Reviewed by Ryosuke Niwa.
</del><ins>+        As a defensive move make RuleData ref the StyleRule. 
+        This adds some ref churn but the overall performance impact should be minimal.
</ins><span class="cx"> 
</span><del>-            Update the document ordered map for an image element before dispatching load or error events
-            when it's inserted into a document.
</del><ins>+        * css/RuleSet.h:
+        (WebCore::RuleData::rule):
</ins><span class="cx"> 
</span><del>-            Test: fast/dom/modify-node-and-while-in-the-callback-too-crash.html
</del><ins>+2014-05-14  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * dom/DocumentOrderedMap.cpp: defensive fix to avoid use after free issues.
-            (WebCore::DocumentOrderedMap::remove):
-            * html/HTMLImageElement.cpp:
-            (WebCore::HTMLImageElement::insertedInto):
-            * loader/ImageLoader.cpp:
-            (WebCore::ImageLoader::updateFromElement): setting m_failedLoadURL makes
-            repeated updateFromElement calls return early.
</del><ins>+        GIF animations don't restart after scrolling on iOS WebKit1
+        https://bugs.webkit.org/show_bug.cgi?id=132900
</ins><span class="cx"> 
</span><del>-2013-11-13  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        &lt;rdar://problem/15292359&gt;
-        Fix incorrect merge of r157299 made in r158605.
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        * platform/graphics/DisplayRefreshMonitor.cpp:
-        (WebCore::DisplayRefreshMonitor::removeClient): Remember to remove clients
-        from m_clientsToBeNotified.
-        * platform/graphics/DisplayRefreshMonitor.h: Might as well make the code
-        more consistent with ToT while I'm here.
</del><ins>+2014-05-13  Andrei Bucur  &lt;abucur@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-2013-11-08  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        [CSS Regions] Assertion failure in some cases with inline blocks
+        https://bugs.webkit.org/show_bug.cgi?id=132859
</ins><span class="cx"> 
</span><del>-        Merge r152867
</del><ins>+        Reviewed by Mihnea Ovidenie.
</ins><span class="cx"> 
</span><del>-    2013-07-18  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        The patch hardens the conditions when the region range caches are
+        populated to avoid desynchronizations when objects move during layout.
+        This is true especially in the case of the boxes found inside
+        inline blocks, that get their range from the containing line.
</ins><span class="cx"> 
</span><del>-            New PDFPlugin doesn't support WebKitOmitPDFSupport, acts as if Plug-ins are off
-            https://bugs.webkit.org/show_bug.cgi?id=118858
</del><ins>+        There is a new function |computedRegionRangeForBox| that will always
+        return a region range for a box using a best effort algorithm. This should
+        be used only when there's no need to cache region information.
</ins><span class="cx"> 
</span><del>-            Reviewed by Eric Carlson.
</del><ins>+        This change also allows better control over the lifecycle of the
+        |RenderBoxRegionInfo| objects stored on the regions. We can now iterate
+        over the full range of the box when cleaning up the region box info. The
+        same applies for the width change detection function.
</ins><span class="cx"> 
</span><del>-            Expand the scope of rejecting non video/ or audio/ MIME types when
-            filling the MIME type cache.
</del><ins>+        Test: fast/regions/inline-block-shifted-region.html
</ins><span class="cx"> 
</span><del>-            * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-            (WebCore::shouldRejectMIMEType): Added utility function.
</del><ins>+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlockFlow::updateRegionForLine): Don't set the containing
+        region if the block doesn't have a range. The returned value would not
+        be correctly clamped.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBlock::hasRegionRangeInFlowThread):
+        * rendering/RenderBox.h:
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::removeRenderBoxRegionInfo): Iterate only over
+        the range of the box, not from the start of the region chain.
+        (WebCore::RenderFlowThread::logicalWidthChangedInRegionsForBlock): Same as
+        above.
+        (WebCore::RenderFlowThread::hasCachedRegionRangeForBox):
+        (WebCore::RenderFlowThread::getRegionRangeForBoxFromCachedInfo):
+        (WebCore::RenderFlowThread::getRegionRangeForBox):
+        (WebCore::RenderFlowThread::computedRegionRangeForBox): Best effort function
+        to determine the range of a box. It will always return something as long
+        as the flow thread has regions.
+        (WebCore::RenderFlowThread::objectShouldFragmentInFlowRegion): Use the new function
+        to determine the range.
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderNamedFlowThread.cpp:
+        (WebCore::RenderNamedFlowThread::absoluteQuadsForBox): Use the new function to determine
+        the range.
</ins><span class="cx"> 
</span><del>-2013-11-07  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+2014-05-13  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r158743
</del><ins>+        Fix &quot;ASSERTION FAILED: m_representation == PlatformLayerRepresentation&quot; with UI-side compositing
+        https://bugs.webkit.org/show_bug.cgi?id=132899
</ins><span class="cx"> 
</span><del>-    2013-11-06  Chris Fleizach  &lt;cfleizach@apple.com&gt; 

-        AX: Audio and Video attachments are not output to VoiceOver 
-        https://bugs.webkit.org/show_bug.cgi?id=123479 
</del><ins>+        Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada. 
</del><ins>+        Export some things
</ins><span class="cx"> 
</span><del>-        Video and audio elements don't appear as distinct objects in the AX hierarchy, 
-        nor are they treated as replaceable objects when emitting the text. We should 
-        treat these characters like attachments, for one. On the Mac platform, we should 
-        also identify them with special subroles. 
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        Tests: platform/mac/accessibility/media-emits-object-replacement.html 
-              platform/mac/accessibility/media-role-descriptions.html 

-        * accessibility/AccessibilityNodeObject.cpp: 
-        (WebCore::AccessibilityNodeObject::isGenericFocusableElement): 
-        * accessibility/AccessibilityObject.h: 
-        * accessibility/AccessibilityRenderObject.cpp: 
-        (WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored): 
-        (WebCore::AccessibilityRenderObject::determineAccessibilityRole): 
-        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm: 
-        (createAccessibilityRoleMap): 
-        (-[WebAccessibilityObjectWrapper subrole]): 
-        (-[WebAccessibilityObjectWrapper roleDescription]): 
-        * editing/TextIterator.cpp: 
-        (WebCore::isRendererReplacedElement): 
</del><ins>+2014-05-13  Hans Muller  &lt;hmuller@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-2013-11-06  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        [CSS Shapes] line height grows around polygon and incorrectly causes text to wrap to next line
+        https://bugs.webkit.org/show_bug.cgi?id=131622
</ins><span class="cx"> 
</span><del>-        Merge r158617
</del><ins>+        Reviewed by Bem Jones-Bey.
</ins><span class="cx"> 
</span><del>-    2013-11-04  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        Corrected an earlier PolygonShape fix https://bugs.webkit.org/show_bug.cgi?id=132132
+        When the top or bottom of a layout line is coincident with a polygon edge vertex, we
+        only consider it an intersection if the edge extends into the line.
</ins><span class="cx"> 
</span><del>-            AX: Mail attachments at the start of an email are not output by VoiceOver
-            https://bugs.webkit.org/show_bug.cgi?id=123697
</del><ins>+        Test: fast/shapes/shape-outside-floats/shape-outside-edge-case.html
</ins><span class="cx"> 
</span><del>-            Reviewed by Ryosuke Niwa.
</del><ins>+        * rendering/shapes/PolygonShape.cpp:
+        (WebCore::OffsetPolygonEdge::clippedEdgeXRange):
</ins><span class="cx"> 
</span><del>-            VoiceOver is expecting that &quot;replaced elements&quot; (attachments in a Mail message in this case) to be
-            represented by the replacement character when asking for a stringForRange.
</del><ins>+2014-05-13  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            However, when that replaced element is at the beginning of the document, the logic does not work because
-            there is a few code places that will take that first Position and advance it forward, not accounting for replaced elements.
-            When using the TextIterator normally, it does account for these, so that's why it's only affecting as at the beginning of the document.
</del><ins>+        m_layerForOverhangAreas is sometimes not positioned correctly when topContentInset 
+        has changed
+        https://bugs.webkit.org/show_bug.cgi?id=132898
+        -and corresponding-
+        &lt;rdar://problem/16644710&gt;
</ins><span class="cx"> 
</span><del>-            Also a &quot;replaced element&quot; can be more than just renderer-&gt;isReplaced(), hence the externing of the isRendererReplacedElement method
-            and using that it in pertinent places.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-            Tests: platform/mac/accessibility/object-replacement-with-no-rendered-children-at-node-start.html
-                   platform/mac/accessibility/object-replacement-with-rendered-children-at-node-start.html
</del><ins>+        This function is called whenever the topContentInset changes, so use it as an 
+        opportunity to ensure that m_layerForOverhangAreas has been positioned correctly.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::frameViewDidChangeSize):
</ins><span class="cx"> 
</span><del>-            * accessibility/AccessibilityObject.cpp:
-            (WebCore::replacedNodeNeedsCharacter):
-            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
-            (nsStringForReplacedNode):
-            * dom/Position.cpp:
-            (WebCore::Position::isCandidate):
-            * dom/PositionIterator.cpp:
-            * dom/Range.cpp:
-            (WebCore::Range::firstNode):
-            * editing/TextIterator.cpp:
-            (WebCore::isRendererReplacedElement):
-            * editing/TextIterator.h:
</del><ins>+        Everyone gets an anchor point!
+        (WebCore::RenderLayerCompositor::updateOverflowControlsLayers):
</ins><span class="cx"> 
</span><del>-2013-11-06  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+2014-05-13  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r158629
</del><ins>+        Attempted build fix after https://bugs.webkit.org/show_bug.cgi?id=132891
</ins><span class="cx"> 
</span><del>-    2013-11-04  Samuel White  &lt;samuel_white@apple.com&gt;
</del><ins>+        * page/PageDebuggable.cpp:
</ins><span class="cx"> 
</span><del>-            AX: AXShowMenu doesn't always work.
-            https://bugs.webkit.org/show_bug.cgi?id=123649
</del><ins>+2014-05-13  Timothy Hatcher  &lt;timothy@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Chris Fleizach.
</del><ins>+        Force developerExtrasEnabled when a remote Inspector client connects.
</ins><span class="cx"> 
</span><del>-            No new tests, the change occurs in a code path that forces the context menu to show which
-            locks up DRT if we try to test it (platform menu is shown). The change itself gives the mouse
-            event handler a chance to handle our platform mouse event BEFORE the event ends up in the show
-            context menu machinery. This is necessary because without it, the element will not become
-            focused. Without focus, accessibility shows different/less menu items than a mouse click. The
-            end result is that context menus shown via accessibility are consistent with menus shown via click.
</del><ins>+        https://bugs.webkit.org/show_bug.cgi?id=132891
</ins><span class="cx"> 
</span><del>-            * page/ContextMenuController.cpp:
-            (WebCore::ContextMenuController::showContextMenuAt):
</del><ins>+        Reviewed by Joseph Pecoraro.
</ins><span class="cx"> 
</span><del>-2013-11-06  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        * page/PageDebuggable.cpp:
+        (WebCore::PageDebuggable::PageDebuggable): Initialize m_forcedDeveloperExtrasEnabled to false.
+        (WebCore::PageDebuggable::connect): Set m_forcedDeveloperExtrasEnabled if the setting is changed.
+        (WebCore::PageDebuggable::disconnect): Switch developerExtrasEnabled back to false
+        if m_forcedDeveloperExtrasEnabled is true.
+        * page/PageDebuggable.h: Added m_forcedDeveloperExtrasEnabled.
</ins><span class="cx"> 
</span><del>-        Merge r154391
</del><ins>+2014-05-13  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-08-21  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        REGRESSION (topContentInset): Searching through Facebook Messenger's chat causes 
+        scrolling in News Feed
+        https://bugs.webkit.org/show_bug.cgi?id=132889
+        -and corresponding-
+        &lt;rdar://problem/16715716&gt;
</ins><span class="cx"> 
</span><del>-            &lt;https://webkit.org/b/120113&gt; [Windows] Enable CSS_IMAGE_SET
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-            Reviewed by Anders Carlsson.
</del><ins>+        First of all, scrollOffsetRelativeToDocument() was very poorly named. This patch 
+        re-names it to the much more accurate documentScrollOffsetRelativeToViewOrigin(). 
+        Re-naming it makes it clear that ONE call site was not getting the right offset. 
+        That call site does not want to know the document’s position relative to the view 
+        origin, but rather it wants to know the Document’s position relative to the 
+        scrolling origin.
</ins><span class="cx"> 
</span><del>-            We can now activate:
-            fast/css/image-set-parsing.html
-            fast/css/image-set-parsing-invalid.html
</del><ins>+        Export new name.
+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-            * WebCore.vcxproj/WebCore.vcxproj: Add missing image set implementation files.
-            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
-            * css/CSSAllInOne.cpp: Add missing CSSImageSetValue.cpp
-            * rendering/style/StyleAllInOne.cpp: Add missing StyeCachedImageSet.cpp
</del><ins>+        Use newly re-named documentScrollPositionRelativeToViewOrigin().
+        * page/FrameView.cpp:
+        (WebCore::FrameView::convertToRenderer):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::documentScrollOffsetRelativeToViewOrigin):
+        (WebCore::ScrollView::documentScrollPositionRelativeToViewOrigin):
+        (WebCore::ScrollView::documentScrollOffsetRelativeToScrollableAreaOrigin):
+        (WebCore::ScrollView::rootViewToContents):
+        (WebCore::ScrollView::windowToContents):
+        (WebCore::ScrollView::scrollOffsetRelativeToDocument): Deleted.
+        (WebCore::ScrollView::scrollPositionRelativeToDocument): Deleted.
+        * platform/ScrollView.h:
</ins><span class="cx"> 
</span><del>-2013-11-04  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        THIS is the spot that needs the new function, 
+        documentScrollOffsetRelativeToScrollableAreaOrigin()()
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollRectToVisible):
</ins><span class="cx"> 
</span><del>-        Merge r155130
</del><ins>+2014-05-13  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-    2013-09-05  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        [iOS] Page scale update messages for media controls should only fire at the end of zooming
+        https://bugs.webkit.org/show_bug.cgi?id=132857
+        &lt;rdar://problem/16631009&gt;
</ins><span class="cx"> 
</span><del>-            [Windows] Unreviewed build/link improvement after r155127 to be
-            consistent about using debug-build support libraries.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-            Now that &lt;rdar://problem/9898937&gt; is resolved, we should be linking
-            to debug AVFoundationCF as well.
</del><ins>+        As the user was zooming, the media controls that responded
+        to the page scale (and resized themselves) would do so
+        slightly out of sync with the screen refreshes, and it looked
+        terrible. They really only need to get told at the end
+        of the zoom that they need to relayout.
</ins><span class="cx"> 
</span><del>-            * page/CaptionUserPreferencesMediaAF.cpp: Link to AVFoundationCF_debug
-            when building with the DEBUG_ALL target.
-            * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp: Ditto.
-            * platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h: Ditto.
</del><ins>+        Allow setPageScaleFactor to accept another parameter
+        that indicates if the change is stable. That way, changes
+        during a user triggers zoom gesture can be ignored for
+        media controls.
</ins><span class="cx"> 
</span><del>-2013-11-04  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        * WebCore.exp.in: Page::setPageScaleFactor takes a new parameter.
+        * dom/Document.cpp:
+        (WebCore::Document::pageScaleFactorChangedAndStable): Renamed from pageScaleFactorChanged.
+        (WebCore::Document::pageScaleFactorChanged): Deleted.
+        * dom/Document.h:
+        * page/Page.cpp:
+        (WebCore::Page::setPageScaleFactor): Accepts a new inStableState parameter,
+        and tells the main frame that the scale factor has changed if it's stable.
+        * page/Page.h:
</ins><span class="cx"> 
</span><del>-        Merge r157773
</del><ins>+2014-05-13  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2013-10-21  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Unreviewed build fix after r168755.
</ins><span class="cx"> 
</span><del>-        [WIN] Properly support reverse animations without needing software fallback.
-        https://bugs.webkit.org/show_bug.cgi?id=85121
</del><ins>+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::metadataDidArrive):
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+2014-05-13  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Testing is provided by existing animation tests.
</del><ins>+        [Mac] hasVideo should return true when video is ready to display
+        https://bugs.webkit.org/show_bug.cgi?id=132885
</ins><span class="cx"> 
</span><del>-        * platform/animation/TimingFunction.h:
-        (WebCore::CubicBezierTimingFunction::createReversed): Added.
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::addAnimation): The early return when performing a reverse or
-        autoreverse animation is no longer needed.
-        * platform/graphics/ca/PlatformCAAnimation.h:
-        * platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
-        (toCAMediaTimingFunction): Use new reversed function.
-        * platform/graphics/ca/win/PlatformCAAnimationWin.cpp:
-        (toCACFTimingFunction): Ditto.
-        (PlatformCAAnimation::setTimingFunction): Pass 'reverse' flag.
-        (PlatformCAAnimation::setTimingFunctions): Ditto.
</del><ins>+        Reviewed by Jer Noble.
</ins><span class="cx"> 
</span><del>-2013-11-04  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseAttribute):
</ins><span class="cx"> 
</span><del>-        Merge r154180
</del><ins>+        * platform/graphics/avfoundation/objc/AudioTrackPrivateAVFObjC.mm:
+        (WebCore::AudioTrackPrivateAVFObjC::resetPropertiesFromTrack): Don't change the
+            enabled state of the AVPlayerItemTrack during setup.
</ins><span class="cx"> 
</span><del>-    2013-08-15  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC): Initialize
+            m_cachedIsReadyForDisplay.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::cancelLoad): Remove &quot;enabled&quot; KVO observers.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoLayer): Observe &quot;readyForDisplay&quot;
+            change notifications.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer): Remove for &quot;readyForDisplay&quot;
+            observer.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::hasAvailableVideoFrame): Return cached readyForDisplay
+            state instead of polling every time.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksChanged): Call setHasVideo(true) if the
+            player layer is ready for display.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::updateAudioTracks): Update logging.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::updateVideoTracks): Ditto.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::firstFrameAvailableDidChange): Cache readyForDisplay
+            state, call tracksChanged() if we haven't seen a video track yet.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::trackEnabledDidChange): New.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::metadataDidArrive): Correct logging.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksDidChange): Remove old &quot;enabled&quot; listeners
+            before release tracks, add new ones to new tracks.
+        (WebCore::assetTrackMetadataKeyNames): Add &quot;enabled&quot; to the list of properties we require to 
+            be loaded before announcing that metadata has loaded.
+        (-[WebCoreAVFMovieObserver observeValueForKeyPath:ofObject:change:context:]): Observe 
+            &quot;readyForDisplay&quot; and &quot;enabled&quot;.
</ins><span class="cx"> 
</span><del>-            [Windows] Prevent dangling CACFLayer when switching to/from Tiled backing.
-            https://bugs.webkit.org/show_bug.cgi?id=119818
</del><ins>+        * platform/graphics/avfoundation/objc/VideoTrackPrivateAVFObjC.cpp:
+        (WebCore::VideoTrackPrivateAVFObjC::resetPropertiesFromTrack): Don't change the
+            enabled state of the AVPlayerItemTrack during setup.
</ins><span class="cx"> 
</span><del>-            Reviewed by Darin Adler.
</del><ins>+2014-05-13  Myles C. Maxfield  &lt;litherum@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-            Covered by existing: compositing/tiling/empty-to-tiled.html
</del><ins>+        Text decorations do not contribute to visual overflow
+        https://bugs.webkit.org/show_bug.cgi?id=132773
</ins><span class="cx"> 
</span><del>-            * platform/graphics/ca/win/PlatformCALayerWin.cpp:
-            (PlatformCALayer::~PlatformCALayer): Remove deleted layer from its
-            parent layer 
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2013-11-04  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        Tests: fast/css3-text/css3-text-decoration/repaint/underline-outside-of-layout-rect.html
</ins><span class="cx"> 
</span><del>-        &lt;rdar://problem/15292359&gt;
-        Merge r157299
</del><ins>+        * rendering/InlineTextBox.cpp:
+        (WebCore::textDecorationStrokeThickness): Refactor into a common function
+        (WebCore::wavyOffsetFromDecoration): Ditto
+        (WebCore::InlineTextBox::extendVerticalVisualOverflowForDecorations): Given
+        vertical overflow bounds, possibly extend those to include location of
+        decorations.
+        (WebCore::InlineTextBox::paintDecoration): Use refactored functions.
+        * rendering/InlineTextBox.h: Function signature
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::setLogicalWidthForTextRun): Call extendVerticalVisualOverflowForDecorations()
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::changeAffectsVisualOverflow): Inspects shadows and text decorations
+        (WebCore::RenderStyle::changeRequiresLayout): Calls changeAffectsVisualOverflow()
+        (WebCore::RenderStyle::changeRequiresRepaintIfTextOrBorderOrOutline): Moved code from here
+        to changeAffectsVisualOverflow().
+        * rendering/style/RenderStyle.h: Function signature
</ins><span class="cx"> 
</span><del>-    2013-10-10  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+2014-05-13  Enrica Casucci  &lt;enrica@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Use after free in WebCore::DisplayRefreshMonitorClient::fireDisplayRefreshIfNeeded
-            https://bugs.webkit.org/show_bug.cgi?id=121033
</del><ins>+        REGRESSION (WebKit2): Zooming to text field leaves it partially hidden by the form assistant.
+        https://bugs.webkit.org/show_bug.cgi?id=132879
+        &lt;rdar://problem/16318049&gt;
</ins><span class="cx"> 
</span><del>-            Reviewed by Dean Jackson.
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-            For safe iteration, use a set rather than a vector, and remove the clients from
-            the set if they are removed during iteration.
</del><ins>+        Adding some exports. The fix to setScrollPosition is to avoid clamping the scroll
+        position when using delegate scrolling.
</ins><span class="cx"> 
</span><del>-            Test: fast/animation/request-animation-frame-remove-client.html
</del><ins>+        * WebCore.exp.in:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setScrollPosition):
</ins><span class="cx"> 
</span><del>-            * platform/graphics/DisplayRefreshMonitor.cpp:
-            (WebCore::DisplayRefreshMonitor::DisplayRefreshMonitor): Initialize the
-            m_clientsToBeNotified pointer to null.
-            (WebCore::DisplayRefreshMonitor::removeClient): If there is a m_clientsToBeNotified
-            set, remove from it as well as the real m_clients set.
-            (WebCore::DisplayRefreshMonitor::displayDidRefresh): Use a HashSet instead of a
-            vector for the copy of the clients set we iterate.
</del><ins>+2014-05-13  Brady Eidson  &lt;beidson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            * platform/graphics/DisplayRefreshMonitor.h: Moved some of the BlackBerry-specific
-            part of this out of the header. Added a new HashSet pointer, m_clientsToBeNotified,
-            to be used to remove clients during the notification process. Also added a FIXME.
</del><ins>+        Followup to: Update positioning/drawing of the image controls button.
+        &lt;rdar://problem/16885077&gt; and https://bugs.webkit.org/show_bug.cgi?id=132883
</ins><span class="cx"> 
</span><del>-            * platform/graphics/blackberry/DisplayRefreshMonitorBlackBerry.cpp: Moved the
-            DisplayAnimationClient class in here.
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-2013-11-04  Lucas Forschler  &lt;lforschler@apple.com&gt;
</del><ins>+        Cleared up the actual intent behind review feedback on the original patch.
</ins><span class="cx"> 
</span><del>-        Merge r157436
</del><ins>+        * html/shadow/mac/ImageControlsButtonElementMac.cpp:
+        (WebCore::ImageControlsButtonElementMac::maybeCreate):
</ins><span class="cx"> 
</span><del>-    2013-10-14  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+2014-05-13  Brady Eidson  &lt;beidson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Crash in WebCore::BidiResolver&lt;WebCore::InlineIterator, WebCore::BidiRun&gt;::createBidiRunsForLine
-            https://bugs.webkit.org/show_bug.cgi?id=122776
</del><ins>+        Update positioning/drawing of the image controls button.
+        &lt;rdar://problem/16885077&gt; and https://bugs.webkit.org/show_bug.cgi?id=132883
</ins><span class="cx"> 
</span><del>-            Reviewed by Darin Adler.
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-            Merge https://chromium.googlesource.com/chromium/blink/+/aca89bc4d984705a1f94b623dae0ab03e239a248
</del><ins>+        * html/shadow/mac/ImageControlsButtonElementMac.cpp:
+        (WebCore::ImageControlsButtonElementMac::maybeCreate): Add inline style for top/right
+          positioning based on the metrics from the render theme.
</ins><span class="cx"> 
</span><del>-            Fix modification of whitespace endpoints to not assume it's operating on RenderTexts
</del><ins>+        * html/shadow/mac/imageControlsMac.css:
+        (.x-webkit-image-controls-button): Can’t hard code any positioning.
</ins><span class="cx"> 
</span><del>-            During line layout, we use midpoints to identify RenderObjects, or parts of
-            RenderObjects, that don't need InlineBoxes, usually because of collapsed whitespace.
</del><ins>+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::imageControlsButtonPositionOffset):
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::servicesRolloverButtonCell):
+        (WebCore::RenderThemeMac::imageControlsButtonPositionOffset):
</ins><span class="cx"> 
</span><del>-            Prior to actually creating BidiRuns (the precursor to InlineBoxes), we use
-            checkMidpoints to fix up our lineMidpointState to handle the case where we start
-            ignoring spaces in our line, but don't stop until somewhere on the following line.
-            Previously, this function assumed that the final midpoint (called an endpoint)
-            was a RenderText, but this assumption is wrong if we have a beginning midpoint
-            created by shouldSkipWhitespaceAfterStartObject (which handles inlines and list
-            markers) and no endpoint on that line. In that case, we'd instead adjust the
-            position backwards on the beginning midpoint, which would cause us to fail to
-            create an InlineBox for the inline or list marker. In the new test added, this
-            would actually trigger a crash due to an assumption when visually re-ordering
-            BidiRuns that a non-empty line would actually contain at least one such run.
</del><ins>+2014-05-13  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Test: fast/text/whitespace/whitespace-and-margin-wrap-after-list-marker-crash.html
</del><ins>+        [iOS WK2] background-attachment:fixed behaves very poorly
+       &n